fix(ci): run repo-local validation on stacked PR bases - #1587
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughFour GitHub Actions workflows now run for pull requests targeting any branch. Pytest validates the workflow triggers and rejects excluded or comment-only wildcard patterns. ChangesPull-request validation triggers
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to Pull-request CI, security, dependency, and Docker validation now run for stacked pull requests targeting any branch. The trigger configuration and regression coverage support the intended behavior with no remaining merge-blocking risk. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review 현재 exact head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_commit='bc83f3f11c90aef94633436b5ce78927c90211e1'
base_commit='042b0c70531b229af3acbd0421a2f23098d848b3'
printf '%s\n' '== Commit verification =='
git cat-file -t "$head_commit"
git cat-file -t "$base_commit"
git merge-base --is-ancestor "$base_commit" "$head_commit" && echo 'base_is_ancestor=yes'
git diff --name-status "$base_commit" "$head_commit"
printf '\n%s\n' '== Exact diff =='
git diff --find-renames --find-copies --unified=80 "$base_commit" "$head_commit" -- \
.github/workflows/app-ci.yml \
.github/workflows/bandit.yml \
.github/workflows/dependency-review.yml \
.github/workflows/docker-publish.yml \
backend/tests/test_stacked_pr_workflow_triggers.py
printf '\n%s\n' '== Workflow AST outlines =='
ast-grep outline .github/workflows/app-ci.yml --items all || true
ast-grep outline .github/workflows/bandit.yml --items all || true
ast-grep outline .github/workflows/dependency-review.yml --items all || true
ast-grep outline .github/workflows/docker-publish.yml --items all || true
printf '\n%s\n' '== Current workflow files with line numbers =='
for f in \
.github/workflows/app-ci.yml \
.github/workflows/bandit.yml \
.github/workflows/dependency-review.yml \
.github/workflows/docker-publish.yml \
backend/tests/test_stacked_pr_workflow_triggers.py
do
echo "--- $f"
cat -n "$f"
doneLength of output: 44568 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_commit='bc83f3f11c90aef94633436b5ce78927c90211e1'
base_commit='042b0c70531b229af3acbd0421a2f23098d848b3'
workflows=(
.github/workflows/app-ci.yml
.github/workflows/bandit.yml
.github/workflows/dependency-review.yml
.github/workflows/docker-publish.yml
)
printf '%s\n' '== Diff whitespace check =='
git diff --check "$base_commit" "$head_commit"
printf '\n%s\n' '== Changed lines only =='
git diff --unified=0 "$base_commit" "$head_commit" -- "${workflows[@]}" \
backend/tests/test_stacked_pr_workflow_triggers.py
printf '\n%s\n' '== Security and publication boundary comparison =='
for revision in "$base_commit" "$head_commit"; do
echo "--- $revision"
for workflow in "${workflows[@]}"; do
echo "[$workflow]"
git show "${revision}:${workflow}" |
grep -nE '^(on:| (pull_request|push|workflow_dispatch):| (branches|tags):|permissions:| permissions:| permissions:| if:| - name: (Log in to GHCR|Build PR image without publishing|Build and publish Docker image)| (push|sbom):| persist-credentials:)' \
|| true
done
done
printf '\n%s\n' '== Test target list and workflow trigger declarations at exact head =='
git show "${head_commit}:backend/tests/test_stacked_pr_workflow_triggers.py" | sed -n '1,120p'
for workflow in "${workflows[@]}"; do
echo "--- $workflow"
git show "${head_commit}:${workflow}" | sed -n '1,25p'
doneLength of output: 10759
문제를 찾지 못했습니다.
