fix(containers): publish explicit split runtime targets - #1365
fix(containers): publish explicit split runtime targets#1365seonghobae wants to merge 14 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (7)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe workflow now builds backend, frontend, and combined images from explicit Docker stages. The Dockerfiles update runtime commands, OCI metadata, user creation, and build exclusions. The attachment filename sanitizer now handles encoded traversal, residual percent escapes, and Windows-style separators. ChangesRuntime image targets
Attachment filename sanitization
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change publishes backend, frontend, and compatibility images from explicit runtime stages and hardens attachment filename handling. The supplied evidence identifies no remaining concrete current-head risk that blocks merge. Sequence Diagram(s)sequenceDiagram
participant BuildWorkflow
participant DockerTarget
participant RuntimeImage
BuildWorkflow->>DockerTarget: select matrix target
DockerTarget->>RuntimeImage: build backend, frontend, or combined stage
RuntimeImage->>RuntimeImage: run configured runtime command
🚥 Pre-merge checks | ✅ 2 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (2 passed)
Full details: Linked Issues checkExplanation The pull request implements explicit backend, frontend, and compatibility Docker targets and binds validation and publication to those targets [ Resolution Complete and verify the full protected release gate set on the exact head. Include independent image builds, per-image security scans, SBOM and provenance, health and connectivity checks, Compose compatibility, end-to-end acceptance, rollback guidance, resolved review threads, and qualifying post-last-push approval before closing the issue. Full details: Out of Scope Changes checkExplanation Most changes support the container runtime split. The attachment-parser sanitization changes in
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please perform a fresh formal review of unchanged exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='4f881bcd657d2e6b6dbf35ee913e00f7478916e1'
repo='ContextualWisdomLab/naruon'
pr='1365'
echo '== Checked-out HEAD =='
git rev-parse HEAD
git status --short
git merge-base --is-ancestor "$expected_head" HEAD && echo "Expected head is reachable from checked-out HEAD"
echo '== PR metadata =='
gh pr view "$pr" --repo "$repo" \
--json number,title,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews,statusCheckRollup \
--jq '{number,title,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name:(.name // .context),status:(.status // .state),conclusion:.conclusion}]}'
echo '== Changed files and exact diff =='
git diff --name-status bc98789521d21271e84789888413c182aa111b4d "$expected_head"
git diff --find-renames --find-copies --unified=80 \
bc98789521d21271e84789888413c182aa111b4d "$expected_head" -- \
Dockerfile frontend/Dockerfile .github/workflows
echo '== Dockerfile outlines =='
ast-grep outline Dockerfile --items all || true
ast-grep outline frontend/Dockerfile --items all || true
echo '== Full target-related Dockerfile lines =='
rg -n -i -C 4 '^\s*FROM\b|backend-runtime|combined-runtime|frontend-runtime' \
Dockerfile frontend/Dockerfile
echo '== Workflow build matrix and target bindings =='
fd -t f -e yml -e yaml .github/workflows -x sh -c \
'echo "---- $1"; rg -n -C 8 -i "matrix:|target:|dockerfile:|file:|context:|docker/build-push-action|build-args" "$1"' sh {}
echo '== Current PR review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='naruon' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body path line originalLine commit { oid } }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads.nodes'Length of output: 37901 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/naruon'
pr='1365'
head='4f881bcd657d2e6b6dbf35ee913e00f7478916e1'
echo '== Regression contract =='
nl -ba backend/tests/test_runtime_image_targets.py
echo '== Target definitions and build-action bindings in docker-publish workflow =='
rg -n -C 6 'component: (backend|naruon|frontend)|dockerfile:|target:|Build PR image without publishing|Build and publish Docker image|docker/build-push-action' \
.github/workflows/docker-publish.yml
echo '== All Buildx target usages in repository workflows =='
fd -t f -e yml -e yaml . .github/workflows -x sh -c \
'if rg -q "docker/build-push-action" "$1"; then echo "---- $1"; rg -n -C 4 "docker/build-push-action|^[[:space:]]*target:" "$1"; fi' sh {}
