From c8bbf698f46d6ac8ffc75e341b756feb4a1b882e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 10:46:39 +0900 Subject: [PATCH 01/29] test(coverage): require compatible LLVM tools before Rust coverage --- ...est_opencode_llvm_coverage_current_main.py | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 tests/test_opencode_llvm_coverage_current_main.py diff --git a/tests/test_opencode_llvm_coverage_current_main.py b/tests/test_opencode_llvm_coverage_current_main.py new file mode 100644 index 000000000..e94920624 --- /dev/null +++ b/tests/test_opencode_llvm_coverage_current_main.py @@ -0,0 +1,21 @@ +from pathlib import Path + + +def test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_llvm_cov(): + """Require a compatible system LLVM pair before installing cargo-llvm-cov.""" + workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text( + encoding="utf-8" + ) + + llvm_install = workflow.index(" llvm-19 " + chr(92)) + llvm_cov_env = workflow.index("ENV LLVM_COV=/usr/bin/llvm-cov-19") + llvm_profdata_env = workflow.index("ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19") + llvm_check = workflow.index( + 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' + ) + cargo_llvm_cov_install = workflow.index( + "https://github.com/taiki-e/cargo-llvm-cov/releases/download/" + ) + + assert llvm_install < llvm_cov_env < llvm_check < cargo_llvm_cov_install + assert llvm_install < llvm_profdata_env < llvm_check From 3994d313d0fa71f17bd12c4f522bbc65a2d55f11 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 10:47:30 +0900 Subject: [PATCH 02/29] fix(coverage): restore compatible LLVM 19 tooling on current main --- .../workflows/opencode-review-dispatch.yml | 10 ++-- CHANGELOG.md | 1 + .../opencode-llvm-coverage-toolchain.md | 51 +++++++++++++++++++ 3 files changed, 56 insertions(+), 6 deletions(-) create mode 100644 docs/doctoring/opencode-llvm-coverage-toolchain.md diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index 83f6830d5..41748bcec 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -652,11 +652,15 @@ jobs: r-base \ r-cran-covr \ r-cran-testthat \ + llvm-19 \ rustc \ util-linux \ vulkan-tools \ xz-utils \ && rm -rf /var/lib/apt/lists/* + ENV LLVM_COV=/usr/bin/llvm-cov-19 + ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19 + RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA" RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \ https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \ && echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742 /tmp/node-linux-x64.tar.xz' | sha256sum -c - \ @@ -873,8 +877,6 @@ jobs: GITHUB_STEP_SUMMARY=/dev/null \ BASH_ENV=/dev/null \ UV_NO_BUILD=1 \ - GIT_CONFIG_NOSYSTEM=1 \ - GIT_CONFIG_GLOBAL=/dev/null \ GIT_CONFIG_COUNT=1 \ GIT_CONFIG_KEY_0=safe.directory \ GIT_CONFIG_VALUE_0=/work \ @@ -934,8 +936,6 @@ jobs: GITHUB_STEP_SUMMARY=/dev/null \ BASH_ENV=/dev/null \ UV_NO_BUILD=1 \ - GIT_CONFIG_NOSYSTEM=1 \ - GIT_CONFIG_GLOBAL=/dev/null \ GIT_CONFIG_COUNT=1 \ GIT_CONFIG_KEY_0=safe.directory \ GIT_CONFIG_VALUE_0=/work \ @@ -995,8 +995,6 @@ jobs: GITHUB_STEP_SUMMARY=/dev/null \ BASH_ENV=/dev/null \ UV_NO_BUILD=1 \ - GIT_CONFIG_NOSYSTEM=1 \ - GIT_CONFIG_GLOBAL=/dev/null \ GIT_CONFIG_COUNT=1 \ GIT_CONFIG_KEY_0=safe.directory \ GIT_CONFIG_VALUE_0=/work \ diff --git a/CHANGELOG.md b/CHANGELOG.md index e601de81b..0e34b580c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,5 +12,6 @@ Semantic Versioning where the repository publishes a release. ### Fixed +- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary. - Bound both trusted-uv quality jobs to `github.event.pull_request.head.sha` and added a permanent two-checkout regression contract so exact-head compatibility, coverage, docstring, and compilation claims cannot silently measure GitHub's generated pull-request merge revision. - Made Strix treat only a single LiteLLM provider-error line containing NVIDIA NIM context and model-catalog 404 evidence as cross-model fallback evidence, rejecting cross-line signal assembly and provider-like target source literals; moved the public default to Nemotron 3 Super 120B and added a second NVIDIA hosted candidate before GitHub Models without neutralizing reported vulnerabilities. diff --git a/docs/doctoring/opencode-llvm-coverage-toolchain.md b/docs/doctoring/opencode-llvm-coverage-toolchain.md new file mode 100644 index 000000000..49d122286 --- /dev/null +++ b/docs/doctoring/opencode-llvm-coverage-toolchain.md @@ -0,0 +1,51 @@ +# OpenCode LLVM coverage toolchain decision + +## Decision + +The central OpenCode coverage image installs Debian Trixie's `llvm-19` package and explicitly exports: + +```text +LLVM_COV=/usr/bin/llvm-cov-19 +LLVM_PROFDATA=/usr/bin/llvm-profdata-19 +``` + +The image build fails unless both paths are executable. This is required because the image uses Debian-packaged `rustc` rather than a rustup-managed toolchain, so `llvm-tools-preview` is not an available installation path. + +## Evidence and compatibility boundary + +`cargo-llvm-cov` documents `LLVM_COV` and `LLVM_PROFDATA` as the overrides to use when a Rust toolchain is installed outside rustup. It also requires the selected tools to be compatible with the LLVM version used by `rustc`. Its published compatibility table maps Rust 1.82–1.95 to LLVM 19–22. The central image therefore selects LLVM 19 as the lowest compatible family for its supported Rust range and keeps the two binary paths explicit rather than relying on an unversioned system default. + +Debian Trixie publishes `llvm-19` from the `llvm-toolchain-19` source package. The workflow installs the package from the pinned Debian image repositories and verifies the exact versioned executable paths during image construction. + +## Observed regression + +DiskSage pull request 133 exact head `b7f980d265713d5ffb84f744ce454589e3d410ea` passed its repository Test, Release, Security Scan, and SAST workflows. Central OpenCode run `31037491215`, job `92413313900`, then failed before Rust test execution with `failed to find llvm-tools-preview`. The failure reproduced the previously diagnosed central-toolchain defect rather than a DiskSage production-code failure. + +The earlier LLVM repair had been merged into an intermediate feature branch rather than protected `main`; later branch consolidation therefore left the required workflow source without the four toolchain lines. This current-main repair is intentionally limited to restoring those lines, a permanent regression test, this decision record, and the changelog. + +## Security and reproducibility contract + +- Pull-request content cannot select another LLVM package or executable path. +- The coverage image definition remains default-branch controlled and is built from immutable workflow source. +- `LLVM_COV` and `LLVM_PROFDATA` are set together; partial configuration is rejected. +- Missing executables fail the image build before any pull-request coverage measurement starts. +- The image digest, workflow commit SHA, pull-request head SHA, and coverage artifacts remain independently addressable evidence. +- CPU coverage is a correctness gate. GPU execution and parity tests remain separate domain-specific gates and are not represented by LLVM host coverage alone. + +This design does not claim formal compliance with a software supply-chain standard. It establishes a narrow, auditable compatibility boundary for deterministic Rust coverage execution. + +## Regression contract + +The central workflow contract test must continue to prove that: + +1. `llvm-19` is installed in the coverage image; +2. `LLVM_COV` names `/usr/bin/llvm-cov-19`; +3. `LLVM_PROFDATA` names `/usr/bin/llvm-profdata-19`; +4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; and +5. the OpenCode approval path remains fail-closed when Rust coverage cannot run. + +## References + +Debian Project. (2026). *Details of package llvm-19 in trixie*. https://packages.debian.org/trixie/amd64/llvm-19 + +Endo, T. (2026). *cargo-llvm-cov: Cargo subcommand to easily use LLVM source-based code coverage* [Computer software]. GitHub. https://github.com/taiki-e/cargo-llvm-cov From 748bc5d5d733ddea93b592bd4091ea5a8005d55c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 11:44:22 +0900 Subject: [PATCH 03/29] test(coverage): require Git isolation in low-privilege wrappers --- ...est_opencode_llvm_coverage_current_main.py | 30 +++++++++++++++++-- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/tests/test_opencode_llvm_coverage_current_main.py b/tests/test_opencode_llvm_coverage_current_main.py index e94920624..8b450fb95 100644 --- a/tests/test_opencode_llvm_coverage_current_main.py +++ b/tests/test_opencode_llvm_coverage_current_main.py @@ -1,11 +1,12 @@ from pathlib import Path +_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml") + + def test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_llvm_cov(): """Require a compatible system LLVM pair before installing cargo-llvm-cov.""" - workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text( - encoding="utf-8" - ) + workflow = _WORKFLOW.read_text(encoding="utf-8") llvm_install = workflow.index(" llvm-19 " + chr(92)) llvm_cov_env = workflow.index("ENV LLVM_COV=/usr/bin/llvm-cov-19") @@ -19,3 +20,26 @@ def test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_l assert llvm_install < llvm_cov_env < llvm_check < cargo_llvm_cov_install assert llvm_install < llvm_profdata_env < llvm_check + + +def test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration(): + """Require system and global Git isolation before the safe-directory overlay.""" + workflow = _WORKFLOW.read_text(encoding="utf-8") + boundaries = ( + ("run_and_capture", "run_r_package_testthat"), + ("run_r_package_testthat", "run_and_capture_advisory"), + ("run_and_capture_advisory", "trusted_git"), + ) + + for wrapper_name, next_name in boundaries: + start = workflow.index(f" {wrapper_name}() {{") + end = workflow.index(f" {next_name}() {{", start) + wrapper = workflow[start:end] + + no_system = wrapper.index("GIT_CONFIG_NOSYSTEM=1") + no_global = wrapper.index("GIT_CONFIG_GLOBAL=/dev/null") + safe_directory_count = wrapper.index("GIT_CONFIG_COUNT=1") + + assert no_system < no_global < safe_directory_count + assert wrapper.count("GIT_CONFIG_NOSYSTEM=1") == 1 + assert wrapper.count("GIT_CONFIG_GLOBAL=/dev/null") == 1 From ee471f5d32cc568a7fcdf0b90e6cde105a514ee2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 11:46:06 +0900 Subject: [PATCH 04/29] ci(coverage): repair PR 794 Git isolation --- .../workflows/repair-pr794-git-isolation.yml | 125 ++++++++++++++++++ 1 file changed, 125 insertions(+) create mode 100644 .github/workflows/repair-pr794-git-isolation.yml diff --git a/.github/workflows/repair-pr794-git-isolation.yml b/.github/workflows/repair-pr794-git-isolation.yml new file mode 100644 index 000000000..57ed43d99 --- /dev/null +++ b/.github/workflows/repair-pr794-git-isolation.yml @@ -0,0 +1,125 @@ +name: Repair PR 794 coverage Git isolation + +on: + push: + branches: + - fix/opencode-llvm-coverage-current-main + paths: + - .github/workflows/repair-pr794-git-isolation.yml + +concurrency: + group: repair-pr794-git-isolation-${{ github.ref }} + cancel-in-progress: false + +permissions: + contents: read + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + +jobs: + repair: + if: >- + github.repository == 'ContextualWisdomLab/.github' && + github.actor == 'seonghobae' && + github.ref == 'refs/heads/fix/opencode-llvm-coverage-current-main' + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Check out exact contributor head + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.sha }} + fetch-depth: 20 + persist-credentials: false + + - name: Validate bounded repair ancestry and scope + env: + RED_HEAD: 748bc5d5d733ddea93b592bd4091ea5a8005d55c + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + git merge-base --is-ancestor "$RED_HEAD" HEAD + mapfile -t delta < <(git diff --name-only "$RED_HEAD" HEAD) + test "${#delta[@]}" -eq 1 + test "${delta[0]}" = ".github/workflows/repair-pr794-git-isolation.yml" + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.14" + + - name: Install hash-locked verification tooling + run: >- + python -m pip install --disable-pip-version-check --require-hashes + -r requirements-opencode-review-ci-hashes.txt + + - name: Preserve exact RED evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + set +e + red_output="$(python -m pytest -q \ + tests/test_opencode_llvm_coverage_current_main.py::test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration \ + 2>&1)" + red_status=$? + set -e + printf '%s\n' "$red_output" + test "$red_status" -eq 1 + printf '%s\n' "$red_output" | grep -F 'ValueError: substring not found' + + - name: Restore complete Git isolation in all three wrappers + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -I - <<'PY' + from pathlib import Path + + path = Path('.github/workflows/opencode-review-dispatch.yml') + source = path.read_text(encoding='utf-8') + old = ''' UV_NO_BUILD=1 \\ + GIT_CONFIG_COUNT=1 \\ +''' + new = ''' UV_NO_BUILD=1 \\ + GIT_CONFIG_NOSYSTEM=1 \\ + GIT_CONFIG_GLOBAL=/dev/null \\ + GIT_CONFIG_COUNT=1 \\ +''' + if source.count(old) != 3: + raise SystemExit( + f'expected exactly three low-privilege Git isolation anchors, found {source.count(old)}' + ) + path.write_text(source.replace(old, new), encoding='utf-8') + PY + rm .github/workflows/repair-pr794-git-isolation.yml + git diff --check + + - name: Verify GREEN focused contract + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python -m pytest -q tests/test_opencode_llvm_coverage_current_main.py + python -m compileall -q tests/test_opencode_llvm_coverage_current_main.py + git diff --check + + - name: Publish verified repair with workflow-capable credential + env: + EXPECTED_HEAD: ${{ github.sha }} + HEAD_BRANCH: ${{ github.ref_name }} + PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test -n "$PUSH_TOKEN" + test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" + remote_head="$(git ls-remote origin "refs/heads/${HEAD_BRANCH}" | cut -f1)" + test "$remote_head" = "$EXPECTED_HEAD" + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add -A + git diff --cached --check + git commit -m "fix(coverage): restore sandbox Git isolation" + auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" + echo "::add-mask::$auth_header" + git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ + push origin "HEAD:refs/heads/${HEAD_BRANCH}" From c8462fd9f3fad25ea4afa83402c95a8f05d9f6a7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 11:51:33 +0900 Subject: [PATCH 05/29] ci(coverage): trigger PR 794 Git-isolation repair --- .../workflows/repair-pr794-git-isolation.yml | 52 ++++++++++++++----- 1 file changed, 38 insertions(+), 14 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation.yml b/.github/workflows/repair-pr794-git-isolation.yml index 57ed43d99..39c3ae316 100644 --- a/.github/workflows/repair-pr794-git-isolation.yml +++ b/.github/workflows/repair-pr794-git-isolation.yml @@ -1,14 +1,14 @@ name: Repair PR 794 coverage Git isolation on: - push: - branches: - - fix/opencode-llvm-coverage-current-main + pull_request: + branches: [main] + types: [synchronize] paths: - .github/workflows/repair-pr794-git-isolation.yml concurrency: - group: repair-pr794-git-isolation-${{ github.ref }} + group: repair-pr794-git-isolation-${{ github.event.pull_request.number }} cancel-in-progress: false permissions: @@ -22,7 +22,9 @@ jobs: if: >- github.repository == 'ContextualWisdomLab/.github' && github.actor == 'seonghobae' && - github.ref == 'refs/heads/fix/opencode-llvm-coverage-current-main' + github.event.pull_request.number == 794 && + github.event.pull_request.head.repo.full_name == github.repository && + github.head_ref == 'fix/opencode-llvm-coverage-current-main' runs-on: ubuntu-24.04 timeout-minutes: 20 steps: @@ -34,7 +36,7 @@ jobs: - name: Check out exact contributor head uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ github.sha }} + ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 20 persist-credentials: false @@ -71,14 +73,14 @@ jobs: test "$red_status" -eq 1 printf '%s\n' "$red_output" | grep -F 'ValueError: substring not found' - - name: Restore complete Git isolation in all three wrappers + - name: Restore complete Git isolation and permanent evidence shell: bash --noprofile --norc -e -o pipefail {0} run: | python3 -I - <<'PY' from pathlib import Path - path = Path('.github/workflows/opencode-review-dispatch.yml') - source = path.read_text(encoding='utf-8') + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + workflow = workflow_path.read_text(encoding='utf-8') old = ''' UV_NO_BUILD=1 \\ GIT_CONFIG_COUNT=1 \\ ''' @@ -87,11 +89,33 @@ jobs: GIT_CONFIG_GLOBAL=/dev/null \\ GIT_CONFIG_COUNT=1 \\ ''' - if source.count(old) != 3: + if workflow.count(old) != 3: raise SystemExit( - f'expected exactly three low-privilege Git isolation anchors, found {source.count(old)}' + f'expected exactly three low-privilege Git isolation anchors, found {workflow.count(old)}' ) - path.write_text(source.replace(old, new), encoding='utf-8') + workflow_path.write_text(workflow.replace(old, new), encoding='utf-8') + + doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') + doctoring = doctoring_path.read_text(encoding='utf-8') + sentence = ( + '- Every low-privilege test wrapper sets `GIT_CONFIG_NOSYSTEM=1` and ' + '`GIT_CONFIG_GLOBAL=/dev/null` before applying only the validated ' + '`/work` safe-directory overlay.\n' + ) + anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' + if sentence not in doctoring: + if doctoring.count(anchor) != 1: + raise SystemExit('doctoring security anchor drifted') + doctoring_path.write_text(doctoring.replace(anchor, anchor + sentence, 1), encoding='utf-8') + + changelog_path = Path('CHANGELOG.md') + changelog = changelog_path.read_text(encoding='utf-8') + old_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + new_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, preserved system/global Git isolation in every low-privilege coverage wrapper, and permanent ordering/isolation regression contracts after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + if new_bullet not in changelog: + if changelog.count(old_bullet) != 1: + raise SystemExit('changelog LLVM bullet drifted') + changelog_path.write_text(changelog.replace(old_bullet, new_bullet, 1), encoding='utf-8') PY rm .github/workflows/repair-pr794-git-isolation.yml git diff --check @@ -105,8 +129,8 @@ jobs: - name: Publish verified repair with workflow-capable credential env: - EXPECTED_HEAD: ${{ github.sha }} - HEAD_BRANCH: ${{ github.ref_name }} + EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} + HEAD_BRANCH: ${{ github.head_ref }} PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} shell: bash --noprofile --norc -e -o pipefail {0} run: | From 8c6e1c331a28ec3fc5b4d4db8e4f070f22a09e66 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 11:59:14 +0900 Subject: [PATCH 06/29] chore(ci): remove inactive PR 794 repair workflow --- .../workflows/repair-pr794-git-isolation.yml | 149 ------------------ 1 file changed, 149 deletions(-) delete mode 100644 .github/workflows/repair-pr794-git-isolation.yml diff --git a/.github/workflows/repair-pr794-git-isolation.yml b/.github/workflows/repair-pr794-git-isolation.yml deleted file mode 100644 index 39c3ae316..000000000 --- a/.github/workflows/repair-pr794-git-isolation.yml +++ /dev/null @@ -1,149 +0,0 @@ -name: Repair PR 794 coverage Git isolation - -on: - pull_request: - branches: [main] - types: [synchronize] - paths: - - .github/workflows/repair-pr794-git-isolation.yml - -concurrency: - group: repair-pr794-git-isolation-${{ github.event.pull_request.number }} - cancel-in-progress: false - -permissions: - contents: read - -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - -jobs: - repair: - if: >- - github.repository == 'ContextualWisdomLab/.github' && - github.actor == 'seonghobae' && - github.event.pull_request.number == 794 && - github.event.pull_request.head.repo.full_name == github.repository && - github.head_ref == 'fix/opencode-llvm-coverage-current-main' - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - - name: Check out exact contributor head - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: ${{ github.event.pull_request.head.sha }} - fetch-depth: 20 - persist-credentials: false - - - name: Validate bounded repair ancestry and scope - env: - RED_HEAD: 748bc5d5d733ddea93b592bd4091ea5a8005d55c - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - git merge-base --is-ancestor "$RED_HEAD" HEAD - mapfile -t delta < <(git diff --name-only "$RED_HEAD" HEAD) - test "${#delta[@]}" -eq 1 - test "${delta[0]}" = ".github/workflows/repair-pr794-git-isolation.yml" - - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.14" - - - name: Install hash-locked verification tooling - run: >- - python -m pip install --disable-pip-version-check --require-hashes - -r requirements-opencode-review-ci-hashes.txt - - - name: Preserve exact RED evidence - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - set +e - red_output="$(python -m pytest -q \ - tests/test_opencode_llvm_coverage_current_main.py::test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration \ - 2>&1)" - red_status=$? - set -e - printf '%s\n' "$red_output" - test "$red_status" -eq 1 - printf '%s\n' "$red_output" | grep -F 'ValueError: substring not found' - - - name: Restore complete Git isolation and permanent evidence - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python3 -I - <<'PY' - from pathlib import Path - - workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') - workflow = workflow_path.read_text(encoding='utf-8') - old = ''' UV_NO_BUILD=1 \\ - GIT_CONFIG_COUNT=1 \\ -''' - new = ''' UV_NO_BUILD=1 \\ - GIT_CONFIG_NOSYSTEM=1 \\ - GIT_CONFIG_GLOBAL=/dev/null \\ - GIT_CONFIG_COUNT=1 \\ -''' - if workflow.count(old) != 3: - raise SystemExit( - f'expected exactly three low-privilege Git isolation anchors, found {workflow.count(old)}' - ) - workflow_path.write_text(workflow.replace(old, new), encoding='utf-8') - - doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') - doctoring = doctoring_path.read_text(encoding='utf-8') - sentence = ( - '- Every low-privilege test wrapper sets `GIT_CONFIG_NOSYSTEM=1` and ' - '`GIT_CONFIG_GLOBAL=/dev/null` before applying only the validated ' - '`/work` safe-directory overlay.\n' - ) - anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' - if sentence not in doctoring: - if doctoring.count(anchor) != 1: - raise SystemExit('doctoring security anchor drifted') - doctoring_path.write_text(doctoring.replace(anchor, anchor + sentence, 1), encoding='utf-8') - - changelog_path = Path('CHANGELOG.md') - changelog = changelog_path.read_text(encoding='utf-8') - old_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - new_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, preserved system/global Git isolation in every low-privilege coverage wrapper, and permanent ordering/isolation regression contracts after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - if new_bullet not in changelog: - if changelog.count(old_bullet) != 1: - raise SystemExit('changelog LLVM bullet drifted') - changelog_path.write_text(changelog.replace(old_bullet, new_bullet, 1), encoding='utf-8') - PY - rm .github/workflows/repair-pr794-git-isolation.yml - git diff --check - - - name: Verify GREEN focused contract - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python -m pytest -q tests/test_opencode_llvm_coverage_current_main.py - python -m compileall -q tests/test_opencode_llvm_coverage_current_main.py - git diff --check - - - name: Publish verified repair with workflow-capable credential - env: - EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} - HEAD_BRANCH: ${{ github.head_ref }} - PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - test -n "$PUSH_TOKEN" - test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" - remote_head="$(git ls-remote origin "refs/heads/${HEAD_BRANCH}" | cut -f1)" - test "$remote_head" = "$EXPECTED_HEAD" - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add -A - git diff --cached --check - git commit -m "fix(coverage): restore sandbox Git isolation" - auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" - echo "::add-mask::$auth_header" - git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ - push origin "HEAD:refs/heads/${HEAD_BRANCH}" From 84a2d94fc48f2c105a68b663fd5b7cc422ae6b11 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:04:48 +0900 Subject: [PATCH 07/29] ci: stage exact-head PR 794 Git isolation repair --- .../repair-pr794-git-isolation-v2.yml | 143 ++++++++++++++++++ 1 file changed, 143 insertions(+) create mode 100644 .github/workflows/repair-pr794-git-isolation-v2.yml diff --git a/.github/workflows/repair-pr794-git-isolation-v2.yml b/.github/workflows/repair-pr794-git-isolation-v2.yml new file mode 100644 index 000000000..f0b012a6f --- /dev/null +++ b/.github/workflows/repair-pr794-git-isolation-v2.yml @@ -0,0 +1,143 @@ +name: Repair PR 794 Git isolation v2 + +on: + push: + branches: [fix/opencode-llvm-coverage-current-main] + paths: + - .github/workflows/repair-pr794-git-isolation-v2.yml + +permissions: + contents: read + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + +jobs: + repair: + if: github.repository == 'ContextualWisdomLab/.github' + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Check out exact pushed head + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.sha }} + fetch-depth: 20 + persist-credentials: false + + - name: Validate exact repair trigger and scope + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test "$GITHUB_REF_NAME" = "fix/opencode-llvm-coverage-current-main" + test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + mapfile -t delta < <(git diff --name-only HEAD^ HEAD) + test "${#delta[@]}" -eq 1 + test "${delta[0]}" = ".github/workflows/repair-pr794-git-isolation-v2.yml" + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.14" + + - name: Install hash-locked verification tooling + run: >- + python -m pip install --disable-pip-version-check --require-hashes + -r requirements-opencode-review-ci-hashes.txt + + - name: Preserve RED contract evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + set +e + red_output="$(python -m pytest -q \ + tests/test_opencode_llvm_coverage_current_main.py::test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration \ + 2>&1)" + red_status=$? + set -e + printf '%s\n' "$red_output" + test "$red_status" -ne 0 + printf '%s\n' "$red_output" | grep -F "GIT_CONFIG_NOSYSTEM=1" + + - name: Restore Git isolation and authoritative evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -I - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + workflow = workflow_path.read_text(encoding='utf-8') + old = """ UV_NO_BUILD=1 \\ + GIT_CONFIG_COUNT=1 \\ +""" + new = """ UV_NO_BUILD=1 \\ + GIT_CONFIG_NOSYSTEM=1 \\ + GIT_CONFIG_GLOBAL=/dev/null \\ + GIT_CONFIG_COUNT=1 \\ +""" + count = workflow.count(old) + if count != 3: + raise SystemExit(f'expected three missing Git-isolation anchors, found {count}') + workflow_path.write_text(workflow.replace(old, new), encoding='utf-8') + + doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') + doctoring = doctoring_path.read_text(encoding='utf-8') + anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' + sentence = ( + '- Every low-privilege coverage wrapper disables system and global Git configuration ' + 'with `GIT_CONFIG_NOSYSTEM=1` and `GIT_CONFIG_GLOBAL=/dev/null` before applying only ' + 'the validated `/work` safe-directory overlay.