fix(coverage): materialize requirements-directory locks - #785
fix(coverage): materialize requirements-directory locks#785seonghobae wants to merge 35 commits into
Conversation
|
Warning Review limit reached
Next review available in: 37 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@opencode-agent @cwl-noema-review Perform an independent formal exact-head review of The final diff contains only the permanent five-file product change; all transient repair workflows and transformers are absent. Recompute current-head coverage and public-docstring evidence; verify that only direct |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head The exact head is workflow-free and all direct current-head security, supply-chain, and Trusted uv Materializer Quality checks are successful. Verify the narrow direct-child |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='ed33253e5d6f93f2e71d80b24e27b301f96efb88'
printf '\n== Exact commits ==\n'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git show -s --format='base=%H%nbase-subject=%s%nbase-date=%cI' "$base"
git show -s --format='head=%H%nhead-subject=%s%nhead-date=%cI' "$head"
printf '\n== Changed files and stat ==\n'
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
printf '\n== Full product diff ==\n'
git diff --find-renames --find-copies --no-ext-diff "$base" "$head"
printf '\n== Candidate source maps for changed Python files ==\n'
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all --view compact || true
done
printf '\n== Candidate discovery and provenance references at exact head ==\n'
rg -n -C 4 --glob '*.py' \
'(requirements|require-hashes|materiali[sz]|manifest|symlink|git\s+cat-file|ls-tree|blob|traversal)' .
printf '\n== Workflow inventory and write-capable workflow references ==\n'
fd -t f -e yml -e yaml .github 2>/dev/null || true
rg -n -i -C 3 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|actions/github-script|git\s+push|force-with-lease|workflow_dispatch)' \
.github 2>/dev/null || true
printf '\n== Relevant tests and documentation references ==\n'
rg -n -C 3 --glob '*test*.py' --glob '*.md' \
'(requirements/|requirements\*\.txt|require-hashes|materiali[sz]|manifest|symlink|nested|PR-only)' .
printf '\n== PR metadata, checks, and review state ==\n'
gh pr view 785 --repo ContextualWisdomLab/.github \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
|| trueLength of output: 202327 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='ed33253e5d6f93f2e71d80b24e27b301f96efb88'
printf '\n== Exact changed files ==\n'
git diff --name-status "$base" "$head"
printf '\n== Exact changed-file diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head"
printf '\n== Materializer complete source map ==\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
printf '\n== Materializer candidate and base-lock implementation ==\n'
rg -n -C 12 \
'def (_is_candidate_lock_name|_is_candidate_lock_path|_is_hash_pinned|base_hash_locks|materialize|_regular|_git|_lock_blob)|manifest' \
scripts/ci/materialize_base_python_requirements.py
printf '\n== Materializer full source, bounded ==\n'
cat -n scripts/ci/materialize_base_python_requirements.py
printf '\n== New requirements-directory regression test ==\n'
cat -n tests/test_requirements_directory_lock_materialization.py
printf '\n== Existing Python materializer boundary tests: relevant regions ==\n'
rg -n -C 10 \
'(regular|symlink|traversal|nested|PR-modified|hash.pinned|manifest|base_hash_locks|require-hashes)' \
tests/test_materialize_base_python_requirements.py
printf '\n== Install closure preflight implementation and tests ==\n'
fd -t f 'install_base_python_locks.py|test_install_base_python_locks.py' . -x sh -c '
echo "--- $1"
cat -n "$1"
' sh {} \;
printf '\n== Exact-head workflow files changed by this diff, if any ==\n'
git diff --name-only "$base" "$head" -- .github/workflows |
while IFS= read -r file; do
