fix(containers): bind provenance to pinned bases - #1203
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
🚧 Files skipped from review as they are similar to previous changes (6)
📝 WalkthroughWalkthroughThe PR updates Docker base-image digests, derives OCI metadata from selected Dockerfiles, validates Ollama multi-platform manifests, adds governance and dependency-pin tests, and documents the container provenance contract. ChangesContainer provenance governance
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to The PR updates pinned container bases and strengthens provenance and dependency-validation contracts; no actionable merge-blocking risk remains after normal exact-head checks and review. Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Dockerfile
participant DockerRegistry
participant OCIMetadata
GitHubActions->>Dockerfile: Read selected first FROM reference
Dockerfile-->>GitHubActions: Return tagged digest-pinned image
GitHubActions->>DockerRegistry: Resolve Ollama manifest platforms
DockerRegistry-->>GitHubActions: Return linux/amd64 and linux/arm64
GitHubActions->>OCIMetadata: Publish derived base name and digest
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
PR governance metadata gate is not ready for
|
|
Closing after Loop drain: permanently blocked — branch was updated onto develop for mergeability, which cleared prior APPROVED robot evidence; re-review (CodeRabbit/OpenCode) and/or central gate jobs (metadata-only gate evaluation, coverage-evidence) remained pending/stuck without a re-runnable workflow handle. Not force-merging (merge-gate policy). Re-open a focused PR when robot capacity is available. Related product security fixes that reimplemented cleanly remain on branch goal/carddav-path-traversal-decode (#1206) for relaunch. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/src/components/calendar/CalendarSidebarRight.tsx`:
- Around line 83-85: Update the three calendar action buttons in
CalendarSidebarRight: add disabled:hover:bg-background to the 삭제 and 복사 buttons,
and disabled:hover:bg-primary to the 수정 button, preserving their existing
disabled behavior and styling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 868bee63-752d-447c-a801-9875c8a11684
📒 Files selected for processing (2)
.jules/palette.mdfrontend/src/components/calendar/CalendarSidebarRight.tsx
The merge-base changed after approval.
|
Resolved the disabled-hover review finding in 1c4fb0a: delete/copy retain |
The merge-base changed after approval.
The merge-base changed after approval.
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Current-head maintenance review completed for pinned container bases, OCI provenance derivation, multi-architecture manifest validation, and governance tests. Refresh central review evidence after the required action suite completes for this exact head.
|
@coderabbitai review Please re-review current head |
|
✅ Action performedReview finished.
|
Pull request was converted to draft
|
Current head |
|
@coderabbitai review Please perform a complete review of the current head |
|
@opencode-agent review Final read-only exact-head review for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/naruon'
target='70fae9c4145ac3cff0f177a9cb82ec059f622aa1'
git cat-file -e "${target}^{commit}"
printf '=== target commit ===\n'
git show -s --format='target=%H%nparents=%P%nsubject=%s%ncommitter_date=%cI' "$target"
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
base_ref=''
for ref in origin/develop develop; do
if git rev-parse --verify --quiet "$ref" >/dev/null; then
base_ref="$ref"
break
fi
done
test -n "$base_ref"
merge_base="$(git merge-base "$base_ref" "$target")"
printf 'base_ref=%s\nmerge_base=%s\n' "$base_ref" "$merge_base"
printf '\n=== PR state and exact-head status ===\n'
gh pr view 1203 --repo "$repo" --json state,headRefOid,baseRefName,statusCheckRollup
gh api "repos/${repo}/commits/${target}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}' | sort
printf '\n=== PR scope at target ===\n'
git diff --name-status "$merge_base" "$target"
printf '\n=== changed workflow paths and writer patterns ===\n'
git diff --name-status "$merge_base" "$target" -- .github/workflows scripts .github
git ls-tree -r --name-only "$target" .github/workflows |