echo '== Current review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='naruon' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
totalCount
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes {
author { login }
body
path
line
originalLine
commit { oid }
}
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads'
echo '== Formal review records =='
gh pr view "$pr" --repo "$repo" --json reviews,reviewDecision,mergeStateStatus \
--jq '{reviewDecision,mergeStateStatus,reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== Commit identity =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"Length of output: 2157 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/naruon'
pr='1365'
head='4f881bcd657d2e6b6dbf35ee913e00f7478916e1'
echo '== Regression contract =='
cat -n backend/tests/test_runtime_image_targets.py
echo '== docker-publish target definitions and build bindings =='
rg -n -C 8 'component: (backend|naruon|frontend)|dockerfile:|target:|Build PR image without publishing|Build and publish Docker image|docker/build-push-action' \
.github/workflows/docker-publish.yml
echo '== Build action target binding counts =='
printf 'build actions: '
rg -n 'uses: docker/build-push-action@' .github/workflows/docker-publish.yml | wc -l
printf 'matrix target bindings: '
rg -n 'target: \$\{\{ matrix\.target \}\}' .github/workflows/docker-publish.yml | wc -l
printf 'matrix target entries: '
rg -n '^\s+target: (backend-runtime|combined-runtime|frontend-runtime)$' .github/workflows/docker-publish.yml | wc -l
echo '== Current review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='naruon' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
totalCount
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } path line originalLine commit { oid } }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads'
echo '== Formal review records =='
gh pr view "$pr" --repo "$repo" --json reviews,reviewDecision,mergeStateStatus \
--jq '{reviewDecision,mergeStateStatus,reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== Commit identity =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"Length of output: 10751
I found no actionable code issues. Verified items:
GitHub still reports
|
|
@opencode-agent @cwl-noema-review Review only. Re-evaluate unchanged exact head |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headaaf0d80fe1671b0b16d9010b368f482d511d162c. -
Head SHA:
aaf0d80fe1671b0b16d9010b368f482d511d162c -
Workflow run: 32123678070
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: docker-publish.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: docker-publish.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: Dockerfile"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: Dockerfile"]
R2 --> V2["required checks"]
Evidence --> S3["Backend: test_runtime_image_targets.py"]
S3 --> I3["API and service runtime"]
I3 --> R3["Review risk: Backend: test_runtime_image_targets.py"]
R3 --> V3["backend tests"]
Evidence --> S4["Frontend: Dockerfile"]
S4 --> I4["browser runtime and bundle"]
I4 --> R4["Review risk: Frontend: Dockerfile"]
R4 --> V4["frontend tests"]
OpenCode Review Overview
|
|
PR governance metadata gate is not ready for
|
|
The failed Strix run for head |
3e7cc54 to
43666be
Compare
Stale review: cited a coverage-evidence/required-check failure on an earlier commit; current head has been verified (gh pr checks) to pass coverage-evidence and all other non-metadata-gate required checks, with no current-head review from this reviewer. Dismissing as superseded per AGENTS.md stale-review guidance.
opencode-agent
Bot
added
priority: medium
|
@opencode-agent @cwl-noema-review Please independently review the complete exact current head against protected develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b. Re-read the full diff, current Checks, security/supply-chain impact, and all prior findings; publish a current-head substantive verdict with no stale evidence. |
|
Correction: the prior review request comment was malformed by the shell and did not include the SHA. Please independently review the complete exact current head against protected develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b. Re-read the full diff, current Checks, security/supply-chain impact, and all prior findings; publish a current-head substantive verdict with no stale evidence. |
Normalize backslashes to slashes and reject residual URL-encoded traversal sequences in _safe_filename before taking Path(...).name, closing a Windows-style and percent-encoded path-traversal vector in the attachment parser.
