fix(coverage): restore LLVM 19 tools on current main - #794
Conversation
|
Warning Review limit reached
Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughOpenCode 커버리지 이미지에 LLVM 19 도구와 명시적 경로를 추가했습니다. 정확한 PR head와 격리된 Git 설정을 검증하는 읽기 전용 품질 워크플로와 회귀 테스트, 관련 문서를 추가했습니다. ChangesOpenCode 커버리지 품질 계약
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Current-head scope review found an unrelated security regression in the final diff. The PR says it is limited to restoring the four LLVM-toolchain lines, its contract test, doctoring, and changelog, but |
|
@opencode-agent address Address only the verified scope regression above: restore |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Current-head review found one valid security regression that must be fixed before this draft can become ready.
The LLVM 19 repair is directionally correct, but the same workflow diff removes GIT_CONFIG_NOSYSTEM=1 and GIT_CONFIG_GLOBAL=/dev/null from all three low-privilege coverage execution wrappers (run_and_capture, run_r_package_testthat, and run_and_capture_advisory). Protected base f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae includes both variables in each wrapper. Their removal re-enables ambient system/global Git configuration inside PR-controlled test processes and is unrelated to the LLVM toolchain fix.
Please repair test-first on the exact current branch:
- Add a permanent contract test that enumerates the three sandbox wrappers and requires both Git-isolation variables before
GIT_CONFIG_COUNT=1. - Restore both variables in all three wrappers without changing the LLVM 19 additions.
- Re-run the exact-head quality/security workflows and keep the PR in draft until all current-head reviews and independent approval are satisfied.
Do not resolve this finding using coverage exclusions, weaker checks, or by removing the safe-directory-only Git configuration.
|
@opencode-agent address Re-evaluate exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
echo '== Checked-out commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
echo '== Exact base-to-head changed files =='
git diff --name-status "$base" "$head"
echo '== Diff stat =='
git diff --stat "$base" "$head"
echo '== Relevant file outlines =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
ast-grep outline tests/test_opencode_llvm_coverage_current_main.py --items all || true
echo '== LLVM / Git isolation / coverage invocation contexts =='
rg -n -C 12 -e 'llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov|run_and_capture|run_r_package_testthat|run_and_capture_advisory|GIT_CONFIG_(NOSYSTEM|GLOBAL|COUNT|KEY_|VALUE_)' .github/workflows/opencode-review-dispatch.yml
echo '== Quality workflow =='
cat -n .github/workflows/opencode-coverage-toolchain-quality-ci.yml
echo '== Contract tests =='
cat -n tests/test_opencode_llvm_coverage_current_main.py
echo '== Documentation and changelog diff =='
git diff --no-ext-diff --unified=80 "$base" "$head" -- CHANGELOG.md docs/doctoring/opencode-llvm-coverage-toolchain.md
echo '== PR metadata, commits, and checks =='
gh pr view 794 --repo ContextualWisdomLab/.github \
--json number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup,reviews \
--jq '{number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,checks:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}]}'
echo '== Open review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=794 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line originalLine } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated,comment:.comments.nodes[0]}'Length of output: 81757
I found no blocking issue. Verified items:
This is a review verdict only. I did not approve the PR. GitHub still reports that an independent qualifying approval is required.
