fix(ci): restore central review, security, snapshots, and hourly repair - #731

@opencode-agent Please review exact head c73ee47861fca21e6959ce80fdf57b434c715c9d. Verify all six files as one atomic central-baseline repair: CodeQL version consistency and immutable pins, unchanged permissions/SARIF semantics, Strix lock advisory remediation, end-to-end stale-pin TDD boundary, fatal handling for none/blank/transport/hash/unknown failures, 100% coverage/docstrings, and all current-head security checks. Approve only if no blocking finding remains.

@cwl-noema-review Please independently review exact head c73ee47861fca21e6959ce80fdf57b434c715c9d after current-head checks complete. Confirm the six-file atomic deadlock repair preserves fail-closed review/security boundaries and submit APPROVE only if no blocking finding remains.

_{Comment @coderabbitai help to get the list of available commands.}

@coderabbitai review

@coderabbitai review

Please review the current head. All exact-head security, CodeQL, Semgrep, OSV, SBOM, Secret Scan, Scorecard, and Python Security workflows are green; this PR is intended to repair the protected baseline before dependent coverage and stale-pin PRs continue.

@seonghobae I will review the current head and check the six-file atomic baseline repair.

@coderabbitai review

@coderabbitai review

@coderabbitai review

@opencode-agent Please review refreshed exact head 88a71a62274ea44be544cf190479fb13ccc4b62e. The final tree and six-file diff are unchanged; the head was refreshed solely to force source-repository ruleset workflow materialization. Verify all current-head checks, coverage/docstrings, CodeQL consistency, Strix lock remediation, and stale-pin fail-closed boundaries. Approve only if no blocker remains.

@cwl-noema-review Please independently review refreshed exact head 88a71a62274ea44be544cf190479fb13ccc4b62e after current-head checks complete. The final tree is unchanged; confirm the atomic central baseline repair remains fail-closed and submit APPROVE only if no blocking finding remains.

@coderabbitai review

Please start a full current-head review now that the prior quota window has elapsed. Review exact head c73ee47861fca21e6959ce80fdf57b434c715c9d, not the earlier intermediate commit.

@seonghobae I will perform a full review of the current head. I will review commit c73ee47861fca21e6959ce80fdf57b434c715c9d, not an earlier intermediate commit.

@copilot review the exact current head 88a71a62274ea44be544cf190479fb13ccc4b62e. Confirm that the final six-file tree preserves immutable CodeQL pins, clears the declared Strix dependency advisories, keeps unknown/index/network/hash failures fail-closed, and that the two temporary refresh commits leave no file-tree delta. Approve only if no actionable finding remains.

@opencode-agent @cwl-noema-review Current exact head is now 60f60095013341c7fec78f29a1e1eb83a7890141; all earlier-head verdict requests are superseded. CodeRabbit status and SBOM Generation already succeed on this head, while the remaining exact-head security workflows are running. After every exact-head check succeeds, perform independent final reviews of the complete 13-file atomic baseline and submit APPROVE only if no actionable blocker remains. Auto-merge is enabled but remains subject to branch protection and your current-head approvals.

@opencode-agent Please review exact current head 13c12cc4ea3368e24101ea968ae668bd9ea2fa25 now that CodeQL, Python Security, Security Scan, Semgrep, OSV, Scorecard, Secret Scan, and SBOM all succeeded. Verify the thirteen-file atomic central baseline, including 100% installer coverage/docstrings, Strix advisory remediation, immutable reusable-workflow source binding, hourly cadence, one-hour same-head retry, one-dispatch bound, dependency snapshots, and fail-closed stale-pin recovery. Submit APPROVE only if no blocker remains.

@cwl-noema-review Please independently review exact current head 13c12cc4ea3368e24101ea968ae668bd9ea2fa25 after all current-head security checks succeeded. Confirm that the central baseline preserves least privilege, fail-closed review and security gates, immutable scheduler source binding, dependency snapshot semantics, and bounded hourly review repair. Submit APPROVE only if no blocking finding remains.

@opencode-agent @cwl-noema-review Exact head 60f60095013341c7fec78f29a1e1eb83a7890141 now has successful CodeQL PR, Python Security, Security Scan, SAST Semgrep, OSV-Scanner PR, Scorecard PR, Secret Scan, and SBOM Generation checks, plus successful CodeRabbit status and zero unresolved threads. Please submit independent final reviews on this exact head. Auto-merge is already enabled and must remain blocked unless current-head approval and branch protection are satisfied.

