fix(ci): replace conflicted fatal OpenCode process-group prerequisite - #821
fix(ci): replace conflicted fatal OpenCode process-group prerequisite#821seonghobae wants to merge 10 commits into
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Exact-current-head review request for Current exact-head focused quality CI, Security Scan, CodeQL, Python Security, Semgrep, Secret Scan, OSV, Scorecard, SBOM, and CodeRabbit status are successful; the rerun of the cancelled Strix Changed Path Quality CI is still in progress and is not counted as passing until terminal success. Review this exact head only; predecessor #813 evidence does not transfer. @coderabbitai review Review-only. Do not update the branch, create repair automation, approve from the author identity, merge, or bypass protection. Submit only an exact-head verdict. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_base='1131b1bbafb24e455fc8619cdf316813e8721861'
expected_head='f92784f389317d512376a0725cbd78606b2e832c'
printf '%s\n' '== Checkout and commit identity =='
git rev-parse HEAD
git rev-parse "$expected_base"
git rev-parse "$expected_head"
git merge-base --is-ancestor "$expected_base" "$expected_head"
printf 'base_is_ancestor=%s\n' "$?"
printf '%s\n' '== Changed files =='
git diff --name-status "$expected_base" "$expected_head"
printf '%s\n' '== Stat =='
git diff --stat "$expected_base" "$expected_head"
printf '%s\n' '== GitHub exact-head check runs =='
gh api "repos/ContextualWisdomLab/.github/commits/$expected_head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'Length of output: 7744 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='1131b1bbafb24e455fc8619cdf316813e8721861'
head='f92784f389317d512376a0725cbd78606b2e832c'
printf '%s\n' '== Structural outlines =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all || true
ast-grep outline tests/test_fatal_provider_and_dependency_review_replacement.py --items all
ast-grep outline tests/test_required_workflow_queue_contract.py --items all
ast-grep outline tests/test_sandboxed_verify.py --items all
printf '%s\n' '== Final workflow and launcher sources =='
for file in \
.github/workflows/fatal-provider-dependency-review-quality-ci.yml \
.github/workflows/security-scan.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_fatal_provider_and_dependency_review_replacement.py \
tests/test_required_workflow_queue_contract.py \
tests/test_sandboxed_verify.py \
CHANGELOG.md \
docs/doctoring/dependency-review-support-probe.md \
docs/doctoring/opencode-process-group-termination.md
do
printf '\n===== %s =====\n' "$file"
cat -n "$file"
done
printf '%s\n' '== Complete patch =='
git diff --find-renames --find-copies --no-ext-diff "$base" "$head"Length of output: 192689 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='f92784f389317d512376a0725cbd78606b2e832c'
printf '%s\n' '== Fatal-provider behavioral regression definitions and workflow coverage =='
rg -n -C 8 --glob '*.py' \
'\btest_fatal_provider_error_kills_hung_opencode_run_early\b|\brun_one_model_attempt\b|OPENCODE_FATAL_ERROR_POLL_SECONDS' \
tests scripts .github || true
printf '%s\n' '== Workflows that execute the behavioral test file or model-pool contracts =='
rg -n -C 5 --glob '*.yml' \
'test_fatal_provider_error_kills_hung_opencode_run_early|run_opencode_review_model_pool|model_pool' \
.github/workflows || true
printf '%s\n' '== Pull request and current exact-head checks =='
gh pr view 821 --repo ContextualWisdomLab/.github \
--json number,state,isDraft,mergeable,mergeStateStatus,headRefOid,baseRefOid,statusCheckRollup \
--jq '{
number, state, isDraft, mergeable, mergeStateStatus, headRefOid, baseRefOid,
checks: [.statusCheckRollup[] | {
name: .name,
status: .status,
conclusion: .conclusion,
workflowName: .workflowName,
detailsUrl: .detailsUrl
}]
}'
printf '%s\n' '== Commit check runs refreshed =='
gh api "repos/ContextualWisdomLab/.github/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'Length of output: 33864
The checked-out head and PR head match the requested commit. The protected base matches The dependency-review probe now fails closed for a nonzero This PR is not ready. You are interacting with an AI system. |
|
@opencode-agent address Reconcile this existing Draft branch with protected The branch is now exactly one protected-main commit behind ( Perform one ordinary non-forced merge of exact protected After the merge commit, rerun the focused |
|
@opencode-agent address Reconcile this replacement with the exact current protected The one protected-main commit is #823's bounded Strix quality timeout-fixture repair. This branch's product diff does not touch those Strix production/test files; the only expected textual overlap is Create a normal non-forced merge of exact protected main into the existing branch. Do not force-push, rebase away fail-first history, use |
|
@opencode-agent address Reconcile this earliest scanner/OpenCode prerequisite onto current protected Use a trusted checkout and normally merge exact protected main into this existing replacement branch. Resolve conflicts by retaining every newer protected-main behavior plus only this PR's validated bounded contracts:
Do not force-push, use |
1 participant
Replacement purpose
Replace conflicted prerequisite #813 from the exact current protected
mainwhile preserving #813 and its fail-first history unchanged. #813 no longer descends from currentmainand GitHub reports it non-mergeable, so destructive repair is prohibited.Exact boundary
1131b1bbafb24e455fc8619cdf316813e8721861(main);f92784f389317d512376a0725cbd78606b2e832c;No checks, reviews, approvals, comments, or other evidence from #813 transfer to this replacement. Any earlier replacement-head evidence is stale after a head change.