|
|
Exact-head review request for @coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
repo='ContextualWisdomLab/.github'
echo '== Exact checked-out commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
test "$(git rev-parse HEAD)" = "$head"
echo '== Exact base-to-head files and stat =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo '== Complete exact diff =='
git diff --no-ext-diff --check "$base" "$head"
git diff --no-ext-diff --unified=30 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/opencode-coverage-toolchain-quality-ci.yml \
tests/test_opencode_llvm_coverage_current_main.py \
docs/doctoring/opencode-llvm-coverage-toolchain.md \
CHANGELOG.md
echo '== Workflow and test structure =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
ast-grep outline .github/workflows/opencode-coverage-toolchain-quality-ci.yml --items all || true
ast-grep outline tests/test_opencode_llvm_coverage_current_main.py --items all || true
echo '== LLVM and Git-isolation contexts =='
rg -n -C 14 \
-e 'llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov' \
-e 'run_and_capture|run_r_package_testthat|run_and_capture_advisory' \
-e 'GIT_CONFIG_(NOSYSTEM|GLOBAL|COUNT|KEY_|VALUE_)' \
.github/workflows/opencode-review-dispatch.yml
echo '== Quality workflow =='
cat -n .github/workflows/opencode-coverage-toolchain-quality-ci.yml
echo '== Contract tests =='
cat -n tests/test_opencode_llvm_coverage_current_main.py
echo '== Pull request metadata and checks =='
gh pr view 794 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,checks:[.statusCheckRollup[]|{name,conclusion,status,workflowName,detailsUrl}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=794 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line originalLine }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated,comment:.comments.nodes[0]}'Length of output: 103163 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
echo '== Direct exact-head workflow evidence =='
for run_id in \
31073129139 \
31073129046 \
31073129110 \
31073129051 \
31073129121 \
31073129432 \
31073129097 \
31073129034 \
31073129330
do
gh run view "$run_id" --repo "$repo" \
--json databaseId,workflowName,event,status,conclusion,headSha,headBranch,jobs \
--jq '{databaseId,workflowName,event,status,conclusion,headSha,headBranch,jobs:[.jobs[]|{name,status,conclusion}]}'
done
echo '== Enforce exact head and successful required quality jobs =='
quality="$(gh run view 31073129139 --repo "$repo" --json headSha,conclusion,jobs)"
jq -e --arg head "$head" '
.headSha == $head
and .conclusion == "success"
and ([.jobs[] | select(
(.name == "Exact-head toolchain contract" or .name == "Full repository test, coverage, and docstring gate")
and .conclusion == "success"
)] | length == 2)
' <<<"$quality"
echo '== Enforce exact head and successful direct security runs =='
for run_id in 31073129046 31073129110 31073129051 31073129121 31073129432 31073129097 31073129034 31073129330; do
gh run view "$run_id" --repo "$repo" --json headSha,conclusion \
--jq --arg head "$head" '.headSha == $head and .conclusion == "success"'
doneLength of output: 6074
I found no blocking issue. Verified items:
This is a review verdict only. I did not approve, merge, update, or otherwise modify the pull request. The pull request still requires any repository-mandated independent approval and branch-protection checks.
|
|
@opencode-agent review Perform an independent formal review of exact current head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
echo '== exact checkout =='
git rev-parse HEAD
test "$(git rev-parse HEAD)" = "$head"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '== exact changed files and whitespace =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
echo '== complete scoped diff =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/opencode-coverage-toolchain-quality-ci.yml \
tests/test_opencode_llvm_coverage_current_main.py \
docs/doctoring/opencode-llvm-coverage-toolchain.md \
CHANGELOG.md
echo '== workflow and contract outlines =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
ast-grep outline .github/workflows/opencode-coverage-toolchain-quality-ci.yml --items all || true
ast-grep outline tests/test_opencode_llvm_coverage_current_main.py --items all || true
echo '== LLVM and Git-isolation contexts =='
rg -n -C 16 \
-e 'llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov' \
-e 'run_and_capture|run_r_package_testthat|run_and_capture_advisory' \
-e 'GIT_CONFIG_(NOSYSTEM|GLOBAL|COUNT|KEY_|VALUE_)' \
.github/workflows/opencode-review-dispatch.yml
echo '== quality workflow =='
cat -n .github/workflows/opencode-coverage-toolchain-quality-ci.yml
echo '== contract test =='
cat -n tests/test_opencode_llvm_coverage_current_main.py
echo '== PR metadata, checks, and threads =='
gh pr view 794 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,checks:[.statusCheckRollup[]|{name,conclusion,status,workflowName,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=794 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line originalLine } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated,comment:.comments.nodes[0]}'
echo '== successful exact-head quality and security workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,status,conclusion,headSha,event \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,event}'Length of output: 116339 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
echo '== locate quality configuration and hash lock =='
fd -a '^(pyproject\.toml|requirements-opencode-review-ci-hashes\.txt)$' .