GitHub가 protected
|
seonghobae
added
bug
ChatGPT Codex Connector
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
bc83f3f11c90aef94633436b5ce78927c90211e1. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084752149/job/101644239461)
- CodeQL PR/CodeQL compatibility analysis (javascript-typescript): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084752149/job/101644239469)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084752149/job/101644239524)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084752149/job/101644239461)
- CodeQL compatibility analysis (javascript-typescript) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084752149/job/101644239469)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084752149/job/101644239524)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084750368/job/101644091356)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084750533/job/101644597447)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084750533/job/101644597447)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34084750368/job/101644091356)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: app-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: app-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: bandit.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: bandit.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Workflow: dependency-review.yml"]
S3 --> I3["GitHub Actions review job"]
I3 --> R3["Review risk: Workflow: dependency-review.yml"]
R3 --> V3["actionlint plus required checks"]
Evidence --> S4["Workflow: docker-publish.yml"]
S4 --> I4["GitHub Actions review job"]
I4 --> R4["Review risk: Workflow: docker-publish.yml"]
R4 --> V4["actionlint plus required checks"]
Evidence --> S5["Test: test_stacked_pr_workflow_triggers.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_stacked_pr_workflow_triggers.py"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
|
Signed-off-by: Seongho Bae <me@seonghobae.me>
|
Exact-head regression repair 8cd91ee: the previous source-regex guard accepted a later !feature/** exclusion and an all-branch wildcard appearing only in a comment. Added both adversarial fixtures; predecessor result was 2 failed / 4 passed because the expected rejection did not occur. The guard now parses Actions YAML with BaseLoader (preserving on as a string), requires the PR event, rejects branches-ignore and excludes negative patterns after the final all-branch wildcard. No workflow behavior was weakened. Fixed suite: 6 passed in20.50s with -W error, terminal0; same committed suite with GITHUB_ACTIONS=true:6passed0.09s terminal0. Ruff/diff checks passed. New Application CI34182997104 and central CodeQL PR34182997073 are actual queued runs for this head, not successful results. No empty requeue commit or lifecycle toggle was used. Previous bc83f3f checks/reviews are historical only. |
Signed-off-by: Seongho Bae <me@seonghobae.me>
|
Visual inspection receipt — 48bd9ef: inspected the rendered AGENTS.md PR automation and review defaults section in the real in-app browser at 1265×712. The new stacked-trigger parsing paragraph is fully visible, wraps normally, and has no observed clipping or overlap. Scope is this documentation paragraph only; this is not product UI, mobile, accessibility, or deployment acceptance. Current-head required checks remain queued; predecessor test results are not hosted current-head gate evidence. |
|
Hosted current-head backend evidence: 48bd9ef, Application CI run34183119049, backend job101926049444 is terminal success. Actual Python3.14 log reports 1813 passed, 32 skipped in15.45s; backend lint also passed. This supersedes local-only evidence for that job, not for the full rollup. Frontend job101926049244 remains in progress after build completion; product smoke and other required reviews/security checks are not yet claimed complete. No head change or rerun was made. |
|
Coordination: preserve the current trigger-fix lane. The independently identified smoke evidence gaps warrant a focused successor, not a claim that the current desktop mocked smoke proves live backend/mobile/all-locale behavior. Please carry unknown API fallback rejection, console-error checks after critical/accessibility interactions, and retained screenshot artifacts with regression cases; first check for an existing owner. Keep endpoint fixtures explicit, preserve failing evidence, and never turn proxy_fetch_failed into an accepted message without identifying its actual request. Package publishing keys do not establish cluster deployment readiness. |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
48bd9efe3509496060386691a8c29d0f06b6b92e. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183119016/job/101929123847)
- CodeQL PR/CodeQL compatibility analysis (javascript-typescript): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183119016/job/101929123873)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183119016/job/101929123859)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183119016/job/101929123847)
- CodeQL compatibility analysis (javascript-typescript) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183119016/job/101929123873)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183119016/job/101929123859)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183116156/job/101948697725)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/naruon/actions/runs/34183116156/job/101948697725)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: app-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: app-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: bandit.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: bandit.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Workflow: dependency-review.yml"]
S3 --> I3["GitHub Actions review job"]
I3 --> R3["Review risk: Workflow: dependency-review.yml"]
R3 --> V3["actionlint plus required checks"]
Evidence --> S4["Workflow: docker-publish.yml"]
S4 --> I4["GitHub Actions review job"]
I4 --> R4["Review risk: Workflow: docker-publish.yml"]
R4 --> V4["actionlint plus required checks"]
Evidence --> S5["Repository file: AGENTS.md"]
S5 --> I5["repository behavior"]
I5 --> R5["Review risk: Repository file: AGENTS.md"]
R5 --> V5["required checks"]
Evidence --> S6["Test: test_stacked_pr_workflow_triggers.py"]
S6 --> I6["regression suite"]
I6 --> R6["Review risk: Test: test_stacked_pr_workflow_triggers.py"]
R6 --> V6["targeted test run"]
1 participant
Current authority — 2026-09-08
develop@042b0c70531b229af3acbd0421a2f23098d848b348bd9efe3509496060386691a8c29d0f06b6b92ebackend/tests/test_stacked_pr_workflow_triggers.pyand reusableAGENTS.mdtrigger-test guidancedevelop; no force update or base rewriteProblem and causal repair
Repository-owned PR validation was filtered to long-lived target branches. A stacked PR targeting a feature-stack base could therefore have zero Application/Bandit/Dependency-Review/Docker PR runs even when its source head contained product/deployment changes.
