fix(governance): supersede stale review decisions safely - #1438
seonghobae wants to merge 8 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe protected merge gate evaluates review requests against the current pull request head. Current-head requests remain blocking, while stale aggregate requests can be superseded by valid exact-head robot evidence. Documentation and tests define and verify this behavior. ChangesCurrent-head review evidence
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: 🟡 Moderate · up to The PR changes how stale review decisions are superseded, but its regression coverage does not exercise an actual stale CHANGES_REQUESTED review. That leaves a concrete correctness gap, so merge should wait for this test case to be added. Sequence Diagram(s)sequenceDiagram
participant MergeGate
participant GitHubReviews
participant RobotEvidence
MergeGate->>RobotEvidence: Evaluate exact-head OpenCode and CodeRabbit evidence
MergeGate->>GitHubReviews: Fetch review metadata and commit_id values
GitHubReviews-->>MergeGate: Return review metadata
MergeGate->>MergeGate: Block current-head requests or supersede stale requests
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
2e7b086 to
c9abd79
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
fbbf7dd to
a9f9b1e
Compare
|
PR governance metadata gate is not ready for
|
|
@coderabbitai review Please review the exact current head a9f9b1e. Re-evaluate governance evidence only for this head and supersede stale requested changes from prior heads. |
|
I will evaluate governance evidence only for this head. I will treat requested changes from earlier heads as stale evidence unless current-head review metadata or required checks still block the merge.
|
|
@opencode-agent @cwl-noema-review Please independently review exact current head a9f9b1e. Verify stale CHANGES_REQUESTED supersession is bounded by exact-head robot evidence, current-head requested changes still block, and all current-head Checks are verified. Publish structured adversarial evidence only. |
|
PR governance metadata gate is not ready for
|
|
I will evaluate current-head governance evidence. I will treat requested changes from earlier heads as stale unless current-head review metadata or required checks block the merge.
|
|
I will evaluate governance evidence for this head. I will treat requested changes from older heads as stale only when valid exact-head robot evidence supersedes them. I will verify that current-head requested changes and required-check failures still block the merge.
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
I will evaluate only exact-head governance evidence. I will treat prior-head
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1438"
head="dc1155a26bbbad97797ca89059b78377bdec0950"
printf '%s\n' '== Checked-out and pull-request head identity =='
git rev-parse HEAD
gh pr view "$pr" --repo "$repo" --json number,headRefOid,reviewDecision,mergeStateStatus,statusCheckRollup \
--jq '{number,headRefOid,reviewDecision,mergeStateStatus,statusCheckRollup: [.statusCheckRollup[] | {name,conclusion,status,workflowName}]}'
printf '%s\n' '== Commit identity =='
git show -s --format='%H%n%P%n%s' "$head"
printf '%s\n' '== Changed paths and diff =='
git diff --name-status "${head}^" "$head"
git diff --check "${head}^" "$head"
git diff --unified=80 "${head}^" "$head" -- scripts/ci/pr_governance_gate.sh scripts/ci/test_pr_governance_gate.sh
printf '%s\n' '== Static structure and relevant gate/test excerpts =='
ast-grep outline scripts/ci/pr_governance_gate.sh --items all
ast-grep outline scripts/ci/test_pr_governance_gate.sh --items all
rg -n -C 12 'CURRENT_ROBOT_REVIEW_READY|CHANGES_REQUESTED|commit_id|OpenCode|CodeRabbit|reviewDecision' \
scripts/ci/pr_governance_gate.sh scripts/ci/test_pr_governance_gate.sh
printf '%s\n' '== Exact-head pull-request review evidence =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq --arg head "$head" \
'[.[] | {id,user:.user.login,state,commit_id,submitted_at} | select(.commit_id == $head)]'
printf '%s\n' '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,details_url}]'
printf '%s\n' '== Unresolved non-outdated review threads =='
gh api graphql \