Pull request was converted to draft
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 2 new potential issues.
⚠️ 1 issue in files not directly in the diff
⚠️ Literal percent filenames are decoded
Valid attachment names containing literal percent escapes are rewritten by unquote, although MIME filenames are already decoded. Displayed names and extension-based parser selection can both change.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
The merge-base changed after approval.
JSONArgsRecommended 경고를 exec-form CMD로 수리한다. runtime PORT 확장과 기본값, Next 프로세스로의 exec는 보존한다. 기존 runtime-target delta와 보호 develop 병합은 그대로 유지하며 파일 삭제는 없다. 회귀 계약 RED 1 failed/1 passed 후 GREEN 2 passed. Docker buildx --check는 no warnings found. 실제 이미지 종료 동작과 전체 이미지 재빌드는 별도 검증 대상이다. 근거: https://docs.docker.com/reference/build-checks/json-args-recommended/ Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
프런트엔드 시작 명령 경고 수리현재 head: #1352 run34074272529/frontend job101597257071은 SUCCESS지만 기존 이는 명령 구조와 Docker build check 근거입니다. 실제 Linux PID 1 종료·신호 전달, 새 전체 이미지 build, 배포·rollback·독립 리뷰·보호 병합을 입증하지 않습니다. Draft를 유지하며 새 head의 hosted 검사가 필요합니다. 원시 출력은 이 작업의 도구 실행 기록에 있고 별도 로그 파일이나 제품 스크린샷을 만들었다고 주장하지 않습니다. 근거(APA 7): Docker, Inc. (n.d.). JSONArgsRecommended. Docker Docs. Retrieved September 7, 2026, from https://docs.docker.com/reference/build-checks/json-args-recommended/ 기존 릴리스 계약 누락 보완후속 head 고정 후속 head에서 |
앞선 runtime-target 검사에서 누락한 기존 release-governance의 shell-form 기대값을 JSON exec-form으로 맞춘다. runtime 변경이나 assertion 삭제는 없으며 단일 계약 RED 뒤 관련 두 파일 37개 검사와 Ruff가 통과했다. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
공통 OCI ARG와 LABEL을 backend-runtime으로 이동해 combined-runtime이 상속하게 한다. 통합 이미지 제목과 설명만 기존 값으로 재지정하며 workflow의 배포 metadata와 build-arg 계약은 그대로 둔다. 중복 라벨 블록의 재배치이며 기존 실행 단계나 delta 삭제는 없다. backend 단계 라벨 누락 RED1 후 관련37검사와 Ruff가 통과했다. Docker backend --check도 경고 없이 통과했다. 기본 라벨은 release provenance 증명이 아니며 실제 image inspect와 hosted 검증은 별도다. 근거: Docker, Inc. (n.d.). Build variables. https://docs.docker.com/build/building/variables/ Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
독립 백엔드 기본 OCI 라벨 수리현재 head 공통 블록을 backend-runtime으로 이동하고 combined-runtime은 상속하도록 바꿨습니다. 두 이미지의 제목과 설명만 각 단계에서 구분하며, workflow·실행 명령·의존성·보호 게이트는 바꾸지 않았습니다. 기본 라벨이 source revision이나 release provenance 전체를 증명한다는 과장도 주석에서 제거했습니다. 기존 전체 OCI 키 검사에 backend 단계 범위를 추가해 RED 1 failed/0.28초/exit1을 확인했습니다. 실제 FROM 경계와 backend/combined 이름·설명 재지정까지 포함한 고정 head 검증은 release-governance + runtime-targets 37 passed/0.30초/exit0입니다. Ruff와 diff 검사도 통과했습니다. 