\n' + ) + if sentence not in doctoring: + if doctoring.count(anchor) != 1: + raise SystemExit('doctoring security anchor drifted') + doctoring = doctoring.replace(anchor, anchor + sentence, 1) + doctoring_path.write_text(doctoring, encoding='utf-8') + + changelog_path = Path('CHANGELOG.md') + changelog = changelog_path.read_text(encoding='utf-8') + old_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + new_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, preserved system/global Git isolation in every low-privilege coverage wrapper, and permanent ordering/isolation regression contracts after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + if new_bullet not in changelog: + if changelog.count(old_bullet) != 1: + raise SystemExit('changelog LLVM bullet drifted') + changelog_path.write_text(changelog.replace(old_bullet, new_bullet, 1), encoding='utf-8') + PY + rm .github/workflows/repair-pr794-git-isolation-v2.yml + git diff --check + + - name: Verify GREEN focused contract + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python -m pytest -q tests/test_opencode_llvm_coverage_current_main.py + python -m compileall -q tests/test_opencode_llvm_coverage_current_main.py + git diff --check + + - name: Publish exact-head repair and self-delete + env: + PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test -n "$PUSH_TOKEN" + test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + remote_head="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" + test "$remote_head" = "$GITHUB_SHA" + mapfile -t changed < <(git diff --name-only) + printf '%s\n' "${changed[@]}" + test "${#changed[@]}" -eq 4 + printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/opencode-review-dispatch.yml' + printf '%s\n' "${changed[@]}" | grep -Fx 'CHANGELOG.md' + printf '%s\n' "${changed[@]}" | grep -Fx 'docs/doctoring/opencode-llvm-coverage-toolchain.md' + printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/repair-pr794-git-isolation-v2.yml' + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add -A + git diff --cached --check + git commit -m "fix(coverage): restore sandbox Git isolation" + auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" + echo "::add-mask::$auth_header" + git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ + push origin "HEAD:refs/heads/${GITHUB_REF_NAME}" From 214319c446184948ee0285ece0f6cdad96dcda1c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:07:30 +0900 Subject: [PATCH 08/29] ci: trigger exact-head PR 794 Git isolation repair --- .github/workflows/repair-pr794-git-isolation-v2.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/repair-pr794-git-isolation-v2.yml b/.github/workflows/repair-pr794-git-isolation-v2.yml index f0b012a6f..e269499ac 100644 --- a/.github/workflows/repair-pr794-git-isolation-v2.yml +++ b/.github/workflows/repair-pr794-git-isolation-v2.yml @@ -141,3 +141,5 @@ jobs: echo "::add-mask::$auth_header" git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ push origin "HEAD:refs/heads/${GITHUB_REF_NAME}" + +# The second push activates this workflow after it exists on the branch. From 8323b7855dae96c8613f4f192b907f5c05bf6553 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:16:02 +0900 Subject: [PATCH 09/29] chore(ci): remove inactive PR 794 repair workflow --- .../repair-pr794-git-isolation-v2.yml | 145 ------------------ 1 file changed, 145 deletions(-) delete mode 100644 .github/workflows/repair-pr794-git-isolation-v2.yml diff --git a/.github/workflows/repair-pr794-git-isolation-v2.yml b/.github/workflows/repair-pr794-git-isolation-v2.yml deleted file mode 100644 index e269499ac..000000000 --- a/.github/workflows/repair-pr794-git-isolation-v2.yml +++ /dev/null @@ -1,145 +0,0 @@ -name: Repair PR 794 Git isolation v2 - -on: - push: - branches: [fix/opencode-llvm-coverage-current-main] - paths: - - .github/workflows/repair-pr794-git-isolation-v2.yml - -permissions: - contents: read - -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - -jobs: - repair: - if: github.repository == 'ContextualWisdomLab/.github' - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - - name: Check out exact pushed head - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: ${{ github.sha }} - fetch-depth: 20 - persist-credentials: false - - - name: Validate exact repair trigger and scope - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - test "$GITHUB_REF_NAME" = "fix/opencode-llvm-coverage-current-main" - test "$(git rev-parse HEAD)" = "$GITHUB_SHA" - mapfile -t delta < <(git diff --name-only HEAD^ HEAD) - test "${#delta[@]}" -eq 1 - test "${delta[0]}" = ".github/workflows/repair-pr794-git-isolation-v2.yml" - - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.14" - - - name: Install hash-locked verification tooling - run: >- - python -m pip install --disable-pip-version-check --require-hashes - -r requirements-opencode-review-ci-hashes.txt - - - name: Preserve RED contract evidence - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - set +e - red_output="$(python -m pytest -q \ - tests/test_opencode_llvm_coverage_current_main.py::test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration \ - 2>&1)" - red_status=$? - set -e - printf '%s\n' "$red_output" - test "$red_status" -ne 0 - printf '%s\n' "$red_output" | grep -F "GIT_CONFIG_NOSYSTEM=1" - - - name: Restore Git isolation and authoritative evidence - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python3 -I - <<'PY' - from pathlib import Path - - workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') - workflow = workflow_path.read_text(encoding='utf-8') - old = """ UV_NO_BUILD=1 \\ - GIT_CONFIG_COUNT=1 \\ -""" - new = """ UV_NO_BUILD=1 \\ - GIT_CONFIG_NOSYSTEM=1 \\ - GIT_CONFIG_GLOBAL=/dev/null \\ - GIT_CONFIG_COUNT=1 \\ -""" - count = workflow.count(old) - if count != 3: - raise SystemExit(f'expected three missing Git-isolation anchors, found {count}') - workflow_path.write_text(workflow.replace(old, new), encoding='utf-8') - - doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') - doctoring = doctoring_path.read_text(encoding='utf-8') - anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' - sentence = ( - '- Every low-privilege coverage wrapper disables system and global Git configuration ' - 'with `GIT_CONFIG_NOSYSTEM=1` and `GIT_CONFIG_GLOBAL=/dev/null` before applying only ' - 'the validated `/work` safe-directory overlay.\n' - ) - if sentence not in doctoring: - if doctoring.count(anchor) != 1: - raise SystemExit('doctoring security anchor drifted') - doctoring = doctoring.replace(anchor, anchor + sentence, 1) - doctoring_path.write_text(doctoring, encoding='utf-8') - - changelog_path = Path('CHANGELOG.md') - changelog = changelog_path.read_text(encoding='utf-8') - old_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - new_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, preserved system/global Git isolation in every low-privilege coverage wrapper, and permanent ordering/isolation regression contracts after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - if new_bullet not in changelog: - if changelog.count(old_bullet) != 1: - raise SystemExit('changelog LLVM bullet drifted') - changelog_path.write_text(changelog.replace(old_bullet, new_bullet, 1), encoding='utf-8') - PY - rm .github/workflows/repair-pr794-git-isolation-v2.yml - git diff --check - - - name: Verify GREEN focused contract - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python -m pytest -q tests/test_opencode_llvm_coverage_current_main.py - python -m compileall -q tests/test_opencode_llvm_coverage_current_main.py - git diff --check - - - name: Publish exact-head repair and self-delete - env: - PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - test -n "$PUSH_TOKEN" - test "$(git rev-parse HEAD)" = "$GITHUB_SHA" - remote_head="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - mapfile -t changed < <(git diff --name-only) - printf '%s\n' "${changed[@]}" - test "${#changed[@]}" -eq 4 - printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/opencode-review-dispatch.yml' - printf '%s\n' "${changed[@]}" | grep -Fx 'CHANGELOG.md' - printf '%s\n' "${changed[@]}" | grep -Fx 'docs/doctoring/opencode-llvm-coverage-toolchain.md' - printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/repair-pr794-git-isolation-v2.yml' - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add -A - git diff --cached --check - git commit -m "fix(coverage): restore sandbox Git isolation" - auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" - echo "::add-mask::$auth_header" - git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ - push origin "HEAD:refs/heads/${GITHUB_REF_NAME}" - -# The second push activates this workflow after it exists on the branch. From 79e372e689663f80f5107ba38a098207b4157bc1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:41:43 +0900 Subject: [PATCH 10/29] ci: activate bounded PR 794 Git isolation repair --- .../repair-pr794-git-isolation-v2.yml | 145 ++++++++++++++++++ 1 file changed, 145 insertions(+) create mode 100644 .github/workflows/repair-pr794-git-isolation-v2.yml diff --git a/.github/workflows/repair-pr794-git-isolation-v2.yml b/.github/workflows/repair-pr794-git-isolation-v2.yml new file mode 100644 index 000000000..e269499ac --- /dev/null +++ b/.github/workflows/repair-pr794-git-isolation-v2.yml @@ -0,0 +1,145 @@ +name: Repair PR 794 Git isolation v2 + +on: + push: + branches: [fix/opencode-llvm-coverage-current-main] + paths: + - .github/workflows/repair-pr794-git-isolation-v2.yml + +permissions: + contents: read + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + +jobs: + repair: + if: github.repository == 'ContextualWisdomLab/.github' + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Check out exact pushed head + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.sha }} + fetch-depth: 20 + persist-credentials: false + + - name: Validate exact repair trigger and scope + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test "$GITHUB_REF_NAME" = "fix/opencode-llvm-coverage-current-main" + test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + mapfile -t delta < <(git diff --name-only HEAD^ HEAD) + test "${#delta[@]}" -eq 1 + test "${delta[0]}" = ".github/workflows/repair-pr794-git-isolation-v2.yml" + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.14" + + - name: Install hash-locked verification tooling + run: >- + python -m pip install --disable-pip-version-check --require-hashes + -r requirements-opencode-review-ci-hashes.txt + + - name: Preserve RED contract evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + set +e + red_output="$(python -m pytest -q \ + tests/test_opencode_llvm_coverage_current_main.py::test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration \ + 2>&1)" + red_status=$? + set -e + printf '%s\n' "$red_output" + test "$red_status" -ne 0 + printf '%s\n' "$red_output" | grep -F "GIT_CONFIG_NOSYSTEM=1" + + - name: Restore Git isolation and authoritative evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 -I - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + workflow = workflow_path.read_text(encoding='utf-8') + old = """ UV_NO_BUILD=1 \\ + GIT_CONFIG_COUNT=1 \\ +""" + new = """ UV_NO_BUILD=1 \\ + GIT_CONFIG_NOSYSTEM=1 \\ + GIT_CONFIG_GLOBAL=/dev/null \\ + GIT_CONFIG_COUNT=1 \\ +""" + count = workflow.count(old) + if count != 3: + raise SystemExit(f'expected three missing Git-isolation anchors, found {count}') + workflow_path.write_text(workflow.replace(old, new), encoding='utf-8') + + doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') + doctoring = doctoring_path.read_text(encoding='utf-8') + anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' + sentence = ( + '- Every low-privilege coverage wrapper disables system and global Git configuration ' + 'with `GIT_CONFIG_NOSYSTEM=1` and `GIT_CONFIG_GLOBAL=/dev/null` before applying only ' + 'the validated `/work` safe-directory overlay.\n' + ) + if sentence not in doctoring: + if doctoring.count(anchor) != 1: + raise SystemExit('doctoring security anchor drifted') + doctoring = doctoring.replace(anchor, anchor + sentence, 1) + doctoring_path.write_text(doctoring, encoding='utf-8') + + changelog_path = Path('CHANGELOG.md') + changelog = changelog_path.read_text(encoding='utf-8') + old_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + new_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, preserved system/global Git isolation in every low-privilege coverage wrapper, and permanent ordering/isolation regression contracts after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + if new_bullet not in changelog: + if changelog.count(old_bullet) != 1: + raise SystemExit('changelog LLVM bullet drifted') + changelog_path.write_text(changelog.replace(old_bullet, new_bullet, 1), encoding='utf-8') + PY + rm .github/workflows/repair-pr794-git-isolation-v2.yml + git diff --check + + - name: Verify GREEN focused contract + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python -m pytest -q tests/test_opencode_llvm_coverage_current_main.py + python -m compileall -q tests/test_opencode_llvm_coverage_current_main.py + git diff --check + + - name: Publish exact-head repair and self-delete + env: + PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test -n "$PUSH_TOKEN" + test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + remote_head="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" + test "$remote_head" = "$GITHUB_SHA" + mapfile -t changed < <(git diff --name-only) + printf '%s\n' "${changed[@]}" + test "${#changed[@]}" -eq 4 + printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/opencode-review-dispatch.yml' + printf '%s\n' "${changed[@]}" | grep -Fx 'CHANGELOG.md' + printf '%s\n' "${changed[@]}" | grep -Fx 'docs/doctoring/opencode-llvm-coverage-toolchain.md' + printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/repair-pr794-git-isolation-v2.yml' + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add -A + git diff --cached --check + git commit -m "fix(coverage): restore sandbox Git isolation" + auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" + echo "::add-mask::$auth_header" + git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ + push origin "HEAD:refs/heads/${GITHUB_REF_NAME}" + +# The second push activates this workflow after it exists on the branch. From 64941361756a88b280b5f384a7fac841526818bc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:42:36 +0900 Subject: [PATCH 11/29] ci: trigger bounded PR 794 Git isolation repair --- .github/workflows/repair-pr794-git-isolation-v2.