[ -n "$file" ] && { echo "--- $file"; cat -n "$file"; }
done
printf '\n== Workflow writers introduced by the exact diff ==\n'
git diff --no-ext-diff "$base" "$head" -- .github |
rg -n -i -C 3 '(contents:\s*write|git\s+push|force-with-lease|gh\s+(api|pr|workflow)|workflow_dispatch)' || true
printf '\n== Current PR check summary, grouped ==\n'
gh pr checks 785 --repo ContextualWisdomLab/.github || trueLength of output: 127039 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='ed33253e5d6f93f2e71d80b24e27b301f96efb88'
printf '\n== Exact-head materializer and installer calls in coverage workflows ==\n'
rg -n -C 8 --glob '*.yml' --glob '*.yaml' \
'(materialize_base_python_requirements\.py|install_base_python_locks\.py|base-python-requirements|--base-sha|--requirements-root)' \
.github/workflows
printf '\n== Candidate-status hash-pin regression coverage ==\n'
rg -n -C 8 --glob 'test*.py' \
'(--require-hashes.*(unpinned|>=)|_is_hash_pinned|requirements/ci\.txt|requirements/nested|symlink|PR-modified)' \
tests
printf '\n== Exact quality workflow runs and their logs ==\n'
gh run list --repo "$repo" --commit "$head" --workflow 'Trusted uv Materializer Quality CI' \
--limit 10 --json databaseId,headSha,status,conclusion,createdAt,updatedAt,url \
|| true
for run_id in $(gh run list --repo "$repo" --commit "$head" --workflow 'Trusted uv Materializer Quality CI' \
--limit 10 --json databaseId --jq '.[].databaseId' 2>/dev/null); do
echo "--- quality run $run_id"
gh run view "$run_id" --repo "$repo" --log 2>&1 | rg -n -C 4 \
'(passed|failed|FAIL|TOTAL|100%|coverage|interrogate|docstring|Python 3\.10|Python 3\.14)' \
|| true
done
printf '\n== Current Strix and failed-status details ==\n'
gh pr checks 785 --repo "$repo" --json name,state,link,bucket \
| jq -r '.[] | select(.name == "strix" or .name == "publish-manual-pr-evidence-status")' \
|| true
printf '\n== Branch protection / rulesets for main ==\n'
gh api "repos/${repo}/branches/main/protection" 2>&1 | jq '{required_status_checks,required_pull_request_reviews,enforce_admins,required_linear_history,allow_force_pushes,allow_deletions}' \
|| true
gh api "repos/${repo}/rulesets" 2>&1 | jq '.[] | {name,enforcement,target,conditions,rules}' \
|| trueLength of output: 207047
I reviewed Finding — P1: Do not materialize an unpinned direct-child lockIn
The existing test at Therefore, a base-owned This violates the stated boundary that only complete hash-pinned locks gain candidate status. It also conflicts with the new doctoring document, which says that candidate content must be hash-pinned. Update candidate validation so an unpinned direct-child Verified controls
You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='ed33253e5d6f93f2e71d80b24e27b301f96efb88'
repo='ContextualWisdomLab/.github'
printf '%s\n' '== Exact commits =='
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git show -s --format='base %H%n%cs %s' "$base"
git show -s --format='head %H%n%cs %s' "$head"
printf '%s\n' '== Exact changed files =='
git diff --name-status --find-renames "$base" "$head"
git diff --stat "$base" "$head"
printf '%s\n' '== Exact diff =='
git diff --no-ext-diff --find-renames --unified=60 "$base" "$head"
printf '%s\n' '== Changed Python file outlines =='
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
test -n "$file" || continue
printf '\n--- %s ---\n' "$file"
ast-grep outline "$file" --items all --view expanded || true
done
printf '%s\n' '== Materializer candidate, content-validation, tree, and manifest regions =='
rg -n -C 12 --glob 'materialize_base_python_requirements.py' \
'def (_is_candidate_lock_name|_is_candidate_lock_path|_is_hash_pinned|_.*regular.*|_.*tree.*|materialize)|require-hashes|hash|manifest|ls-tree|cat-file|symlink|traversal' .
printf '%s\n' '== Installer preflight regions =='
rg -n -C 10 --glob 'install_base_python_locks.py' \
'require-hashes|preflight|manifest|pip|closure|defer|skip|install' .
