fix(strix): accept legal Packrat fixture paths - #800
Conversation
📝 WalkthroughWalkthroughStrix 변경 경로 정책이 쉼표와 ASCII 괄호를 허용하도록 변경되었습니다. 원시 ChangesStrix 경로 정책
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review Review-only exact-head request for |
|
@coderabbitai review Review exact current head |
|
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/strix-changed-path-quality-ci.yml:
- Around line 6-9: Update the workflow’s paths configuration to include
docs/doctoring/strix-legal-git-paths.md and CHANGELOG.md so changes to either
contract file trigger validation. In the workflow test step, replace the
single-test-file invocation with the full suite command using coverage and
pytest against tests in quiet mode.
In `@tests/test_strix_changed_path_policy.py`:
- Around line 65-84: Reject raw “..” path components before normalization in the
changed-path normalizer, and add “safe/../target.txt” to the rejected cases in
tests/test_strix_changed_path_policy.py:65-84. Update
docs/doctoring/strix-legal-git-paths.md:20-29 to retain the traversal-rejection
claim only after this fix, and remove or limit the same fail-closed claim in
CHANGELOG.md:15 until the fix is applied.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 306ffc18-d8b4-4332-a38e-0f618add47b9
📒 Files selected for processing (5)
.github/workflows/strix-changed-path-quality-ci.ymlCHANGELOG.mddocs/doctoring/strix-legal-git-paths.mdscripts/ci/strix_quick_gate.shtests/test_strix_changed_path_policy.py
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Review exact current head |
|
@opencode-agent @cwl-noema-review Review-only exact-head request for |
|
|
|
@coderabbitai review Please retry the exact-current-head review for |
|
|
|
@coderabbitai review Review exact current head |
|
I will verify the raw-traversal rejection boundary and the full-suite exact-head workflow. I will treat
|
|
Addressed the remaining Scorecard |
|
Review-only request for exact current head |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
I will validate the stated path-policy boundary, raw traversal rejection, argument handling, dependency hash enforcement, workflow coverage, and security controls. I will treat prior-head evidence as historical only. I will not mutate, approve, bypass, or merge the branch.
|
|
@cwl-noema-review Independently review exact current head |
|
@coderabbitai review Read-only exact-head review requested for |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review Review exact head |
|
@opencode-agent review Review exact head |
|
@cwl-noema-review review Independently review exact head |
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
|
@coderabbitai review Review only exact current head |
|
@opencode-agent Perform a read-only exact-head review of PR #800 at Independently verify the bounded changed-path grammar, raw traversal rejection before normalization, out-of-root resolution, NUL/CR/LF/backslash/shell-metacharacter and unsupported-Unicode rejection, legal Packrat punctuation acceptance, full-suite permanent quality workflow, immutable action and wheel/hash pins, and unchanged reviewer credential boundary. Submit a current-head outcome only after inspecting the exact tree and successful exact-head runs. Do not merge, enable auto-merge, release, publish, rebase, or retarget. |
|
@cwl-noema-review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
printf '%s\n' '== Commit identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested head: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${base}^{commit}"
printf '%s\n' '== Live pull request metadata, checks, and reviews =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,statusCheckRollup,reviews \
--jq '{headRefOid,baseRefOid,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion}],reviews:[.reviews[]|{author:.author.login,state}]}'
printf '%s\n' '== Exact diff scope and whitespace validation =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
printf '%s\n' '== Source maps =='
ast-grep outline scripts/ci/strix_quick_gate.sh --items all || true
ast-grep outline tests/test_strix_changed_path_policy.py --items all || true
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all || true
printf '%s\n' '== Quality workflow =='
cat -n .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== Changed-path normalization and use =='
rg -n -C 14 \
'normalize_changed_file_path|allowed|raw.*\.\.|\.\.|realpath|read -r|printf|git diff|eval|sh -c|bash -c|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== Path-policy, dependency, and shell-suite assertions =='
rg -n -C 5 \
'Packrat|comma|parenthes|traversal|absolute|control|whitespace|backslash|shell|Unicode|out.of.root|require-hashes|only-binary|test_strix_quick_gate|coverage.*pytest|pytest|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
scripts/ci/test_strix_quick_gate.sh \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== Doctoring and changelog =='
cat -n docs/doctoring/strix-legal-git-paths.md
tail -n 80 CHANGELOG.md
printf '%s\n' '== Exact reviewed diff =='
