Skip to content

ci(opencode-review): provision LLVM coverage tools #755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 7 commits into from
Aug 5, 2026
Merged

ci(opencode-review): provision LLVM coverage tools #755

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4e4b99a
ci: stage fail-closed LLVM coverage repair
seonghobae Aug 4, 2026
c28a16f
ci: use bounded app token for workflow repair
seonghobae Aug 4, 2026
2cd3e13
ci(opencode-review): provision LLVM coverage tools
opencode-agent[bot] Aug 4, 2026
575aa55
docs(doctoring): trace LLVM coverage toolchain decision
seonghobae Aug 5, 2026
3a31af0
fix(security): apply remediated Strix dependency floors
seonghobae Aug 5, 2026
6610317
ci: refresh PR 755 Strix lock from validated blob
seonghobae Aug 5, 2026
5495d08
fix(security): refresh remediated Strix hash lock
github-actions[bot] Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/opencode-review-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -652,11 +652,15 @@ jobs:
r-base \
r-cran-covr \
r-cran-testthat \
llvm-19 \
rustc \
util-linux \
vulkan-tools \
xz-utils \
&& rm -rf /var/lib/apt/lists/*
ENV LLVM_COV=/usr/bin/llvm-cov-19
ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19
RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"
Comment on lines +655 to +663

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow excerpt ---'
sed -n '625,675p' .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '--- documentation excerpt ---'
sed -n '1,40p' docs/doctoring/opencode-llvm-coverage-toolchain.md
printf '%s\n' '--- related package/source references ---'
rg -n -C 3 'llvm-19|llvm-toolchain-19|rustc|snapshot|LLVM_COV|LLVM_PROFDATA|pinned' \
  .github/workflows/opencode-review-dispatch.yml \
  docs/doctoring/opencode-llvm-coverage-toolchain.md

Repository: ContextualWisdomLab/.github

Length of output: 20474

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- all APT and image-repository controls in workflow ---'
rg -n -C 4 'apt-get|sources.list|snapshot.debian|deb\.debian|llvm-19|rustc|FROM .*python' \
  .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '--- package pinning syntax in repository ---'
rg -n -S 'apt-get install.*=|llvm-toolchain-19|snapshot\.debian\.org|apt_preferences|/etc/apt/preferences|snapshot\.debian' \
  .github docs scripts tests 2>/dev/null || true
printf '%s\n' '--- relevant workflow contract tests ---'
rg -n -C 5 'llvm-19|LLVM_COV|LLVM_PROFDATA|coverage image|Dockerfile|apt-get install' \
  tests .github 2>/dev/null | head -n 300

Repository: ContextualWisdomLab/.github

Length of output: 17230

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text()
doc = Path("docs/doctoring/opencode-llvm-coverage-toolchain.md").read_text()

dockerfile = workflow.split("cat >\"$coverage_build_dir/Dockerfile\" <<'DOCKERFILE\n", 1)[1].split("\n          DOCKERFILE", 1)[0]
packages = re.findall(r"(?m)^\s{14}([a-z0-9][a-z0-9+.-]*)(?:\s*\\)?$", dockerfile)
apt_lines = [line.strip() for line in dockerfile.splitlines() if "apt-get" in line or "snapshot.debian" in line or "sources.list" in line or "preferences" in line]

print("packages:", packages)
print("version-pinned packages:", [p for p in packages if "=" in p])
print("APT repository/pinning lines:", apt_lines)
print("base image pinned by digest:", bool(re.search(r"^FROM .+@sha256:[0-9a-f]{64}$", dockerfile, re.M)))
print("documentation claims pinned repositories:", "pinned Debian image repositories" in doc)
print("documentation claims exact package version:", "19.1.7-3+b1" in doc)
PY

Repository: ContextualWisdomLab/.github

Length of output: 274

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text()
doc = Path("docs/doctoring/opencode-llvm-coverage-toolchain.md").read_text()

start = workflow.index("cat >")
start = workflow.index("\n", start) + 1
end = workflow.index("\n", workflow.index("DOCKERFILE", start))
dockerfile = "\n".join(
    line[10:] if line.startswith("          ") else line
    for line in workflow[start:end].splitlines()
)

packages = re.findall(r"(?m)^\s{2,}([a-z0-9][a-z0-9+.-]*)(?:\s*\\)?$", dockerfile)
apt_lines = [
    line.strip()
    for line in dockerfile.splitlines()
    if any(token in line for token in (
        "apt-get", "snapshot.debian", "sources.list", "preferences"
    ))
]

print("packages:", packages)
print("version-pinned packages:", [p for p in packages if "=" in p])
print("APT repository/pinning lines:", apt_lines)
print(
    "base image pinned by digest:",
    bool(re.search(r"^FROM .+@sha256:[0-9a-f]{64}$", dockerfile, re.M)),
)
print("documentation claims pinned repositories:", "pinned Debian image repositories" in doc)
print("documentation claims exact package version:", "19.1.7-3+b1" in doc)
PY