printf '%s\n' '== Relevant regression-test regions =='
rg -n -C 10 --glob 'test*.py' \
'requirements/ci\.txt|requirements/nested|require-hashes|unpinned|hash-pinned|symlink|traversal|PR-only|manifest|base_hash_locks' tests
printf '%s\n' '== Workflow inventory and exact-diff write capability scan =='
fd -t f -e yml -e yaml .github 2>/dev/null || true
git diff --no-ext-diff "$base" "$head" -- .github |
rg -n -i -C 3 'contents:\s*write|pull-requests:\s*write|git\s+push|force-with-lease|workflow_dispatch|actions/github-script' || true
printf '%s\n' '== Current PR and check metadata =='
gh pr view 785 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
gh pr checks 785 --repo "$repo" || trueLength of output: 202643
I reviewed P1 — Reject incomplete direct-child locks before materialization
This file has no hash for The new direct-child rule accepts The later independent Update the candidate validation to require a hash for every requirement before materialization. Add a regression test for Verified controls
The PR is still blocked and requires review according to current GitHub metadata. I cannot approve while the incomplete-lock candidate path remains. You are interacting with an AI system. |
|
@jules Replace the current self-removing repair workflow with ordinary reviewed source commits on this branch. The product diff must contain only the permanent requirements-directory lock discovery, coverage/workflow contract, tests, doctoring, and CHANGELOG changes; no temporary writer, force-with-lease publisher, self-delete mechanism, or expected-RED artifact may remain. Implement the narrow direct-child rule for regular base-owned |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='ed33253e5d6f93f2e71d80b24e27b301f96efb88'
repo='ContextualWisdomLab/.github'
printf '\n== Exact commits ==\n'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git show -s --format='base=%H%n%s%n%cs' "$base"
git show -s --format='head=%H%n%s%n%cs' "$head"
printf '\n== Changed files ==\n'
git diff --name-status --find-renames "$base" "$head"
git diff --stat "$base" "$head"
printf '\n== Exact diff ==\n'
git diff --no-ext-diff --find-renames --unified=50 "$base" "$head"
printf '\n== Materializer outline ==\n'
materializer="$(fd -t f '^materialize_base_python_requirements\.py$' . | head -n1)"
test -n "$materializer"
ast-grep outline "$materializer" --items all --view expanded
printf '\n== Materializer validation, tree, and manifest code ==\n'
rg -n -C 14 \
'def (_is_candidate_lock_name|_is_candidate_lock_path|_is_hash_pinned|_.*tree.*|_.*regular.*|materialize)|--require-hashes|--hash|manifest|ls-tree|cat-file|symlink|traversal|base_hash_locks' \
"$materializer"
printf '\n== Installer preflight code ==\n'
fd -t f '^install_base_python_locks\.py$' . -x sh -c '
ast-grep outline "$1" --items all --view expanded
rg -n -C 12 "require-hashes|preflight|manifest|pip|closure|skip|defer|install" "$1"
' sh {}
printf '\n== Relevant test code ==\n'
fd -t f -e py . tests -x sh -c '
if rg -q "requirements/ci\.txt|requirements/nested|_is_hash_pinned|--require-hashes|base_hash_locks|symlink|PR-only|manifest" "$1"; then
echo "--- $1"
rg -n -C 10 "requirements/ci\.txt|requirements/nested|_is_hash_pinned|--require-hashes|base_hash_locks|symlink|PR-only|manifest" "$1"
fi
' sh {}
printf '\n== Workflow files changed by exact diff ==\n'
git diff --name-only "$base" "$head" -- .github/workflows |
while IFS= read -r file; do
test -n "$file" || continue
echo "--- $file"
git show "${head}:${file}" | nl -ba
done
printf '\n== Write-capability scan in exact workflow diff ==\n'
git diff --no-ext-diff "$base" "$head" -- .github |
rg -n -i -C 3 'contents:\s*write|pull-requests:\s*write|git\s+push|force-with-lease|workflow_dispatch|actions/github-script' || true
printf '\n== Current PR metadata and checks ==\n'
gh pr view 785 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
gh pr checks 785 --repo "$repo" || true
printf '\n== Current unresolved review threads ==\n'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=785 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 130146 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='ed33253e5d6f93f2e71d80b24e27b301f96efb88'