while IFS= read -r path; do
git show "${target}:${path}" |
rg -n -i '(contents:[[:space:]]*write|pull-requests:[[:space:]]*write|issues:[[:space:]]*write|git[[:space:]]+push|gh[[:space:]]+(pr|api|issue).*(create|edit|merge)|finali[sz]er|repair)' &&
printf '%s\n' "--- ${path}"
done || true
printf '\n=== Dockerfile first FROM references ===\n'
for path in Dockerfile Dockerfile.ollama frontend/Dockerfile connector/Dockerfile; do
printf '%s\n' "--- $path"
git show "${target}:${path}" | grep -nEm1 '^[[:space:]]*FROM[[:space:]]+' || true
done
printf '\n=== Docker publish provenance and manifest controls ===\n'
git show "${target}:.github/workflows/docker-publish.yml" |
rg -n -C 9 '(base_dockerfile|base_digest|base_name|Dockerfile\.ollama|linux/amd64|linux/arm64|first FROM|manifest|inspect)' || true
printf '\n=== governance test outlines ===\n'
git show "${target}:backend/tests/test_release_governance.py" > /tmp/test_release_governance.py
git show "${target}:backend/tests/test_container_dependency_pin_contract.py" > /tmp/test_container_dependency_pin_contract.py
ast-grep outline /tmp/test_release_governance.py --items all --type function
ast-grep outline /tmp/test_container_dependency_pin_contract.py --items all --type function
printf '\n=== container and dependency governance assertions ===\n'
rg -n -C 5 \
'(first_dockerfile_base_reference|assert_oci_metadata_matches_first_base|container_base|cryptography|protobuf|postcss|jsdom|brace-expansion|undici|pnpm-workspace|requirements-hashes)' \
/tmp/test_release_governance.py /tmp/test_container_dependency_pin_contract.py
printf '\n=== governed dependency records ===\n'
for path in \
backend/requirements.txt backend/requirements-hashes.txt \
requirements-strix-ci.txt requirements-strix-ci-hashes.txt \
frontend/package.json frontend/pnpm-workspace.yaml frontend/pnpm-lock.yaml
do
printf '%s\n' "--- $path"
git show "${target}:${path}" |
rg -n -C 2 '(cryptography|protobuf|postcss|jsdom|brace-expansion|undici)' || true
done
printf '\n=== provenance documentation references ===\n'
git show "${target}:docs/operations/container-provenance-contract.md" | tail -n 32
printf '\n=== failed or incomplete exact-head run detail ===\n'
gh run list --repo "$repo" --commit "$target" --limit 100 \
--json databaseId,workflowName,name,headSha,status,conclusion,url \
| jq -r '.[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "skipped" and .conclusion != "neutral")) | [.databaseId,.workflowName,.name,.headSha,.status,(.conclusion // "null"),.url] | `@tsv`' \
|| trueLength of output: 72935 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/naruon'
target='70fae9c4145ac3cff0f177a9cb82ec059f622aa1'
run_id='31167943575'
job_id='92833042864'
printf '=== failed Application CI job ===\n'
gh run view "$run_id" --repo "$repo" \
--json databaseId,headSha,status,conclusion,event,url,jobs \
| jq '{databaseId,headSha,status,conclusion,event,url,jobs:[.jobs[]|{databaseId,name,status,conclusion,startedAt,completedAt,url,steps:[.steps[]|{name,status,conclusion,number}]}]}'
printf '\n=== failed Application CI log ===\n'
gh run view "$run_id" --repo "$repo" --job "$job_id" --log-failed || true
printf '\n=== metadata-only gate details ===\n'
gh api "repos/${repo}/check-runs/92833010841" \
--jq '{name,head_sha,status,conclusion,details_url,output}' || true
printf '\n=== target OCI governance assertions ===\n'
git show "${target}:backend/tests/test_release_governance.py" | sed -n '40,182p'
printf '\n=== target dependency contract ===\n'
git show "${target}:backend/tests/test_container_dependency_pin_contract.py" | sed -n '80,190p'
printf '\n=== Dockerfile OCI argument declarations ===\n'
for path in Dockerfile frontend/Dockerfile; do
printf '%s\n' "--- $path"
git show "${target}:${path}" |
rg -n -C 2 '(OCI_IMAGE_BASE_DIGEST|OCI_IMAGE_BASE_NAME|^FROM )' || true
done
printf '\n=== exact-head incomplete check state ===\n'
gh api "repos/${repo}/commits/${target}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | select(.status != "completed") | {name,status,details_url,started_at}' | sortLength of output: 37367
The container provenance implementation is coherent:
However, exact-head Application CI failed. The failure is reproducible from the GitHub log.
