fix(ci): modernize fuzz runtime and attest exact PR head - #547
fix(ci): modernize fuzz runtime and attest exact PR head#547seonghobae wants to merge 21 commits into
Conversation
|
Warning Review limit reached
Next review available in: 53 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
seonghobae
changed the title
seonghobae
changed the title
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/fuzz-setup-node-node24cannot be merged cleanly intodevelop; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
developintofix/fuzz-setup-node-node24, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 547 --repo ContextualWisdomLab/scopeweave
git fetch origin develop
git merge --no-ff origin/develop # or: git rebase origin/develop
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/fuzz-setup-node-node24
# rebase path only: git push --force-with-lease origin HEAD:fix/fuzz-setup-node-node24- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fuzz.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: fuzz-setup-node-runtime.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: coverage-script-contract.test.mjs"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
75b4d86114b99b793a6d64afe070acffc0fd869e - Workflow run: 32051152113
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fuzz.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: fuzz-setup-node-runtime.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: coverage-script-contract.test.mjs"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fuzz.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: fuzz.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: fuzz-setup-node-runtime.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: fuzz-setup-node-runtime.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: coverage-script-contract.test.mjs"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: coverage-script-contract.test.mjs"]
R4 --> V4["targeted test run"]
|
Dismissed as stale, addressed evidence: this review was anchored to predecessor head 75b4d86 and requested conflict resolution. Current head a3c6d21 is a non-destructive merge of current protected develop@1fadec04195805722829b386475a09a15f8cd926, GitHub now reports the PR mergeable, and all six repository-native current-head workflows (Server Tests, Fuzz, Security Scan, Dependency Review, SAST Semgrep, OSV Scanner) are terminal success. This dismissal does not constitute approval and does not substitute for the required independent current-head review or central corrected review/security evidence.
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
a3c6d2176fd727d3d1623f88f18d362943964fd8. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/scopeweave/actions/runs/32068469365/job/95505953376)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/scopeweave/actions/runs/32068469365/job/95505953376)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fuzz.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: fuzz.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: fuzz-setup-node-runtime.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: fuzz-setup-node-runtime.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: coverage-script-contract.test.mjs"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: coverage-script-contract.test.mjs"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
a3c6d2176fd727d3d1623f88f18d362943964fd8. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/scopeweave/actions/runs/32068469365/job/95505953376)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/scopeweave/actions/runs/32068469365/job/95505953376)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fuzz.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: fuzz.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: fuzz-setup-node-runtime.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: fuzz-setup-node-runtime.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: coverage-script-contract.test.mjs"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: coverage-script-contract.test.mjs"]
R4 --> V4["targeted test run"]
|
@coderabbitai review Please review the exact current contributor head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="df0fa17bd5035af6455c889022c540b4f439e3d6"
head="8644756958ba4252b7d0d539a6ba92f0cd42ac9b"
repo="ContextualWisdomLab/scopeweave"
echo "== Exact commit objects =="
git cat-file -t "$base"
git cat-file -t "$head"
echo "base=$(git rev-parse "$base^{commit}")"
echo "head=$(git rev-parse "$head^{commit}")"
echo "== Relationship: behind ahead =="
git rev-list --left-right --count "$base...$head"
echo "== Changed paths and status =="
git diff --name-status "$base" "$head"
echo "== Diffstat =="
git diff --stat "$base" "$head"
echo "== Scoped diff =="
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/fuzz.yml \
CHANGELOG.md \
docs/doctoring/fuzz-setup-node-runtime.md \
tests/unit/coverage-script-contract.test.mjs
echo "== Current head workflow =="
git show "$head:.github/workflows/fuzz.yml"
echo "== Current head contract test =="
git show "$head:tests/unit/coverage-script-contract.test.mjs"
echo "== PR metadata and checks for requested head =="
gh pr view 547 --repo "$repo" --json number,state,isDraft,mergeable,headRefOid,baseRefOid,headRefName,baseRefName,reviewDecision,statusCheckRollupLength of output: 34722 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/scopeweave"
head="8644756958ba4252b7d0d539a6ba92f0cd42ac9b"
echo "== setup-node v7.0.0 tag and action runtime =="
gh api repos/actions/setup-node/git/ref/tags/v7.0.0 --jq '.object.type + " " + .object.sha'
gh api repos/actions/setup-node/contents/action.yml?ref=820762786026740c76f36085b0efc47a31fe5020 \
--jq '.content' \
| tr -d '\n' \
| base64 --decode \
| sed -n '/^runs:/,/^[^[:space:]]/p'
echo "== Selected current PR workflow runs =="
for run in 32231659491 32231659417 32231659420 32231659443 32231659839; do
gh api "repos/$repo/actions/runs/$run" \
--jq '"run=\(.id) workflow=\(.name) event=\(.event) head_sha=\(.head_sha) conclusion=\(.conclusion)"'
done
echo "== PR review decisions and commit anchors =="
gh api "repos/$repo/pulls/547/reviews?per_page=100" \
--jq '.[] | "id=\(.id) user=\(.user.login) state=\(.state) commit_id=\(.commit_id) submitted_at=\(.submitted_at) body=\(.body | gsub("[\r\n]+"; " ") | .[0:240])"'Length of output: 3239
No code findings.
I did not treat the prior A qualifying independent current-head approval remains a separate governance requirement.
|
1 participant
Superseded by canonical CI-integrity owner #523
Fresh protected-base and exact-head comparison on 2026-08-20 shows that this PR no longer contains unique product/control behavior that needs a second integration path.
develop:df0fa17bd5035af6455c889022c540b4f439e3d6;8644756958ba4252b7d0d539a6ba92f0cd42ac9b;34eb45f219c4fcb77ac9c3d979cdbccc8d8efdb5.The effective protected-base delta here is limited to
.github/workflows/fuzz.yml,tests/unit/coverage-script-contract.test.mjs,docs/doctoring/fuzz-setup-node-runtime.md, andCHANGELOG.md. PR #523 now preserves and strengthens all four semantics:${{ github.event.pull_request.head.sha || github.sha }}, disables persisted credentials, and fails closed on runtime SHA mismatch;actions/setup-nodeis immutably pinned to v7.0.0 commit820762786026740c76f36085b0efc47a31fe5020while ScopeWeave itself remains on Node.js 22.13.0;tests/unit/fuzz-exact-head-contract.test.mjsthat additionally protects the immutable checkout action, exact expected SHA binding, credential boundary, setup-node revision, deprecated-v4 rejection, and unprivilegedpull_requesttrust boundary;During convergence, #523 also exposed and repaired an unintended history regression that had deleted the published 1.0.0 GitHub Pages note and altered the published 1.0.1 Korean release text. It now has an executable regression that preserves those published notes exactly.
This PR's current repository-native checks are terminal-success, but its current formal review history contains predecessor-head OpenCode
CHANGES_REQUESTEDverdicts and no qualifying independent current-head approval. Those statuses are not transferred to #523. Closing this PR therefore removes a duplicate writer/integration lane without treating predecessor evidence as merge authority or discarding unique implementation value.