수정 트리의 Docker buildx backend --check는 exit0, no warnings found였습니다. 명령: backend에서 실제 최종 이미지 inspect, 플랫폼별 전체 build, 종료 동작, 배포·독립 승인·보호 병합은 아직 별도 검증 대상입니다. 정보 리뷰를 자동 resolve하거나 Draft를 해제하지 않았습니다. 근거(APA 7): Docker, Inc. (n.d.). Build variables. Docker Docs. Retrieved September 7, 2026, from https://docs.docker.com/build/building/variables/ . 부모 단계에서 선언한 build argument의 자식 단계 상속을 따릅니다. |
실제 backend 이미지 라벨 검증고정
기본 created/revision/ref.name 값은 비어 있습니다. 이번 증거는 로컬 backend target의 라벨 포함 여부이며, complete release provenance나 배포·amd64·통합 이미지·실제 앱 종료 동작을 증명하지 않습니다. 실제 build step11에 |
|
@coderabbitai review Please review the unchanged current head |
useradd 호출 한 번에 SYS_UID_MAX=10001을 지정해 --system과 고정 UID의 범위 충돌을 해결한다. 전역 login.defs, UID/GID10001, nologin, 비루트 실행은 변경하지 않는다. 파일 삭제와 경고 필터링은 없다. RED1/34pass 후 관련37pass와 Ruff 통과. 고정 Python 기반 이미지의 network-none 임시 컨테이너에서 Dockerfile의 실제 계정 생성 명령을 실행해 경고 부재, UID/GID10001, nologin을 검증했다. 이전 전체 이미지의 경고를 소급 통과시키지 않는다. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
고정 UID 경고 수리후속 head 회귀 RED 1 failed/34 passed/7.41초/exit1 뒤, 고정 후속 head에서 관련 37 passed/0.81초/exit0, Ruff와 diff 검사가 통과했습니다. Dockerfile에서 실제 계정 생성 RUN을 읽어 고정 Python 기반 이미지의 network-none 임시 컨테이너에서 실행했습니다. useradd 경고 없이 끝났으며 UID/GID10001과 nologin을 직접 assertion했습니다. 임시 컨테이너는 --rm으로 실행 종료 때 제거됐습니다. 이것은 계정 생성 명령의 실제 Linux 검증입니다. b533의 전체 이미지를 다시 빌드했다는 뜻은 아니며 ae002 전체 빌드의 경고는 당시 실패 관찰로 남습니다. 후속 hosted build와 보호 병합은 별도입니다. push 후 API는 Ready/OPEN을 반환했지만 이 작업이 Draft를 해제한 것은 아닙니다. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/naruon'
pr='1365'
head='ae002ebed3cb396c92ee9f0116c3c6c8a3389204'
base='042b0c70531b229af3acbd0421a2f23098d848b3'
echo '== Commit and checkout identity =='
printf 'checkout='; git rev-parse HEAD
git show -s --format='requested=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'protected base is an ancestor of requested head'
echo '== PR identity and current check state =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,reviewDecision,mergeStateStatus,isDraft,statusCheckRollup,reviews \
--jq '{number,headRefOid,baseRefOid,reviewDecision,mergeStateStatus,isDraft,checks:[.statusCheckRollup[] | {name:(.name // .context),status:(.status // .state),conclusion:.conclusion,detailsUrl}],reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]}'
echo '== Complete protected-base changed-file list =='
git diff --name-status "$base" "$head"
echo '== Complete protected-base diff =='
