fix(actions): bound agent mention dispatch envelope - #840
Conversation
📝 WalkthroughWalkthroughOpenCode 호출을 v2 canonical claim envelope로 변경했습니다. Wrapper와 scheduler가 payload 및 PR snapshot을 재검증합니다. 리뷰 전용 경로는 병합과 브랜치 변경을 수행하지 않습니다. OpenCode와 Strix 실행은 run ID 또는 invocation key로 격리됩니다. ChangesOpenCode v2 호출 계약
스케줄러 dispatch 검증
스냅샷 보호 리뷰
실행 격리와 품질 계약
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review Please review the exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='826c6eeec7aa5a72ce69521e23c3f6a1b998fe52'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git diff-tree --no-commit-id --name-status -r "$expected"
printf '\n--- Python and workflow outlines ---\n'
git diff-tree --no-commit-id --name-only -r "$expected" |
while IFS= read -r file; do
case "$file" in
*.py)
printf '\n### %s\n' "$file"
ast-grep outline "$file" --items all --type function,class 2>/dev/null || true
;;
*.yml|*.yaml)
printf '\n### %s\n' "$file"
nl -ba "$file" | sed -n '1,260p'
;;
esac
done
printf '\n--- Relevant contract and concurrency references ---\n'
rg -n -C 4 -g '*.py' -g '*.yml' -g '*.yaml' \
'(opencode_payload|agent-mention-opencode|merge-scheduler-agent-review-v2|cwl\.agent-invocation/v2|repository_dispatch|client_payload|agent_invocation_key|review_policy|concurrency:|cancel-in-progress|ledger|claim)' .Length of output: 2376 🏁 Script executed: #!/bin/bash
set -euo pipefail
commit='826c6eeec7aa5a72ce69521e23c3f6a1b998fe52'
base="${commit}^"
printf '%s\n' '--- Changed implementation diffs ---'
git diff --unified=80 "$base" "$commit" -- \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/pr-review-merge-scheduler.yml \
.github/workflows/strix.yml \
scripts/ci/agent_mention_router.py \
scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '--- Complete changed workflows ---'
for file in \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/pr-review-merge-scheduler.yml \
.github/workflows/strix.yml
do
printf '\n### %s\n' "$file"
sed -n '1,420p' "$file"
done
printf '%s\n' '--- Contract-related source definitions and test assertions ---'
grep -nE -C 8 \
'^(def |class )|opencode_payload|agent_invocation_key|review_policy|repository_dispatch|client_payload|ledger|claim|snapshot|cancel|concurrency|merge-scheduler-agent-review-v2' \
scripts/ci/agent_mention_router.py \
scripts/ci/pr_review_merge_scheduler.py \
tests/test_agent_mention_complete_payload_binding.py \
tests/test_agent_mention_downstream_idempotency.py \
tests/test_agent_mention_idempotency.py \
tests/test_agent_mention_repository_dispatch_envelope.py \
tests/test_agent_mention_router.py \
tests/test_opencode_agent_contract.py \
tests/test_pr_review_merge_scheduler.py \
tests/test_required_workflow_queue_contract.py || trueLength of output: 202196 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Python definitions and key references ---'
grep -nE \
'^(def |class )|AGENT.*(SCHEMA|CLAIM|PAYLOAD)|opencode_payload|validate_.*(payload|claim|invocation|snapshot)|claim_.*(ledger|key)|ledger.*claim|dispatch_(opencode|strix)|active_.*run|force_cancel|inspect_snapshot_bound|validate_expected_pr_snapshot|expected_(head|base)|agent_invocation_key' \
scripts/ci/agent_mention_router.py \
scripts/ci/pr_review_merge_scheduler.py || true
printf '%s\n' '--- Workflow section markers ---'
for file in \
.github/workflows/agent-mention-opencode-dispatch.yml \
.github/workflows/agent-mention-router-quality-ci.yml \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/pr-review-merge-scheduler.yml \
.github/workflows/strix.yml
do
printf '\n### %s\n' "$file"
grep -nE \
'^(name:|on:|concurrency:|permissions:| [A-Za-z0-9_-]+:| - name:)|repository_dispatch|merge-scheduler-agent-review-v2|cwl\.agent-invocation/v2|client_payload|agent_invocation_key|claim|ledger|concurrency|cancel-in-progress|expected-(head|base)|TARGET_' \
"$file" || true
doneLength of output: 73580 🏁 Script executed: #!/bin/bash
set -euo pipefail
show() {
file="$1"
start="$2"
end="$3"
printf '\n### %s:%s-%s\n' "$file" "$start" "$end"
sed -n "${start},${end}p" "$file"
}
show scripts/ci/agent_mention_router.py 220 490
show .github/workflows/agent-mention-opencode-dispatch.yml 1 290
show .github/workflows/pr-review-merge-scheduler.yml 86 680
show scripts/ci/pr_review_merge_scheduler.py 1840 2205
show scripts/ci/pr_review_merge_scheduler.py 2281 2535
show scripts/ci/pr_review_merge_scheduler.py 3946 4115
show .github/workflows/strix.yml 66 370Length of output: 101297
I found no Critical or Important findings in the requested scope. The review verified these controls:
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
tests/test_agent_mention_repository_dispatch_envelope.py (1)
194-203: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winwrapper의 정책 검증과 형식 검증을 다루는 변이를 추가하세요.