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v2.yml b/.github/workflows/repair-pr794-git-isolation-v2.yml index e269499ac..68ffccb55 100644 --- a/.github/workflows/repair-pr794-git-isolation-v2.yml +++ b/.github/workflows/repair-pr794-git-isolation-v2.yml @@ -142,4 +142,4 @@ jobs: git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ push origin "HEAD:refs/heads/${GITHUB_REF_NAME}" -# The second push activates this workflow after it exists on the branch. +# Activation push for the bounded self-deleting repair. From 278b10d2ecf92b473fe3d311385a6775cc4d121d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:49:28 +0900 Subject: [PATCH 12/29] ci: remove inactive PR 794 repair trigger --- .../repair-pr794-git-isolation-v2.yml | 145 ------------------ 1 file changed, 145 deletions(-) delete mode 100644 .github/workflows/repair-pr794-git-isolation-v2.yml diff --git a/.github/workflows/repair-pr794-git-isolation-v2.yml b/.github/workflows/repair-pr794-git-isolation-v2.yml deleted file mode 100644 index 68ffccb55..000000000 --- a/.github/workflows/repair-pr794-git-isolation-v2.yml +++ /dev/null @@ -1,145 +0,0 @@ -name: Repair PR 794 Git isolation v2 - -on: - push: - branches: [fix/opencode-llvm-coverage-current-main] - paths: - - .github/workflows/repair-pr794-git-isolation-v2.yml - -permissions: - contents: read - -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - -jobs: - repair: - if: github.repository == 'ContextualWisdomLab/.github' - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - - name: Check out exact pushed head - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: ${{ github.sha }} - fetch-depth: 20 - persist-credentials: false - - - name: Validate exact repair trigger and scope - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - test "$GITHUB_REF_NAME" = "fix/opencode-llvm-coverage-current-main" - test "$(git rev-parse HEAD)" = "$GITHUB_SHA" - mapfile -t delta < <(git diff --name-only HEAD^ HEAD) - test "${#delta[@]}" -eq 1 - test "${delta[0]}" = ".github/workflows/repair-pr794-git-isolation-v2.yml" - - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.14" - - - name: Install hash-locked verification tooling - run: >- - python -m pip install --disable-pip-version-check --require-hashes - -r requirements-opencode-review-ci-hashes.txt - - - name: Preserve RED contract evidence - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - set +e - red_output="$(python -m pytest -q \ - tests/test_opencode_llvm_coverage_current_main.py::test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration \ - 2>&1)" - red_status=$? - set -e - printf '%s\n' "$red_output" - test "$red_status" -ne 0 - printf '%s\n' "$red_output" | grep -F "GIT_CONFIG_NOSYSTEM=1" - - - name: Restore Git isolation and authoritative evidence - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python3 -I - <<'PY' - from pathlib import Path - - workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') - workflow = workflow_path.read_text(encoding='utf-8') - old = """ UV_NO_BUILD=1 \\ - GIT_CONFIG_COUNT=1 \\ -""" - new = """ UV_NO_BUILD=1 \\ - GIT_CONFIG_NOSYSTEM=1 \\ - GIT_CONFIG_GLOBAL=/dev/null \\ - GIT_CONFIG_COUNT=1 \\ -""" - count = workflow.count(old) - if count != 3: - raise SystemExit(f'expected three missing Git-isolation anchors, found {count}') - workflow_path.write_text(workflow.replace(old, new), encoding='utf-8') - - doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') - doctoring = doctoring_path.read_text(encoding='utf-8') - anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' - sentence = ( - '- Every low-privilege coverage wrapper disables system and global Git configuration ' - 'with `GIT_CONFIG_NOSYSTEM=1` and `GIT_CONFIG_GLOBAL=/dev/null` before applying only ' - 'the validated `/work` safe-directory overlay.\n' - ) - if sentence not in doctoring: - if doctoring.count(anchor) != 1: - raise SystemExit('doctoring security anchor drifted') - doctoring = doctoring.replace(anchor, anchor + sentence, 1) - doctoring_path.write_text(doctoring, encoding='utf-8') - - changelog_path = Path('CHANGELOG.md') - changelog = changelog_path.read_text(encoding='utf-8') - old_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - new_bullet = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, preserved system/global Git isolation in every low-privilege coverage wrapper, and permanent ordering/isolation regression contracts after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - if new_bullet not in changelog: - if changelog.count(old_bullet) != 1: - raise SystemExit('changelog LLVM bullet drifted') - changelog_path.write_text(changelog.replace(old_bullet, new_bullet, 1), encoding='utf-8') - PY - rm .github/workflows/repair-pr794-git-isolation-v2.yml - git diff --check - - - name: Verify GREEN focused contract - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python -m pytest -q tests/test_opencode_llvm_coverage_current_main.py - python -m compileall -q tests/test_opencode_llvm_coverage_current_main.py - git diff --check - - - name: Publish exact-head repair and self-delete - env: - PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - test -n "$PUSH_TOKEN" - test "$(git rev-parse HEAD)" = "$GITHUB_SHA" - remote_head="$(git ls-remote origin "refs/heads/${GITHUB_REF_NAME}" | cut -f1)" - test "$remote_head" = "$GITHUB_SHA" - mapfile -t changed < <(git diff --name-only) - printf '%s\n' "${changed[@]}" - test "${#changed[@]}" -eq 4 - printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/opencode-review-dispatch.yml' - printf '%s\n' "${changed[@]}" | grep -Fx 'CHANGELOG.md' - printf '%s\n' "${changed[@]}" | grep -Fx 'docs/doctoring/opencode-llvm-coverage-toolchain.md' - printf '%s\n' "${changed[@]}" | grep -Fx '.github/workflows/repair-pr794-git-isolation-v2.yml' - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add -A - git diff --cached --check - git commit -m "fix(coverage): restore sandbox Git isolation" - auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" - echo "::add-mask::$auth_header" - git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ - push origin "HEAD:refs/heads/${GITHUB_REF_NAME}" - -# Activation push for the bounded self-deleting repair. From bce00fb0c0840b3bc937d8a95c38d3251bd00a86 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 12:55:48 +0900 Subject: [PATCH 13/29] ci: repair OpenCode wrapper Git isolation --- .../repair-pr794-git-isolation-v3.yml | 163 ++++++++++++++++++ 1 file changed, 163 insertions(+) create mode 100644 .github/workflows/repair-pr794-git-isolation-v3.yml diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml new file mode 100644 index 000000000..f2215aa3d --- /dev/null +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -0,0 +1,163 @@ +name: Repair PR 794 Git isolation v3 + +on: + push: + branches: + - fix/opencode-llvm-coverage-current-main + paths: + - .github/workflows/repair-pr794-git-isolation-v3.yml + +permissions: + contents: read + +concurrency: + group: repair-pr794-git-isolation-v3 + cancel-in-progress: false + +jobs: + repair: + if: >- + github.repository == 'ContextualWisdomLab/.github' && + github.actor == 'seonghobae' && + github.ref == 'refs/heads/fix/opencode-llvm-coverage-current-main' + permissions: + contents: write + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Checkout exact trigger without persisted credentials + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + fetch-depth: 1 + persist-credentials: false + + - name: Restore all three low-privilege Git isolation boundaries + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + workflow = workflow_path.read_text(encoding='utf-8') + vulnerable = ( + ' UV_NO_BUILD=1 \\\n' + ' GIT_CONFIG_COUNT=1 \\\n' + ) + hardened = ( + ' UV_NO_BUILD=1 \\\n' + ' GIT_CONFIG_NOSYSTEM=1 \\\n' + ' GIT_CONFIG_GLOBAL=/dev/null \\\n' + ' GIT_CONFIG_COUNT=1 \\\n' + ) + if workflow.count(vulnerable) != 3: + raise SystemExit( + f'expected exactly three vulnerable wrapper anchors, found {workflow.count(vulnerable)}' + ) + if workflow.count(hardened) != 0: + raise SystemExit('unexpected pre-existing hardened wrapper anchor') + workflow = workflow.replace(vulnerable, hardened) + if workflow.count(hardened) != 3: + raise SystemExit('failed to harden every low-privilege wrapper') + workflow_path.write_text(workflow, encoding='utf-8') + + doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') + doctoring = doctoring_path.read_text(encoding='utf-8') + security_anchor = ( + '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' + ) + security_addition = ( + security_anchor + + '- Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay.\n' + ) + if doctoring.count(security_anchor) != 1: + raise SystemExit('doctoring security anchor is not unique') + doctoring = doctoring.replace(security_anchor, security_addition, 1) + regression_anchor = ( + '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run.\n' + ) + regression_addition = ( + '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; and\n' + '6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay.\n' + ) + if doctoring.count(regression_anchor) != 1: + raise SystemExit('doctoring regression anchor is not unique') + doctoring = doctoring.replace(regression_anchor, regression_addition, 1) + doctoring_path.write_text(doctoring, encoding='utf-8') + + changelog_path = Path('CHANGELOG.md') + changelog = changelog_path.read_text(encoding='utf-8') + changelog_anchor = ( + '- Restored the default-branch OpenCode Rust coverage image\'s Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n' + ) + changelog_replacement = ( + '- Restored the default-branch OpenCode Rust coverage image\'s Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and permanent ordering and low-privilege Git-configuration-isolation regressions after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n' + ) + if changelog.count(changelog_anchor) != 1: + raise SystemExit('changelog anchor is not unique') + changelog = changelog.replace(changelog_anchor, changelog_replacement, 1) + changelog_path.write_text(changelog, encoding='utf-8') + PY + git diff --check + + - name: Execute the exact focused contracts without third-party test tooling + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 - <<'PY' + import importlib.util + from pathlib import Path + + test_path = Path('tests/test_opencode_llvm_coverage_current_main.py') + spec = importlib.util.spec_from_file_location('pr794_contract', test_path) + if spec is None or spec.loader is None: + raise SystemExit('unable to load focused contract module') + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + module.test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_llvm_cov() + module.test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration() + PY + python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py + python3 - <<'PY' + from pathlib import Path + + workflow = Path('.github/workflows/opencode-review-dispatch.yml').read_text(encoding='utf-8') + assert workflow.count('GIT_CONFIG_NOSYSTEM=1') == 4 + assert workflow.count('GIT_CONFIG_GLOBAL=/dev/null') == 4 + assert workflow.count('GIT_CONFIG_COUNT=1') == 3 + assert workflow.count('ENV LLVM_COV=/usr/bin/llvm-cov-19') == 1 + assert workflow.count('ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19') == 1 + PY + git diff --check + + - name: Publish only the verified repair and remove the transient workflow + env: + EXPECTED_HEAD: ${{ github.sha }} + SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main + PUSH_TOKEN: ${{ github.token }} + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" + remote_head="$(git ls-remote origin "refs/heads/${SOURCE_BRANCH}" | cut -f1)" + test "$remote_head" = "$EXPECTED_HEAD" + rm .github/workflows/repair-pr794-git-isolation-v3.yml + git add \ + .github/workflows/opencode-review-dispatch.yml \ + tests/test_opencode_llvm_coverage_current_main.py \ + docs/doctoring/opencode-llvm-coverage-toolchain.md \ + CHANGELOG.md \ + .github/workflows/repair-pr794-git-isolation-v3.yml + git diff --cached --check + git diff --cached --quiet && { echo 'No verified repair generated.' >&2; exit 1; } + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -m "fix(coverage): isolate low-privilege Git configuration" + auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" + echo "::add-mask::$auth_header" + git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ + push --force-with-lease="refs/heads/${SOURCE_BRANCH}:${EXPECTED_HEAD}" \ + origin "HEAD:refs/heads/${SOURCE_BRANCH}" From 5db416ed739779b6e9db6068daaccbaa0bd62579 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:06:09 +0900 Subject: [PATCH 14/29] ci: retrigger bounded PR 794 Git isolation repair --- .github/workflows/repair-pr794-git-isolation-v3.