repo='ContextualWisdomLab/.github'
printf '\n== Exact changed workflow at requested head ==\n'
git show "${head}:.github/workflows/trusted-uv-materializer-quality-ci.yml" | sed -n '1,240p'
printf '\n== Write-capability tokens in the exact workflow diff ==\n'
git diff --no-ext-diff "$base" "$head" -- .github/workflows |
rg -n -i -C 3 'contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git\s+push|force-with-lease|workflow_dispatch|actions/github-script' || true
printf '\n== PR exact-head metadata and check rollup ==\n'
gh pr view 785 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
printf '\n== Current check summary ==\n'
gh pr checks 785 --repo "$repo" || true
printf '\n== Current unresolved review-thread count ==\n'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=785 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
printf '\n== Requested head workflow runs ==\n'
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json name,headSha,status,conclusion,url \
--jq '.[] | select(.headSha == "'"$head"'") | [.name,.status,.conclusion,.url] | `@tsv`' \
|| trueLength of output: 45429
I reviewed P1 — Reject incomplete direct-child locks before materializationIn The existing test in
The later This behavior conflicts with the stated boundary that a candidate must be completely hash-pinned before materialization. Update the candidate-content validation so every requirement has a valid hash before the materializer emits the manifest entry. Add a regression test for Verified controls
The PR remains You are interacting with an AI system. |
|
@opencode-agent review Review exact head |
|
@cwl-noema-review @opencode-agent Please review the exact current head after the fail-closed hash-lock classification repair. Earlier reviews and checks are stale. |
|
@cwl-noema-review Submit one formal exact-current-head review through GitHub's review API. Do not add another discussion comment, mutate, or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
@cwl-noema-review Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Exact-head review for b3f5f7e: changes requested.
P1: scripts/ci/materialize_base_python_requirements.py does not validate candidate requirements or include operands before materialization. _is_hash_pinned() accepts any non-directive logical line containing --hash= and any line beginning with -r or --requirement . Therefore, direct-child requirements/*.txt files can enter manifest.json with an option line containing --hash=, an invalid hash token, or an absolute or traversal include. The later pip --require-hashes preflight occurs after materialization and does not enforce the candidate-selection boundary.
Require exact package pins with valid inline SHA-256 hashes. Permit only bounded relative include operands. Reject option lines, malformed hash tokens, absolute paths, traversal paths, and malformed includes. Add manifest-exclusion regression tests for each input.
GitHub also reports this pull request as DIRTY, so it is not mergeable.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
pr_json="$(gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews)"
printf '%s\n' '== Live PR identity and checks =='
printf '%s\n' "$pr_json" | jq '{
number, state, isDraft, headRefOid, baseRefOid, mergeStateStatus, reviewDecision,
checks: [.statusCheckRollup[] | {name, status, conclusion}]
}'
head="$(printf '%s\n' "$pr_json" | jq -r '.headRefOid')"
base="$(printf '%s\n' "$pr_json" | jq -r '.baseRefOid')"
printf '%s\n' '== Commit relation and changed scope =='
printf 'base=%s\nhead=%s\n' "$base" "$head"
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true' || echo 'base_is_ancestor=false'
git diff --name-status --find-renames "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== Materializer validation and materialization =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba | sed -n '100,230p;430,540p'
printf '%s\n' '== Relevant regression tests =='
for file in \
tests/test_materialize_base_python_requirements.py \
tests/test_requirements_directory_lock_materialization.py; do
echo "--- ${file}"
git show "${head}:${file}" | nl -ba |
