From 274cc9a68849fd0782c9c7693c4a32f88da28563 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 30 Jun 2026 18:42:47 +0900 Subject: [PATCH 1/3] Regenerate Strix CI lock for Python 3.13 --- requirements-strix-ci-hashes.txt | 34 +++++++++++++++++--------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/requirements-strix-ci-hashes.txt b/requirements-strix-ci-hashes.txt index 57e0d52ad..2e060db5b 100644 --- a/requirements-strix-ci-hashes.txt +++ b/requirements-strix-ci-hashes.txt @@ -1,5 +1,5 @@ # This file was autogenerated by uv via the following command: -# uv pip compile --generate-hashes --python-version 3.14 --python-platform x86_64-manylinux_2_28 --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt +# uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-manylinux_2_28 --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt aiohappyeyeballs==2.6.2 \ --hash=sha256:4708045e2d7a6c6bdf8aafa8ed39649eaf926a4543b54560659129e3365953c4 \ --hash=sha256:e202810ee718bd01fc6ef49e8ea53d023d5cb6b581076d7925aa499fa55dbe64 @@ -772,9 +772,9 @@ google-crc32c==1.8.0 \ # via # google-cloud-storage # google-resumable-media -google-genai==2.10.0 \ - --hash=sha256:77912cd558cd7dfd5b75c25fd1c609e78d7954dde583331104022a46ea90f9ee \ - --hash=sha256:d5350311567ae660c24cbc1752aee4b3d660f89c0106d2dcd2a69978c35afe1e +google-genai==1.75.0 \ + --hash=sha256:56bac3991b311c93f980c0a2abcd287b672146905df1fbd71c92ed633d5a07cf \ + --hash=sha256:8dc4c096e7d6288c3087f6893f582fe52468932464781edb8193bd92b9fefb2c # via google-cloud-aiplatform google-resumable-media==2.10.0 \ --hash=sha256:88152884bee37b2bf36a0ab81ad8c7fd12212c9803dd981d77c1b35b02d34e7c \ @@ -1334,9 +1334,9 @@ openai==2.43.0 \ # via # litellm # openai-agents -openai-agents==0.17.7 \ - --hash=sha256:51b5ae43756eea37032e430f95979ba3999af6b1ade397df6c0ffeaf1939646a \ - --hash=sha256:ca76e7f882c9d8f06e3dfb8064cc33bcb5a5f34a29816cb9af863f395964ff0c +openai-agents==0.14.6 \ + --hash=sha256:e9d16b835f73be4c5e3798694f90d7a62efcade931e59416bc7462c850e15705 \ + --hash=sha256:fdd3fb459892c8af5d0b522908b544e96f6217c7254ba55e966424493b43c1ed # via strix-agent packaging==26.2 \ --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \ @@ -1481,15 +1481,17 @@ proto-plus==1.28.0 \ # google-api-core # google-cloud-aiplatform # google-cloud-resource-manager -protobuf==7.35.1 \ - --hash=sha256:11d6b0ec246892d85215b0a13ca6e0233cf5284b68f0ac02646427f4ff88a799 \ - --hash=sha256:230a75ddfc2de4806e56696ce9640c1cdfdb6543b7cfce98d42a4c0a0e7bdb87 \ - --hash=sha256:24f857477359a85c0c235261b8ba905fd51b2562f4a64ca1df5473f29850cbf6 \ - --hash=sha256:353652e4efd0bca5b5fc2656abf8307ef351f0cf938c9eba09f0e09c20a25c30 \ - --hash=sha256:4bc97768d8fe4ad6743c8a19403e314511ed9f6d13205b687e52421c023ac1b9 \ - --hash=sha256:74758715c53d7158fb76caf4f0cfdacc5329a4b1bb994f865d6cf302d413a1c4 \ - --hash=sha256:b73f9489a4b8b1c9cb1f8ed951c736392592edb24b9d6819f36d2e10b171d5b4 \ - --hash=sha256:ce115a26fe0c39a2c29973d914d327e516a6455464489fe3cd1e51a1b354f81a +protobuf==6.33.6 \ + --hash=sha256:0cd27b587afca21b7cfa59a74dcbd48a50f0a6400cfb59391340ad729d91d326 \ + --hash=sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901 \ + --hash=sha256:7d29d9b65f8afef196f8334e80d6bc1d5d4adedb449971fefd3723824e6e77d3 \ + --hash=sha256:9720e6961b251bde64edfdab7d500725a2af5280f3f4c87e57c0208376aa8c3a \ + --hash=sha256:a6768d25248312c297558af96a9f9c929e8c4cee0659cb07e780731095f38135 \ + --hash=sha256:bd56799fb262994b2c2faa1799693c95cc2e22c62f56fb43af311cae45d26f0e \ + --hash=sha256:c96c37eec15086b79762ed265d59ab204dabc53056e3443e702d2681f4b39ce3 \ + --hash=sha256:e2afbae9b8e1825e3529f88d514754e094278bb95eadc0e199751cdd9a2e82a2 \ + --hash=sha256:e9db7e292e0ab79dd108d7f1a94fe31601ce1ee3f7b79e0692043423020b0593 \ + --hash=sha256:f443a394af5ed23672bc6c486be138628fbe5c651ccbc536873d7da23d1868cf # via # google-api-core # google-cloud-aiplatform From cfc232f8bf747120fa37e919e359d9183137919e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 30 Jun 2026 19:07:51 +0900 Subject: [PATCH 2/3] Handle same-head Strix success