fix(coverage): materialize trusted uv lock dependencies - #743
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough신뢰된 기준 커밋에서 Changes신뢰된 uv materialization
Strix NVIDIA NIM fallback
저장소 품질 및 workflow 회귀
의존성 및 release updates
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='2ef7a3661d26aa17636fc562f51531993c21313b'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git diff-tree --no-commit-id --name-status -r "$expected"
printf '\n--- IMPLEMENTATION OUTLINE ---\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
printf '\n--- TEST OUTLINES ---\n'
for f in \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_trusted_uv_download_contract.py \
tests/test_uv_export_isolation_contract.py
do
printf '\n### %s ###\n' "$f"
ast-grep outline "$f" --items all --view expanded
done
printf '\n--- IMPLEMENTATION ---\n'
cat -n scripts/ci/materialize_base_python_requirements.py
printf '\n--- FOCUSED TESTS ---\n'
for f in \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_trusted_uv_download_contract.py \
tests/test_uv_export_isolation_contract.py
do
printf '\n### %s ###\n' "$f"
cat -n "$f"
done
printf '\n--- DESIGN RECORD ---\n'
cat -n docs/doctoring/trusted-uv-lock-materialization.mdLength of output: 81216 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='2ef7a3661d26aa17636fc562f51531993c21313b'
printf '%s\n' '--- REF AND MERGE-BASE DISCOVERY ---'
git remote -v
git branch -a --contains "$head" || true
for ref in origin/main origin/master main master; do
if git rev-parse --verify --quiet "$ref" >/dev/null; then
base="$(git merge-base "$ref" "$head")"
printf 'REF=%s MERGE_BASE=%s\n' "$ref" "$base"
git diff --name-status "$base" "$head"
fi
done
printf '%s\n' '--- PULL REQUEST METADATA ---'
gh pr view 743 --repo ContextualWisdomLab/.github --json baseRefName,baseRefOid,headRefName,headRefOid,isDraft,state,mergeStateStatus,statusCheckRollup
printf '%s\n' '--- REDIRECT AND OUTPUT-VALIDATION CALL SITES ---'
rg -n -C 4 --glob '*.py' \
'geturl\(\)|urlparse\(|TRUSTED_UV_ARCHIVE_URL|_is_fully_hash_pinned_requirement|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE' \
scripts tests
printf '%s\n' '--- QUALITY CONFIGURATION CANDIDATES ---'
fd -H -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc|ruff\.toml)$' . \
-E .git -E node_modules -E dist -E build \
-x sh -c 'printf "\n### %s ###\n" "$1"; cat -n "$1"' sh {}
printf '%s\n' '--- DOCSTRING AND COVERAGE REFERENCES ---'
rg -n -C 3 --hidden \
'(branch\s*=\s*true|--cov-branch|fail_under|docstring|pydocstyle|D[0-9]{3}|materialize_base_python_requirements)' \
-g '!**/.git/**' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' .Length of output: 109425
I found two blockers.
The reviewed implementation otherwise matches the requested boundaries:
I did not execute repository tests because the review sandbox prohibits execution of repository code. Pull request ✅ Action performedReview finished.