git diff --no-ext-diff --unified=45 "$base" "$head" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.mdLength of output: 202913 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
log='/tmp/coderabbit-shell-logs/shell-output-Pjmk8U'
printf '%s\n' '== Retained identity and live PR metadata =='
sed -n '1,120p' "$log"
printf '%s\n' '== Current identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested head: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${base}^{commit}"
printf '%s\n' '== Current check state =='
gh pr view 800 --repo "$repo" --json headRefOid,baseRefOid,statusCheckRollup \
--jq '{headRefOid,baseRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
printf '%s\n' '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=800 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { path line } } }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved | not) | {isOutdated, comments:.comments.nodes}]'
printf '%s\n' '== Exact workflow and shell-only test evidence =='
nl -ba .github/workflows/strix-changed-path-quality-ci.yml | sed -n '1,72p'
nl -ba scripts/ci/test_strix_quick_gate.sh | sed -n '8984,8998p'
rg -n -C 2 'complete repository test suite' docs/doctoring/strix-legal-git-paths.mdLength of output: 34085
I verified the checked-out commit and live PR head as I found one actionable issue.
Add this command to the verification step. Keep the existing bash scripts/ci/test_strix_quick_gate.shThe remaining inspected controls are correctly bounded. The normalizer adds comma and ASCII parentheses only. It rejects raw There are no unresolved review threads. One live
|
|
@opencode-agent @cwl-noema-review Review exact current head |
|
@opencode-agent @cwl-noema-review |
|
@coderabbitai review @opencode-agent @cwl-noema-review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='87c302cf37343e5a816f1ddb24d3f6e0e12410d8'
printf '%s\n' '== exact commit identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
printf '%s\n' '== live pull request state =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,statusCheckRollup,reviews \
--jq '{headRefOid,baseRefOid,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion}],reviews:[.reviews[]|{author:.author.login,state}]}'
base="$(gh pr view 800 --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf '%s\n' '== exact diff scope and integrity =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
printf '%s\n' '== source maps =='
ast-grep outline scripts/ci/strix_quick_gate.sh --items all || true
ast-grep outline tests/test_strix_changed_path_policy.py --items all || true
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all || true
printf '%s\n' '== quality workflow =='
cat -n .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== changed-path normalizer and consumers =='
rg -n -C 14 \
'normalize_changed_file_path|allowed|raw.*\.\.|\.\.|realpath|read -r|printf|git diff|eval|sh -c|bash -c|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== regression and dependency contracts =='
rg -n -C 5 \
'Packrat|comma|parenthes|traversal|absolute|control|whitespace|backslash|shell|Unicode|out.of.root|require-hashes|only-binary|test_strix_quick_gate|coverage.*pytest|pytest|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
scripts/ci/test_strix_quick_gate.sh \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== doctoring and changelog =='
cat -n docs/doctoring/strix-legal-git-paths.md
tail -n 100 CHANGELOG.md
printf '%s\n' '== exact relevant diff =='
git diff --no-ext-diff --unified=45 "$base" "$head" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.md
printf '%s\n' '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=800 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { path line body } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select((.isResolved | not) and (.isOutdated | not)) | {comments:.comments.nodes}]'Length of output: 203473 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-lwnCNV'
repo='ContextualWisdomLab/.github'
head='87c302cf37343e5a816f1ddb24d3f6e0e12410d8'
printf '%s\n' '== retained identity and PR metadata =='
sed -n '1,120p' "$log"
printf '%s\n' '== live identity and status checks =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
gh pr view 800 --repo "$repo" --json headRefOid,baseRefOid,statusCheckRollup \
--jq '{headRefOid,baseRefOid,checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
printf '%s\n' '== exact workflow test commands =='
nl -ba .github/workflows/strix-changed-path-quality-ci.yml | sed -n '50,70p'
printf '%s\n' '== shell-suite references in workflow =='
rg -n -C 2 'test_strix_quick_gate\.sh' .github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== shell-only changed-path regression cases =='
nl -ba scripts/ci/test_strix_quick_gate.sh | sed -n '8984,8998p'
printf '%s\n' '== doctoring workflow-completeness statement =='
nl -ba docs/doctoring/strix-legal-git-paths.md | sed -n '37,50p'
printf '%s\n' '== changed-path normalizer boundary =='
nl -ba scripts/ci/strix_quick_gate.sh | sed -n '386,445p'Length of output: 14886
I verified the checked-out commit and live PR head as I found one actionable defect.