rg -n -C 6 -- 'requirements/ci\.txt|requirements/nested|require-hashes|--hash=|--requirement|-r |manifest|unpinned|invalid|absolute|traversal|symlink|directive'
done
printf '%s\n' '== Active review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line }
}
}
}
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false and .isOutdated == false)]'Length of output: 8826 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf '%s\n' '== Exact current head =='
printf '%s\n' "$head"
printf '%s\n' '== Materializer candidate validation and materialization =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
cat -n | sed -n '100,240p;430,550p'
printf '%s\n' '== Relevant materializer regression tests =='
for file in \
tests/test_materialize_base_python_requirements.py \
tests/test_requirements_directory_lock_materialization.py; do
printf '%s\n' "--- ${file}"
git show "${head}:${file}" | cat -n |
rg -n -C 6 -- 'requirements/ci\.txt|requirements/nested|require-hashes|--hash=|--requirement|-r |manifest|unpinned|invalid|absolute|traversal|symlink|directive'
done
printf '%s\n' '== Active non-outdated review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line }
}
}
}
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false and .isOutdated == false)]'Length of output: 31716 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
expected_head='b3f5f7e87b57d9b5b76e3c628fe5d21be84d269f'
current_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
if [ "$current_head" != "$expected_head" ]; then
printf 'Head changed; no review submitted. expected=%s current=%s\n' \
"$expected_head" "$current_head" >&2
exit 1
fi
body=$'Exact-head review for b3f5f7e87b57d9b5b76e3c628fe5d21be84d269f: changes requested.\n\nP1: `scripts/ci/materialize_base_python_requirements.py` does not validate candidate requirements or include operands before materialization. `_is_hash_pinned()` accepts any non-directive logical line containing `--hash=` and any line beginning with `-r ` or `--requirement `. Therefore, direct-child `requirements/*.txt` files can enter `manifest.json` with an option line containing `--hash=`, an invalid hash token, or an absolute or traversal include. The later `pip --require-hashes` preflight occurs after materialization and does not enforce the candidate-selection boundary.\n\nRequire exact package pins with valid inline SHA-256 hashes. Permit only bounded relative include operands. Reject option lines, malformed hash tokens, absolute paths, traversal paths, and malformed includes. Add manifest-exclusion regression tests for each input.\n\nGitHub also reports this pull request as `DIRTY`, so it is not mergeable.'
gh api --method POST "repos/${repo}/pulls/${pr}/reviews" \
-f commit_id="$current_head" \
-f event='REQUEST_CHANGES' \
-f body="$body" \
--jq '{id, state, commit_id, html_url}'Length of output: 1941
Verdict: Changes requested. The review identifies the fail-open candidate validation and the current You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai No further discussion comments are needed. Complete the formal exact-current-head review through the review API only; do not mutate or merge. |
There was a problem hiding this comment.
Exact-head review for b3f5f7e: changes requested.
P1: Candidate validation remains fail-open before materialization. In scripts/ci/materialize_base_python_requirements.py, _is_hash_pinned() accepts any non-directive line containing --hash= and every -r or --requirement line. base_hash_locks() then writes the accepted direct-child requirements/*.txt candidate into the manifest before independent pip --require-hashes closure preflight.
This permits option lines that contain --hash=, malformed hash tokens, and absolute, traversal, or malformed requirement includes to gain candidate status. The later preflight can reject installation, but it does not enforce the required materialization boundary.
Require an exact package == pin with one or more valid inline SHA-256 hashes. Permit only bounded relative requirement includes. Reject option lines, malformed hashes, absolute paths, traversal paths, and malformed include operands. Add manifest-exclusion tests for each invalid input.