|
|
Addressed both exact-head CodeRabbit blockers in
@coderabbitai review |
|
@opencode-agent @cwl-noema-review The PR is now Ready for Review. Review exact current head |
|
@opencode-agent @cwl-noema-review review-only exact-current-head request for |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
printf '%s\n' '--- EXACT REVISION, PR, AND CHECK STATE ---'
printf 'checked_out=%s expected=%s\n' "$(git rev-parse HEAD)" "$head"
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
gh pr view 743 --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,details_url}]'
printf '%s\n' '--- EXACT DIFF, ACTIVE THREADS, AND TEMPORARY WRITERS ---'
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
rg -n -C 3 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|git push|gh pr|pull_request_target|PR_NUMBER|pull_request\.number)' \
.github/workflows || true
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=743 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
printf '%s\n' '--- TRUSTED UV STATIC MAP ---'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
rg -n -C 12 \
'^def (_list_regular_files|_read_base|_download_trusted_uv_archive|_install_trusted_uv|_run_uv_export|_export_uv_lock)|TRUSTED_UV_|ProxyHandler|HTTPRedirectHandler|urlparse\(|parsed\.port|urlopen\(|tomli|tool\.uv\.workspace|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- GIT ISOLATION, QUALITY, AND STRIX CONTRACTS ---'
sed -n '850,1020p' .github/workflows/opencode-review-dispatch.yml
sed -n '1,180p' tests/test_repository_branch_coverage_pr743_cleanup.py
rg -n -C 8 \
'branch = true|fail_under = 100|python-version: "3\.10"|python-version: "3\.14"|--cov-branch|docstring|py_compile|head\.sha|persist-credentials' \
pyproject.toml .github/workflows/trusted-uv-materializer-quality-ci.yml \
tests/test_trusted_uv_materializer_quality_workflow_contract.py
rg -n -C 10 \
'STRIX_MODEL_REQUESTED|nemotron-3-super-120b-a12b|gpt-5\.6-luna|COPILOT_GITHUB_TOKEN|is_nvidia_nim_not_found_error|NotFoundError|catalog|same.model|same_model|vulnerab' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
printf '%s\n' '--- PORTABILITY, STREAMING, EXPORT, AND DOCTORING CONTRACTS ---'
for file in \
tests/test_trusted_uv_portability_and_streaming.py \
tests/test_uv_workspace_fail_closed.py \
tests/test_uv_export_isolation_contract.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_redirect_and_coverage_contract.py \
docs/doctoring/trusted-uv-lock-materialization.md \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md
do
printf '\n### %s ###\n' "$file"
rg -n -C 4 \
'(platform|x86_64|stream|chunk|size|sha256|workspace|nested|orphan|tracked|frozen|offline|no-cache|hash|exact|redirect|port|APA|References|limitation|fallback|NVIDIA)' \
"$file"
done
printf '%s\n' '--- CHANGED WORKFLOW ACTION PINS ---'
git diff --name-only "$base" "$head" -- .github/workflows | while IFS= read -r path; do
printf '### %s ###\n' "$path"
rg -n '^\s*uses:\s+' "$path" || true
doneLength of output: 160186 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
test "$(git rev-parse HEAD)" = "$head"
printf '%s\n' '--- CURRENT PR AND CHECK STATUS ---'
gh pr view 743 --repo "$repo" --json headRefOid,baseRefOid,isDraft,state,mergeStateStatus \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | {name,status,conclusion,details_url}]'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=743 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)] | length'
printf '%s\n' '--- PROTECTED BRANCH REQUIREMENTS ---'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution,required_signatures,required_linear_history,allow_force_pushes,allow_deletions}' \
|| true
printf '%s\n' '--- TRUSTED UV DOWNLOAD, INSTALL, AND BASE-READ CODE ---'
sed -n '1,300p' scripts/ci/materialize_base_python_requirements.py
sed -n '340,550p' scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- STRIX CREDENTIAL AND DEPENDENCY FLOOR CHECK ---'
rg -n -C 3 'COPILOT_GITHUB_TOKEN|STRIX_GITHUB_MODELS_TOKEN|NVIDIA_NIM_API_KEY' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh
rg -n -C 2 '^(aiohttp|cryptography)==' \
requirements-strix-ci.txt requirements-strix-ci-hashes.txtLength of output: 38757
I found no current source-level actionable finding. I verified these controls:
I cannot approve this PR now. The current exact-head You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review the current exact head only. Re-evaluate every unresolved or predecessor-head concern against the current diff, with special attention to the complete adjacent Git environment block: the only accepted trust entry is |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf '%s\n' '--- EXACT REVISION ---'
printf 'checked_out=%s\nhead=%s\nbase=%s\n' "$(git rev-parse HEAD)" "$head" "$base"
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
printf '%s\n' '--- PR, CHECKS, AND THREADS ---'
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
printf '%s\n' '--- BRANCH PROTECTION ---'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution,required_signatures,required_linear_history}' \
|| printf '%s\n' 'Branch-protection API was not available to this review token.'