git diff --find-renames --find-copies --unified=60 "$base" "$head"
echo '== Relevant file outlines =='
ast-grep outline Dockerfile --items all || true
ast-grep outline frontend/Dockerfile --items all || true
ast-grep outline backend/services/attachment_parser.py --items all || true
ast-grep outline backend/tests/test_runtime_image_targets.py --items all || true
ast-grep outline backend/tests/test_release_governance.py --items all || true
echo '== Dockerfiles: stages, labels, entrypoint, and command =='
rg -n -C 12 '^\s*(FROM|ARG|LABEL|ENTRYPOINT|CMD)\b|backend-runtime|combined-runtime|frontend-runtime|appuser' \
Dockerfile frontend/Dockerfile
echo '== Publication workflow: matrices and Buildx inputs =='
rg -n -C 12 'pull_request_image_validation|publish_images|matrix:|component:|dockerfile:|target:|docker/build-push-action|file:|context:' \
.github/workflows/docker-publish.yml
echo '== Changed regression-test regions =='
rg -n -C 10 '_safe_filename|frontend-runtime|backend-runtime|combined-runtime|JSONArgsRecommended|CMD|LABEL|org\.opencontainers' \
backend/tests/test_attachment_parser.py \
backend/tests/test_runtime_image_targets.py \
backend/tests/test_release_governance.py \
backend/services/attachment_parser.py \
.jules/sentinel.md || true
echo '== Current review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='naruon' -F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
totalCount
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } path line originalLine commit { oid } }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads'Length of output: 115465
GitHub now reports PR The five-file delta from
However, the current checks are queued for Please request a fresh review for the current SHA after the required checks reach terminal status. You are interacting with an AI system. |
일반 backend COPY가 호스트 .venv 패키지를 가져오지 않도록 모든 깊이의 .venv를 제외한다. 기존 잠금 의존성 설치와 사용자 파일은 유지하고 삭제하지 않는다. tracked archive만 쓰던 검증 절차의 전제를 일반 빌드 설정으로 보완한다. 누락 규칙 RED1/2pass 후 관련38검사와 Ruff 통과. 이번 증거는 설정 계약이며 새 전체 이미지 빌드 증거가 아니다. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
일반 로컬 빌드의 가상환경 제외후속 head 누락 규칙 RED 1 failed/2 passed/3.23초/exit1 뒤, 고정 후속 head에서 관련 release/runtime 검사 38 passed/0.28초/exit0, Ruff와 diff 검사 통과입니다. 이는 설정 회귀 검증이고 실제 Docker context 필터 동작이나 최신 전체 이미지 빌드 증거로 확대하지 않습니다. ae002 실제 이미지·b533 실제 계정 생성 결과는 각 커밋의 범위로 보존합니다. 현재 Ready/OPEN이며 새 exact-head Checks와 독립 승인·보호 병합은 미완료입니다. |