현재 변이 목록은 envelope 키, claim 키, bool 타입, digest, schema만 다룹니다. wrapper의
expected_policy검사와 정규식 검사(repository,head_sha,base_branch,actor)는 이 파일에서 실행 검증되지 않습니다.정책 위반 변이는 digest도 함께 갱신해야 해당 분기에 도달합니다. 그렇지 않으면 digest 불일치로 먼저 거부되어 정책 분기를 검증하지 못합니다.
♻️ 제안 변이 추가
"altered-bound-field", "unsupported-schema", + "policy-violating-claim", ], )정책 변이 처리 분기 예시:
elif mutation == "policy-violating-claim": payload["claim"]["update_branches"] = True payload["agent_invocation_key"] = hashlib.sha256( json.dumps( payload["claim"], ensure_ascii=True, separators=(",", ":"), sort_keys=True, ).encode("utf-8") ).hexdigest()
INVOCATION_KEY와PAYLOAD_SCHEMA는 이미payload에서 읽으므로 추가 변경은 필요하지 않습니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_agent_mention_repository_dispatch_envelope.py` around lines 194 - 203, 변이 테스트 목록과 해당 mutation 처리 로직에 expected_policy 위반 변이 및 repository, head_sha, base_branch, actor 정규식 위반 변이를 추가하세요. policy-violating-claim은 claim 변경 후 payload의 agent_invocation_key도 동일한 정규화·정렬 방식으로 다시 계산해 digest 검증을 통과한 뒤 정책 분기에 도달하게 하며, 각 형식 변이는 해당 필드만 유효하지 않은 값으로 바꾸고 나머지 검증 조건은 유지하세요..github/workflows/strix.yml (1)
72-78: 🚀 Performance & Scalability | 🔵 Trivialrepository_dispatch 실행에 대한 동시 실행 상한이 사라집니다.
github.run_id는 dispatch마다 고유하므로 각 실행이 별도 그룹을 가집니다.cancel-in-progress도 해당 이벤트에서 비활성화됩니다. 결과적으로 같은 PR에 대한 Strix 실행이 직렬화되지 않고, 각 실행은 최대 120분 예산을 사용합니다. 중복 억제는 scheduler의 same-head 판정에만 남습니다. 이 트레이드오프는 stale dispatch의 취소를 막기 위한 의도적 선택입니다. Actions 동시 실행 사용량을 관찰하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/strix.yml around lines 72 - 78, Update the repository_dispatch concurrency configuration in the workflow’s group expression to avoid using the unique github.run_id as the group key, so dispatches for the same target remain serialized and subject to the intended concurrency limit. Preserve the stale-dispatch protection only if it does not remove same-PR serialization, and keep cancel-in-progress disabled for repository_dispatch..github/workflows/opencode-review-dispatch.yml (1)
15-18: 🚀 Performance & Scalability | 🔵 Trivialrun-id 단위 격리는 PR별 동시 실행 상한을 제거합니다.