printf '%s\n' '--- COMPLETE GIT ISOLATION BLOCKS ---'
awk '
/ trusted_git\(\) \{/ { exit }
{ lines[++n] = $0 }
END {
expected[1]=" GIT_CONFIG_NOSYSTEM=1 \\"
expected[2]=" GIT_CONFIG_GLOBAL=/dev/null \\"
expected[3]=" GIT_CONFIG_COUNT=1 \\"
expected[4]=" GIT_CONFIG_KEY_0=safe.directory \\"
expected[5]=" GIT_CONFIG_VALUE_0=/work \\"
count=0
for (i=1; i<=n-4; i++) {
ok=1
for (j=1; j<=5; j++) if (lines[i+j-1] != expected[j]) ok=0
if (ok) count++
}
print "complete_adjacent_blocks=" count
}
' .github/workflows/opencode-review-dispatch.yml
sed -n '850,1020p' .github/workflows/opencode-review-dispatch.yml
sed -n '1,180p' tests/test_repository_branch_coverage_pr743_cleanup.py
printf '%s\n' '--- TRUSTED UV BOUNDARIES ---'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
rg -n -C 10 \
'TRUSTED_UV_|ProxyHandler|HTTPRedirectHandler|urlparse\(|parsed\.port|_list_regular_files|_read_base|tool\.uv\.workspace|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|symlink|S_IS' \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_trusted_uv_portability_and_streaming.py \
tests/test_uv_workspace_fail_closed.py \
tests/test_uv_export_isolation_contract.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_redirect_and_coverage_contract.py
printf '%s\n' '--- QUALITY, PINS, LOCKS, AND DOCTORING ---'
rg -n -C 8 \
'branch = true|fail_under = 100|python-version: "3\.10"|python-version: "3\.14"|--cov-branch|docstring|py_compile|head\.sha|persist-credentials' \
pyproject.toml \
.github/workflows/trusted-uv-materializer-quality-ci.yml \
tests/test_trusted_uv_materializer_quality_workflow_contract.py
rg -n -C 8 \
'STRIX_MODEL_REQUESTED|NVIDIA_NIM_API_KEY|STRIX_GITHUB_MODELS_TOKEN|COPILOT_GITHUB_TOKEN|is_nvidia_nim_not_found_error|NotFoundError|catalog|same.model|vulnerab' \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
rg -n -C 2 '^(aiohttp|cryptography)==' \
requirements-strix-ci.txt requirements-strix-ci-hashes.txt
rg -n -C 4 \
'(APA|References|uv\.lock|workspace|nested|coverage|branch|100%|limitation|Astral|NVIDIA|404|fallback)' \
docs/doctoring/trusted-uv-lock-materialization.md \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md
printf '%s\n' '--- WORKFLOW PINS AND TEMPORARY WRITER INVENTORY ---'
git diff --name-only "$base" "$head" -- .github/workflows | while IFS= read -r path; do
printf '### %s ###\n' "$path"
rg -n '^\s*uses:\s+' "$path" || true
done
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' \
|| true
rg -n -C 3 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|git push|gh pr|pull_request_target)' \
.github/workflows || trueLength of output: 205289 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-sQ5Yhx'
repo='ContextualWisdomLab/.github'
pr='743'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf '%s\n' '--- CAPTURED EXACT-HEAD METADATA ---'
rg -n -A180 -B2 -- \
'--- EXACT REVISION ---|--- PR, CHECKS, AND THREADS ---|--- BRANCH PROTECTION ---|--- COMPLETE GIT ISOLATION BLOCKS ---' \
"$log" | sed -n '1,500p'
printf '%s\n' '--- CURRENT NARROW STATUS ---'
printf 'checked_out=%s\nhead=%s\nbase=%s\n' "$(git rev-parse HEAD)" "$head" "$base"
test "$(git rev-parse HEAD)" = "$head"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | {name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)] | length'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution}' \
|| printf '%s\n' 'Branch-protection API was not available to this review token.'