최신 실제 빌드와 가상환경 제외 검증고정 head 이미지: 원시 빌드 로그에서 warning/fatal/denied/timeout 단어 검사를 수행해 0건을 확인했습니다. 실제 이미지에서 network-none/read-only/cap-drop ALL/no-new-privileges 임시 컨테이너를 실행해 /app/.venv 부재, UID/GID10001, nologin을 assertion했고 exit0입니다. 컨테이너는 --rm으로 정상 제거됐습니다. 이전 ae002의 useradd 경고를 소급 통과 처리하지 않습니다. 원시 로그 이 검증은 로컬 ARM64 backend 빌드와 파일 제외·계정 계약입니다. 실제 backend 앱 기동, frontend SIGTERM, amd64/통합 이미지, release provenance, 제품 Visual Inspection, hosted Checks와 보호 병합을 대신하지 않습니다. |
기존 PR의 CMD·OCI·UID·빌드 context 수리와 RED/검증 근거를 연결한다. 구현08417의 실제 이미지 증거와 문서 후속 커밋을 구분하고 미검증 범위를 유지한다. runtime 변경이나 삭제는 없다. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
|
검증 문서를 실제 Edge에서 GitHub exact-SHA Preview를 직접 시각 검수했습니다. 데스크톱의 문제/선택 문단과 모바일390×844의 실패·명령·이미지 식별자·남은 위험·참고 문헌을 확인했습니다. 관찰한 문단 겹침은 없고 긴 해시는 줄바꿈됩니다. 명령 블록은 좁은 화면에서 GitHub의 가로 스크롤을 사용합니다. viewport는 원래 크기로 복원했습니다. 원본 스크린샷은 작업 도구 출력에 있으며 별도 PNG 파일은 만들지 않았습니다. 이는 문서 렌더 검수이지 로그인한 제품 UI의 정상 상태 검수가 아닙니다. |
|
추가 실제 이미지 검증: 구현 08417ad(현재597192는 문서만 추가)의 linux/arm64 프런트엔드 이미지 sha256:e9245f30a8e9dcd6bf0378b32c55f7a5112a0c992df10b2d7ecc275ac10436fe를 로컬에 생성했습니다. 빌드 프로세스 종료와 최종 DONE을 확인했습니다. 외부 네트워크·고객 자료·인증 비밀 없이 실제 컨테이너에서 Next.js16.2.12가 PID1이고 PORT3107로 시작됨을 확인했습니다. 최초 HTTP assertion은 401을 잘못 기대해 실패했습니다. GET/sessionJson 실제 소스를 확인한 뒤 200, Cache-Control:no-store, authenticated:false 계약을 다시 검증해 통과했습니다. 정상 로그인 제품 VI의 증거는 아닙니다. 두 차례 normal docker stop 뒤 주 프로세스 ExitCode143, OOMKilled:false, Error빈값을 확인했습니다. 첫 종료에서는 실행 중 healthcheck가137로 끝났으므로 모든 cleanup이 경고 없이 성공했다고 주장하지 않습니다. 중지된 검증 컨테이너와 이미지는 근거 보존을 위해 남겼습니다. 로컬 빌드에는 npm 다운로드 지연 WARN5건이 남았습니다. GitHub image run34077982014의 세 validation job도 terminalSUCCESS이나 frontend job101607722107 rawlog에 다운로드 지연 WARN과 No output specified 경고가 있습니다. JSONArgsRecommended 재발은 해당 로그에서 찾지 못했습니다. 출력 방식 명시 수리를 기존 owner에서 검토하며, 이번 결과를 warning-free gate나 release/배포 증거로 확대하지 않습니다. |
출력 미지정 경고의 원인을 PR build 입력에서 수정한다. 게시 금지와 amd64/arm64 검증은 유지한다. 회귀 RED 1실패/2통과, 후속 38통과 및 Ruff/diff 검사 통과. 기존 delta 삭제나 병합은 없다. Co-Authored-By: Codex <noreply@openai.com> Signed-off-by: Seongho Bae <me@seonghobae.me>
|
현재 head 9b137f25f426743e18fc61125575ec7949d45db8에서 PR validation의 출력 방식을 type=cacheonly로 명시했습니다. Docker 공식 문서의 test-build 계약을 적용했으며 기존 게시 금지와 linux/amd64,linux/arm64는 그대로입니다: https://docs.docker.com/build/exporters/#cache-only-export 누락 회귀검사는 수정 전 1실패/2통과(4.08초), 수정 후 두 파일 38통과(3.88초), 커밋 동결 후 38통과(3.50초)입니다. Ruff와 diff 검사를 통과했고 해당 workflow actionlint도 exit0/무출력입니다. 새 hosted Checks는 아직 대기·실행 중이므로 과거 성공을 현재 head의 통과로 사용하지 않습니다. registry 다운로드 지연 경고는 별도 미해결이며 숨기는 설정은 추가하지 않았습니다. |
The merge-base changed after approval.