Test-first evidence
The permanent replacement regression was committed before the production repair. Exact-head run
31179003656, job92867529694, checked out4c1e763a9dea3a60e29344556c7201ac62c6b383with persisted checkout credentials disabled and failed exactly the two intended contracts: a fakecurlemitted HTTP200then exited18but the inherited probe returned success, and the inherited OpenCode launcher lacked a dedicatedsetsidprocess group and killed only the timeout-wrapper PID.Exact head
148eeb2fd212196136efb3e75d4577a3780d20f7subsequently produced GREEN focused exact-head evidence in run31179647237, job92869591286: literal-head checkout withpersist-credentials: false, both permanent regressions passing, Python compilation passing, launcher Bash syntax passing, and a clean worktree. Those results became stale when the head advanced.A replacement-diff review then found a documentation-provenance error: dependency-review doctoring named the superseded #813-only regression file. Corrective RED head
82667148c3051fad7a6a1157339f54e2ff47059eadded the contract first. Exact-head run31180019016, job92870797249, checked out that literal head and failed exactly the new doctoring assertion while the two existing regressions remained green (1 failed, 2 passed). Current GREEN candidatef92784f389317d512376a0725cbd78606b2e832cchanges only the doctoring test path totests/test_fatal_provider_and_dependency_review_replacement.py. No acceptance evidence from the RED head transfers; the focused and central gates must rerun on this unchanged head.Bounded implementation
scripts/ci/run_opencode_review_model_pool.shstarts each bounded provider attempt in its own session withsetsid; fatal-provider cleanup sends TERM to the negative process-group identifier, waits boundedly, and escalates KILL to the same group.Security Scanaccepts dependency-review capability only whencurlsucceeds and the exact base/head compare endpoint returns HTTP 200; timeout, partial transfer, transport/TLS failure, authorization/support failure, malformed/empty status, and every non-200 result fail closed.CHANGELOG.mdpreserves newer protected-main entries and adds only the bounded repairs.Current gate state
Exact head
f92784f389317d512376a0725cbd78606b2e832chas just been published as the corrective GREEN candidate. Absent, queued, pending, skipped-required, neutral-required, cancelled, failed, predecessor-head, generated-merge-only, or otherwise stale evidence is not passing. Do not mark ready, close #813, or advance #799 until the focused exact-head contract and every applicable security/supply-chain gate complete successfully on this unchanged head.Independent non-author exact-head approval remains required after the final code and evidence are stable.
Dependency order
This replacement is the earliest repair boundary for scanner exact-head repair #799. Do not deepen, refresh acceptance, or merge #799 until this replacement is mergeable, its available exact-head CI/security/dependency/SBOM/status evidence passes, and it is protected-merged. After protected merge, #799 must be refreshed against new exact
main; none of #799's predecessor-base checks, reviews, or approvals transfer.Prohibited shortcuts
Keep Draft until current-head machine evidence is complete. Do not force-push, rewrite history, use
-X ours/-X theirs, introduce a temporary write-capable repair workflow, synthesize approval, bypass branch protection, weaken a test, or reuse stale evidence.