printf '%s\n' '--- GIT TRUST BOUNDARY ---'
rg -n -C 10 \
'GIT_CONFIG_NOSYSTEM=1|GIT_CONFIG_GLOBAL=/dev/null|GIT_CONFIG_COUNT=1|GIT_CONFIG_KEY_0=safe\.directory|GIT_CONFIG_VALUE_0=/work|safe\.directory|trusted_git\(\)' \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py \
tests/test_repository_branch_coverage_pr743_cleanup.py
printf 'safe-directory values before trusted_git: '
sed -n '1,/^[[:space:]]*trusted_git()[[:space:]]*{/p' .github/workflows/opencode-review-dispatch.yml \
| rg 'GIT_CONFIG_VALUE_[0-9]+=|GIT_CONFIG_KEY_[0-9]+=' \
|| true
printf '%s\n' '--- IMMUTABLE READ, DOWNLOAD, AND FILE-TYPE BOUNDARIES ---'
rg -n -C 16 \
'^def (_list_regular_files|_read_base|_download_trusted_uv_archive|_install_trusted_uv|base_hash_locks|materialize)|git.*ls-tree|git.*show|stat\.S_ISREG|is_symlink|tarfile|extract|member\.isreg|member\.issym|TRUSTED_UV_ARCHIVE_SHA256|hashlib\.sha256|platform\.system|platform\.machine|UV_VERSION' \
scripts/ci/materialize_base_python_requirements.pyLength of output: 78347
I found no current source-level blocker. I verified these controls:
I cannot approve this PR yet. GitHub reports Use a token with branch-protection read access, or resolve the blocked policy state. Then request an exact-head approval review again. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Please perform the final independent exact-head review for |
|
@opencode-agent @cwl-noema-review Please review exact current head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: PASS - current-head Coverage Decision PASS plus no failed checks and no unresolved threads on head 91f0e36. Verification posture: bounded evidence + CodeGraph verbatim source + coverage PASS; changed-file evidence inspected includes .github/workflows/opencode-review-dispatch.yml (lines 876/999) and .github/workflows/strix.yml (line 446). Linter/static: lint contract (hadolint Dockerfile) targets an unchanged Dockerfile; no lint findings in evidence. TDD/regression: 15 added/updated test files including hermetic-Git cleanup regression, uv redirect/workspace-fail-closed/export-isolation/download/portability boundaries, and NIM-fallback tests. Coverage: PASS - Coverage execution evidence: supported repository test suites passed (python3 -m coverage run -m pytest tests with --fail-under=100). Docstring coverage: PASS - configured repository docstring gates passed or advisory per Coverage execution evidence. DAG: source-backed flowchart mapping trusted-uv-materializer-quality-ci.yml and materialize_base_python_requirements.py to exact-base uv.lock materialization, sandbox git isolation, NIM fallback, and the passing boundary-test suite (head flow). PoC/execution: coverage execution evidence at head; no browser receipts (non-web repository). DDD/domain: CI/ops domain - trusted supply-chain materialization boundary with fail-closed transport. CDD/context: workflow context - coverage evidence, review dispatch, and Strix security gate. Similar issues: prior heads 7f270b3..59c5e0b iterated against CodeRabbit/opencode-agent findings; current-head thread evidence shows all resolved. Claim/concept check: PR claims exact-base offline hash-pinned materialization - corroborated by verbatim source (fixed SHA-256 pin, no-proxy/no-redirect, 64 MiB caps, hash-pin detection, workspace fail-closed) and the passing boundary tests. Standards search: GitHub Actions/git/uv semantics verified via hunks and repository tests; no external numerical/scientific claims. Compatibility/convention: multi-word identifiers only; no DB/API objects; pinned action SHAs. Breaking-change/backcompat: strix default model rename is internal to CI; keyless/private fallback preserves prior behavior. Performance: bounded uv download (120s timeout, 64 MiB caps) and streaming portability tests. Developer experience: review-dispatch sandbox hardening removes false git-ownership failures. User experience: non-web surface - CI workflow logs and review-gate output. Visual/DOM: non-web interaction surface reviewed (workflow/review-comment output); no DOM surface. Accessibility/i18n: non-web; not applicable. Supply-chain/license: CodeQL v4.37.5 single SHA d1ba80a13dd99fba24a470575428917156a28b43; requirements-strix-ci-hashes.txt refreshed with hashes; trusted uv archive SHA-pinned. Packaging: pyproject.toml requires-python >=3.10; quality workflow runs 3.10/3.14; unpackaged_source_surfaces is empty. Security/privacy: hermetic git config (GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_GLOBAL=/dev/null, safe.directory=/work) on all three sandboxes, token vars unset, redirect rejection and workspace fail-closed in the materializer.