fix(noema): replay OIDC envelope repair on current main - #834
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughNoema OIDC 교환 응답에 fail-closed 검증을 추가했습니다. 워크플로는 저장소에 바인딩된 ChangesNoema OIDC 응답 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant NoemaOIDC
participant GitHubWorkflow
participant jq
NoemaOIDC->>GitHubWorkflow: OIDC 교환 응답 반환
GitHubWorkflow->>jq: 응답 envelope 및 저장소 메타데이터 검증
jq-->>GitHubWorkflow: 검증 결과와 data.token 반환
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review Please review the unchanged exact head |
|
|
|
@coderabbitai review Re-review only the unchanged exact head |
|
I will limit the review to the four-file Noema OIDC response-envelope repair. I will not use evidence from superseded PR
|
|
@coderabbitai review Re-review only unchanged exact head |
|
I will limit the review to the four-file Noema OIDC success-envelope repair. I will not use evidence from superseded PR ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_noema_oidc_exchange_contract.py`:
- Around line 41-44: Update the assertions in the exchange contract test to
verify that the `echo "::add-mask::$app_token"` command appears before `echo
"token=$app_token" >>"$GITHUB_OUTPUT"` within `exchange`, while preserving the
existing presence checks.
- Line 24: Update the assertion in the noema OIDC exchange contract test so it
rejects the `.token // empty` jq pattern regardless of whether the filter uses
single or double quotes; prefer checking the quote-independent pattern itself.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8cc60992-3a83-462d-b8da-6169c065e230
📒 Files selected for processing (4)
.github/workflows/noema-review.ymlCHANGELOG.mddocs/doctoring/noema-oidc-exchange-envelope.mdtests/test_noema_oidc_exchange_contract.py
1 participant
RCA
The Noema OIDC exchange can successfully return its stable success envelope while the central consumer still fails because protected
mainreads the nonexistent top-level.token. The actual token is repository-bound underdata.token; treating the resulting empty lookup as a missing credential misdiagnoses a producer/consumer schema mismatch.Historical PR #822 contains the bounded repair but is no longer mergeable and is based on protected-main
1131b1bbafb24e455fc8619cdf316813e8721861. Protectedmainadvanced to6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. Checks, reviews, approvals, comments, and synthetic merge evidence from #822 do not transfer here.Feasibility decision
A destructive rebase/force-push is unnecessary. The old base → current main delta touches only the Strix quality workflow, its doctoring/test, and one independent
CHANGELOG.mdentry; it does not modifynoema-review.yml. This replacement is therefore rebuilt directly from exact current protected main and carries only the same four-file bounded OIDC contract, while preserving the intervening Strix changelog entry.Bounded repair
ok: trueand object-valueddata;data.token, exact target repository identity, and non-empty workflow-source/expiry metadata;.data.tokenafter the full envelope validates;Exact replacement boundary
This branch is exactly four commits ahead and zero behind protected main at creation. The effective diff is limited to:
.github/workflows/noema-review.ymltests/test_noema_oidc_exchange_contract.pydocs/doctoring/noema-oidc-exchange-envelope.mdCHANGELOG.mdNo predecessor evidence transfers. Keep Draft until implementation/tests/docs/changelog are complete and every currently executable exact-head deterministic/security/supply-chain gate is green with zero current source-backed findings. At that point Ready status is permitted solely to obtain current-head automated and independent review; Ready is not merge evidence. Merge remains prohibited until current automated review is complete, zero valid unresolved findings remain, a qualifying non-author counted approval exists, and branch protection/repository policy allow the exact unchanged head.
Operational acceptance
After protected integration, execute a real Noema OIDC exchange and prove the stable response envelope reaches token extraction successfully without exposing the token. PR checks alone are not operational closure.
Supersedes #822 only after this replacement proves its own exact-head gates.
Summary by CodeRabbit
버그 수정
문서
테스트