이전 그룹은 target repository와 PR 번호를 사용했으므로 같은 PR의 실행이 직렬화되었습니다. 이제 모든 dispatch가 고유 그룹을 가지며 취소도 하지 않습니다. 중복 억제는 scheduler의
active_opencode_run_refssame-head 판정에만 의존합니다. 해당 판정이 지연되거나 실패하면 동일 PR에 대해 최대 325분 예산의 리뷰 job이 병렬로 누적될 수 있습니다.Actions 동시 실행 사용량과 큐 대기 시간을 모니터링하십시오. 필요하면 조직 수준 러너 상한이나 dispatch 발행 측 rate limit을 함께 두십시오.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-review-dispatch.yml around lines 15 - 18, Restore PR-level concurrency grouping in the workflow by deriving group from the target repository and PR number, while preserving cancel-in-progress behavior that prevents stale runs from cancelling newer valid work. Update the group expression near the repository_dispatch configuration and keep duplicate suppression from depending solely on scheduler active_opencode_run_refs same-head checks.scripts/ci/pr_review_merge_scheduler.py (1)
2329-2335: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win승인된 head에서도 "no OpenCode approval" 사유가 출력됩니다.
이 분기는
current_head_approved확인(2342번 줄)보다 먼저 실행됩니다. 현재 head가 이미 승인된 상태에서 base가 앞서 있으면, 결정 사유가 "current head has no OpenCode approval"로 기록됩니다. 결정 자체는wait로 올바르지만 운영자가 보는 사유가 실제 상태와 다릅니다. 사유 문자열을 승인 상태에 맞게 분기하십시오.♻️ 제안 수정
behind_by = branch_outdated_by_base(pr, merge_state) if behind_by and trigger_reviews: + approval_state = ( + "current head is approved" + if current_head_approved + else "current head has no OpenCode approval" + ) return Decision( number, "wait", - "current head has no OpenCode approval; snapshot-bound review cannot update an outdated branch", + f"{approval_state}; snapshot-bound review cannot update an outdated branch", )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ci/pr_review_merge_scheduler.py` around lines 2329 - 2335, Update the decision-reason selection in the behind_by and trigger_reviews branch to account for current_head_approved before reporting the missing-approval message. Preserve the existing wait decision, but use an approval-consistent reason when the head is already approved and retain the current no-approval reason otherwise; reuse the current_head_approved check rather than duplicating approval logic.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agent-mention-router-quality-ci.yml:
- Line 23: quality job의 변경 감시 목록이 테스트 파일만 포함하고 소스 모듈을 누락하고 있습니다. 해당 workflow의
paths 목록에 pr_review_fix_scheduler.py 소스 경로를 추가하거나, 테스트 파일 항목을 제거해 소스 변경 시에도 job이
실행되도록 정리하십시오.
- Around line 17-18: quality job의 coverage 및 interrogate 게이트 대상에
pr_review_merge_scheduler.py가 빠져 있습니다. 기존 agent_mention_router.py와
agent_mention_sweep.py를 유지하면서 두 게이트의 검사 대상에
scripts/ci/pr_review_merge_scheduler.py를 추가하고, 해당 파일에도 100% 기준이 적용되도록 수정하십시오.
In `@tests/test_agent_mention_repository_dispatch_envelope.py`:
- Line 138: Remove the unnecessary f-string prefix from the assertion containing
PAYLOAD_SCHEMA, change the doubled braces to the required literal GitHub
expression braces, and use a double-quoted string so the embedded single quotes
need no escaping.
---
Nitpick comments:
In @.github/workflows/opencode-review-dispatch.yml:
- Around line 15-18: Restore PR-level concurrency grouping in the workflow by
deriving group from the target repository and PR number, while preserving
cancel-in-progress behavior that prevents stale runs from cancelling newer valid
work. Update the group expression near the repository_dispatch configuration and
keep duplicate suppression from depending solely on scheduler
active_opencode_run_refs same-head checks.
In @.github/workflows/strix.yml:
- Around line 72-78: Update the repository_dispatch concurrency configuration in
the workflow’s group expression to avoid using the unique github.run_id as the
group key, so dispatches for the same target remain serialized and subject to
the intended concurrency limit. Preserve the stale-dispatch protection only if
it does not remove same-PR serialization, and keep cancel-in-progress disabled
for repository_dispatch.