|
現 head 9b137f25f426743e18fc61125575ec7949d45db8의 image run34079790641에서 backend job101612776465가 terminalSUCCESS입니다. 원시 job 로그를 직접 읽어 --output type=cacheonly 명령 적용, No output specified 0건, JSONArgsRecommended 0건, WARN/WARNING 단어가 있는 로그 줄 0건을 확인했습니다. 출력 미지정 경고 수리는 이 backend hosted 실행 범위에서 확인됐습니다. frontend101612776305와 combined101612776463은 아직 실행 중이며 이 결과를 두 job이나 전체 release 증거로 확대하지 않습니다. |
|
현재 9b137f25f426743e18fc61125575ec7949d45db8의 image run34079790641이 세 validation job 모두 terminalSUCCESS로 끝났습니다. raw job 로그별 검사 결과: backend101612776465 WARN/WARNING0줄, combined101612776463 4줄, frontend101612776305 7줄입니다. 세 로그 모두 --output type=cacheonly 적용을 확인했고 No output specified와 JSONArgsRecommended는 각각0건입니다. 출력 미지정 경고 수리는 세 hosted 이미지 검증에서 확인됐습니다. 남은 11개 경고 줄은 npm registry 요청지연이며 이 결과를 warning-free 통과나 release/배포 증거로 확대하지 않습니다. 같은 head를 이유 없이 재실행하거나 경고 임계값을 높이지 않습니다. 기존 경고 로그를 보존하며 요청지연의 원인은 별도 분석 대상입니다. |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
9b137f25f426743e18fc61125575ec7949d45db8. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790387/job/101625848212)
- CodeQL PR/CodeQL compatibility analysis (javascript-typescript): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790387/job/101625848181)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790387/job/101625848202)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790387/job/101625848212)
- CodeQL compatibility analysis (javascript-typescript) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790387/job/101625848181)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790387/job/101625848202)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079789054/job/101625866086)
- SAST Semgrep/Semgrep (multi-language SAST): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790392/job/101625816147)
- Semgrep (multi-language SAST) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079790392/job/101625816147)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079789031/job/101625907873)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079789031/job/101625907873)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34079789054/job/101625866086)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: .dockerignore"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: .dockerignore"]
R1 --> V1["required checks"]
Evidence --> S2["Workflow: docker-publish.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: docker-publish.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Repository file: sentinel.md"]
S3 --> I3["repository behavior"]
I3 --> R3["Review risk: Repository file: sentinel.md"]
R3 --> V3["required checks"]
Evidence --> S4["Repository file: Dockerfile"]
S4 --> I4["repository behavior"]
I4 --> R4["Review risk: Repository file: Dockerfile"]
R4 --> V4["required checks"]
Evidence --> S5["Backend: attachment_parser.py"]
S5 --> I5["API and service runtime"]
I5 --> R5["Review risk: Backend: attachment_parser.py"]
R5 --> V5["backend tests"]
Evidence --> S6["Test: test_attachment_parser.py (3 files)"]
S6 --> I6["regression suite"]
I6 --> R6["Review risk: Test: test_attachment_parser.py (3 files)"]
R6 --> V6["targeted test run"]
Evidence --> S7["Docs: runtime-image-boundary-verification.md"]
S7 --> I7["operator or user guidance"]
I7 --> R7["Review risk: Docs: runtime-image-boundary-verification.md"]
R7 --> V7["docs review"]
Evidence --> S8["Frontend: Dockerfile"]
S8 --> I8["browser runtime and bundle"]
I8 --> R8["Review risk: Frontend: Dockerfile"]
R8 --> V8["frontend tests"]
1 participant
Bounded deployment slice
Refs #1022. This PR owns one release-path boundary: backend, frontend, and compatibility images must build explicit runtime targets, and each independently published image must retain the OCI metadata and runtime command contract expected by release governance.