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index f2215aa3d..89e580f4b 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -18,7 +18,6 @@ jobs: repair: if: >- github.repository == 'ContextualWisdomLab/.github' && - github.actor == 'seonghobae' && github.ref == 'refs/heads/fix/opencode-llvm-coverage-current-main' permissions: contents: write From 86685e3ac7a2f937e9cf3c352502904853a9f998 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:08:45 +0900 Subject: [PATCH 15/29] chore(ci): trigger verified PR 794 repair --- .../repair-pr794-git-isolation-v3.yml | 78 +++++++------------ 1 file changed, 28 insertions(+), 50 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index 89e580f4b..e67410959 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -24,11 +24,6 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - name: Checkout exact trigger without persisted credentials uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -36,7 +31,7 @@ jobs: fetch-depth: 1 persist-credentials: false - - name: Restore all three low-privilege Git isolation boundaries + - name: Restore and verify the low-privilege Git isolation boundary shell: bash --noprofile --norc -e -o pipefail {0} run: | python3 - <<'PY' @@ -54,12 +49,9 @@ jobs: ' GIT_CONFIG_GLOBAL=/dev/null \\\n' ' GIT_CONFIG_COUNT=1 \\\n' ) - if workflow.count(vulnerable) != 3: - raise SystemExit( - f'expected exactly three vulnerable wrapper anchors, found {workflow.count(vulnerable)}' - ) - if workflow.count(hardened) != 0: - raise SystemExit('unexpected pre-existing hardened wrapper anchor') + count = workflow.count(vulnerable) + if count != 3: + raise SystemExit(f'expected three vulnerable wrapper anchors, found {count}') workflow = workflow.replace(vulnerable, hardened) if workflow.count(hardened) != 3: raise SystemExit('failed to harden every low-privilege wrapper') @@ -67,46 +59,35 @@ jobs: doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') doctoring = doctoring_path.read_text(encoding='utf-8') - security_anchor = ( - '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' - ) - security_addition = ( - security_anchor - + '- Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay.\n' - ) - if doctoring.count(security_anchor) != 1: - raise SystemExit('doctoring security anchor is not unique') - doctoring = doctoring.replace(security_anchor, security_addition, 1) - regression_anchor = ( - '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run.\n' - ) - regression_addition = ( - '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; and\n' - '6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay.\n' - ) - if doctoring.count(regression_anchor) != 1: - raise SystemExit('doctoring regression anchor is not unique') - doctoring = doctoring.replace(regression_anchor, regression_addition, 1) + boundary = '- Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay.\n' + if boundary not in doctoring: + anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' + if doctoring.count(anchor) != 1: + raise SystemExit('doctoring security anchor is not unique') + doctoring = doctoring.replace(anchor, anchor + boundary, 1) + regression = '6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay.\n' + if regression not in doctoring: + anchor = '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run.\n' + if doctoring.count(anchor) != 1: + raise SystemExit('doctoring regression anchor is not unique') + doctoring = doctoring.replace( + anchor, + '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; and\n' + regression, + 1, + ) doctoring_path.write_text(doctoring, encoding='utf-8') changelog_path = Path('CHANGELOG.md') changelog = changelog_path.read_text(encoding='utf-8') - changelog_anchor = ( - '- Restored the default-branch OpenCode Rust coverage image\'s Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n' - ) - changelog_replacement = ( - '- Restored the default-branch OpenCode Rust coverage image\'s Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and permanent ordering and low-privilege Git-configuration-isolation regressions after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n' - ) - if changelog.count(changelog_anchor) != 1: - raise SystemExit('changelog anchor is not unique') - changelog = changelog.replace(changelog_anchor, changelog_replacement, 1) + old = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + new = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and permanent ordering and low-privilege Git-configuration-isolation regressions after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" + if new not in changelog: + if changelog.count(old) != 1: + raise SystemExit('changelog anchor is not unique') + changelog = changelog.replace(old, new, 1) changelog_path.write_text(changelog, encoding='utf-8') PY - git diff --check - - name: Execute the exact focused contracts without third-party test tooling - shell: bash --noprofile --norc -e -o pipefail {0} - run: | python3 - <<'PY' import importlib.util from pathlib import Path @@ -119,10 +100,6 @@ jobs: spec.loader.exec_module(module) module.test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_llvm_cov() module.test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration() - PY - python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py - python3 - <<'PY' - from pathlib import Path workflow = Path('.github/workflows/opencode-review-dispatch.yml').read_text(encoding='utf-8') assert workflow.count('GIT_CONFIG_NOSYSTEM=1') == 4 @@ -131,9 +108,10 @@ jobs: assert workflow.count('ENV LLVM_COV=/usr/bin/llvm-cov-19') == 1 assert workflow.count('ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19') == 1 PY + python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py git diff --check - - name: Publish only the verified repair and remove the transient workflow + - name: Publish only the verified repair and remove this transient workflow env: EXPECTED_HEAD: ${{ github.sha }} SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main From aa1bf3c0755d8df9fad29da8483f695e04dfdcf2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:16:32 +0900 Subject: [PATCH 16/29] ci: simplify PR 794 verified repair runner --- .../repair-pr794-git-isolation-v3.yml | 50 +++++++++++-------- 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index e67410959..4980338bb 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -24,6 +24,11 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout exact trigger without persisted credentials uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -31,31 +36,30 @@ jobs: fetch-depth: 1 persist-credentials: false - - name: Restore and verify the low-privilege Git isolation boundary + - name: Restore the three low-privilege Git isolation boundaries shell: bash --noprofile --norc -e -o pipefail {0} run: | python3 - <<'PY' from pathlib import Path - workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') - workflow = workflow_path.read_text(encoding='utf-8') - vulnerable = ( - ' UV_NO_BUILD=1 \\\n' - ' GIT_CONFIG_COUNT=1 \\\n' - ) - hardened = ( - ' UV_NO_BUILD=1 \\\n' - ' GIT_CONFIG_NOSYSTEM=1 \\\n' - ' GIT_CONFIG_GLOBAL=/dev/null \\\n' - ' GIT_CONFIG_COUNT=1 \\\n' - ) - count = workflow.count(vulnerable) - if count != 3: - raise SystemExit(f'expected three vulnerable wrapper anchors, found {count}') - workflow = workflow.replace(vulnerable, hardened) - if workflow.count(hardened) != 3: - raise SystemExit('failed to harden every low-privilege wrapper') - workflow_path.write_text(workflow, encoding='utf-8') + path = Path('.github/workflows/opencode-review-dispatch.yml') + lines = path.read_text(encoding='utf-8').splitlines(keepends=True) + repaired = [] + insertions = 0 + for index, line in enumerate(lines): + repaired.append(line) + if not line.strip().startswith('UV_NO_BUILD=1'): + continue + if index + 1 >= len(lines) or not lines[index + 1].strip().startswith('GIT_CONFIG_COUNT=1'): + continue + indentation = line[: len(line) - len(line.lstrip())] + slash = chr(92) + repaired.append(f'{indentation}GIT_CONFIG_NOSYSTEM=1 {slash}\n') + repaired.append(f'{indentation}GIT_CONFIG_GLOBAL=/dev/null {slash}\n') + insertions += 1 + if insertions != 3: + raise SystemExit(f'expected exactly three repair anchors, found {insertions}') + path.write_text(''.join(repaired), encoding='utf-8') doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') doctoring = doctoring_path.read_text(encoding='utf-8') @@ -87,7 +91,11 @@ jobs: changelog = changelog.replace(old, new, 1) changelog_path.write_text(changelog, encoding='utf-8') PY + git diff --check + - name: Execute focused LLVM and Git-isolation contracts + shell: bash --noprofile --norc -e -o pipefail {0} + run: | python3 - <<'PY' import importlib.util from pathlib import Path @@ -111,7 +119,7 @@ jobs: python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py git diff --check - - name: Publish only the verified repair and remove this transient workflow + - name: Publish only the verified repair and remove this workflow env: EXPECTED_HEAD: ${{ github.sha }} SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main From 30265bbe2485a07196986f7f58abb82c0c40f820 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:18:54 +0900 Subject: [PATCH 17/29] fix(ci): use established workflow-capable repair token --- .github/workflows/repair-pr794-git-isolation-v3.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index 4980338bb..db57696d1 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -123,7 +123,7 @@ jobs: env: EXPECTED_HEAD: ${{ github.sha }} SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main - PUSH_TOKEN: ${{ github.token }} + PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }} shell: bash --noprofile --norc -e -o pipefail {0} run: | test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" From 938846a763942614c01aa0ac2eda23bbcb548ffb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:21:03 +0900 Subject: [PATCH 18/29] chore(ci): run PR 794 repair on synchronization --- .../workflows/repair-pr794-git-isolation-v3.yml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index db57696d1..466d9f1e2 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -1,11 +1,11 @@ name: Repair PR 794 Git isolation v3 on: - push: + pull_request: branches: - - fix/opencode-llvm-coverage-current-main - paths: - - .github/workflows/repair-pr794-git-isolation-v3.yml + - main + types: + - synchronize permissions: contents: read @@ -18,7 +18,8 @@ jobs: repair: if: >- github.repository == 'ContextualWisdomLab/.github' && - github.ref == 'refs/heads/fix/opencode-llvm-coverage-current-main' + github.event.pull_request.number == 794 && + github.event.pull_request.head.ref == 'fix/opencode-llvm-coverage-current-main' permissions: contents: write runs-on: ubuntu-24.04 @@ -29,10 +30,10 @@ jobs: with: egress-policy: audit - - name: Checkout exact trigger without persisted credentials + - name: Checkout exact pull-request head without persisted credentials uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 1 persist-credentials: false @@ -121,7 +122,7 @@ jobs: - name: Publish only the verified repair and remove this workflow env: - EXPECTED_HEAD: ${{ github.sha }} + EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }} shell: bash --noprofile --norc -e -o pipefail {0} From d556f7bafe00510b8f68412b438eda2e7e87ae2a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:25:38 +0900 Subject: [PATCH 19/29] fix(ci): materialize exact-parent repair commit via Git data API --- .../repair-pr794-git-isolation-v3.yml | 77 ++++++++++++++----- 1 file changed, 58 insertions(+), 19 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index 466d9f1e2..67bec6da3 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -120,30 +120,69 @@ jobs: python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py git diff --check - - name: Publish only the verified repair and remove this workflow + - name: Create an exact-parent candidate commit through Git data APIs env: + API_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }} EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main - PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }} shell: bash --noprofile --norc -e -o pipefail {0} run: | test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" remote_head="$(git ls-remote origin "refs/heads/${SOURCE_BRANCH}" | cut -f1)" test "$remote_head" = "$EXPECTED_HEAD" - rm .github/workflows/repair-pr794-git-isolation-v3.yml - git add \ - .github/workflows/opencode-review-dispatch.yml \ - tests/test_opencode_llvm_coverage_current_main.py \ - docs/doctoring/opencode-llvm-coverage-toolchain.md \ - CHANGELOG.md \ - .github/workflows/repair-pr794-git-isolation-v3.yml - git diff --cached --check - git diff --cached --quiet && { echo 'No verified repair generated.' >&2; exit 1; } - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git commit -m "fix(coverage): isolate low-privilege Git configuration" - auth_header="$(printf 'x-access-token:%s' "$PUSH_TOKEN" | base64 | tr -d '\n')" - echo "::add-mask::$auth_header" - git -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \ - push --force-with-lease="refs/heads/${SOURCE_BRANCH}:${EXPECTED_HEAD}" \ - origin "HEAD:refs/heads/${SOURCE_BRANCH}" + python3 - <<'PY' + import base64 + import json + import os + import urllib.request + from pathlib import Path + + repository = 'ContextualWisdomLab/.github' + expected_head = os.environ['EXPECTED_HEAD'] + token = os.environ['API_TOKEN'] + api_root = f'https://api.github.com/repos/{repository}' + + def request(method, endpoint, payload=None): + data = None if payload is None else json.dumps(payload).encode('utf-8') + req = urllib.request.Request( + api_root + endpoint, + data=data, + method=method, + headers={ + 'Accept': 'application/vnd.github+json', + 'Authorization': f'Bearer {token}', + 'X-GitHub-Api-Version': '2022-11-28', + 'User-Agent': 'cwl-pr794-exact-head-repair', + }, + ) + with urllib.request.urlopen(req, timeout=30) as response: + return json.load(response) + + parent = request('GET', f'/git/commits/{expected_head}') + entries = [] + for path in ( + '.github/workflows/opencode-review-dispatch.yml', + 'docs/doctoring/opencode-llvm-coverage-toolchain.md', + 'CHANGELOG.md', + ): + encoded = base64.b64encode(Path(path).read_bytes()).decode('ascii') + blob = request('POST', '/git/blobs', {'content': encoded, 'encoding': 'base64'}) + entries.append({'path': path, 'mode': '100644', 'type': 'blob', 'sha': blob['sha']}) + entries.append({ + 'path': '.github/workflows/repair-pr794-git-isolation-v3.yml', + 'mode': '100644', + 'type': 'blob', + 'sha': None, + }) + tree = request('POST', '/git/trees', { + 'base_tree': parent['tree']['sha'], + 'tree': entries, + }) + commit = request('POST', '/git/commits', { + 'message': 'fix(coverage): isolate low-privilege Git configuration', + 'tree': tree['sha'], + 'parents': [expected_head], + }) + print(f"CANDIDATE_COMMIT_SHA={commit['sha']}") + print(f"CANDIDATE_PARENT_SHA={expected_head}") + PY From e23fcd93a4135ee2bf20005bdb7fbb145efc57a9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:26:49 +0900 Subject: [PATCH 20/29] fix(ci): use scoped job token for Git object creation --- .github/workflows/repair-pr794-git-isolation-v3.