In `@scripts/ci/pr_review_merge_scheduler.py`:
- Around line 2329-2335: Update the decision-reason selection in the behind_by
and trigger_reviews branch to account for current_head_approved before reporting
the missing-approval message. Preserve the existing wait decision, but use an
approval-consistent reason when the head is already approved and retain the
current no-approval reason otherwise; reuse the current_head_approved check
rather than duplicating approval logic.
In `@tests/test_agent_mention_repository_dispatch_envelope.py`:
- Around line 194-203: 변이 테스트 목록과 해당 mutation 처리 로직에 expected_policy 위반 변이 및
repository, head_sha, base_branch, actor 정규식 위반 변이를 추가하세요.
policy-violating-claim은 claim 변경 후 payload의 agent_invocation_key도 동일한 정규화·정렬
방식으로 다시 계산해 digest 검증을 통과한 뒤 정책 분기에 도달하게 하며, 각 형식 변이는 해당 필드만 유효하지 않은 값으로 바꾸고 나머지
검증 조건은 유지하세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6d598337-0ae6-4383-8542-9d9f4d1a5ccb
📒 Files selected for processing (19)
.github/workflows/agent-mention-opencode-dispatch.yml.github/workflows/agent-mention-router-quality-ci.yml.github/workflows/opencode-review-dispatch.yml.github/workflows/pr-review-merge-scheduler.yml.github/workflows/strix.ymlCHANGELOG.mddocs/automation/review-agent-comment-invocation.mdscripts/ci/agent_mention_router.pyscripts/ci/pr_review_merge_scheduler.pyscripts/ci/test_strix_quick_gate.shtests/test_agent_mention_complete_payload_binding.pytests/test_agent_mention_downstream_idempotency.pytests/test_agent_mention_idempotency.pytests/test_agent_mention_repository_dispatch_envelope.pytests/test_agent_mention_router.pytests/test_opencode_agent_contract.pytests/test_opencode_workflow_shell_syntax.pytests/test_pr_review_merge_scheduler.pytests/test_required_workflow_queue_contract.py
|
@coderabbitai review Please perform one fresh full review of unchanged exact head |
|
The review will not transfer conclusions from the predecessor-head review. It will examine the v2 dispatch envelope, live-PR snapshot binding, ledger-before-forward ordering, review-only mutation denial, and stale-event concurrency and cancellation behavior.
|
|
@coderabbitai review Please review the unchanged exact head |
|
I will evaluate the current
|
|
@coderabbitai review Please perform one fresh full review of unchanged exact head |
|
I will evaluate only findings valid on this exact head. I will not transfer predecessor-head conclusions or treat this automated review as human approval.
|
1 participant
RCA
The organization-wide mention sweep at run 31258218169 / job 93104819883 isolated 402 HTTP 422 failures. Every failure said
No more than 10 properties are allowed; 14 were supplied.Two OpenCode repository-dispatch hops violated GitHub's maximum of ten top-level
client_payloadproperties:agent_mention_router.py::opencode_payload()emitted 14 properties.agent-mention-opencode-dispatch.ymlemitted another 14-propertymerge-schedulerpayload.Noema remains within the limit at nine properties.
Fix
cwl.agent-invocation/v2envelope:schema, canonicalclaim, andagent_invocation_key.merge-scheduler-agent-review-v2handling while retaining the schema-free legacymerge-schedulerpath.Organization-wide validation
agent-mention-opencode,merge-scheduler-agent-review-v2, or the nestedreview_policy/v2 claim schema.repository_dispatchbuilder is within the ten-property limit; no sibling rollout is required.Exact-current-head verification
Current exact head:
ba93f537302086ae54a919ea45c3ca96f2458415on protected base6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.1017 passed, 16 subtests passedgit diff --check: passtest_strix_quick_gate: PASSThe prior independent review that reported no Critical or Important findings was anchored to predecessor head
826c6eeec7aa5a72ce69521e23c3f6a1b998fe52; it is diagnostic history only and does not transfer to current headba93f537302086ae54a919ea45c3ca96f2458415. A fresh current-head automated review remains required. The latest CodeRabbit full-review attempt on the current head was organization-rate-limited; reviewer capacity is not a source defect and must not trigger speculative source changes. A qualifying counted independent non-author approval remains a separate governance gate.This replaces and supersedes #826 without modifying its branch.
Summary by CodeRabbit
개선 사항
문서
Protected deployment status