Repository: ContextualWisdomLab/.github

Length of output: 701

APT 패키지 고정을 구현과 문서에서 일치시키세요.

FROM 이미지 digest는 고정되어 있지만, apt-get update는 llvm-19와 rustc의 버전 또는 Debian 저장소 snapshot을 고정하지 않습니다. 따라서 재빌드마다 Rust/LLVM 도구체인과 coverage 결과가 달라질 수 있습니다.

  • .github/workflows/opencode-review-dispatch.yml#L655-L663: 호환되는 exact package version 또는 immutable Debian snapshot을 적용하세요.
  • docs/doctoring/opencode-llvm-coverage-toolchain.md#L16-L18: 실제 고정 방식을 문서화하세요. 고정하지 않으면 pinned 및 exact version 주장을 제거하세요.
📍 Affects 2 files
  • .github/workflows/opencode-review-dispatch.yml#L655-L663 (this comment)
  • docs/doctoring/opencode-llvm-coverage-toolchain.md#L16-L18
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/opencode-review-dispatch.yml around lines 655 - 663, Pin
the llvm-19 and rustc APT inputs in the Docker build using compatible exact
package versions or an immutable Debian snapshot, and retain the executable
checks for LLVM_COV and LLVM_PROFDATA. In
docs/doctoring/opencode-llvm-coverage-toolchain.md lines 16-18, document the
implemented pinning mechanism and versions; if the build remains unpinned,
remove the “pinned” and exact-version claims instead.

RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \
https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \
&& echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742 /tmp/node-linux-x64.tar.xz' | sha256sum -c - \
Expand Down
45 changes: 45 additions & 0 deletions docs/doctoring/opencode-llvm-coverage-toolchain.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
# OpenCode LLVM coverage toolchain decision

## Decision

The central OpenCode coverage image installs Debian Trixie's `llvm-19` package and explicitly exports:

```text
LLVM_COV=/usr/bin/llvm-cov-19
LLVM_PROFDATA=/usr/bin/llvm-profdata-19
```

The image build fails unless both paths are executable. This is required because the image uses Debian-packaged `rustc` rather than a rustup-managed toolchain, so `llvm-tools-preview` is not an available installation path.

## Evidence and compatibility boundary

`cargo-llvm-cov` documents `LLVM_COV` and `LLVM_PROFDATA` as the overrides to use when a Rust toolchain is installed outside rustup. It also requires the selected tools to be compatible with the LLVM version used by `rustc`. Its published compatibility table maps Rust 1.82–1.95 to LLVM 19–22. The central image therefore selects LLVM 19 as the lowest compatible family for its supported Rust range and keeps the two binary paths explicit rather than relying on an unversioned system default.

Debian Trixie publishes `llvm-19` from the `llvm-toolchain-19` source package. The package version currently documented for amd64 is 19.1.7-3+b1. The workflow installs the package from the pinned Debian image repositories and verifies the exact versioned executable paths during image construction.
Comment on lines +16 to +18

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

echo '--- candidate files ---'
git ls-files | rg '(^|/)(docs/doctoring/opencode-llvm-coverage-toolchain\.md|.*workflow.*|.*docker.*|.*container.*|.*\.ya?ml$)' | head -200

echo '--- references to llvm-19, apt installation, and package pinning ---'
rg -n -C 4 'llvm-19|apt-get install|apt-cache policy|snapshot\.debian|deb\.debian|pinned|19\.1\.7|LLVM_COV|LLVM_PROFDATA' . \
  -g '*.md' -g '*.yml' -g '*.yaml' -g 'Dockerfile*' -g '*.sh' || true

echo '--- target document ---'
target='docs/doctoring/opencode-llvm-coverage-toolchain.md'
if [ -f "$target" ]; then
  cat -n "$target"
fi

Repository: ContextualWisdomLab/.github

Length of output: 38896

🏁 Script executed:

#!/bin/bash
set -eu

echo '--- workflow structure ---'
ast-grep outline .github/workflows/opencode-review.yml
echo '--- workflow coverage-related commands ---'
rg -n -C 8 'coverage|docker|apt|rustc|cargo-llvm|LLVM|llvm|Dockerfile|debian' \
  .github/workflows/opencode-review.yml

echo '--- contract test references ---'
rg -n -C 10 'coverage|docker|apt|rustc|cargo-llvm|LLVM|llvm|Dockerfile|debian|opencode-llvm' \
  tests/test_opencode_docker_evidence_contract.py \
  tests/test_opencode_workflow_shell_syntax.py \
  scripts/ci/test_strix_quick_gate.sh

echo '--- all tracked files containing coverage image/build markers ---'
rg -l 'cargo-llvm-cov|LLVM_COV|LLVM_PROFDATA|llvm-cov-19|llvm-profdata-19|coverage image|coverage_build' . \
  -g '!docs/doctoring/opencode-llvm-coverage-toolchain.md' | sort

Repository: ContextualWisdomLab/.github

Length of output: 50384

🏁 Script executed:

#!/bin/bash
set -eu

workflow='.github/workflows/opencode-review-dispatch.yml'

echo '--- package and LLVM commands in the actual dispatch workflow ---'
rg -n -C 12 'apt-get|apt-cache|llvm|rustc|cargo-llvm|LLVM|Dockerfile|coverage_build|coverage image' "$workflow" || true

echo '--- coverage step names and run blocks ---'
rg -n '^(\s+name:|\s+run:|\s+env:|\s+uses:)' "$workflow" | \
  awk '$1+0 >= 450 && $1+0 <= 850 {print}' || true

echo '--- nearby coverage implementation ---'
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/opencode-review-dispatch.yml")
lines = p.read_text(encoding="utf-8").splitlines()
for i, line in enumerate(lines, 1):
    low = line.lower()
    if any(x in low for x in ("materialize pull request merge tree", "coverage", "cargo-llvm", "llvm_cov", "llvm-profdata", "llvm-cov", "apt-get")):
        start = max(1, i - 20)
        end = min(len(lines), i + 45)
        print(f"\n--- lines {start}-{end} (match at {i}) ---")
        for n in range(start, end + 1):
            print(f"{n:5}: {lines[n-1]}")
PY

Repository: ContextualWisdomLab/.github

Length of output: 50384

🏁 Script executed:

#!/bin/bash
set -eu

echo '--- exact LLVM/package matches in tracked files ---'
git grep -n -E 'apt(-get)?[[:space:]]+install|cargo-llvm-cov|LLVM_COV|LLVM_PROFDATA|llvm-cov-19|llvm-profdata-19|llvm-19|llvm-toolchain-19|19\.1\.7-3' -- \
  ':!scripts/ci/test_strix_quick_gate.sh' \
  ':!scripts/ci/run_opencode_review_model_pool.sh' \
  ':!scripts/ci/emit_opencode_failed_check_fallback_findings.sh' \
  ':!docs/org-required-workflow-rollout.md' \
  ':!PR_GOVERNANCE_AUDIT.md' || true

echo '--- workflow section boundaries ---'
grep -n -E '^  [A-Za-z0-9_.-]+:|^      - name:|^      - id:' \
  .github/workflows/opencode-review-dispatch.yml | \
  grep -E 'coverage|Coverage|Rust|rust|LLVM|Docker|docker|Materialize|Install|Build|toolchain' || true

echo '--- only exact package-related lines from the dispatch workflow ---'
grep -n -E 'apt(-get)?[[:space:]]+install|cargo-llvm-cov|LLVM_COV|LLVM_PROFDATA|llvm-cov-19|llvm-profdata-19|llvm-19|llvm-toolchain-19|19\.1\.7-3' \
  .github/workflows/opencode-review-dispatch.yml || true

echo '--- files containing exact package installation command ---'
git grep -l -E 'apt(-get)?[[:space:]]+install[[:space:]].*llvm|apt(-get)?[[:space:]]+install' -- \
  ':!scripts/ci/test_strix_quick_gate.sh' \
  ':!scripts/ci/run_opencode_review_model_pool.sh' \
  ':!scripts/ci/emit_opencode_failed_check_fallback_findings.sh' \
  ':!docs/org-required-workflow-rollout.md' \
  ':!PR_GOVERNANCE_AUDIT.md' || true