echo '== coverage and pytest configuration =='
rg -n -C 12 \
-e '^\[tool\.(coverage|pytest)' \
-e 'branch\s*=|fail_under|addopts|--cov' \
pyproject.toml
echo '== hash-lock validation =='
awk '
/^[[:space:]]*`#/` || /^[[:space:]]*$/ { next }
{ requirements += 1; if ($0 ~ /--hash=sha256:/) hashed += 1 }
END {
printf("requirements=%d hashed_lines=%d\n", requirements, hashed)
exit !(requirements > 0 && hashed == requirements)
}
' requirements-opencode-review-ci-hashes.txt
sed -n '1,120p' requirements-opencode-review-ci-hashes.txt
echo '== exact-head quality job conclusions =='
gh run view 31073129139 --repo "$repo" \
--json headSha,status,conclusion,event,jobs \
--jq --arg head "$head" '
.headSha == $head
and .status == "completed"
and .conclusion == "success"
and ([.jobs[] | select(
(.name == "Exact-head toolchain contract" or .name == "Full repository test, coverage, and docstring gate")
and .status == "completed"
and .conclusion == "success"
)] | length == 2)
'
gh run view 31073129139 --repo "$repo" \
--json headSha,status,conclusion,event,jobs \
--jq '{headSha,status,conclusion,event,jobs:[.jobs[]|{name,status,conclusion}]}'Length of output: 2539 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
echo '== hash-lock sample and logical-block validation =='
sed -n '1,100p' requirements-opencode-review-ci-hashes.txt
python3 - <<'PY'
from pathlib import Path
path = Path("requirements-opencode-review-ci-hashes.txt")
blocks: list[str] = []
current = ""
for raw in path.read_text(encoding="utf-8").splitlines():
line = raw.strip()
if not line or line.startswith("#"):
continue
current = f"{current} {line}".strip()
if not line.endswith("\\"):
blocks.append(current)
current = ""
if current:
raise SystemExit("unterminated requirement continuation")
missing_hashes = [
block for block in blocks
if not block.startswith(("-", "--")) and "--hash=sha256:" not in block
]
print(f"logical_requirement_blocks={len(blocks)}")
print(f"blocks_missing_sha256_hashes={len(missing_hashes)}")
for block in missing_hashes:
print(block)
if not blocks or missing_hashes:
raise SystemExit(1)
PY
echo '== exact-head quality workflow run =='
gh run view 31073129139 --repo "$repo" \
--json headSha,status,conclusion,event,jobs \
--jq '{headSha,status,conclusion,event,jobs:[.jobs[]|{name,status,conclusion}]}'
gh run view 31073129139 --repo "$repo" \
--json headSha,status,conclusion,jobs \
--jq --arg head "$head" '
.headSha == $head
and .status == "completed"
and .conclusion == "success"
and ([.jobs[] | select(
(.name == "Exact-head toolchain contract" or .name == "Full repository test, coverage, and docstring gate")
and .status == "completed"
and .conclusion == "success"
)] | length == 2)
'Length of output: 10500
I found no blocking issue. Verified items:
This is a review verdict only. I did not approve, merge, update, or modify the pull request. GitHub currently reports that review is still required.
|
|
Closing as superseded by the dependency-ordered repair in #759. This exact head ( |
Pull request was closed
|
Reopening because protected |
|
@opencode-agent @cwl-noema-review @coderabbitai review Recompute formal review evidence for exact reopened head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='6bd29ccd394a94b6018cb0985d0febee186124bf'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
echo '== Exact checkout and commit identity =='
git rev-parse HEAD
test "$(git rev-parse HEAD)" = "$head"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
echo '== Exact base-to-head scope and whitespace =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== Complete reviewed diff =='
git diff --no-ext-diff --unified=35 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/opencode-coverage-toolchain-quality-ci.yml \
tests/test_opencode_llvm_coverage_current_main.py \
docs/doctoring/opencode-llvm-coverage-toolchain.md \
CHANGELOG.md
echo '== Workflow and test outlines =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
ast-grep outline .github/workflows/opencode-coverage-toolchain-quality-ci.yml --items all || true
ast-grep outline tests/test_opencode_llvm_coverage_current_main.py --items all || true
echo '== LLVM provisioning and Git-isolation contexts =='
rg -n -C 18 \
-e 'llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov' \
-e 'run_and_capture|run_r_package_testthat|run_and_capture_advisory' \
-e 'GIT_CONFIG_(NOSYSTEM|GLOBAL|COUNT|KEY_|VALUE_)' \
.github/workflows/opencode-review-dispatch.yml
echo '== Exact-head quality workflow =='
cat -n .github/workflows/opencode-coverage-toolchain-quality-ci.yml
echo '== Permanent contract tests =='
cat -n tests/test_opencode_llvm_coverage_current_main.py
echo '== Coverage, docstring, and hash-lock configuration =='
fd -a '^(pyproject\.toml|requirements-opencode-review-ci-hashes\.txt)$' .