Add The remaining inspected controls are correctly bounded. The normalizer adds only comma and ASCII parentheses. It rejects raw The live You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review Review-only exact-head request for |
|
@opencode-agent Perform a read-only exact-head review of PR #800 at All exact-head Strix quality, CodeQL, Python Security, SAST, Security Scan, Secret Scan, OSV, Scorecard, SBOM, and CodeRabbit checks completed successfully. Independently verify the final six-file path boundary: legal comma/ASCII-parenthesis acceptance, raw |
|
@opencode-agent Please review the exact current head only. Verify the six-file legal Packrat-path repair, raw traversal rejection, quoted-argument boundary, exact-head quality evidence, and unresolved threads. Do not update the branch or merge. |
|
@opencode-agent Implement the minimal permanent GREEN repair on exact current head The exact-head read-only review found one valid coverage defect: Modify only directly necessary permanent quality-contract files:
Run |
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/strix-changed-path-quality-ci.yml:
- Around line 6-12: Update the paths list in the strix-changed-path-quality-ci
workflow to include scripts/ci/test_strix_quick_gate.sh, ensuring changes only
to that shell regression suite trigger the quality workflow and satisfy the
required-path validation in test_strix_workflow_dependency_hashes.py.
- Around line 6-12: 워크플로 계약에 셸 회귀 스위트를 포함하십시오.
`.github/workflows/strix-changed-path-quality-ci.yml` 6-12행의 `paths`에
`scripts/ci/test_strix_quick_gate.sh`를 추가하고, 57-64행에서 `python -m coverage run -m
pytest tests -q` 직후 `bash scripts/ci/test_strix_quick_gate.sh`를 실행하십시오.
`docs/doctoring/strix-legal-git-paths.md` 47-49행은 워크플로가 셸 스위트를 실행하도록 변경한 뒤 기존
설명을 유지하고, 실행하지 않는 경우에만 설명을 축소하십시오.
- Around line 3-13: Update the workflow’s top-level on configuration to add the
workflow_dispatch trigger alongside pull_request, enabling manual execution
through the Actions UI or API. Extend the relevant contract test, such as the
workflow-trigger assertions in tests/test_strix_workflow_dependency_hashes.py,
to verify workflow_dispatch is present.