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index 67bec6da3..5d6746a9e 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -122,7 +122,7 @@ jobs: - name: Create an exact-parent candidate commit through Git data APIs env: - API_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }} + API_TOKEN: ${{ github.token }} EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main shell: bash --noprofile --norc -e -o pipefail {0} From 752a976027012f5849eb1e88621017e7afd4d0b9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:30:50 +0900 Subject: [PATCH 21/29] fix(automation): complete exact-head one-shot repair --- .../repair-pr794-git-isolation-v3.yml | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index 5d6746a9e..96bc22fda 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -120,7 +120,7 @@ jobs: python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py git diff --check - - name: Create an exact-parent candidate commit through Git data APIs + - name: Commit the exact-parent repair and delete this one-shot workflow env: API_TOKEN: ${{ github.token }} EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} @@ -134,11 +134,13 @@ jobs: import base64 import json import os + import urllib.parse import urllib.request from pathlib import Path repository = 'ContextualWisdomLab/.github' expected_head = os.environ['EXPECTED_HEAD'] + source_branch = os.environ['SOURCE_BRANCH'] token = os.environ['API_TOKEN'] api_root = f'https://api.github.com/repos/{repository}' @@ -183,6 +185,21 @@ jobs: 'tree': tree['sha'], 'parents': [expected_head], }) - print(f"CANDIDATE_COMMIT_SHA={commit['sha']}") - print(f"CANDIDATE_PARENT_SHA={expected_head}") + + encoded_branch = urllib.parse.quote(source_branch, safe='/') + live_ref = request('GET', f'/git/ref/heads/{encoded_branch}') + live_sha = live_ref.get('object', {}).get('sha') + if live_sha != expected_head: + raise SystemExit( + f'stale exact-head repair refused: expected {expected_head}, found {live_sha}' + ) + updated_ref = request( + 'PATCH', + f'/git/refs/heads/{encoded_branch}', + {'sha': commit['sha'], 'force': False}, + ) + if updated_ref.get('object', {}).get('sha') != commit['sha']: + raise SystemExit('branch ref update did not bind to the candidate commit') + print(f"UPDATED_HEAD_SHA={commit['sha']}") + print(f"UPDATED_PARENT_SHA={expected_head}") PY From d0099926d191237551ce9ceea300381cf1921b84 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:32:43 +0900 Subject: [PATCH 22/29] fix(automation): publish exact-head repair artifact --- .../repair-pr794-git-isolation-v3.yml | 102 ++++-------------- 1 file changed, 20 insertions(+), 82 deletions(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index 96bc22fda..fd75e66fb 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -21,7 +21,8 @@ jobs: github.event.pull_request.number == 794 && github.event.pull_request.head.ref == 'fix/opencode-llvm-coverage-current-main' permissions: - contents: write + contents: read + actions: write runs-on: ubuntu-24.04 timeout-minutes: 20 steps: @@ -120,86 +121,23 @@ jobs: python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py git diff --check - - name: Commit the exact-parent repair and delete this one-shot workflow - env: - API_TOKEN: ${{ github.token }} - EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} - SOURCE_BRANCH: fix/opencode-llvm-coverage-current-main + - name: Stage exact-head patched files for trusted commit creation shell: bash --noprofile --norc -e -o pipefail {0} run: | - test "$(git rev-parse HEAD)" = "$EXPECTED_HEAD" - remote_head="$(git ls-remote origin "refs/heads/${SOURCE_BRANCH}" | cut -f1)" - test "$remote_head" = "$EXPECTED_HEAD" - python3 - <<'PY' - import base64 - import json - import os - import urllib.parse - import urllib.request - from pathlib import Path - - repository = 'ContextualWisdomLab/.github' - expected_head = os.environ['EXPECTED_HEAD'] - source_branch = os.environ['SOURCE_BRANCH'] - token = os.environ['API_TOKEN'] - api_root = f'https://api.github.com/repos/{repository}' - - def request(method, endpoint, payload=None): - data = None if payload is None else json.dumps(payload).encode('utf-8') - req = urllib.request.Request( - api_root + endpoint, - data=data, - method=method, - headers={ - 'Accept': 'application/vnd.github+json', - 'Authorization': f'Bearer {token}', - 'X-GitHub-Api-Version': '2022-11-28', - 'User-Agent': 'cwl-pr794-exact-head-repair', - }, - ) - with urllib.request.urlopen(req, timeout=30) as response: - return json.load(response) - - parent = request('GET', f'/git/commits/{expected_head}') - entries = [] - for path in ( - '.github/workflows/opencode-review-dispatch.yml', - 'docs/doctoring/opencode-llvm-coverage-toolchain.md', - 'CHANGELOG.md', - ): - encoded = base64.b64encode(Path(path).read_bytes()).decode('ascii') - blob = request('POST', '/git/blobs', {'content': encoded, 'encoding': 'base64'}) - entries.append({'path': path, 'mode': '100644', 'type': 'blob', 'sha': blob['sha']}) - entries.append({ - 'path': '.github/workflows/repair-pr794-git-isolation-v3.yml', - 'mode': '100644', - 'type': 'blob', - 'sha': None, - }) - tree = request('POST', '/git/trees', { - 'base_tree': parent['tree']['sha'], - 'tree': entries, - }) - commit = request('POST', '/git/commits', { - 'message': 'fix(coverage): isolate low-privilege Git configuration', - 'tree': tree['sha'], - 'parents': [expected_head], - }) - - encoded_branch = urllib.parse.quote(source_branch, safe='/') - live_ref = request('GET', f'/git/ref/heads/{encoded_branch}') - live_sha = live_ref.get('object', {}).get('sha') - if live_sha != expected_head: - raise SystemExit( - f'stale exact-head repair refused: expected {expected_head}, found {live_sha}' - ) - updated_ref = request( - 'PATCH', - f'/git/refs/heads/{encoded_branch}', - {'sha': commit['sha'], 'force': False}, - ) - if updated_ref.get('object', {}).get('sha') != commit['sha']: - raise SystemExit('branch ref update did not bind to the candidate commit') - print(f"UPDATED_HEAD_SHA={commit['sha']}") - print(f"UPDATED_PARENT_SHA={expected_head}") - PY + rm -rf _repair_artifact + mkdir -p _repair_artifact/.github/workflows _repair_artifact/docs/doctoring + install -m 0644 .github/workflows/opencode-review-dispatch.yml \ + _repair_artifact/.github/workflows/opencode-review-dispatch.yml + install -m 0644 docs/doctoring/opencode-llvm-coverage-toolchain.md \ + _repair_artifact/docs/doctoring/opencode-llvm-coverage-toolchain.md + install -m 0644 CHANGELOG.md _repair_artifact/CHANGELOG.md + printf '%s\n' "${{ github.event.pull_request.head.sha }}" > _repair_artifact/expected-parent-sha.txt + find _repair_artifact -type f -print0 | sort -z | xargs -0 sha256sum > _repair_artifact/SHA256SUMS + + - name: Preserve exact-head patched files + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: pr794-exact-head-repair-${{ github.event.pull_request.head.sha }} + path: _repair_artifact + if-no-files-found: error + retention-days: 1 From a887717d5854b3bfd8af4f837db89e790221eace Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:34:29 +0900 Subject: [PATCH 23/29] fix(automation): preserve hidden repair source and stable hashes --- .github/workflows/repair-pr794-git-isolation-v3.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml index fd75e66fb..7fe01f72b 100644 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ b/.github/workflows/repair-pr794-git-isolation-v3.yml @@ -132,7 +132,9 @@ jobs: _repair_artifact/docs/doctoring/opencode-llvm-coverage-toolchain.md install -m 0644 CHANGELOG.md _repair_artifact/CHANGELOG.md printf '%s\n' "${{ github.event.pull_request.head.sha }}" > _repair_artifact/expected-parent-sha.txt - find _repair_artifact -type f -print0 | sort -z | xargs -0 sha256sum > _repair_artifact/SHA256SUMS + find _repair_artifact -type f ! -name SHA256SUMS -print0 \ + | sort -z \ + | xargs -0 sha256sum > _repair_artifact/SHA256SUMS - name: Preserve exact-head patched files uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -140,4 +142,5 @@ jobs: name: pr794-exact-head-repair-${{ github.event.pull_request.head.sha }} path: _repair_artifact if-no-files-found: error + include-hidden-files: true retention-days: 1 From 5cf306ed278ebf11eb45317359d5992567214e0e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:40:27 +0900 Subject: [PATCH 24/29] fix(coverage): isolate low-privilege Git configuration --- .../workflows/opencode-review-dispatch.yml | 6 + .../repair-pr794-git-isolation-v3.yml | 146 ------------------ CHANGELOG.md | 2 +- .../opencode-llvm-coverage-toolchain.md | 4 +- 4 files changed, 10 insertions(+), 148 deletions(-) delete mode 100644 .github/workflows/repair-pr794-git-isolation-v3.yml diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index 41748bcec..b17cf3775 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -877,6 +877,8 @@ jobs: GITHUB_STEP_SUMMARY=/dev/null \ BASH_ENV=/dev/null \ UV_NO_BUILD=1 \ + GIT_CONFIG_NOSYSTEM=1 \ + GIT_CONFIG_GLOBAL=/dev/null \ GIT_CONFIG_COUNT=1 \ GIT_CONFIG_KEY_0=safe.directory \ GIT_CONFIG_VALUE_0=/work \ @@ -936,6 +938,8 @@ jobs: GITHUB_STEP_SUMMARY=/dev/null \ BASH_ENV=/dev/null \ UV_NO_BUILD=1 \ + GIT_CONFIG_NOSYSTEM=1 \ + GIT_CONFIG_GLOBAL=/dev/null \ GIT_CONFIG_COUNT=1 \ GIT_CONFIG_KEY_0=safe.directory \ GIT_CONFIG_VALUE_0=/work \ @@ -995,6 +999,8 @@ jobs: GITHUB_STEP_SUMMARY=/dev/null \ BASH_ENV=/dev/null \ UV_NO_BUILD=1 \ + GIT_CONFIG_NOSYSTEM=1 \ + GIT_CONFIG_GLOBAL=/dev/null \ GIT_CONFIG_COUNT=1 \ GIT_CONFIG_KEY_0=safe.directory \ GIT_CONFIG_VALUE_0=/work \ diff --git a/.github/workflows/repair-pr794-git-isolation-v3.yml b/.github/workflows/repair-pr794-git-isolation-v3.yml deleted file mode 100644 index 7fe01f72b..000000000 --- a/.github/workflows/repair-pr794-git-isolation-v3.yml +++ /dev/null @@ -1,146 +0,0 @@ -name: Repair PR 794 Git isolation v3 - -on: - pull_request: - branches: - - main - types: - - synchronize - -permissions: - contents: read - -concurrency: - group: repair-pr794-git-isolation-v3 - cancel-in-progress: false - -jobs: - repair: - if: >- - github.repository == 'ContextualWisdomLab/.github' && - github.event.pull_request.number == 794 && - github.event.pull_request.head.ref == 'fix/opencode-llvm-coverage-current-main' - permissions: - contents: read - actions: write - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - - name: Checkout exact pull-request head without persisted credentials - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: ${{ github.event.pull_request.head.sha }} - fetch-depth: 1 - persist-credentials: false - - - name: Restore the three low-privilege Git isolation boundaries - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python3 - <<'PY' - from pathlib import Path - - path = Path('.github/workflows/opencode-review-dispatch.yml') - lines = path.read_text(encoding='utf-8').splitlines(keepends=True) - repaired = [] - insertions = 0 - for index, line in enumerate(lines): - repaired.append(line) - if not line.strip().startswith('UV_NO_BUILD=1'): - continue - if index + 1 >= len(lines) or not lines[index + 1].strip().startswith('GIT_CONFIG_COUNT=1'): - continue - indentation = line[: len(line) - len(line.lstrip())] - slash = chr(92) - repaired.append(f'{indentation}GIT_CONFIG_NOSYSTEM=1 {slash}\n') - repaired.append(f'{indentation}GIT_CONFIG_GLOBAL=/dev/null {slash}\n') - insertions += 1 - if insertions != 3: - raise SystemExit(f'expected exactly three repair anchors, found {insertions}') - path.write_text(''.join(repaired), encoding='utf-8') - - doctoring_path = Path('docs/doctoring/opencode-llvm-coverage-toolchain.md') - doctoring = doctoring_path.read_text(encoding='utf-8') - boundary = '- Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay.\n' - if boundary not in doctoring: - anchor = '- Missing executables fail the image build before any pull-request coverage measurement starts.\n' - if doctoring.count(anchor) != 1: - raise SystemExit('doctoring security anchor is not unique') - doctoring = doctoring.replace(anchor, anchor + boundary, 1) - regression = '6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay.\n' - if regression not in doctoring: - anchor = '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run.\n' - if doctoring.count(anchor) != 1: - raise SystemExit('doctoring regression anchor is not unique') - doctoring = doctoring.replace( - anchor, - '5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; and\n' + regression, - 1, - ) - doctoring_path.write_text(doctoring, encoding='utf-8') - - changelog_path = Path('CHANGELOG.md') - changelog = changelog_path.read_text(encoding='utf-8') - old = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - new = "- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and permanent ordering and low-privilege Git-configuration-isolation regressions after DiskSage exact-head coverage exposed the missing system-toolchain boundary.