-F owner="ContextualWisdomLab" \
-F name="naruon" \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated }
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)] | length'Length of output: 84149 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1438"
head="dc1155a26bbbad97797ca89059b78377bdec0950"
printf '%s\n' '== Exact-head review objects =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq "[.[] | {id, user: .user.login, state, commit_id, submitted_at} | select(.commit_id == \"${head}\")]"
printf '%s\n' '== Non-current requested-change review objects =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq "[.[] | {id, user: .user.login, state, commit_id, submitted_at} | select(.state == \"CHANGES_REQUESTED\" and .commit_id != \"${head}\")]"
printf '%s\n' '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name, status, conclusion, app: .app.slug}]'
printf '%s\n' '== Exact-head combined commit status =='
gh api "repos/${repo}/commits/${head}/status" \
--jq '{state, statuses: [.statuses[] | {context, state, updated_at}]}'
printf '%s\n' '== Unresolved, non-outdated review-thread count =='
gh api graphql \
-F owner="ContextualWisdomLab" \
-F name="naruon" \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated }
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)] | length'
printf '%s\n' '== Branch-protection requirement sources =='
gh api "repos/${repo}/branches/main/protection/required_status_checks" \
--jq '{strict, contexts, checks}' || trueLength of output: 5874 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1438"
head="dc1155a26bbbad97797ca89059b78377bdec0950"
printf '%s\n' '== Unresolved non-outdated review threads =='
gh api graphql \
-F owner="ContextualWisdomLab" \
-F name="naruon" \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
id
isResolved
isOutdated
path
line
originalLine
comments(first: 20) {
nodes {
author { login }
commit { oid }
originalCommit { oid }
body
createdAt
}
}
}
}
}
}
}' \
--jq --arg head "$head" '
[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false and .isOutdated == false)
| {
path,
line,
originalLine,
comments: [
.comments.nodes[] | {
author: .author.login,
commit: .commit.oid,
originalCommit: .originalCommit.oid,
createdAt,
body
}
]
}
]'
printf '%s\n' '== Current-head review comments =='
gh api "repos/${repo}/pulls/${pr}/comments?per_page=100" \
--jq --arg head "$head" \
'[.[] | select(.commit_id == $head or .original_commit_id == $head)
| {id, user: .user.login, commit_id, original_commit_id, path, line, body}]'
printf '%s\n' '== Current-head issue comments with blocking terms =='
gh api "repos/${repo}/issues/${pr}/comments?per_page=100" \
--jq --arg head "$head" '
[.[] | select((.body | contains($head))
and (.body | test("pre[- ]merge|blocking|failure|failed|warning|potential issue|actionable comment"; "i")))
| {id, user: .user.login, created_at, body}]'Length of output: 2352 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1438"
head="dc1155a26bbbad97797ca89059b78377bdec0950"
printf '%s\n' '== Unresolved non-outdated review threads =='
gh api graphql \
-F owner="ContextualWisdomLab" \
-F name="naruon" \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
originalLine
comments(first: 20) {
nodes {
author { login }
commit { oid }
originalCommit { oid }
body
}
}
}
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false and .isOutdated == false)
| {
path,
line,
originalLine,
comments: [
.comments.nodes[] | {
author: .author.login,
commit: .commit.oid,
originalCommit: .originalCommit.oid,
body
}
]
}]'
printf '%s\n' '== Current-head review comments =='
gh api "repos/${repo}/pulls/${pr}/comments?per_page=100" \
--jq "[.[] | select(.commit_id == \"${head}\" or .original_commit_id == \"${head}\")
| {id, user: .user.login, commit_id, original_commit_id, path, line, body}]"
printf '%s\n' '== Current-head blocking issue comments =='
gh api "repos/${repo}/issues/${pr}/comments?per_page=100" \
--jq "[.[] | select((.body | contains(\"${head}\"))
and (.body | test(\"pre[- ]merge|blocking|failure|failed|warning|potential issue|actionable comment\"; \"i\")))
| {id, user: .user.login, created_at, body}]"Length of output: 41564
I found no new defect in the stale-review supersession logic.