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review-dispatch.yml, .github/workflows/scheduled-security-scan.yml, .github/workflows/strix.yml, .github/workflows/trusted-uv-materializer-quality-ci.yml, CHANGELOG.md, and 28 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review-dispatch.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/opencode-review-dispatch.yml","line":876,"hypothesis":"Sandboxed git subprocesses still read host system/global git config or lack safe.directory, leaking protected config or failing ownership checks on the PR-controlled checkout.","attack_or_counterexample":"Run git config --show-origin --list inside the sandbox env block and assert only GIT_CONFIG_COUNT/GIT_CONFIG_KEY_0/GIT_CONFIG_VALUE_0 entries resolve with no host global/system sources.","evidence":"Focused current-head hunk at .github/workflows/opencode-review-dispatch.yml:876 shows GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null added adjacent to GIT_CONFIG_COUNT=1/GIT_CONFIG_KEY_0=safe.directory/GIT_CONFIG_VALUE_0=/work in all three sandbox blocks; the historical repair request documented tests/test_repository_branch_coverage_pr743_cleanup.py::test_opencode_runtime_git_calls_use_fully_isolated_configuration as RED before these entries, and current-head Coverage execution evidence reports the repository test suite passed at head 91f0e361 including that added regression file. source-line-sha256=751bff917d422021e1cdea1ba76d73288117f740166a5214be928b6ddd309354","outcome":"falsified"},{"path":".github/workflows/strix.yml","line":446,"hypothesis":"The NVIDIA NIM model rename to nemotron-3-super-120b-a12b is applied in only some branches, so the public-repo default path selects a stale 404 model or the missing-key fallback no longer triggers.","attack_or_counterexample":"Trace the default public-repo path with no NVIDIA_NIM_API_KEY: assert the model falls back to gpt-5.6-luna and that the nvidia_nim case branch and strix_llm_file write branch match the new model name.","evidence":"Focused current-head hunk at .github/workflows/strix.yml:446 renames both the STRIX_MODEL default expression and the [ -z \"$STRIX_NVIDIA_NIM_API_KEY\" ] fallback condition to nemotron-3-super-120b-a12b, and the following case branch and strix_llm_file write sites are renamed identically; added tests/test_strix_nvidia_nim_not_found_fallback.py (261 lines) and docs/doctoring/strix-nvidia-nim-not-found-fallback.md pin the 404-fallback semantics, and current-head Coverage execution evidence reports the suite passed at head 91f0e361. source-line-sha256=54200615d828241e847e3eb8e56055e22285519a97b29f377ce96a49229dac52","outcome":"falsified"}],"residual_risk":"Focused-hunks packet truncation at ~12 KB of 213 KB prevents independent line-level review of the full materialize_base_python_requirements.py diff, the new trusted-uv-materializer-quality-ci.yml body, and strix_quick_gate.sh; approval rests on the verbatim CodeGraph source of the security-critical boundary, the 100%-statement coverage PASS at head, absence of failed checks and unresolved threads, and consistency of all visible hunks. The strix.yml hunk region beyond line ~798 (receipt line 864) was not fully visible."}- Result: APPROVE
- Reason: Current-head evidence affirmatively supports PR #743: Coverage execution evidence reports supported repository test suites passed at head 91f0e36, no active failed GitHub Checks, no unresolved review threads, and every visible workflow hunk is internally consistent (hermetic GIT_CONFIG isolation on all three sandbox blocks, CodeQL v4.37.5 single-SHA alignment, NVIDIA NIM rename in lockstep across default/fallback/case/llm-write).