최신 검증 범위 — 9b137f2, 2026-09-07
9b137f25f426743e18fc61125575ec7949d45db8다. PR validation에outputs: type=cacheonly를 명시하고 게시 금지·두 플랫폼 계약을 검사했다. release 단계 변경은 없다.34079790641의 frontend101612776305, combined101612776463, backend101612776465는 실제 실행 중이다. 기존 성공을 현재 head로 이전하지 않는다.과거 검증 범위 — 597192, 2026-09-07
597192f0a799db5710da76b04bd5df4a5533eed6, Ready/OPEN. 보호 병합은 미완료다.develop@042b0c70531b229af3acbd0421a2f23098d848b3; compare ahead 12 / behind 0, merge base는 같은 보호 커밋이다..dockerignore와docs/doctoring/runtime-image-boundary-verification.md가 추가됐다. PR API의 10개 파일 중 보호 기준에서 상속한 3개는 새로 소유하지 않는다.34077981659, 이미지 검사34077982014는 현재 head에서 queued다. 이전 head의 성공을 전용하지 않는다.아래 ae002 시점의 근거는 보존된 이력이며 위 최신 관찰을 대체하지 않는다.
Historical authority — ae002, 2026-09-07
develop@042b0c70531b229af3acbd0421a2f23098d848b3ae002ebed3cb396c92ee9f0116c3c6c8a3389204fix/publish-independent-runtime-targetsdevelop: ahead 9 / behind 0 / merge base = protected develop.github/workflows/docker-publish.yml,Dockerfile,frontend/Dockerfile,backend/tests/test_runtime_image_targets.py,backend/tests/test_release_governance.pyThe PR API's broader eight-file listing includes
.jules/sentinel.mdand the attachment-parser repair inherited through the protected-base merge; those are not this PR's effective current delta and are not re-owned here.TDD and causal repair lineage
The original runtime-target repair binds the release matrix to explicit
backend-runtime,frontend-runtime, andcombined-runtimetargets for both PR validation and publication and names the Docker stages accordingly.After ordinary protected-base adoption, three normal descendants were read and retained rather than treated as a race:
1bda1b5bc4e13f74f36133a7835ec0ad7ddb393echanges the frontend runtimeCMDto Docker JSON exec form while preserving${PORT:-3000}expansion andexecreplacement of the shell process. The focused runtime-target regression records the command contract.807eaa800e8835766545b0dffc46be26d8bdf299aligns the existing release-governance assertion with that JSON exec-form command instead of weakening/removing the assertion.ae002ebed3cb396c92ee9f0116c3c6c8a3389204repairs the independently built backend image's baked OCI metadata: common OCI ARG/LABEL declarations live inbackend-runtime,combined-runtimeinherits them and overrides only the combined title/description, and release-governance tests require every predefined image annotation key in the backend stage plus the target-specific titles/descriptions.The previously open Devin analysis noting that
backend-runtimedid not bake OCI labels was answered with this exact-head source/test evidence and is now resolved/outdated. Current review-thread inventory is zero unresolved. Historical reviews belong to predecessor heads and do not transfer.No action pin, permission, security gate, provenance/SBOM control, deployment condition, reviewer identity, or protected-branch rule is weakened. No force-push, destructive rebase, dummy/no-op requeue commit, or source copy from another canonical owner was used.
Historical hosted evidence — ae002
For unchanged head
ae002ebed3cb396c92ee9f0116c3c6c8a3389204:34076831919— success34076831965— success34076832031— in progress34076831912— queued34076831800— queued34076831810— queuedQueued/in-progress/absent evidence is non-passing. Predecessor check results and dismissed/comment-only reviews are not current-head merge authority. Ready is review admission only; it does not authorize merge while required execution or post-last-push approval is incomplete.
Compatibility and release boundary
The combined
naruonimage remains a compatibility artifact while backend and frontend are independently addressable release targets. The acceptance criteria in #1022 remain incomplete after this slice; it does not prove deployment, per-image SBOM/provenance publication, rollback/recovery, runtime health, or end-to-end buyer acceptance.Merge only when one unchanged exact head satisfies every then-live repository/organization required check, all valid findings/threads are resolved, and the live one-approval/post-last-push review requirement is satisfied. No self-approval, review fabrication/dismissal, admin/bypass merge, force-push, destructive rebase, dummy requeue commit, synthesized status, or gate weakening.
Summary by CodeRabbit
Bug Fixes
Chores
Documentation