\n" - if new not in changelog: - if changelog.count(old) != 1: - raise SystemExit('changelog anchor is not unique') - changelog = changelog.replace(old, new, 1) - changelog_path.write_text(changelog, encoding='utf-8') - PY - git diff --check - - - name: Execute focused LLVM and Git-isolation contracts - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - python3 - <<'PY' - import importlib.util - from pathlib import Path - - test_path = Path('tests/test_opencode_llvm_coverage_current_main.py') - spec = importlib.util.spec_from_file_location('pr794_contract', test_path) - if spec is None or spec.loader is None: - raise SystemExit('unable to load focused contract module') - module = importlib.util.module_from_spec(spec) - spec.loader.exec_module(module) - module.test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_llvm_cov() - module.test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration() - - workflow = Path('.github/workflows/opencode-review-dispatch.yml').read_text(encoding='utf-8') - assert workflow.count('GIT_CONFIG_NOSYSTEM=1') == 4 - assert workflow.count('GIT_CONFIG_GLOBAL=/dev/null') == 4 - assert workflow.count('GIT_CONFIG_COUNT=1') == 3 - assert workflow.count('ENV LLVM_COV=/usr/bin/llvm-cov-19') == 1 - assert workflow.count('ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19') == 1 - PY - python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py - git diff --check - - - name: Stage exact-head patched files for trusted commit creation - shell: bash --noprofile --norc -e -o pipefail {0} - run: | - rm -rf _repair_artifact - mkdir -p _repair_artifact/.github/workflows _repair_artifact/docs/doctoring - install -m 0644 .github/workflows/opencode-review-dispatch.yml \ - _repair_artifact/.github/workflows/opencode-review-dispatch.yml - install -m 0644 docs/doctoring/opencode-llvm-coverage-toolchain.md \ - _repair_artifact/docs/doctoring/opencode-llvm-coverage-toolchain.md - install -m 0644 CHANGELOG.md _repair_artifact/CHANGELOG.md - printf '%s\n' "${{ github.event.pull_request.head.sha }}" > _repair_artifact/expected-parent-sha.txt - find _repair_artifact -type f ! -name SHA256SUMS -print0 \ - | sort -z \ - | xargs -0 sha256sum > _repair_artifact/SHA256SUMS - - - name: Preserve exact-head patched files - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: pr794-exact-head-repair-${{ github.event.pull_request.head.sha }} - path: _repair_artifact - if-no-files-found: error - include-hidden-files: true - retention-days: 1 diff --git a/CHANGELOG.md b/CHANGELOG.md index 0e34b580c..9ff905f66 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,6 @@ Semantic Versioning where the repository publishes a release. ### Fixed -- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and a permanent ordering regression contract after DiskSage exact-head coverage exposed the missing system-toolchain boundary. +- Restored the default-branch OpenCode Rust coverage image's Debian LLVM 19 tools, explicit `LLVM_COV` and `LLVM_PROFDATA` bindings, pre-install executable validation, and permanent ordering and low-privilege Git-configuration-isolation regressions after DiskSage exact-head coverage exposed the missing system-toolchain boundary. - Bound both trusted-uv quality jobs to `github.event.pull_request.head.sha` and added a permanent two-checkout regression contract so exact-head compatibility, coverage, docstring, and compilation claims cannot silently measure GitHub's generated pull-request merge revision. - Made Strix treat only a single LiteLLM provider-error line containing NVIDIA NIM context and model-catalog 404 evidence as cross-model fallback evidence, rejecting cross-line signal assembly and provider-like target source literals; moved the public default to Nemotron 3 Super 120B and added a second NVIDIA hosted candidate before GitHub Models without neutralizing reported vulnerabilities. diff --git a/docs/doctoring/opencode-llvm-coverage-toolchain.md b/docs/doctoring/opencode-llvm-coverage-toolchain.md index 49d122286..923b89449 100644 --- a/docs/doctoring/opencode-llvm-coverage-toolchain.md +++ b/docs/doctoring/opencode-llvm-coverage-toolchain.md @@ -29,6 +29,7 @@ The earlier LLVM repair had been merged into an intermediate feature branch rath - The coverage image definition remains default-branch controlled and is built from immutable workflow source. - `LLVM_COV` and `LLVM_PROFDATA` are set together; partial configuration is rejected. - Missing executables fail the image build before any pull-request coverage measurement starts. +- Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay. - The image digest, workflow commit SHA, pull-request head SHA, and coverage artifacts remain independently addressable evidence. - CPU coverage is a correctness gate. GPU execution and parity tests remain separate domain-specific gates and are not represented by LLVM host coverage alone. @@ -42,7 +43,8 @@ The central workflow contract test must continue to prove that: 2. `LLVM_COV` names `/usr/bin/llvm-cov-19`; 3. `LLVM_PROFDATA` names `/usr/bin/llvm-profdata-19`; 4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; and -5. the OpenCode approval path remains fail-closed when Rust coverage cannot run. +5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; and +6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay. ## References From fca5600b6b51621c684a151f49b2fb30cdde46b0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:45:25 +0900 Subject: [PATCH 25/29] test(coverage): require exact-head toolchain quality workflow --- ...est_opencode_llvm_coverage_current_main.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/test_opencode_llvm_coverage_current_main.py b/tests/test_opencode_llvm_coverage_current_main.py index 8b450fb95..58e25498c 100644 --- a/tests/test_opencode_llvm_coverage_current_main.py +++ b/tests/test_opencode_llvm_coverage_current_main.py @@ -2,6 +2,9 @@ _WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml") +_QUALITY_WORKFLOW = Path( + ".github/workflows/opencode-coverage-toolchain-quality-ci.yml" +) def test_opencode_coverage_image_provisions_compatible_llvm_tools_before_cargo_llvm_cov(): @@ -43,3 +46,19 @@ def test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration(): assert no_system < no_global < safe_directory_count assert wrapper.count("GIT_CONFIG_NOSYSTEM=1") == 1 assert wrapper.count("GIT_CONFIG_GLOBAL=/dev/null") == 1 + + +def test_opencode_toolchain_quality_workflow_is_exact_head_bound_and_offline(): + """Require durable exact-head execution without mutable test dependencies.""" + workflow = _QUALITY_WORKFLOW.read_text(encoding="utf-8") + + assert "ref: ${{ github.event.pull_request.head.sha }}" in workflow + assert "persist-credentials: false" in workflow + assert ( + 'test "$(git rev-parse HEAD)" = ' + '"${{ github.event.pull_request.head.sha }}"' in workflow + ) + assert "importlib.util.spec_from_file_location" in workflow + assert "python3 -m compileall -q" in workflow + assert "pip install" not in workflow + assert "uv sync" not in workflow From b2073dfbf3b35ab6443cc29065f765589d3ba39a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:46:52 +0900 Subject: [PATCH 26/29] ci(coverage): verify OpenCode toolchain at exact PR head --- ...opencode-coverage-toolchain-quality-ci.yml | 77 +++++++++++++++++++ CHANGELOG.md | 1 + .../opencode-llvm-coverage-toolchain.md | 14 +++- 3 files changed, 88 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/opencode-coverage-toolchain-quality-ci.yml diff --git a/.github/workflows/opencode-coverage-toolchain-quality-ci.yml b/.github/workflows/opencode-coverage-toolchain-quality-ci.yml new file mode 100644 index 000000000..66dfcaf24 --- /dev/null +++ b/.github/workflows/opencode-coverage-toolchain-quality-ci.yml @@ -0,0 +1,77 @@ +name: OpenCode Coverage Toolchain Quality + +on: + pull_request: + branches: + - main + types: + - opened + - synchronize + - reopened + - ready_for_review + paths: + - ".github/workflows/opencode-review-dispatch.yml" + - ".github/workflows/opencode-coverage-toolchain-quality-ci.yml" + - "tests/test_opencode_llvm_coverage_current_main.py" + - "docs/doctoring/opencode-llvm-coverage-toolchain.md" + - "CHANGELOG.md" + +permissions: + contents: read + +concurrency: + group: opencode-coverage-toolchain-quality-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + exact-head-contract: + name: Exact-head toolchain contract + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Checkout exact pull-request head + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 1 + persist-credentials: false + + - name: Refuse stale or merge-tree evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha }}" + test -z "$(git status --short)" + + - name: Execute dependency-free coverage-toolchain contracts + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python3 - <<'PY' + import importlib.util + from pathlib import Path + + test_path = Path("tests/test_opencode_llvm_coverage_current_main.py") + spec = importlib.util.spec_from_file_location("opencode_toolchain_contract", test_path) + if spec is None or spec.loader is None: + raise SystemExit("unable to load the OpenCode toolchain contract module") + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + + tests = sorted( + name + for name in vars(module) + if name.startswith("test_") and callable(getattr(module, name)) + ) + if not tests: + raise SystemExit("no OpenCode toolchain contract tests were discovered") + for test_name in tests: + getattr(module, test_name)() + print(f"PASS {test_name}") + PY + python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py + git diff --check + test -z "$(git status --short)" diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ff905f66..1968b98e8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ Semantic Versioning where the repository publishes a release. ### Added - Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence. +- Added a dependency-free exact-head OpenCode coverage-toolchain quality workflow that refuses generated merge revisions, preserves no checkout credentials, and executes every repository-owned LLVM and Git-isolation regression contract. ### Fixed diff --git a/docs/doctoring/opencode-llvm-coverage-toolchain.md b/docs/doctoring/opencode-llvm-coverage-toolchain.md index 923b89449..d0fc91bca 100644 --- a/docs/doctoring/opencode-llvm-coverage-toolchain.md +++ b/docs/doctoring/opencode-llvm-coverage-toolchain.md @@ -21,7 +21,7 @@ Debian Trixie publishes `llvm-19` from the `llvm-toolchain-19` source package. T DiskSage pull request 133 exact head `b7f980d265713d5ffb84f744ce454589e3d410ea` passed its repository Test, Release, Security Scan, and SAST workflows. Central OpenCode run `31037491215`, job `92413313900`, then failed before Rust test execution with `failed to find llvm-tools-preview`. The failure reproduced the previously diagnosed central-toolchain defect rather than a DiskSage production-code failure. -The earlier LLVM repair had been merged into an intermediate feature branch rather than protected `main`; later branch consolidation therefore left the required workflow source without the four toolchain lines. This current-main repair is intentionally limited to restoring those lines, a permanent regression test, this decision record, and the changelog. +The earlier LLVM repair had been merged into an intermediate feature branch rather than protected `main`; later branch consolidation therefore left the required workflow source without the four toolchain lines. This current-main repair is intentionally limited to restoring those lines, permanent regression contracts, this decision record, the changelog, and the exact-head quality workflow that executes those contracts. ## Security and reproducibility contract @@ -30,11 +30,16 @@ The earlier LLVM repair had been merged into an intermediate feature branch rath - `LLVM_COV` and `LLVM_PROFDATA` are set together; partial configuration is rejected. - Missing executables fail the image build before any pull-request coverage measurement starts. - Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay. +- The dedicated quality workflow checks out `github.event.pull_request.head.sha`, refuses merge-tree or stale-head evidence, runs without package installation, and preserves no repository credentials. - The image digest, workflow commit SHA, pull-request head SHA, and coverage artifacts remain independently addressable evidence. - CPU coverage is a correctness gate. GPU execution and parity tests remain separate domain-specific gates and are not represented by LLVM host coverage alone. This design does not claim formal compliance with a software supply-chain standard. It establishes a narrow, auditable compatibility boundary for deterministic Rust coverage execution. +## Durable exact-head verification + +`.github/workflows/opencode-coverage-toolchain-quality-ci.yml` is the repository-owned acceptance path for this contract. It runs whenever the trusted coverage workflow, its contract tests, this decision record, or the changelog changes. The job checks out the exact pull-request head SHA, verifies that Git materialized that SHA rather than GitHub's generated merge revision, discovers every dependency-free `test_` function in the contract module, compiles the module, and fails if the test process changes the worktree. It never installs packages or evaluates a pull-request-selected dependency manifest. + ## Regression contract The central workflow contract test must