- Head SHA:
91f0e3616897f47a40029ae5ca5846f0b84a75e9 - Workflow run: 30996997972
- Workflow attempt: 1
|
Review-only exact-current-head dispatch. Do not update branches or merge. Re-evaluate trusted-base uv materialization, Python 3.10/3.14 portability, 100% production statement/branch coverage and docstrings, secure Strix locks, Git configuration isolation, and absence of temporary write-capable workflows. |
|
@cwl-noema-review Independently review the exact current head. Confirm the uv lock parser and bootstrap are bound to the validated base SHA, offline export is fail-closed, Git configuration is hermetic, secure dependency floors remain intact, and no pull-request-controlled code can reach a write credential. |
|
@coderabbitai review Please perform a fresh exact-current-head review after all bounded repair commits. Treat predecessor-head approvals and cancelled or absent checks as stale. |
Rate Limit Exceeded
|
|
@coderabbitai review Please review exact current head @opencode-agent Review this same exact head after all current-head checks complete. @cwl-noema-review Independently review this same exact head; do not reuse predecessor-head evidence. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
printf '%s\n' '--- EXACT REVISION AND PR STATE ---'
printf 'checked_out=%s expected=%s\n' "$(git rev-parse HEAD)" "$head"
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution}' \
|| printf '%s\n' 'Branch-protection API unavailable to this token.'
printf '%s\n' '--- DIFF AND TEMPORARY-WRITER INVENTORY ---'
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
rg -n -C 2 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|git push|gh pr|pull_request_target)' \
.github/workflows || true
printf '%s\n' '--- TRUSTED UV IMPLEMENTATION AND CONTRACT TEST MAP ---'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
rg -n -C 10 \
'^def (_list_regular_files|_read_base|_download_trusted_uv_archive|_install_trusted_uv|_run_uv_export|_export_uv_lock)|TRUSTED_UV_|ProxyHandler|HTTPRedirectHandler|urlparse\(|parsed\.port|urlopen\(|tarfile|member\.isreg|platform\.system|platform\.machine|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|tool\.uv\.workspace' \
scripts/ci/materialize_base_python_requirements.py
for path in \
tests/test_trusted_uv_portability_and_streaming.py \
tests/test_uv_workspace_fail_closed.py \
tests/test_uv_export_isolation_contract.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_redirect_and_coverage_contract.py
do
printf '\n### %s ###\n' "$path"
rg -n -C 4 '(sha256|redirect|port|stream|chunk|platform|workspace|nested|orphan|tracked|frozen|offline|no-cache|exact|hash)' "$path"
done
printf '%s\n' '--- GIT ISOLATION, QUALITY, AND STRIX CONTRACTS ---'
sed -n '850,1020p' .github/workflows/opencode-review-dispatch.yml
sed -n '1,180p' tests/test_repository_branch_coverage_pr743_cleanup.py
rg -n -C 8 \
'branch = true|fail_under = 100|python-version: "3\.10"|python-version: "3\.14"|--cov-branch|docstring|py_compile|head\.sha|persist-credentials' \
pyproject.toml .github/workflows/trusted-uv-materializer-quality-ci.yml \
tests/test_trusted_uv_materializer_quality_workflow_contract.py
rg -n -C 10 \
'STRIX_MODEL_REQUESTED|STRIX_GITHUB_MODELS_TOKEN|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|nemotron|is_nvidia_nim_not_found_error|NotFoundError|catalog|same.model|vulnerab' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
printf '%s\n' '--- DOCSTRINGS, LOCK FLOORS, AND DOCTORING ---'
python3 - <<'PY'
import ast
from pathlib import Path
missing = []
for path in Path("scripts/ci").rglob("*.py"):
tree = ast.parse(path.read_text(encoding="utf-8"))
for node in ast.walk(tree):
if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
if not node.name.startswith("_") and not ast.get_docstring(node):
missing.append((str(path), node.name, node.lineno))
print("missing_public_docstrings=", missing)
PY
rg -n -C 2 '^(aiohttp|cryptography)==' requirements-strix-ci.txt requirements-strix-ci-hashes.txt
rg -n -C 3 \
'(APA|References|uv\.lock|workspace|nested|coverage|branch|100%|Astral|NVIDIA|404|fallback)' \
docs/doctoring/trusted-uv-lock-materialization.md \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md
printf '%s\n' '--- CHANGED WORKFLOW ACTION PINS ---'
git diff --name-only "$base" "$head" -- .github/workflows | while IFS= read -r path; do
printf '### %s ###\n' "$path"
rg -n '^\s*uses:\s+' "$path" || true
doneLength of output: 178298 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
log='/tmp/coderabbit-shell-logs/shell-output-4G9BCe'
printf '%s\n' '--- EXACT-HEAD STATUS ---'
printf 'checked_out=%s expected=%s\n' "$(git rev-parse HEAD)" "$head"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | {name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution}' \
|| printf '%s\n' 'Branch-protection API unavailable to this token.'
