Post-merge PR #185 stabilization and warning/security follow-through

[seonghobae]

현재 역할

업무/O1: coordinate post-merge stabilization after PR #185 moved default develop to a84d1a1ace3228e947eca0f6d785095d5520b2b0.

현재 상태

PR #185 is merged and its original CodeRabbit blockers are complete. Post-merge checks and security metadata still exposed follow-up work that should not be hidden behind a completed reconciliation issue.

현재 코드 기준 유효성

Verified from a fresh Stepwise worktree created from current origin/develop:
/Users/seonghobae/opencode_tasks/bandscope/.worktrees/stepwise-pr185-postmerge.

현재 코드 근거

• PR chore: reconcile main release line into develop #185 merged into develop: chore: reconcile main release line into develop #185
• Merge commit: a84d1a1ace3228e947eca0f6d785095d5520b2b0
• Fresh local baseline passed: BANDSCOPE_ENABLE_RUST_CHECK=1 ./scripts/harness/quickcheck.sh
• Post-merge OSSF Scorecard push run failed: [Bug] Fix OSSF Scorecard publish failure after PR #185 merge #187
• Rust dependency advisory/deprecation tracking remains open: [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188
• Completed predecessor issue Resolve current-head CodeRabbit blockers for PR #185 #186 closed after PR chore: reconcile main release line into develop #185 merge evidence was linked.
• Historical parent Reconcile main release/UI line into default develop and close warning output debt #178 is complete for the default-branch reconciliation itself.

stale한 부분과 재해석

#178 is now a historical reconciliation issue. This issue is the active post-merge stabilization parent so open follow-ups do not live under a completed parent.

상위/하위/인접 관계

• Milestone / 직무: CodeRabbit Generated Unit Tests: Add unit tests for PR changes #2 v0.1.4 Default-branch Reconciliation & Zero-warning Stabilization
• Parent / 업무: this issue
• Sub-issues / 과업:
  • [Bug] Fix OSSF Scorecard publish failure after PR #185 merge #187 Fix OSSF Scorecard publish failure after PR chore: reconcile main release line into develop #185 merge
  • [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188 Track Rust rand advisory and transitive deprecated proc-macro-hack
• Completed predecessor: Resolve current-head CodeRabbit blockers for PR #185 #186
• Historical predecessor: Reconcile main release/UI line into default develop and close warning output debt #178
• Related completed warning cleanup: Resolve Librosa and Audioread Warnings/Deprecations during Analysis #153, Fix warnings and deprecation messages in test suite #154, Refresh warning/deprecation cleanup on reconciled develop #180
• Adjacent queue verification: Revalidate open develop PR queue after default branch reconciliation #184

다음 액션

1. Fix [Bug] Fix OSSF Scorecard publish failure after PR #185 merge #187 first because it is a repo-controlled failed default-branch workflow.
2. Then execute [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188, starting with a minimal lockfile update for rand.
3. Keep robot reviewer and required GitHub Checks as merge gates. Do not wait for human review unless explicitly requested.
4. Close this parent only after child issues are closed and post-merge checks are green.

완료 조건

• [Bug] Fix OSSF Scorecard publish failure after PR #185 merge #187 and [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188 are resolved or explicitly split into narrower child issues with owner and evidence.
• All PRs pass required GitHub Checks.
• CodeRabbit or equivalent robot-reviewer evidence is current-head approved or explicitly skipped by authoritative check evidence.
• Deployment/release-quality evidence from GitHub Actions is green for the merged commits.

Security Notes

• This issue coordinates supply-chain and dependency evidence after a default-branch merge.
• Do not weaken security workflows, branch protections, SBOM retention, or cross-platform build gates.
• Do not suppress warnings/deprecations with broad filters; fix root cause or document a narrow owner chain.

[coderabbitai]

🔗 Related PRs

#21 - chore(deps): consolidate green Dependabot updates [merged]
#54 - docs: align required checks with stable gates [merged]
#58 - fix(ci): remove unverified Syft download in SBOM workflow [merged]
#95 - Sync main to develop after v0.1.0 release [merged]
#96 - chore(security): resolve OSSF Scorecard alerts [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[seonghobae]

#187 is resolved and verified after PR #190.\n\nEvidence:\n- PR #190 merged: https://github.com/seonghobae/bandscope/pull/190\n- Merge commit: a79c763\n- Current default-branch OSSF Scorecard run succeeded: https://github.com/seonghobae/bandscope/actions/runs/25153584554\n- OSSF job succeeded: https://github.com/seonghobae/bandscope/actions/runs/25153584554/job/73729709278\n\nThe post-merge workflow failure from a84d1a1 is superseded by the successful develop run on a79c763. Remaining child work: #188 Rust rand advisory / proc-macro-hack owner-chain remediation.

[seonghobae]

#188 is resolved and verified after PR #191.

Evidence:

• PR fix: patch rust dependency advisory ownership #191 merged: fix: patch rust dependency advisory ownership #191
• Merge commit on develop: 80f22c3
• [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188 closed as completed: [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188
• Current-head CodeRabbit evidence: CodeRabbit resolved addressed comments and approved ecd156d before merge.
• Post-merge develop runs for 80f22c3 all completed successfully: bandit, sbom, trivy, secret-scan-gate, codeql, ci, release, security-audit, ossf-scorecard, and build-baseline.
• Required cross-platform build evidence is green on the merge commit: build / macos / amd64, build / macos / arm64, build / windows / amd64, build / windows / arm64, gate / build / macos, and gate / build / windows.

The two child issues for this parent are now resolved:

• [Bug] Fix OSSF Scorecard publish failure after PR #185 merge #187 fixed by PR fix: enforce OSSF Scorecard publish constraints #190 and verified on develop.
• [Security] Track Rust rand advisory and transitive deprecated proc-macro-hack #188 fixed by PR fix: patch rust dependency advisory ownership #191 and verified on develop.

Closing this stabilization parent as completed.