Skip to content

Fix Strix CI lock for Python 3.13 #210

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
opencode-agent merged 3 commits into from
Jun 30, 2026
Merged

Fix Strix CI lock for Python 3.13 #210

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
274cc9a
Regenerate Strix CI lock for Python 3.13
seonghobae Jun 30, 2026
cfc232f
Handle same-head Strix success check evidence
seonghobae Jun 30, 2026
e3e2cdd
Supersede stale Strix failures with success check runs
seonghobae Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4037,6 +4037,57 @@ jobs:
'
}

current_head_successful_strix_check_run() {
local owner="${GH_REPOSITORY%%/*}"
local name="${GH_REPOSITORY#*/}"

gh api graphql \
-f owner="$owner" \
-f name="$name" \
-F number="$PR_NUMBER" \
-f query='
query($owner:String!,$name:String!,$number:Int!) {
repository(owner:$owner,name:$name) {
pullRequest(number:$number) {
statusCheckRollup {
contexts(first: 100) {
nodes {
__typename
... on CheckRun {
name
status
conclusion
completedAt
detailsUrl
checkSuite {
workflowRun {
workflow {
name
}
}
}
}
}
}
}
}
}
}
' \
--jq '
(.data.repository.pullRequest.statusCheckRollup.contexts.nodes // [])
| map(
select(.__typename == "CheckRun")
| select((.status // "") == "COMPLETED")
| select((.conclusion // "" | ascii_upcase) == "SUCCESS")
| select((.name // "" | ascii_downcase) == "strix")
| select((.checkSuite.workflowRun.workflow.name // "") == "Strix Security Scan" or (.checkSuite.workflowRun.workflow.name // "") == "Strix")
)
| sort_by(.completedAt // "")
| last.detailsUrl // empty
'
}

latest_current_head_manual_strix_run() {
local runs_json
runs_json="$(mktemp)"
Expand Down Expand Up @@ -4073,6 +4124,9 @@ jobs:
local failed_strix_run_id