printf '%s\n' '--- TRUSTED UV CORE ---'
nl -ba scripts/ci/materialize_base_python_requirements.py | sed -n '1,330p'
nl -ba scripts/ci/materialize_base_python_requirements.py | sed -n '340,560p'
printf '%s\n' '--- EXACT CHECKS, TEMPORARY-WRITER INVENTORY, AND DIFF ERRORS ---'
rg -n -A120 -B2 -- '--- EXACT REVISION AND PR STATE ---' "$log" | sed -n '1,180p'
printf 'temporary-artifacts:\n'
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
printf 'diff-check:\n'
git diff --check "$base" "$head"Length of output: 2949 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
printf '%s\n' '--- TRUSTED UV SOURCE: CONSTANTS, DOWNLOAD, AND INSTALL ---'
sed -n '1,330p' scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- TRUSTED UV SOURCE: BASE TREE, EXPORT, AND ENTRY POINT ---'
sed -n '340,560p' scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- SOURCE-LEVEL SECURITY MARKERS ---'
grep -nE \
'TRUSTED_UV_ARCHIVE_(URL|SHA256)|ProxyHandler|HTTPRedirectHandler|urlparse|parsed\.port|platform\.(system|machine)|member\.isreg|sha256|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|stat\.S_ISREG|tool\.uv\.workspace' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- TEMPORARY-WRITER INVENTORY AND DIFF CHECK ---'
matches="$(fd -H -t f . .github scripts tests docs 2>/dev/null | grep -Ei '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true)"
if [ -n "$matches" ]; then
printf '%s\n' "$matches"
else
printf '%s\n' 'none'
fi
git diff --check "$base" "$head"Length of output: 22830
I found no current source-level actionable issue. I verified the requested controls:
GitHub reports that PR You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Re-evaluate the exact current head only. Preserve trusted-base lock materialization, secure Strix NVIDIA NIM fallback, 100% statement/branch/docstring gates, isolated Git configuration, and all protected review credentials. Do not bypass branch protection or reuse predecessor-head evidence. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf '%s\n' '--- EXACT CURRENT REVISION AND PR STATE ---'
printf 'checked_out=%s\nhead=%s\nbase=%s\n' "$(git rev-parse HEAD)" "$head" "$base"
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergedAt,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergedAt,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
printf '%s\n' '--- BRANCH PROTECTION ---'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution,required_signatures,required_linear_history}' \
|| printf '%s\n' 'Branch-protection API unavailable to this review token.'