The Dockerfiles correctly use short Docker Hub references. The workflow normalizes those references to The failed check is on the requested commit:
A successful exact-head backend rerun, completed image validation, completed Strix result, and a passing metadata gate are required before approval.
|
|
@opencode-agent review Final read-only exact-head review for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/naruon'
target='b694980c9af59eee919e22b114329d376a1b2baa'
git cat-file -e "${target}^{commit}"
printf '=== target ===\n'
git show -s --format='commit=%H%nparents=%P%nsubject=%s%ncommitter_date=%cI' "$target"
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
base_ref=''
for ref in origin/develop develop; do
if git rev-parse --verify --quiet "$ref" >/dev/null; then
base_ref="$ref"
break
fi
done
test -n "$base_ref"
merge_base="$(git merge-base "$base_ref" "$target")"
printf 'base_ref=%s\nmerge_base=%s\n' "$base_ref" "$merge_base"
printf '\n=== PR state and target check runs ===\n'
gh pr view 1203 --repo "$repo" --json state,headRefOid,baseRefName,statusCheckRollup
gh api "repos/${repo}/commits/${target}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}' | sort
printf '\n=== PR scope ===\n'
git diff --name-status "$merge_base" "$target"
printf '\n=== Dockerfile first FROM and OCI defaults ===\n'
for path in Dockerfile Dockerfile.ollama frontend/Dockerfile connector/Dockerfile; do
printf '%s\n' "--- $path"
git show "${target}:${path}" |
rg -n -C 2 '^[[:space:]]*FROM[[:space:]]+|OCI_IMAGE_BASE_(DIGEST|NAME)' || true
done
printf '\n=== publish workflow provenance, override, and Ollama platform controls ===\n'
git show "${target}:.github/workflows/docker-publish.yml" |
rg -n -C 10 '(base_dockerfile|base_digest|base_name|OCI_IMAGE_BASE_(DIGEST|NAME)|first FROM|Dockerfile\.ollama|manifest|linux/amd64|linux/arm64|build-arg)' || true
printf '\n=== governance test structure ===\n'
git show "${target}:backend/tests/test_release_governance.py" > /tmp/test_release_governance.py
git show "${target}:backend/tests/test_container_dependency_pin_contract.py" > /tmp/test_container_dependency_pin_contract.py
ast-grep outline /tmp/test_release_governance.py --items all --type function
ast-grep outline /tmp/test_container_dependency_pin_contract.py --items all --type function
rg -n -C 5 '(first_dockerfile_base_reference|assert_oci_metadata_matches_first_base|cryptography|protobuf|postcss|jsdom|brace-expansion|undici|pnpm-workspace|requirements-hashes)' \
/tmp/test_release_governance.py /tmp/test_container_dependency_pin_contract.py
printf '\n=== governed dependency artifacts ===\n'
for path in \
backend/requirements.txt backend/requirements-hashes.txt \
requirements-strix-ci.txt requirements-strix-ci-hashes.txt \
frontend/package.json frontend/pnpm-workspace.yaml frontend/pnpm-lock.yaml
do
printf '%s\n' "--- $path"
git show "${target}:${path}" |
rg -n -C 2 '(cryptography|protobuf|postcss|jsdom|brace-expansion|undici)' || true
done
printf '\n=== changed workflow paths and writer patterns ===\n'
git diff --name-status "$merge_base" "$target" -- .github/workflows scripts .github
git ls-tree -r --name-only "$target" .github/workflows |
while IFS= read -r path; do
git show "${target}:${path}" |
rg -q -i '(contents:[[:space:]]*write|pull-requests:[[:space:]]*write|issues:[[:space:]]*write|git[[:space:]]+push|gh[[:space:]]+(pr|api|issue).*(create|edit|merge)|finali[sz]er|repair)' &&
printf '%s\n' "$path"
done || true
printf '\n=== provenance documentation references ===\n'
git show "${target}:docs/operations/container-provenance-contract.md" | tail -n 36Length of output: 74237
One dependency-governance gap remains. Parse The container provenance implementation is otherwise consistent:
The exact-head checks are not all complete.