The earlier Devin fallback-flag observation is not valid for this source. The current source sets the readiness flag in the OpenCode fallback path. The PR is not ready for a protected merge yet:
No approval is issued while these current-head merge conditions remain unresolved. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review review only exact current head 4ccee12 of PR #1438 against base develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b. Recheck the complete current diff, current review threads, current hosted Checks, and any stale aggregate review decision. Publish structured exact-head verdicts; do not merge, update branch, dismiss reviews, bypass protection, or reuse predecessor evidence. |
opencode-agent
Bot
added
priority: medium
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Lifecycle repair on exact head The valid part is distinguishing stale aggregate review state from an exact-current-head human review. The branch must not, however, make passing CodeRabbit/OpenCode evidence look like authority to supersede a review decision in the merge gate. Current effective rules are stronger and explicit: organization ruleset This PR also carries an old base identity ( |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 899493fae4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | map(last) | ||
| | map(select((.state // "" | ascii_upcase) == "CHANGES_REQUESTED")) |
There was a problem hiding this comment.
When a reviewer requests changes on the current head and later submits a COMMENTED review, the unconditional map(last) treats the comment as the reviewer's effective decision even though a comment does not clear the requested changes. With passing current-head CodeRabbit evidence, CURRENT_CHANGES_REQUESTED_COUNT becomes zero and the governance check can incorrectly publish success. Ignore non-decision states such as COMMENTED when selecting each reviewer's latest effective state, and add this sequence to bash scripts/ci/test_pr_governance_gate.sh.
AGENTS.md reference: AGENTS.md:L190-L194
Useful? React with 👍 / 👎.
| else | ||
| printf 'Stale CHANGES_REQUESTED review decision is superseded by current-head robot evidence on %s.\n' "$HEAD_REF_OID" |
There was a problem hiding this comment.
When a pending review is started on an older commit but submitted after the current-head CodeRabbit/OpenCode run has already passed, its commit_id is stale while its submitted_at is newer than the robot evidence. The boolean CURRENT_ROBOT_REVIEW_READY loses that ordering, so this branch treats the older robot result as superseding the newer CHANGES_REQUESTED review and can publish a successful governance check. Retain evidence timestamps and supersede a stale request only when qualifying robot evidence was produced afterward; cover this ordering in bash scripts/ci/test_pr_governance_gate.sh.
AGENTS.md reference: AGENTS.md:L190-L194
Useful? React with 👍 / 👎.
| | .. | ||
| | objects | ||
| | select(has("state") and has("commit_id")) |
There was a problem hiding this comment.
When GitHub reports aggregate CHANGES_REQUESTED but the reviews endpoint returns an empty array or a requested review with a missing/null commit_id, this filter silently produces no current request. A passing robot check then reaches the supersession branch even though the response never proved that every requested review belongs to an older commit. Validate that the aggregate decision can be reconciled with at least one well-formed requested review, otherwise add a metadata blocker; add empty and null-commit_id fixtures to bash scripts/ci/test_pr_governance_gate.sh.
AGENTS.md reference: AGENTS.md:L190-L194
Useful? React with 👍 / 👎.
1 participant
Current exact authority
This PR owns Naruon's PR-governance metadata interpretation: stale aggregate review decisions may be superseded only by qualifying current-head evidence, while current-head requested changes, unreadable review metadata, pending evidence, and required-check failures remain blocking. It does not dismiss reviews or add a merge bypass.
develop:042b0c70531b229af3acbd0421a2f23098d848b3899493fae44a50648faa0ecaa6e7095b94037833ahead_by=8,behind_by=0, merge base = current protecteddevelopThe prior body described
5cc9ca33...as diverged and needing another protected-base adoption. That state is stale: the current head already containsdevelop@042b0c...as its merge base with no behind commits. Do not create another gratuitous restack or no-op requeue.Contract preserved
reviewDecisionfrom current-headCHANGES_REQUESTED;Current evidence boundary
Exact-head repository runs currently include Bandit terminal-success, while Application CI is in progress and Security Scan, Semgrep, CodeQL PR, and Docker are queued. Historical shell/local evidence is development evidence only. Keep Draft until one unchanged head has all then-live repository/organization required checks terminal-success, zero actionable current-head findings/threads, and qualifying independent post-last-push approval. No close-as-cleanup, force push, destructive rebase, self-approval, bypass/admin merge, dummy requeue, or predecessor-evidence transfer.