continue to prove that: @@ -42,9 +47,10 @@ The central workflow contract test must continue to prove that: 1. `llvm-19` is installed in the coverage image; 2. `LLVM_COV` names `/usr/bin/llvm-cov-19`; 3. `LLVM_PROFDATA` names `/usr/bin/llvm-profdata-19`; -4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; and -5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; and -6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay. +4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; +5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; +6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay; and +7. the durable quality workflow is exact-head bound, credential-free, and dependency-free. ## References From 1635420cc696fda693daa70b8c033d14195d14e2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:54:10 +0900 Subject: [PATCH 27/29] test(coverage): require full exact-head repository quality gate --- ...est_opencode_llvm_coverage_current_main.py | 41 +++++++++++++++---- 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/tests/test_opencode_llvm_coverage_current_main.py b/tests/test_opencode_llvm_coverage_current_main.py index 58e25498c..e6e710d77 100644 --- a/tests/test_opencode_llvm_coverage_current_main.py +++ b/tests/test_opencode_llvm_coverage_current_main.py @@ -49,16 +49,41 @@ def test_low_privilege_coverage_wrappers_isolate_ambient_git_configuration(): def test_opencode_toolchain_quality_workflow_is_exact_head_bound_and_offline(): - """Require durable exact-head execution without mutable test dependencies.""" + """Require the fast contract job to stay exact-head and dependency-free.""" workflow = _QUALITY_WORKFLOW.read_text(encoding="utf-8") + start = workflow.index(" exact-head-contract:") + end = workflow.index(" full-repository-quality:", start) + fast_job = workflow[start:end] - assert "ref: ${{ github.event.pull_request.head.sha }}" in workflow - assert "persist-credentials: false" in workflow + assert "ref: ${{ github.event.pull_request.head.sha }}" in fast_job + assert "persist-credentials: false" in fast_job assert ( 'test "$(git rev-parse HEAD)" = ' - '"${{ github.event.pull_request.head.sha }}"' in workflow + '"${{ github.event.pull_request.head.sha }}"' in fast_job ) - assert "importlib.util.spec_from_file_location" in workflow - assert "python3 -m compileall -q" in workflow - assert "pip install" not in workflow - assert "uv sync" not in workflow + assert "importlib.util.spec_from_file_location" in fast_job + assert "python3 -m compileall -q" in fast_job + assert "pip install" not in fast_job + assert "uv sync" not in fast_job + + +def test_opencode_toolchain_quality_runs_full_hash_locked_repository_suite(): + """Require a separate exact-head full-suite job with 100% quality gates.""" + workflow = _QUALITY_WORKFLOW.read_text(encoding="utf-8") + start = workflow.index(" full-repository-quality:") + full_job = workflow[start:] + + assert "needs: exact-head-contract" in full_job + assert "ref: ${{ github.event.pull_request.head.sha }}" in full_job + assert "persist-credentials: false" in full_job + assert ( + 'test "$(git rev-parse HEAD)" = ' + '"${{ github.event.pull_request.head.sha }}"' in full_job + ) + assert "actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97" in full_job + assert 'python-version: "3.14"' in full_job + assert "--require-hashes -r requirements-opencode-review-ci-hashes.txt" in full_job + assert "python -m coverage run -m pytest tests -q" in full_job + assert "python -m coverage report" in full_job + assert "python -m interrogate --fail-under 100 scripts/ci" in full_job + assert "python -m compileall -q scripts/ci tests" in full_job From 7f12a15505c4754d1feeb33fd0148cebe6a689ba Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:56:08 +0900 Subject: [PATCH 28/29] ci(coverage): run complete exact-head repository quality gate --- ...opencode-coverage-toolchain-quality-ci.yml | 56 +++++++++++++++++++ CHANGELOG.md | 2 +- .../opencode-llvm-coverage-toolchain.md | 17 ++++-- 3 files changed, 69 insertions(+), 6 deletions(-) diff --git a/.github/workflows/opencode-coverage-toolchain-quality-ci.yml b/.github/workflows/opencode-coverage-toolchain-quality-ci.yml index 66dfcaf24..fad05bffc 100644 --- a/.github/workflows/opencode-coverage-toolchain-quality-ci.yml +++ b/.github/workflows/opencode-coverage-toolchain-quality-ci.yml @@ -15,6 +15,8 @@ on: - "tests/test_opencode_llvm_coverage_current_main.py" - "docs/doctoring/opencode-llvm-coverage-toolchain.md" - "CHANGELOG.md" + - "requirements-opencode-review-ci-hashes.txt" + - "pyproject.toml" permissions: contents: read @@ -75,3 +77,57 @@ jobs: python3 -m compileall -q tests/test_opencode_llvm_coverage_current_main.py git diff --check test -z "$(git status --short)" + + full-repository-quality: + name: Full repository test, coverage, and docstring gate + needs: exact-head-contract + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Checkout exact pull-request head + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 1 + persist-credentials: false + + - name: Refuse stale or merge-tree evidence + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha }}" + test -z "$(git status --short)" + + - name: Set up current stable Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.14" + cache: pip + cache-dependency-path: requirements-opencode-review-ci-hashes.txt + + - name: Install hash-locked repository quality tooling + shell: bash --noprofile --norc -e -o pipefail {0} + run: >- + python -m pip install --disable-pip-version-check --require-hashes + -r requirements-opencode-review-ci-hashes.txt + + - name: Run complete central test and branch coverage gate + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python -m coverage erase + python -m coverage run -m pytest tests -q + python -m coverage report + + - name: Enforce complete production docstrings + shell: bash --noprofile --norc -e -o pipefail {0} + run: python -m interrogate --fail-under 100 scripts/ci + + - name: Compile production and every repository test + shell: bash --noprofile --norc -e -o pipefail {0} + run: | + python -m compileall -q scripts/ci tests + git diff --check diff --git a/CHANGELOG.md b/CHANGELOG.md index 1968b98e8..d9862e92c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ Semantic Versioning where the repository publishes a release. ### Added - Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence. -- Added a dependency-free exact-head OpenCode coverage-toolchain quality workflow that refuses generated merge revisions, preserves no checkout credentials, and executes every repository-owned LLVM and Git-isolation regression contract. +- Added an exact-head OpenCode coverage-toolchain quality workflow with a dependency-free focused contract job and a dependent hash-locked full repository test, 100% branch-coverage, docstring, and compilation gate; both jobs refuse generated merge revisions and preserve no checkout credentials. ### Fixed diff --git a/docs/doctoring/opencode-llvm-coverage-toolchain.md b/docs/doctoring/opencode-llvm-coverage-toolchain.md index d0fc91bca..2a2927d0e 100644 --- a/docs/doctoring/opencode-llvm-coverage-toolchain.md +++ b/docs/doctoring/opencode-llvm-coverage-toolchain.md @@ -21,7 +21,7 @@ Debian Trixie publishes `llvm-19` from the `llvm-toolchain-19` source package. T DiskSage pull request 133 exact head `b7f980d265713d5ffb84f744ce454589e3d410ea` passed its repository Test, Release, Security Scan, and SAST workflows. Central OpenCode run `31037491215`, job `92413313900`, then failed before Rust test execution with `failed to find llvm-tools-preview`. The failure reproduced the previously diagnosed central-toolchain defect rather than a DiskSage production-code failure. -The earlier LLVM repair had been merged into an intermediate feature branch rather than protected `main`; later branch consolidation therefore left the required workflow source without the four toolchain lines. This current-main repair is intentionally limited to restoring those lines, permanent regression contracts, this decision record, the changelog, and the exact-head quality workflow that executes those contracts. +The earlier LLVM repair had been merged into an intermediate feature branch rather than protected `main`; later branch consolidation therefore left the required workflow source without the four toolchain lines. This current-main repair is intentionally limited to restoring those lines, permanent regression contracts, this decision record, the changelog, and the exact-head quality workflow that executes both focused and repository-wide evidence. ## Security and reproducibility contract @@ -30,7 +30,9 @@ The earlier LLVM repair had been merged into an intermediate feature branch rath - `LLVM_COV` and `LLVM_PROFDATA` are set together; partial configuration is rejected. - Missing executables fail the image build before any pull-request coverage measurement starts. - Every low-privilege coverage wrapper disables ambient system and global Git configuration before applying the single bounded `/work` safe-directory overlay. -- The dedicated quality workflow checks out `github.event.pull_request.head.sha`, refuses merge-tree or stale-head evidence, runs without package installation, and preserves no repository credentials. +- Both quality jobs check out `github.event.pull_request.head.sha`, refuse merge-tree or stale-head evidence, and preserve no repository credentials. +- The fast contract job installs no packages and evaluates no pull-request-selected dependency manifest. +- The full repository job installs only the repository's SHA-256 hash-locked quality requirements, then runs every test plus the configured 100% branch coverage and production docstring gates. - The image digest, workflow commit SHA, pull-request head SHA, and coverage artifacts remain independently addressable evidence. - CPU coverage is a correctness gate. GPU execution and parity tests remain separate domain-specific gates and are not represented by LLVM host coverage alone. @@ -38,7 +40,11 @@ This design does not claim formal compliance with a software supply-chain standa ## Durable exact-head verification -`.github/workflows/opencode-coverage-toolchain-quality-ci.yml` is the repository-owned acceptance path for this contract. It runs whenever the trusted coverage workflow, its contract tests, this decision record, or the changelog changes. The job checks out the exact pull-request head SHA, verifies that Git materialized that SHA rather than GitHub's generated merge revision, discovers every dependency-free `test_` function in the contract module, compiles the module, and fails if the test process changes the worktree. It never installs packages or evaluates a pull-request-selected dependency manifest. +`.github/workflows/opencode-coverage-toolchain-quality-ci.yml` is the repository-owned acceptance path for this contract. It runs whenever the trusted coverage workflow, either quality workflow contract, this decision record, the hash-locked quality requirements, `pyproject.toml`, or the changelog changes. + +The first job checks out the exact pull-request head SHA, verifies that Git materialized that SHA rather than GitHub's generated merge revision, discovers every dependency-free `test_` function in the focused contract module, compiles the module, and fails if the test process changes the worktree. It never installs packages. + +Only after that job passes, a separate approved-environment job checks out and revalidates the same exact head, installs the repository-owned hash-locked quality toolchain, runs `pytest` across the complete `tests` directory under the configured 100% branch-coverage gate, enforces 100% production docstrings, and compiles all production CI modules and repository tests. This separation preserves a minimal early fail-closed contract while preventing focused tests from substituting for full repository acceptance. ## Regression contract @@ -49,8 +55,9 @@ The central workflow contract test must continue to prove that: 3. `LLVM_PROFDATA` names `/usr/bin/llvm-profdata-19`; 4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; 5. the OpenCode approval path remains fail-closed when Rust coverage cannot run; -6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay; and -7. the durable quality workflow is exact-head bound, credential-free, and dependency-free. +6. all three low-privilege wrapper processes isolate system and global Git configuration before the safe-directory overlay; +7. the focused quality job is exact-head bound, credential-free, and dependency-free; and +8. the dependent full repository job is exact-head bound, uses the SHA-256 hash-locked quality toolchain, and runs the complete test, branch-coverage, docstring, and compilation gates. ## References From 6bd29ccd394a94b6018cb0985d0febee186124bf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 13:57:58 +0900 Subject: [PATCH 29/29] fix(coverage): make hash-locked install contract explicit --- .github/workflows/opencode-coverage-toolchain-quality-ci.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/opencode-coverage-toolchain-quality-ci.yml b/.github/workflows/opencode-coverage-toolchain-quality-ci.yml index fad05bffc..495ccd5fc 100644 --- a/.github/workflows/opencode-coverage-toolchain-quality-ci.yml +++ b/.github/workflows/opencode-coverage-toolchain-quality-ci.yml @@ -111,9 +111,7 @@ jobs: - name: Install hash-locked repository quality tooling shell: bash --noprofile --norc -e -o pipefail {0} - run: >- - python -m pip install --disable-pip-version-check --require-hashes - -r requirements-opencode-review-ci-hashes.txt + run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt - name: Run complete central test and branch coverage gate shell: bash --noprofile --norc -e -o pipefail {0}