Repository: ContextualWisdomLab/.github

Length of output: 6863

🏁 Script executed:

#!/bin/bash
set -eu

file='.github/workflows/opencode-review-dispatch.yml'
sed -n '600,685p' "$file"

echo '--- test assertions around the coverage image ---'
sed -n '2700,2770p' tests/test_opencode_agent_contract.py

echo '--- image source and repository configuration references ---'
grep -n -E 'FROM |sources\.list|debian|snapshot|deb |apt-get update|apt-get install|apt-mark|policy|version' "$file" | \
  awk '$1+0 >= 580 && $1+0 <= 700 {print}'

Repository: ContextualWisdomLab/.github

Length of output: 7795

🌐 Web query:

Debian Trixie amd64 llvm-19 package version 1:19.1.7-3+b1 packages.debian.org

💡 Result:

The package llvm-19 version 1:19.1.7-3+b1 for the amd64 architecture is a valid and available package in the Debian Trixie (testing) repository [1][2]. This version is part of the llvm-toolchain-19 source package (specifically built from version 1:19.1.7-3) [2][3]. The "+b1" suffix indicates that it is a binary-only upload (rebuild) generated by the Debian buildd system for the amd64 architecture [1][2]. Key technical details for llvm-19 (amd64) include: - Source Package: llvm-toolchain-19 (version 1:19.1.7-3) [2] - Version: 1:19.1.7-3+b1 [1][2] - Architecture: amd64 [1][2] - Dependencies: Requires packages such as llvm-19-runtime (= 1:19.1.7-3+b1) and llvm-19-linker-tools (= 1:19.1.7-3+b1), along with various standard system libraries like libc6, libstdc++6, and libzstd1 [2]. You can find the official details and download links for this package and its associated libraries (such as libllvm19 and llvm-19-dev, which share the same versioning) on the Debian Packages website [1][4][5].

Citations:

Debian 패키지 고정 주장을 실제 설치 방식에 맞추세요.

apt-get install llvm-19는 버전 1:19.1.7-3+b1 또는 immutable Debian snapshot을 고정하지 않습니다. 실행 파일 경로 검사는 패키지 버전을 검증하지 않습니다. 고정을 요구하지 않으면 line 18의 “pinned Debian image repositories”를 제거하고, 패키지 표기를 1:19.1.7-3+b1로 수정하세요. 고정이 요구사항이면 workflow와 문서에 exact package version 및 immutable snapshot을 함께 반영하세요.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/doctoring/opencode-llvm-coverage-toolchain.md` around lines 16 - 18,
Update the documentation around the LLVM 19 package installation to match the
workflow’s actual behavior: either remove the “pinned Debian image repositories”
claim and change the package version to 1:19.1.7-3+b1, or implement exact
package-version installation together with an immutable Debian snapshot in both
the workflow and this document. Keep executable-path checks only as path
validation, not package-version verification.

Source: MCP tools


## Security and reproducibility contract

- Pull-request content cannot select another LLVM package or executable path.
- The coverage image definition remains default-branch controlled and is built from immutable workflow source.
- `LLVM_COV` and `LLVM_PROFDATA` are set together; partial configuration is rejected.
- Missing executables fail the image build before any pull-request coverage measurement starts.
- The image digest, workflow commit SHA, pull-request head SHA, and coverage artifacts remain independently addressable evidence.
- CPU coverage is a correctness gate. GPU execution and parity tests remain separate domain-specific gates and are not represented by LLVM host coverage alone.

This design does not claim formal compliance with a software supply-chain standard. It establishes a narrow, auditable compatibility boundary for deterministic Rust coverage execution.

## Regression contract

The central workflow contract test must continue to prove that:

1. `llvm-19` is installed in the coverage image;
2. `LLVM_COV` names `/usr/bin/llvm-cov-19`;
3. `LLVM_PROFDATA` names `/usr/bin/llvm-profdata-19`;
4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; and
5. the OpenCode approval path remains fail-closed when Rust coverage cannot run.

## References

Debian Project. (2026). *Details of package llvm-19 in trixie*. https://packages.debian.org/trixie/amd64/llvm-19

Taiki Endo. (2026). *cargo-llvm-cov: Cargo subcommand to easily use LLVM source-based code coverage* [Computer software]. GitHub. https://github.com/taiki-e/cargo-llvm-cov
Loading
Loading