rg -n -C 10 -e '^\[tool\.(coverage|pytest)' -e 'branch\s*=|fail_under|addopts|--cov' pyproject.toml
python3 - <<'PY'
from pathlib import Path
p = Path("requirements-opencode-review-ci-hashes.txt")
blocks, current = [], ""
for raw in p.read_text(encoding="utf-8").splitlines():
line = raw.strip()
if not line or line.startswith("#"):
continue
current = f"{current} {line}".strip()
if not line.endswith("\\"):
blocks.append(current)
current = ""
if current:
raise SystemExit("unterminated requirement continuation")
missing = [b for b in blocks if not b.startswith(("-", "--")) and "--hash=sha256:" not in b]
print(f"logical_requirement_blocks={len(blocks)}")
print(f"blocks_missing_sha256_hashes={len(missing)}")
if not blocks or missing:
raise SystemExit(1)
PY
echo '== PR state, exact head, and check rollup =='
gh pr view 794 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,event,status,conclusion,headSha \
--jq '.[] | {databaseId,workflowName,event,status,conclusion,headSha}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=794 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line originalLine }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated,comment:.comments.nodes[0]}'Length of output: 139783
I found no source-level blocking issue. Verified items:
I cannot submit a passing current-head CI and security verdict yet. The reopened-head workflow set was still incomplete during this review. The current quality full-suite job, CodeQL, OSV, Semgrep, Security Scan, Python Security, Scorecard, Strix, and Required OpenCode Review runs were queued or in progress. GitHub also reports You are interacting with an AI system. |
|
Superseded by dependency-ordered central PR #759. The complete exact head of this PR,
#759 also retains the broader coverage-diagnostics, materializer, security-boundary, and downstream dependency work that must land before contextual-orchestrator #96 and Inkspan #65. It remains Draft pending fresh exact-head CI, security, review, and independent approval. No checks, reviews, or approval from this predecessor head are being transferred. Closing this PR removes the duplicate merge path and prevents competing branch writers while preserving its valid changes in the authoritative branch. |
Pull request was closed
|
Closing as superseded by #759. Exact head |
Pull request was closed
|
Closing as superseded by #759. Exact head |
Pull request was closed
|
@coderabbitai review Please re-evaluate the exact live head only. Verify LLVM 19 and explicit tool paths, executable preflight, all three low-privilege Git configuration isolation wrappers, dependency-free exact-head contract, hash-locked full repository suite, 100% branch coverage and public docstrings, compilation, and zero unresolved threads. Review only; do not update the branch, approve through a non-independent identity, merge, release, or alter protections. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
echo '== Live pull request metadata =='
gh pr view 794 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,checks:[.statusCheckRollup[]|{name,workflowName,status,conclusion,detailsUrl}]}'
echo '== Checked-out commit =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
head="$(gh pr view 794 --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view 794 --repo "$repo" --json baseRefOid --jq .baseRefOid)"
test "$(git rev-parse HEAD)" = "$head"
echo '== Exact base-to-live-head scope =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== LLVM and Git-isolation contexts =='
rg -n -C 16 \
-e 'llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov' \
-e 'run_and_capture|run_r_package_testthat|run_and_capture_advisory' \
-e 'GIT_CONFIG_(NOSYSTEM|GLOBAL|COUNT|KEY_|VALUE_)' \
.github/workflows/opencode-review-dispatch.yml || true
echo '== Quality workflow =='
cat -n .github/workflows/opencode-coverage-toolchain-quality-ci.yml 2>/dev/null || true
echo '== Contract test outline and content =='
ast-grep outline tests/test_opencode_llvm_coverage_current_main.py --items all 2>/dev/null || true
cat -n tests/test_opencode_llvm_coverage_current_main.py 2>/dev/null || true
echo '== Quality configuration and lock file =='
fd -a '^(pyproject\.toml|requirements-opencode-review-ci-hashes\.txt)$' .