printf '%s\n' '--- CURRENT DIFF AND WRITE-CAPABLE AUTOMATION ---'
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
rg -n -C 2 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|git push|gh pr|pull_request_target)' \
.github/workflows || true
printf '%s\n' '--- TRUSTED UV SOURCE BOUNDARIES ---'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
rg -n -C 10 \
'^def (_list_regular_files|_read_base|_download_trusted_uv_archive|_install_trusted_uv|_run_uv_export|_export_uv_lock)|TRUSTED_UV_|ProxyHandler|HTTPRedirectHandler|urlparse\(|parsed\.port|urlopen\(|tarfile|member\.isreg|platform\.(system|machine)|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|tool\.uv\.workspace|stat\.S_ISREG' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- GIT ISOLATION, QUALITY, AND STRIX BOUNDARIES ---'
sed -n '850,1020p' .github/workflows/opencode-review-dispatch.yml
sed -n '1,180p' tests/test_repository_branch_coverage_pr743_cleanup.py
rg -n -C 7 \
'branch = true|fail_under = 100|python-version: "3\.10"|python-version: "3\.14"|--cov-branch|docstring|py_compile|head\.sha|persist-credentials' \
pyproject.toml .github/workflows/trusted-uv-materializer-quality-ci.yml \
tests/test_trusted_uv_materializer_quality_workflow_contract.py
rg -n -C 10 \
'STRIX_MODEL_REQUESTED|STRIX_GITHUB_MODELS_TOKEN|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|nemotron|is_nvidia_nim_not_found_error|NotFoundError|catalog|same.model|vulnerab' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
printf '%s\n' '--- DOCSTRINGS AND DEPENDENCY FLOORS ---'
python3 - <<'PY'
import ast
from pathlib import Path
missing = []
for path in Path("scripts/ci").rglob("*.py"):
tree = ast.parse(path.read_text(encoding="utf-8"))
for node in ast.walk(tree):
if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
if not node.name.startswith("_") and not ast.get_docstring(node):
missing.append((str(path), node.name, node.lineno))
print("missing_public_docstrings=", missing)
PY
rg -n -C 2 '^(aiohttp|cryptography)==' requirements-strix-ci.txt requirements-strix-ci-hashes.txtLength of output: 237562
I found no current source-level actionable issue in the requested scope.
Pull request I could not independently verify protected-branch rules. The branch-protection API returned HTTP 403 for the review token. You are interacting with an AI system. |
2 participants
Purpose
Provide exact-base, offline, fully hash-pinned Python dependency materialization for repositories that use
uv.lock, and integrate the bounded Strix NVIDIA hosted-model availability repair required for protected downstream merges.Trusted uv boundary
uv.lockand siblingpyproject.tomlonly from the validated 40-character base SHA;[tool.uv.workspace]projects while preserving independently operable nested modules;uv exportunder isolated environment directories;==pins followed exclusively by complete SHA-256 hashes;Quality and security evidence
The read-only quality workflow proves Python 3.10 conditional
tomlicompatibility, Python 3.14 full tests, production statement and branch coverage at 100%, production docstrings at 100%, compilation, immutable action pins, exact contributor-head checkout, and hermetic runtime Git configuration for all three OpenCode sandbox invocations.Permanent tests cover execution sandboxes, JavaScript and Noema repository classification, reporting edges, review-scheduler branches, short reads, bounded downloads, cache cleanup, supported runner architecture, fail-closed workspace handling, exact adjacent Git-isolation blocks, and absence of PR-specific write-capable repair automation. The readiness timeout regression repeats its terminal monotonic timestamp indefinitely, the Git-isolation regression proves the
trusted_git()boundary marker and the completesafe.directory=/workblock, and the Noema regression proves the complete line-free review-thread rendering.Integrated Strix hosted-model repair
nvidia/nemotron-3-super-120b-a12b;nvidia/llama-3.3-nemotron-super-49b-v1.5before GitHub Models;COPILOT_GITHUB_TOKENand change no independent reviewer credential or scope.Protected-base repairs
scheduled-security-scan.ymlto immutable v4.37.5;aiohttp==3.14.3,cryptography==50.0.0, compatible pyOpenSSL, and regenerated hashes;Exact-head gate
Current exact head:
91f0e3616897f47a40029ae5ca5846f0b84a75e9.The following exact-head workflows succeeded:
All inline review threads are resolved, the PR is mergeable, and the final diff contains no temporary repair workflow. Every predecessor-head review is stale after the complete safe-directory isolation-value regression. Current-head OpenCode, Noema, CodeRabbit/qualifying independent approval and branch protection remain mandatory. Auto-merge may act only after every same-head rule succeeds.
After merge, #757 and downstream repositories must reconcile with the resulting protected central baseline and rerun their exact-head gates.
Standards traceability
Doctoring records cite official Astral uv, GitHub Actions, Git, RFC 3986, RFC 9110, NVIDIA primary documentation, and approved SLSA 1.2 materials in APA 7th form. No unsupported formal-conformance claim is made.
Summary by CodeRabbit
새로운 기능
uv.lock에서 해시가 고정된 Python 요구사항을 안전하게 생성합니다.버그 수정
문서