The source fix adds the all-base
**pull-request target pattern to the four repo-local validation workflows without changing push/tag publication conditions, permissions, action pins, release behavior, or canonical central-workflow ownership.The original guard inspected workflow source text. That was insufficient: a comment containing
**could satisfy the test, and an ordered negative pattern after**could still exclude a feature-stack base. Ordinary descendants preserved the source fix and strengthened the regression:8cd91ee71eb355b7c33876910e88719cfc7ec1f4parses the event configuration with the already hash-locked PyYAMLBaseLoader, preserving the Actionsonkey, and rejects both comment-only wildcards and later negative exclusions;48bd9efe3509496060386691a8c29d0f06b6b92erecords that reusable parser/ordered-pattern contract inAGENTS.md.No additional YAML parser or runtime dependency was introduced.
Corrected CI evidence authority
The repo-local runs associated with this PR are terminal: Application CI
34183119049, Bandit34183119055, Docker34183119159, Security34183119059, and Semgrep34183119012succeeded; CodeQL PR34183119016failed at the shared verdict bridge. However, the Application/Bandit/Docker jobs must no longer be described as source-head checkout proof.GitHub's current
pull_requestevent contract setsGITHUB_REFtorefs/pull/<number>/mergeandGITHUB_SHAto the merge commit for an open mergeable PR. The protected repo-local workflows useactions/checkoutwithout an explicitref, so those PR jobs execute the GitHub merge ref by default. Their success proves combined-tree compatibility associated with this PR revision, not execution of the literal source commit48bd9efe....Primary GitHub authority: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request
This newly verified evidence-integrity gap is not repaired by rewriting #1587 history. Stacked child #1600 owns a RED-first repair requiring
ref: ${{ github.event.pull_request.head.sha || github.sha }}in Application CI, Bandit, Dependency Review, and Docker, and binds retained browser PNG identity to the same source-head SHA. #1600 has already demonstrated that Application/Bandit/Docker events are generated when a dependent PR targets this #1587 feature base, so the all-base trigger behavior has live acceptance evidence even though source checkout still needs the child repair.Dependency Review is a separate caveat: no recent repo-local Dependency Review run was generated for #1600 despite the #1587 branch containing the all-base filter. Protected
developstill contains the older long-lived-base filter. This absence remains non-passing evidence and must be resolved rather than inferred away before #1587 can be treated as fully proven across all four workflows.CodeRabbit submitted formal APPROVED review after the latest #1587 push at 2026-09-08T03:33:11Z. Current inline review-thread inventory is empty. The older OpenCode
CHANGES_REQUESTEDsubmission is bound to predecessorbc83f3f...and its then-failed checks; it is retained as history and is not treated as current-source-head approval or finding.CodeQL language detection completed successfully. The
actions,python, andjavascript-typescriptcompatibility jobs each read the current-head dispatch verdict and then failed atRelease runner or enforce current-head CodeQL verdict; the laterDispatch current-head CodeQL scanjob completed successfully. The canonical recovery remains in the.githubowner path, not this Naruon branch.Stack succession
After this source head normally integrates into protected
develop, #1600 must be ordinary-restacked/retargeted and must prove literal source-head checkout plus downloadable hosted PNG evidence. Only after that prerequisite is integrated should dependent deployment/product branches be synchronized and revalidated.Merge #1587 only after every then-live protected repository/organization context is terminal-success, the missing Dependency Review behavior is explained/repaired with evidence, and no valid source finding remains. No self-approval, bypass/admin merge, force-push, destructive rebase, dummy/no-op requeue, predecessor evidence transfer, synthetic status, central workflow copy, or gate weakening.