In `@docs/doctoring/strix-legal-git-paths.md`:
- Around line 47-49: Update the verification-scope description in
strix-legal-git-paths.md to match the workflow: either include
scripts/ci/test_strix_quick_gate.sh in the documented validation or revise the
claim about running the complete repository test suite to describe only the
checks actually executed.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e52a6a28-f118-4551-b229-a3baefca2dca
📒 Files selected for processing (6)
.github/workflows/strix-changed-path-quality-ci.ymlCHANGELOG.mddocs/doctoring/strix-legal-git-paths.mdscripts/ci/strix_quick_gate.shtests/test_strix_changed_path_policy.pytests/test_strix_workflow_dependency_hashes.py
🚧 Files skipped from review as they are similar to previous changes (1)
- CHANGELOG.md
|
@opencode-agent address Exact head
Preserve the bounded legal-path policy, raw traversal rejection, immutable pins, read-only permissions, reviewer identities, and six-file permanent scope plus the necessary existing shell regression trigger. Do not add temporary writers, bypass review, merge, or release. |
|
The The branch now preserves the valid parts of the review—shell regression trigger path and execution, full repository coverage suite, and matching doctoring—while removing |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_strix_workflow_dependency_hashes.py`:
- Around line 37-42: 강화된 YAML 키 검사를 위해
test_strix_workflow_rejects_branch_selected_manual_dispatch에서 re를 import하고
workflow_dispatch 키의 공백 및 작은따옴표·큰따옴표 표기를 모두 탐지하도록 정규식을 업데이트하세요. YAML 파서가 이미 사용
가능하면 on 섹션 아래의 workflow_dispatch 키를 구조적으로 검사하되, 해당 워크플로가 수동 디스패치를 포함하지 않아야 한다는
기존 동작은 유지하세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9cc45491-eb81-461c-9e7b-b3fcf06e4f99
📒 Files selected for processing (3)
.github/workflows/strix-changed-path-quality-ci.ymldocs/doctoring/strix-legal-git-paths.mdtests/test_strix_workflow_dependency_hashes.py
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/strix-changed-path-quality-ci.yml
| def test_strix_workflow_rejects_branch_selected_manual_dispatch() -> None: | ||
| """Central executable workflows load no branch-selected manual source.""" | ||
| workflow = WORKFLOW.read_text(encoding="utf-8") | ||
|
|
||
| assert "workflow_dispatch:" not in workflow | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
printf '%s\n' '--- target test ---'
sed -n '1,140p' tests/test_strix_workflow_dependency_hashes.py
printf '%s\n' '--- related workflow files ---'
git ls-files | rg '(^|/)(\.github/workflows|.*workflow.*|.*strix.*)$' | head -80
printf '%s\n' '--- workflow_dispatch occurrences ---'
rg -n -C 3 'workflow_dispatch|on:' .github tests 2>/dev/null | head -240Repository: ContextualWisdomLab/.github
Length of output: 21112
🏁 Script executed:
printf '%s\n' '--- Strix workflow ---'
sed -n '1,220p' .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '--- repository test/config dependencies ---'
rg -n '(^|[[:space:]])(PyYAML|ruamel|yaml|pytest)' pyproject.toml setup.cfg setup.py requirements*.txt tox.ini 2>/dev/null | head -120
printf '%s\n' '--- relevant history/diff summary ---'
git status --short
git diff --stat
git diff -- tests/test_strix_workflow_dependency_hashes.py .github/workflows/strix-changed-path-quality-ci.ymlRepository: ContextualWisdomLab/.github
Length of output: 3757
🏁 Script executed:
python3 - <<'PY'
import importlib.util
import re
samples = {
"plain": "on:\n workflow_dispatch:\n",
"space_before_colon": "on:\n workflow_dispatch :\n",
"single_quoted": "on:\n 'workflow_dispatch':\n",
"double_quoted": 'on:\n "workflow_dispatch":\n',
}
pattern = re.compile(r"(?m)^\s*['\"]?workflow_dispatch['\"]?\s*:")
for name, text in samples.items():