check evidence --- scripts/ci/collect_failed_check_evidence.sh | 69 +++++++++++++++++++++ scripts/ci/test_strix_quick_gate.sh | 1 + 2 files changed, 70 insertions(+) diff --git a/scripts/ci/collect_failed_check_evidence.sh b/scripts/ci/collect_failed_check_evidence.sh index 0800a9482..be85e2aa1 100755 --- a/scripts/ci/collect_failed_check_evidence.sh +++ b/scripts/ci/collect_failed_check_evidence.sh @@ -209,12 +209,14 @@ failed_contexts="$(mktemp)" workflow_run_contexts="$(mktemp)" active_failed_contexts="$(mktemp)" manual_success_contexts="$(mktemp)" +manual_success_check_runs="$(mktemp)" superseded_failed_contexts="$(mktemp)" tmp_files=( "$failed_contexts" "$workflow_run_contexts" "$active_failed_contexts" "$manual_success_contexts" + "$manual_success_check_runs" "$superseded_failed_contexts" ) cleanup() { @@ -255,6 +257,20 @@ manual_success_for_label() { return 0 done <"$manual_success_contexts" + while IFS=$'\t' read -r success_context success_url success_description; do + if [ "$(printf '%s' "$success_context" | tr '[:upper:]' '[:lower:]')" != "$key" ]; then + continue + fi + success_run_id="$(printf '%s' "$success_url" | sed -n 's#.*/actions/runs/\([0-9][0-9]*\).*#\1#p')" + if [ -n "$failed_run_id" ] && + [ -n "$success_run_id" ] && + [ "$failed_run_id" -ge "$success_run_id" ]; then + continue + fi + printf '%s\t%s\t%s\n' "$success_context" "$success_url" "$success_description" + return 0 + done <"$manual_success_check_runs" + return 1 } @@ -339,6 +355,59 @@ gh api graphql \ | @tsv ' >"$failed_contexts" +gh api graphql \ + -f owner="$owner" \ + -f name="$repo" \ + -F number="$PR_NUMBER" \ + -f prId="$pr_node_id" \ + -f query=' + query($owner:String!,$name:String!,$number:Int!,$prId:ID!) { + repository(owner:$owner,name:$name) { + pullRequest(number:$number) { + statusCheckRollup { + contexts(first: 100) { + nodes { + __typename + ... on CheckRun { + name + status + conclusion + detailsUrl + isRequired(pullRequestId: $prId) + checkSuite { + workflowRun { + databaseId + workflow { + name + } + } + } + } + } + } + } + } + } + } + ' \ + --jq ' + (.data.repository.pullRequest.statusCheckRollup.contexts.nodes // []) + | map( + select(.__typename == "CheckRun") + | select((.status // "") == "COMPLETED") + | select((.conclusion // "" | ascii_upcase) == "SUCCESS") + | select((.name // "" | ascii_downcase) == "strix") + | select((.checkSuite.workflowRun.workflow.name // "") == "Strix Security Scan" or (.checkSuite.workflowRun.workflow.name // "") == "Strix") + | [ + "strix", + (.detailsUrl // ""), + "Current-head successful Strix check run superseded stale failed Strix evidence." + ] + ) + | .[] + | @tsv + ' >"$manual_success_check_runs" + env HEAD_SHA="$HEAD_SHA" gh run list \ --repo "$GH_REPOSITORY" \ --commit "$HEAD_SHA" \ diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index c1d4f9e59..86e9b7f03 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -797,6 +797,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" "A successful same-head manual workflow_dispatch Strix run may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL" "opencode review prompt allows only explicit same-head manual Strix evidence to supersede stale rollup failures" assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "Superseded failed checks" "failed-check evidence lists stale failed contexts superseded by current-head manual Strix evidence" assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "manual_success_contexts" "failed-check evidence compares explicit manual success statuses before active failures" + assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "manual_success_check_runs" "failed-check evidence compares successful same-head Strix check runs before active failures" assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "No active failed GitHub Checks remained after superseded checks were classified" "failed-check evidence reports no active failures after stale contexts are superseded" assert_file_contains "$REPO_ROOT/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "Strix