|
|
/oc Reconcile this branch with current protected After reconciliation, run Application CI, dependency review, Bandit, Semgrep, Security Scan, amd64/arm64 container build, provenance/annotation assertions, and |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headcb3946c209a7c99f030e775d9219a43b6c74fad6. -
Head SHA:
cb3946c209a7c99f030e775d9219a43b6c74fad6 -
Workflow run: 31183597980
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: docker-publish.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: docker-publish.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Backend (3 files)"]
S3 --> I3["API and service runtime"]
I3 --> R3["Review risk: Backend (3 files)"]
R3 --> V3["backend tests"]
Evidence --> S4["Docs: container-provenance-contract.md"]
S4 --> I4["operator or user guidance"]
I4 --> R4["Review risk: Docs: container-provenance-contract.md"]
R4 --> V4["docs review"]
Evidence --> S5["Frontend: Dockerfile"]
S5 --> I5["browser runtime and bundle"]
I5 --> R5["Review risk: Frontend: Dockerfile"]
R5 --> V5["frontend tests"]
|
@coderabbitai review |
✅ Action performedReview finished.
|
Superseded by the current exact head a6cce6f. This review evaluated predecessor cb3946c and requested changes solely because coverage-evidence failed there. On the unchanged current head, coverage-evidence and opencode-review are both completed successfully, the required CI/security/container checks are terminal-success, and all review threads are resolved. Dismissing only this stale predecessor-head gate result; no approval is being synthesized or bypassed.
2 participants
Summary
base.digestandbase.nameannotations from the actual firstFROMinstead of stale duplicated constants;ffc7838to4ebb5acin /frontend in the frontend-docker-base-images group #1304, chore(deps): bump the docker-base-images group with 3 updates #1305, and chore(deps): bump python fromcea0e60toa7fb1e6in /connector #1306 into this single provenance-owning lane.Current exact candidate
develop@b70016f9075883a6e879282c887d74e5adf66bbda6cce6f014afe2638d46600ccfd521128f44f640develop(behind_by=0).a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360c0988bcc5c2bc, Node4ebb5ace66f15a24c14c492e01a8beeed4fddf970a856109f5126e703e5fe503, Ollamab88c73ace3e115f8ec53dc8761ae1c0aabfa675406e3681786b98757ce050f42.ffc7838to4ebb5acin /frontend in the frontend-docker-base-images group #1304, chore(deps): bump the docker-base-images group with 3 updates #1305, and chore(deps): bump python fromcea0e60toa7fb1e6in /connector #1306 were closed only after those exact unique digest updates were preserved here.The current tree contains no PR-specific finalizer workflow or repair script. It includes executable contracts for OCI metadata/base synchronization, Ollama multi-platform manifest resolution, backend/Strix Python security pins, and frontend generated-lock security pins.
Standards and claim boundary
Doctoring uses OCI Image Format 1.1.1, SLSA Build Provenance 1.2, and final NIST SSDF 1.1 as authoritative references in APA 7th form. This does not claim a SLSA level or certification solely from OCI annotations.
Verification boundary
All predecessor-head checks and reviews are historical after consolidation. The current exact head must pass the complete repository CI, container, dependency, security, coverage, and current-head review gates. Queued, predecessor-head, stale, author-only, or model-only evidence is not qualifying independent approval.
Merge gate
Merge only after every required exact-head check is terminal-success, all actionable review threads are resolved, a qualifying independent non-author approval exists where live organization policy requires it, and normal protected-branch rules accept the unchanged head without bypass.
Summary by CodeRabbit
Security
Documentation
Maintenance