GitHub also reports this pull request as DIRTY, so the exact head is not mergeable.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
pr_json="$(gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews)"
printf '%s\n' '== Live PR identity and checks =='
printf '%s\n' "$pr_json" | jq '{
number, state, isDraft, headRefOid, baseRefOid, mergeStateStatus, reviewDecision,
checks: [.statusCheckRollup[] | {name, status, conclusion}]
}'
head="$(printf '%s\n' "$pr_json" | jq -r '.headRefOid')"
base="$(printf '%s\n' "$pr_json" | jq -r '.baseRefOid')"
printf '%s\n' '== Commit relation and changed scope =='
printf 'base=%s\nhead=%s\n' "$base" "$head"
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true' || echo 'base_is_ancestor=false'
git diff --name-status --find-renames "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== Candidate validation and materialization at live head =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba | sed -n '100,250p;430,560p'
printf '%s\n' '== Relevant regression coverage at live head =='
for file in \
tests/test_materialize_base_python_requirements.py \
tests/test_requirements_directory_lock_materialization.py; do
printf '%s\n' "--- ${file}"
git show "${head}:${file}" | nl -ba |
rg -n -C 6 -- \
'requirements/ci\.txt|requirements/nested|require-hashes|--hash=|--requirement|-r |manifest|unpinned|invalid|absolute|traversal|symlink|directive'
done
printf '%s\n' '== Active non-outdated review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line }
}
}
}
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false and .isOutdated == false)]'Length of output: 8892 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf '== Exact live head ==\n%s\n' "$head"
printf '%s\n' '== Candidate validation and materialization =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
cat -n | sed -n '100,250p;430,560p'
printf '%s\n' '== Relevant regression coverage =='
for file in \
tests/test_materialize_base_python_requirements.py \
tests/test_requirements_directory_lock_materialization.py; do
printf '%s\n' "--- ${file}"
git show "${head}:${file}" | cat -n |
rg -n -C 6 -- \
'requirements/ci\.txt|requirements/nested|require-hashes|--hash=|--requirement|-r |manifest|unpinned|invalid|absolute|traversal|symlink|directive' \
|| true
done
printf '%s\n' '== Active non-outdated review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line }
}
}
}
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false and .isOutdated == false)]'Length of output: 32443 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
expected_head='b3f5f7e87b57d9b5b76e3c628fe5d21be84d269f'
current_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
if [ "$current_head" != "$expected_head" ]; then
printf 'Head changed; review was not submitted. expected=%s current=%s\n' \
"$expected_head" "$current_head" >&2
exit 1
fi
body=$'Exact-head review for b3f5f7e87b57d9b5b76e3c628fe5d21be84d269f: changes requested.\n\nP1: Candidate validation remains fail-open before materialization. In `scripts/ci/materialize_base_python_requirements.py`, `_is_hash_pinned()` accepts any non-directive line containing `--hash=` and every `-r ` or `--requirement ` line. `base_hash_locks()` then writes the accepted direct-child `requirements/*.txt` candidate into the manifest before independent `pip --require-hashes` closure preflight.\n\nThis permits option lines that contain `--hash=`, malformed hash tokens, and absolute, traversal, or malformed requirement includes to gain candidate status. The later preflight can reject installation, but it does not enforce the required materialization boundary.\n\nRequire an exact package `==` pin with one or more valid inline SHA-256 hashes. Permit only bounded relative requirement includes. Reject option lines, malformed hashes, absolute paths, traversal paths, and malformed include operands. Add manifest-exclusion tests for each invalid input.\n\nGitHub also reports this pull request as `DIRTY`, so the exact head is not mergeable.'
gh api --method POST "repos/${repo}/pulls/${pr}/reviews" \
-f commit_id="$current_head" \
-f event='REQUEST_CHANGES' \
-f body="$body" \
--jq '{id, state, commit_id, html_url}'Length of output: 2073
You are interacting with an AI system. |
|
@opencode-agent address Reconcile the trusted requirements-directory lock materializer onto the current protected base without rewriting history. Exact PR head is Use a trusted checkout and normally merge exact protected main into this existing branch. Resolve conflicts by preserving every newer protected-main behavior plus only this bounded lock-discovery contract:
The old exact head had Trusted uv Materializer Quality CI plus all security/supply-chain checks green, and its GA-S temporary workflow findings are already resolved/outdated; none of that evidence transfers after reconciliation. Do not resurrect any After the normal merge commit, run the focused requirements/uv materializer suite with exact 100% production statement/branch/docstring coverage, complete central suite and Strix quick gate, Python 3.10/3.14 compilation, and all exact-head Security Scan, SAST, CodeQL, Python Security, Secret Scan, OSV, Scorecard, and SBOM gates. Remove only genuine merge-conflict artifacts if created by the merge and keep Draft until current-head automated and qualifying independent review are clean. Do not merge or synthesize approval. |
|
/oc Refetch the live PR and abort without writing unless exact head is still Implement the minimum GREEN repair in
Run first the two focused suites |
|
/oc Refetch the live PR and stop without writing unless exact head is
Run the 12 failing cases first, then the complete trusted-uv focused suite, 100% statement/branch coverage, full central tests, 100% public docstrings, Python 3.10/3.14 compatibility, compileall and |
|
@opencode-agent review Re-evaluate exact current head |
Dismissed as source-stale predecessor evidence. It reviewed b3f5f7e87b57d9b5b76e3c628fe5d21be84d269f; exact current head is dcc539176271658f024de7419044f513c6fb7317, GitHub reports it mergeable, all ten current-head workflows are terminal-success, and no unresolved thread remains. This dismissal is not approval, qualifying human review, base freshness, merge authority, or protected-main acceptance.
