[codex] Sync PR governance scheduler contract - #460
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the local PR Review Merge Scheduler to match the centralized governance contract, tightening “current head” approval validation, proactively resolving GitHub-marked outdated review threads, and reclassifying ACTION_REQUIRED check runs as workflow/policy waits rather than source-code failures.
Changes:
- Resolve GitHub
Outdatedreview threads (via GraphQL thread IDs) before enforcing unresolved-thread gates, and annotate decisions with cleanup notes. - Strengthen OpenCode approval validation by requiring the review to match the PR head commit and (when present) an explicit
Head SHAembedded in the review body. - Split
ACTION_REQUIREDcheck runs out of “failed checks” into a dedicated “wait for workflow unblock” decision/guidance path, and improve error logging by scrubbing sensitive data.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
services/analysis-engine/tests/test_supply_chain_policy.py |
Updates the supply-chain policy test assertions to track the updated scheduler contract (new helpers/constants and logic). |
scripts/ci/pr_review_merge_scheduler.py |
Implements the governance sync: outdated-thread cleanup, head-SHA enforcement for OpenCode reviews, ACTION_REQUIRED handling, and decision contract enhancements. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| text = re.sub(r'(?i)(bearer\s+)[^\s"\'\\]+', r'\1***', text) | ||
| text = re.sub(r'(?i)(token\s+)[^\s"\'\\]+', r'\1***', text) | ||
| text = re.sub(r'(ghp_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+)', '***', text) |
| reason: str, | ||
| ) -> Decision: | ||
| """Disable auto-merge and return a disable_auto_merge decision with the concrete unsafe reason.""" | ||
| """Disable auto-merge and return a WAIT decision with the concrete unsafe reason.""" |
2825534 to
60e3b11
Compare
|
Superseded by the organization-level reusable workflow rollout direction. This PR copied the central scheduler into the repository, which would preserve the per-repository drift we are trying to remove. The next change should keep target repositories as thin callers, or use a central scheduler/app path, with the canonical OpenCode/Strix/PR-governance logic owned by ContextualWisdomLab/.github. |
OpenCode Review Overview
OpenCode reviewed the current-head evidence but found unresolved human review threads before approval.
Review thread evidenceLatest unresolved human review thread evidence
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
OpenCode reviewed the current-head evidence but found unresolved human review threads before approval.
- Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human review thread evidence on the current pull request.
- Root cause: Human review feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
- Fix: Address or resolve the listed human review thread(s), then re-run OpenCode on the current head.
- Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE.
Review thread evidence
Latest unresolved human review thread evidence
scripts/ci/pr_review_merge_scheduler.py line 633
-
Latest human comment: @copilot-pull-request-reviewer at 2026-06-25T22:04:45Z
-
Comment URL: #460 (comment)
-
Comment excerpt: The docstring says this returns a "WAIT decision", but the returned Decision.action is "disable_auto_merge" (the contract mapping happens later via contract_decision()). This is easy to misread when working with Decision.action directly.
-
Result: REQUEST_CHANGES
-
Reason: unresolved human review thread(s) were present before approval.
-
Head SHA:
60e3b11c7ba98980ccbdebd1c6357d660ade1e30 -
Workflow run: 28203520862
-
Workflow attempt: 1
Summary
Outdatedreview threads before active unresolved-thread checks, using the workflowGITHUB_TOKENonly.Head SHA.ACTION_REQUIREDcheck runs as workflow/policy waits instead of source-code failures.GH_HOSTguard so scheduler tokens are only used against github.com.Live evidence
ContextualWisdomLab/bandscopesaw 79 open PRs and classified 11 stale auto-merge candidates asdisable_auto_merge: 🧹 [code health improvement] Extract nested functions from scorecard_sarif_upload_normalization_violations #387, 🧹 Split oversized test function to improve readability and granularity #400, build(deps-dev): bump eslint-plugin-jsdoc from 63.0.5 to 63.0.7 #439, build(deps-dev): bump @types/node from 25.9.3 to 26.0.0 #440, build(deps): bump @base-ui/react from 1.5.0 to 1.6.0 #441, build(deps-dev): bump @tauri-apps/cli from 2.11.2 to 2.11.3 #442, build(deps-dev): bump @vitejs/plugin-react from 6.0.2 to 6.0.3 #443, build(deps-dev): bump vite from 8.0.16 to 8.1.0 #444, build(deps-dev): bump typescript-eslint from 8.60.1 to 8.62.0 #446, 🎨 Palette: 컴팩트 네비게이션 키보드 접근성 개선 #448, UI(접근성): 모바일 내비게이션 버튼에 focus 스타일 추가 #451.wait: current head is approved; auto-merge already enabled, so it was trusting stale approval evidence.{"block": 68, "disable_auto_merge": 11}.Validation
python3 scripts/ci/pr_review_merge_scheduler.py --self-testpython3 -m py_compile scripts/ci/pr_review_merge_scheduler.pybash -n scripts/ci/collect_failed_check_evidence.sh scripts/ci/emit_opencode_failed_check_fallback_findings.sh scripts/ci/opencode_review_approve_gate.sh scripts/ci/validate_opencode_failed_check_review.sh scripts/ci/test_opencode_fact_gate_contract.shGH_HOST=evil.example python3 scripts/ci/pr_review_merge_scheduler.py --repo ContextualWisdomLab/bandscope --base-branch develop --project-flow git-flow --dry-run --max-prs 1exits withunsupported GH_HOST.python3 scripts/ci/pr_review_merge_scheduler.py --repo ContextualWisdomLab/bandscope --base-branch develop --project-flow git-flow --dry-run --max-prs 100 --no-trigger-reviews --no-enable-auto-merge --update-branches./scripts/harness/quickcheck.shgit diff --check