manual_strix_success_target="$(current_head_manual_strix_success_status || true)"
if [ -z "$manual_strix_success_target" ]; then
manual_strix_success_target="$(current_head_successful_strix_check_run || true)"
fi
if [ -n "$manual_strix_success_target" ]; then
manual_strix_success_run_id="$(printf '%s' "$manual_strix_success_target" | sed -n 's#.*/actions/runs/\([0-9][0-9]*\).*#\1#p')"
while IFS= read -r rollup_line; do
Expand Down
34 changes: 18 additions & 16 deletions requirements-strix-ci-hashes.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# This file was autogenerated by uv via the following command:
# uv pip compile --generate-hashes --python-version 3.14 --python-platform x86_64-manylinux_2_28 --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt
# uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-manylinux_2_28 --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt
aiohappyeyeballs==2.6.2 \
--hash=sha256:4708045e2d7a6c6bdf8aafa8ed39649eaf926a4543b54560659129e3365953c4 \
--hash=sha256:e202810ee718bd01fc6ef49e8ea53d023d5cb6b581076d7925aa499fa55dbe64
Expand Down Expand Up @@ -772,9 +772,9 @@ google-crc32c==1.8.0 \
# via
# google-cloud-storage
# google-resumable-media
google-genai==2.10.0 \
--hash=sha256:77912cd558cd7dfd5b75c25fd1c609e78d7954dde583331104022a46ea90f9ee \
--hash=sha256:d5350311567ae660c24cbc1752aee4b3d660f89c0106d2dcd2a69978c35afe1e
google-genai==1.75.0 \
--hash=sha256:56bac3991b311c93f980c0a2abcd287b672146905df1fbd71c92ed633d5a07cf \
--hash=sha256:8dc4c096e7d6288c3087f6893f582fe52468932464781edb8193bd92b9fefb2c
# via google-cloud-aiplatform
google-resumable-media==2.10.0 \
--hash=sha256:88152884bee37b2bf36a0ab81ad8c7fd12212c9803dd981d77c1b35b02d34e7c \
Expand Down Expand Up @@ -1334,9 +1334,9 @@ openai==2.43.0 \
# via
# litellm
# openai-agents
openai-agents==0.17.7 \
--hash=sha256:51b5ae43756eea37032e430f95979ba3999af6b1ade397df6c0ffeaf1939646a \
--hash=sha256:ca76e7f882c9d8f06e3dfb8064cc33bcb5a5f34a29816cb9af863f395964ff0c
openai-agents==0.14.6 \
--hash=sha256:e9d16b835f73be4c5e3798694f90d7a62efcade931e59416bc7462c850e15705 \
--hash=sha256:fdd3fb459892c8af5d0b522908b544e96f6217c7254ba55e966424493b43c1ed
# via strix-agent
packaging==26.2 \
--hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
Expand Down Expand Up @@ -1481,15 +1481,17 @@ proto-plus==1.28.0 \
# google-api-core
# google-cloud-aiplatform
# google-cloud-resource-manager
protobuf==7.35.1 \
--hash=sha256:11d6b0ec246892d85215b0a13ca6e0233cf5284b68f0ac02646427f4ff88a799 \
--hash=sha256:230a75ddfc2de4806e56696ce9640c1cdfdb6543b7cfce98d42a4c0a0e7bdb87 \
--hash=sha256:24f857477359a85c0c235261b8ba905fd51b2562f4a64ca1df5473f29850cbf6 \
--hash=sha256:353652e4efd0bca5b5fc2656abf8307ef351f0cf938c9eba09f0e09c20a25c30 \
--hash=sha256:4bc97768d8fe4ad6743c8a19403e314511ed9f6d13205b687e52421c023ac1b9 \
--hash=sha256:74758715c53d7158fb76caf4f0cfdacc5329a4b1bb994f865d6cf302d413a1c4 \
--hash=sha256:b73f9489a4b8b1c9cb1f8ed951c736392592edb24b9d6819f36d2e10b171d5b4 \
--hash=sha256:ce115a26fe0c39a2c29973d914d327e516a6455464489fe3cd1e51a1b354f81a
protobuf==6.33.6 \
--hash=sha256:0cd27b587afca21b7cfa59a74dcbd48a50f0a6400cfb59391340ad729d91d326 \
--hash=sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901 \
--hash=sha256:7d29d9b65f8afef196f8334e80d6bc1d5d4adedb449971fefd3723824e6e77d3 \
--hash=sha256:9720e6961b251bde64edfdab7d500725a2af5280f3f4c87e57c0208376aa8c3a \
--hash=sha256:a6768d25248312c297558af96a9f9c929e8c4cee0659cb07e780731095f38135 \
--hash=sha256:bd56799fb262994b2c2faa1799693c95cc2e22c62f56fb43af311cae45d26f0e \
--hash=sha256:c96c37eec15086b79762ed265d59ab204dabc53056e3443e702d2681f4b39ce3 \
--hash=sha256:e2afbae9b8e1825e3529f88d514754e094278bb95eadc0e199751cdd9a2e82a2 \
--hash=sha256:e9db7e292e0ab79dd108d7f1a94fe31601ce1ee3f7b79e0692043423020b0593 \
--hash=sha256:f443a394af5ed23672bc6c486be138628fbe5c651ccbc536873d7da23d1868cf
# via
# google-api-core
# google-cloud-aiplatform
Expand Down
69 changes: 69 additions & 0 deletions scripts/ci/collect_failed_check_evidence.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,12 +209,14 @@ failed_contexts="$(mktemp)"
workflow_run_contexts="$(mktemp)"
active_failed_contexts="$(mktemp)"
manual_success_contexts="$(mktemp)"
manual_success_check_runs="$(mktemp)"
superseded_failed_contexts="$(mktemp)"
tmp_files=(
"$failed_contexts"
"$workflow_run_contexts"
"$active_failed_contexts"
"$manual_success_contexts"
"$manual_success_check_runs"
"$superseded_failed_contexts"
)
cleanup() {
Expand Down Expand Up @@ -255,6 +257,20 @@ manual_success_for_label() {
return 0
done <"$manual_success_contexts"