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head |
|
Exact-current-head review request for Review the bounded six-file requirements-directory lock repair: only direct-child Keep the exact head unchanged. Do not transfer predecessor review evidence, synthesize author approval, broaden candidate trust, skip closure validation, update the branch, merge, release, or bypass protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
expected_head='edbe8d35b16c6f0a7041fefc476513e160cadb10'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Live PR identity, reviews, and checks =='
pr_json="$(gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup,reviews)"
printf '%s\n' "$pr_json" | jq '{
number, state, isDraft, headRefOid, baseRefOid, mergeStateStatus, reviewDecision,
checks: [.statusCheckRollup[] | {name, status, conclusion, workflowName}],
reviews: [.reviews[] | {author: .author.login, state, commit: .commit.oid}]
}'
head="$(printf '%s\n' "$pr_json" | jq -r '.headRefOid')"
base="$(printf '%s\n' "$pr_json" | jq -r '.baseRefOid')"
test "$head" = "$expected_head"
test "$base" = "$expected_base"
printf '%s\n' '== Commit identity and exact changed scope =='
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head"
git show -s --format='base=%H%nbase_subject=%s%nhead=%H%nhead_subject=%s%nhead_parents=%P' "$base" "$head"
git diff --name-status --find-renames "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== Exact product diff =='
git diff --no-ext-diff --find-renames --unified=35 "$base" "$head" -- \
.github/workflows/trusted-uv-materializer-quality-ci.yml \
CHANGELOG.md \
docs/doctoring/trusted-requirements-directory-lock-discovery.md \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_requirements_directory_lock_materialization.py
printf '%s\n' '== Materializer source map and boundary regions =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
git show "${head}:scripts/ci/materialize_base_python_requirements.py" | nl -ba |
sed -n '1,300p;400,620p'
printf '%s\n' '== Installer closure-preflight regions =='
git show "${head}:scripts/ci/install_base_python_locks.py" | nl -ba |
rg -n -C 12 -- 'require-hashes|preflight|manifest|pip|closure|skip|defer|install' || true
printf '%s\n' '== Relevant regression evidence =='
for file in \
tests/test_materialize_base_python_requirements.py \
tests/test_requirements_directory_lock_materialization.py; do
printf '%s\n' "--- ${file}"
git show "${head}:${file}" | nl -ba |
rg -n -C 8 -- \
'requirements/ci\.txt|requirements/nested|require-hashes|--hash=|--requirement|-r |manifest|unpinned|invalid|absolute|traversal|symlink|query|fragment|backslash|PR-only|regular blob' || true
done
printf '%s\n' '== Exact-diff workflow writer scan =='
git diff --no-ext-diff "$base" "$head" -- .github |
rg -n -i -C 3 \
'contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git\s+push|force-with-lease|workflow_dispatch|actions/github-script|encoded' || true
printf '%s\n' '== Active non-outdated review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false and .isOutdated == false)]'
printf '%s\n' '== Protected base rules and required checks =='
gh api "repos/${repo}/branches/main/protection" 2>&1 |
jq '{required_status_checks,required_pull_request_reviews,enforce_admins,required_linear_history,allow_force_pushes,allow_deletions}' || trueLength of output: 58628 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='785'
head='edbe8d35b16c6f0a7041fefc476513e160cadb10'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
current_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
test "$current_head" = "$head"
printf '%s\n' '== Include predicate and control-character tests =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
sed -n '118,190p'
git show "${head}:tests/test_requirements_directory_lock_materialization.py" |
sed -n '55,190p'
git show "${head}:tests/test_materialize_base_python_requirements.py" |
rg -n -C 6 -- 'control|NUL|\\x00|include|_is_hash_pinned|manifest|requirements/' || true
printf '%s\n' '== Installer preflight implementation =='
git show "${head}:scripts/ci/install_base_python_locks.py" |
rg -n -C 14 -- 'require-hashes|preflight|manifest|pip|closure|skip|defer|install' || true