rg -n -C 10 -e '^\[tool\.(coverage|pytest)' -e 'branch\s*=|fail_under|addopts|--cov' pyproject.toml 2>/dev/null || true
echo '== Exact-live-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,workflowName,event,status,conclusion,headSha \
--jq '.[] | {databaseId,workflowName,event,status,conclusion,headSha}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=794 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) {
nodes { author { login } body path line originalLine }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {isOutdated,comment:.comments.nodes[0]}'Length of output: 145325
I found one blocking issue.
Other verified items:
The pull request is closed. I did not approve, modify, merge, release, or change protections. You are interacting with an AI system. |
1 participant
Purpose
Restore the protected-current-main OpenCode Rust coverage toolchain after DiskSage PR #133 exact head
b7f980d265713d5ffb84f744ce454589e3d410eaexposed the central failurefailed to find llvm-tools-previewin run31037491215, job92413313900.Test-first history
c8bbf698f46d6ac8ffc75e341b756feb4a1b882e: adds a permanent ordering contract requiring LLVM 19, both explicit tool paths, and executable validation before cargo-llvm-cov installation.3994d313d0fa71f17bd12c4f522bbc65a2d55f11: restores the trusted toolchain configuration and records doctoring/changelog evidence.748bc5d5d733ddea93b592bd4091ea5a8005d55c: requires all three low-privilege coverage wrappers to disable ambient system/global Git configuration before applying the bounded safe-directory overlay.5cf306ed278ebf11eb45317359d5992567214e0e: restores the six Git-isolation lines, preserves the LLVM 19 configuration, updates doctoring and CHANGELOG, and removes the temporary exact-head repair workflow from the final diff.fca5600b6b51621c684a151f49b2fb30cdde46b0: requires a durable repository-owned workflow that executes the focused contracts at the literal pull-request head without package installation.b2073dfbf3b35ab6443cc29065f765589d3ba39a: adds the credential-free, dependency-free focused quality job and updates authoritative doctoring and changelog evidence.1635420cc696fda693daa70b8c033d14195d14e2: requires a separate exact-head, hash-locked full repository test, branch-coverage, docstring, and compilation gate.7f12a15505c4754d1feeb33fd0148cebe6a689ba: adds the dependent approved-environment full-suite job and aligns the doctoring and changelog claims with its implemented scope.6bd29ccd394a94b6018cb0985d0febee186124bf: makes the--require-hashes -r requirements-opencode-review-ci-hashes.txtcommand explicit as one audited source line so the permanent contract and executed command are identical.Current exact-head scope
Current head:
6bd29ccd394a94b6018cb0985d0febee186124bfThe final diff is limited to:
.github/workflows/opencode-review-dispatch.yml.github/workflows/opencode-coverage-toolchain-quality-ci.ymltests/test_opencode_llvm_coverage_current_main.pydocs/doctoring/opencode-llvm-coverage-toolchain.mdCHANGELOG.mdFresh repository CI, security, review, and approval evidence for this exact head remains required; older-head results are not reused.
Security and compatibility boundary
llvm-19in the trusted coverage image.LLVM_COV=/usr/bin/llvm-cov-19andLLVM_PROFDATA=/usr/bin/llvm-profdata-19and verifies both executables before cargo-llvm-cov use./worksafe-directory overlay.github.event.pull_request.head.sha, refuses stale or generated merge-tree evidence, preserves no checkout credentials, discovers every focused contract test, compiles the test module, and refuses worktree mutation.requirements-opencode-review-ci-hashes.txtwith--require-hashes, runs all tests under the configured 100% branch-coverage gate, enforces 100% production docstrings, and compiles all production CI modules and tests.Current exact-head evidence
31072730539: focused job passed; full repository test, 100% branch-coverage, docstring, and compilation job passed.Merge gate
Keep Draft until the final diff is verified against current protected main, every current-head CI/security/review gate passes, no actionable thread remains, and a qualifying independent non-author approval and branch protection permit merge without bypass. After merge, start a fresh DiskSage #133 OpenCode review on its unchanged exact current head; do not reuse the failed predecessor run or any older-head evidence.