vulnerability report window([[:space:]]|$)" "failed-check fallback detects numbered Strix vulnerability report windows with a POSIX ERE boundary" assert_file_not_contains "$REPO_ROOT/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "Strix vulnerability report window\\\\b" "failed-check fallback must not rely on non-portable grep -E word boundaries" From e3e2cdd1851e3ba7d49ef4f4dcbc59fdb31d7102 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 30 Jun 2026 19:30:13 +0900 Subject: [PATCH 3/3] Supersede stale Strix failures with success check runs --- .github/workflows/opencode-review.yml | 54 +++++++++++++++++++++++++++ scripts/ci/test_strix_quick_gate.sh | 1 + 2 files changed, 55 insertions(+) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index 0e68d07e2..d6530e99a 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -4037,6 +4037,57 @@ jobs: ' } + current_head_successful_strix_check_run() { + local owner="${GH_REPOSITORY%%/*}" + local name="${GH_REPOSITORY#*/}" + + gh api graphql \ + -f owner="$owner" \ + -f name="$name" \ + -F number="$PR_NUMBER" \ + -f query=' + query($owner:String!,$name:String!,$number:Int!) { + repository(owner:$owner,name:$name) { + pullRequest(number:$number) { + statusCheckRollup { + contexts(first: 100) { + nodes { + __typename + ... on CheckRun { + name + status + conclusion + completedAt + detailsUrl + checkSuite { + workflowRun { + workflow { + name + } + } + } + } + } + } + } + } + } + } + ' \ + --jq ' + (.data.repository.pullRequest.statusCheckRollup.contexts.nodes // []) + | map( + select(.__typename == "CheckRun") + | select((.status // "") == "COMPLETED") + | select((.conclusion // "" | ascii_upcase) == "SUCCESS") + | select((.name // "" | ascii_downcase) == "strix") + | select((.checkSuite.workflowRun.workflow.name // "") == "Strix Security Scan" or (.checkSuite.workflowRun.workflow.name // "") == "Strix") + ) + | sort_by(.completedAt // "") + | last.detailsUrl // empty + ' + } + latest_current_head_manual_strix_run() { local runs_json runs_json="$(mktemp)" @@ -4073,6 +4124,9 @@ jobs: local failed_strix_run_id manual_strix_success_target="$(current_head_manual_strix_success_status || true)" + if [ -z "$manual_strix_success_target" ]; then + manual_strix_success_target="$(current_head_successful_strix_check_run || true)" + fi if [ -n "$manual_strix_success_target" ]; then manual_strix_success_run_id="$(printf '%s' "$manual_strix_success_target" | sed -n 's#.*/actions/runs/\([0-9][0-9]*\).*#\1#p')" while IFS= read -r rollup_line; do diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 86e9b7f03..19c1760f4 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -795,6 +795,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "model name, title, severity, endpoint, and Code Locations/path:line evidence" "failed-check evidence collector names required Strix report fields" assert_file_contains "$workflow_file" "If bounded failed GitHub Check evidence contains active failed checks, treat it as a blocker until diagnosed." "opencode review prompt forces active failed-check diagnosis" assert_file_contains "$workflow_file" "A successful same-head manual workflow_dispatch Strix run may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL" "opencode review prompt allows only explicit same-head manual Strix evidence to supersede stale rollup failures" + assert_file_contains "$workflow_file" "current_head_successful_strix_check_run" "opencode approval gate treats same-head successful Strix check runs as stale Strix failure superseders" assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "Superseded failed checks" "failed-check evidence lists stale failed contexts superseded by current-head manual Strix evidence" assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "manual_success_contexts" "failed-check evidence compares explicit manual success statuses before active failures" assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "manual_success_check_runs" "failed-check evidence compares successful same-head Strix check runs before active failures"