print(name, "raw=", "workflow_dispatch:" in text, "regex=", pattern.search(text) is not None)
for module in ("yaml", "ruamel.yaml"):
print(module, bool(importlib.util.find_spec(module)))
if importlib.util.find_spec("yaml"):
import yaml
for name, text in samples.items():
try:
parsed = yaml.safe_load(text)
print(name, "parsed_on_keys=", list(parsed.get(True, parsed.get("on", {}))) if isinstance(parsed, dict) else parsed)
except Exception as exc:
print(name, "parse_error=", type(exc).__name__, str(exc))
PY
printf '%s\n' '--- policy references ---'
rg -n -i -C 4 'branch[- ]selected|manual dispatch|workflow_dispatch|exact-head|central executable|untrusted branch' .github docs scripts tests | head -260Repository: ContextualWisdomLab/.github
Length of output: 31808
🏁 Script executed:
ruby -ryaml <<'RUBY'
samples = {
"plain" => "on:\n workflow_dispatch:\n",
"space_before_colon" => "on:\n workflow_dispatch :\n",
"single_quoted" => "on:\n 'workflow_dispatch':\n",
"double_quoted" => "on:\n \"workflow_dispatch\":\n",
}
samples.each do |name, text|
begin
parsed = YAML.safe_load(text, permitted_classes: [], aliases: false)
on_value = parsed["on"] || parsed[true]
puts "#{name} parsed=true on_keys=#{on_value.is_a?(Hash) ? on_value.keys.inspect : on_value.inspect}"
rescue StandardError => e
puts "#{name} parsed=false error=#{e.class}: #{e.message}"
end
end
RUBYRepository: ContextualWisdomLab/.github
Length of output: 386
workflow_dispatch 검사를 YAML 키 구조에 맞게 강화하세요.
현재 검사는 workflow_dispatch :, 'workflow_dispatch':, "workflow_dispatch":와 같이 YAML에서 유효한 표기를 놓칩니다. re를 import하고 해당 키 표기를 모두 검사하세요. YAML 파서를 사용할 수 있으면 on 아래 키를 구조적으로 검사하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/test_strix_workflow_dependency_hashes.py` around lines 37 - 42, 강화된
YAML 키 검사를 위해 test_strix_workflow_rejects_branch_selected_manual_dispatch에서 re를
import하고 workflow_dispatch 키의 공백 및 작은따옴표·큰따옴표 표기를 모두 탐지하도록 정규식을 업데이트하세요. YAML
파서가 이미 사용 가능하면 on 섹션 아래의 workflow_dispatch 키를 구조적으로 검사하되, 해당 워크플로가 수동 디스패치를 포함하지
않아야 한다는 기존 동작은 유지하세요.
2 participants
Buyer-visible blocker
The organization-required Strix gate rejected a tracked legal Packrat fixture path containing comma and ASCII parentheses before security analysis, blocking exact-head review of
ContextualWisdomLab/aFIPC#160even though the path is legal Git data.Exact current stack
87c302cf37343e5a816f1ddb24d3f6e0e12410d8;e71fdab2ab088001f218765ecb5e3b7fabfee11a;Focused repair
(and)in the existing bounded changed-path allowlist...components before normalization can collapse embedded traversal.CHANGELOG.md, and authoritative doctoring changes.Exact-head acceptance evidence
For
87c302cf37343e5a816f1ddb24d3f6e0e12410d8, all exact-head workflows completed successfully:31152007300;31152007323;31152007376;31152007292;31152007334;31152007324;31152007580;31152007337;31152007308;Every inline review thread is resolved or outdated; zero actionable unresolved thread remains. The final scope is exactly
.github/workflows/strix-changed-path-quality-ci.yml,CHANGELOG.md,docs/doctoring/strix-legal-git-paths.md,scripts/ci/strix_quick_gate.sh,tests/test_strix_changed_path_policy.py, andtests/test_strix_workflow_dependency_hashes.py.Formal exact-current-head OpenCode/Noema review and a qualifying independent non-author approval are still required. Queued, cancelled, predecessor-head, status-only, author-only, or synthetic evidence is not accepted.
Merge gate
Merge only after fresh exact-head automated review, qualifying independent non-author approval, zero unresolved actionable findings, and every branch-protection rule pass without bypass. After integration, rerun Strix for unchanged
aFIPC#160; predecessor failure is not reused.Summary by CodeRabbit
버그 수정
문서
테스트 및 품질