while IFS=$'\t' read -r success_context success_url success_description; do
if [ "$(printf '%s' "$success_context" | tr '[:upper:]' '[:lower:]')" != "$key" ]; then
continue
fi
success_run_id="$(printf '%s' "$success_url" | sed -n 's#.*/actions/runs/\([0-9][0-9]*\).*#\1#p')"
if [ -n "$failed_run_id" ] &&
[ -n "$success_run_id" ] &&
[ "$failed_run_id" -ge "$success_run_id" ]; then
continue
fi
printf '%s\t%s\t%s\n' "$success_context" "$success_url" "$success_description"
return 0
done <"$manual_success_check_runs"

return 1
}

Expand Down Expand Up @@ -339,6 +355,59 @@ gh api graphql \
| @tsv
' >"$failed_contexts"

gh api graphql \
-f owner="$owner" \
-f name="$repo" \
-F number="$PR_NUMBER" \
-f prId="$pr_node_id" \
-f query='
query($owner:String!,$name:String!,$number:Int!,$prId:ID!) {
repository(owner:$owner,name:$name) {
pullRequest(number:$number) {
statusCheckRollup {
contexts(first: 100) {
nodes {
__typename
... on CheckRun {
name
status
conclusion
detailsUrl
isRequired(pullRequestId: $prId)
checkSuite {
workflowRun {
databaseId
workflow {
name
}
}
}
}
}
}
}
}
}
}
' \
--jq '
(.data.repository.pullRequest.statusCheckRollup.contexts.nodes // [])
| map(
select(.__typename == "CheckRun")
| select((.status // "") == "COMPLETED")
| select((.conclusion // "" | ascii_upcase) == "SUCCESS")
| select((.name // "" | ascii_downcase) == "strix")
| select((.checkSuite.workflowRun.workflow.name // "") == "Strix Security Scan" or (.checkSuite.workflowRun.workflow.name // "") == "Strix")
| [
"strix",
(.detailsUrl // ""),
"Current-head successful Strix check run superseded stale failed Strix evidence."
]
)
| .[]
| @tsv
' >"$manual_success_check_runs"

env HEAD_SHA="$HEAD_SHA" gh run list \
--repo "$GH_REPOSITORY" \
--commit "$HEAD_SHA" \
Expand Down
2 changes: 2 additions & 0 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -795,8 +795,10 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "model name, title, severity, endpoint, and Code Locations/path:line evidence" "failed-check evidence collector names required Strix report fields"
assert_file_contains "$workflow_file" "If bounded failed GitHub Check evidence contains active failed checks, treat it as a blocker until diagnosed." "opencode review prompt forces active failed-check diagnosis"
assert_file_contains "$workflow_file" "A successful same-head manual workflow_dispatch Strix run may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL" "opencode review prompt allows only explicit same-head manual Strix evidence to supersede stale rollup failures"
assert_file_contains "$workflow_file" "current_head_successful_strix_check_run" "opencode approval gate treats same-head successful Strix check runs as stale Strix failure superseders"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "Superseded failed checks" "failed-check evidence lists stale failed contexts superseded by current-head manual Strix evidence"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "manual_success_contexts" "failed-check evidence compares explicit manual success statuses before active failures"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "manual_success_check_runs" "failed-check evidence compares successful same-head Strix check runs before active failures"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" "No active failed GitHub Checks remained after superseded checks were classified" "failed-check evidence reports no active failures after stale contexts are superseded"
assert_file_contains "$REPO_ROOT/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "Strix vulnerability report window([[:space:]]|$)" "failed-check fallback detects numbered Strix vulnerability report windows with a POSIX ERE boundary"
assert_file_not_contains "$REPO_ROOT/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "Strix vulnerability report window\\\\b" "failed-check fallback must not rely on non-portable grep -E word boundaries"
Expand Down
Loading