printf '%s\n' '== Authentication and materialization implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
sed -n '460,545p'
printf '%s\n' '== Workflow content and introduced writer scan =='
git show "${head}:.github/workflows/trusted-uv-materializer-quality-ci.yml" |
sed -n '1,190p'
git diff --no-ext-diff "$base" "$head" -- .github |
rg -n -i -C 3 \
'contents:\s*write|pull-requests:\s*write|issues:\s*write|id-token:\s*write|git\s+push|force-with-lease|workflow_dispatch|actions/github-script|encoded' || true
printf '%s\n' '== Current check summary and active threads =='
gh pr checks "$pr" --repo "$repo" || true
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' | jq '[.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false and .isOutdated == false)]'
printf '%s\n' '== Branch protection and live PR state =='
gh api "repos/${repo}/branches/main/protection" |
jq '{required_status_checks,required_pull_request_reviews,enforce_admins,required_linear_history,allow_force_pushes,allow_deletions}' || true
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,reviews |
jq .Length of output: 50734
I reviewed P1 — Reject NUL and control characters in requirement include targetsIn For example, this direct-child candidate is accepted: The line has two fields. Its target is not absolute. It contains no The later Reject NUL and all control characters in the include target. Add predicate and manifest-exclusion regressions for at least Verified controls
🧠 Learnings usedYou are interacting with an AI system. |
2 participants
Buyer and review problem
Central OpenCode coverage historically discovered conventional
requirements*.txtlocks but ignored complete base-owned locks stored as direct children such asrequirements/ci.txt. The first implementation then exposed a trust-boundary defect: candidate qualification treated the presence of--hash=or a requirement-include prefix as sufficient trust before independent dependency-closure validation.Exact current identity
edbe8d35b16c6f0a7041fefc476513e160cadb10;6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;Detailed test counts previously recorded for
dcc539176271658f024de7419044f513c6fb7317are predecessor-head evidence and do not transfer. The current hosted quality run and security/supply-chain runs are the authoritative evidence foredbe8d35b16c6f0a7041fefc476513e160cadb10.Accepted trust boundary
A direct child
.txtfile under a directory namedrequirementsmay become a candidate in addition to conventional lock names, but path eligibility never grants dependency trust.==pin with at least one complete SHA-256--hash=value;--require-hashesdirective is not trust evidence;-r/--requirementforms;.., URL/scheme syntax, home expansion, backslashes, query/fragment syntax, option-like operands, extra inline options, ranges, malformed hashes, and pip option lines fail before materialization;pip --require-hashesclosure preflight.Unpinned inputs, notes, deeper descendants, unrelated files, PR-only content, malformed Git trees, and unsafe includes remain excluded.
Test-first lineage
At RED head
4914e124c339f93bac5da42aeaf649ed893315d4, the permanent quality gate reported 12 intended failures and 77 passes for range pins, malformed hashes, option lines, unsafe includes, and manifest admission. The production repair made those same contracts green without weakening the downstream closure proof.The current exact head has successful:
The predecessor OpenCode/CodeRabbit findings about merge conflicts and fail-open candidate admission were dismissed after their source-backed defects were repaired. They are neither current-head approvals nor transferable merge authority.
Downstream activation and merge gate
After protected integration, affected product PRs such as
fast-mlsirm#546,#549,#550, and#556must rerun the central exact-head coverage/review path.Keep unmerged until the Ready-cycle current-head gates are terminal-success, semantic review has no valid finding, qualifying independent non-author human approval exists, live-base compatibility and branch protection are revalidated, and expected-head merge authority succeeds. Protected-main operational acceptance remains required after integration.