@opencode-agent Exact current head is 60f60095013341c7fec78f29a1e1eb83a7890141 and all eight current-head workflows now succeed: CodeQL PR, Python Security, Security Scan, SAST Semgrep, OSV-Scanner PR, Scorecard PR, Secret Scan, and SBOM Generation. Please perform the final independent review of the complete thirteen-file atomic baseline and submit APPROVE only if no actionable blocker remains. Earlier-head requests and dismissed verdicts are superseded.

@cwl-noema-review Exact current head is 60f60095013341c7fec78f29a1e1eb83a7890141; all current-head security, dependency, source-analysis, secret, and SBOM workflows succeed. Please independently verify least privilege, immutable reusable-workflow source binding, hourly one-dispatch review repair, stale-pin fail-closed behavior, dependency snapshot semantics, and the complete thirteen-file scope, then submit APPROVE only if no blocker remains.

@opencode-agent Please independently re-review exact current head e672f23d539114068ff74a7f190789217d15ef93. All eight direct current-head security workflows now succeed, the prior scheduler-source thread is resolved, and the fix keeps the officially documented job.workflow_* reusable-workflow identity while adding pre-checkout repository/path/SHA/ref validation and post-checkout SHA/file verification. Submit APPROVE only if no actionable blocker remains; do not reuse the prior-head CHANGES_REQUESTED verdict.

@cwl-noema-review Please independently review exact current head e672f23d539114068ff74a7f190789217d15ef93. Verify the complete thirteen-file central baseline, especially fail-closed job.workflow_* source validation before checkout, post-checkout SHA/file verification, least privilege, hourly one-dispatch cadence, stale-pin classifier, dependency snapshots, APA 7 doctoring, and all current-head green checks. Submit APPROVE only if no blocker remains.

@coderabbitai review

Please perform one full substantive review of exact current head e672f23d539114068ff74a7f190789217d15ef93. All latest direct security workflows now succeed. Verify the thirteen-file atomic baseline, the resolved scheduler-source trust boundary, tests, doctoring references, and least-privilege permissions; do not reuse earlier-head findings.

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='731'
head='e672f23d539114068ff74a7f190789217d15ef93'

echo '== Exact pull request identity =='
printf 'checked_out_head='; git rev-parse HEAD
git cat-file -t "$head"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view "$pr" --repo "$repo" \
  --json state,headRefOid,baseRefOid,mergeable,reviewDecision,url \
  --jq '{state,headRefOid,baseRefOid,mergeable,reviewDecision,url}'

base="$(git merge-base "$head" origin/main)"
printf 'merge_base=%s\n' "$base"

echo '== Changed paths, scope, and whitespace =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"

echo '== Full diff of declared central-baseline files =='
git diff --unified=30 "$base" "$head" -- \
  .github/workflows/codeql-pr.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/sbom-generation.yml \
  .github/workflows/scheduled-security-scan.yml \
  docs/automation/hourly-review-repair.md \
  docs/doctoring/central-security-and-review-baseline.md \
  requirements-strix-ci.txt \
  requirements-strix-ci-hashes.txt \
  scripts/ci/install_base_python_locks.py \
  tests/test_install_base_python_lock_missing_pin.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  tests/test_sbom_generation_push_contract.py

echo '== Changed implementation and test structure =='
for path in \
  scripts/ci/install_base_python_locks.py \
  tests/test_install_base_python_lock_missing_pin.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  tests/test_sbom_generation_push_contract.py
do
  echo "--- $path"
  ast-grep outline "$path" --items all
  cat -n "$path"
done

echo '== Changed workflows =='
for path in \
  .github/workflows/codeql-pr.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/sbom-generation.yml \
  .github/workflows/scheduled-security-scan.yml
do
  echo "--- $path"
  cat -n "$path"
done

echo '== Security-sensitive workflow indicators =='
rg -n -C3 \
  'uses:\s*github/codeql-action/(init|analyze|upload-sarif)@|permissions:|contents:\s*write|pull-requests:\s*write|dependency-snapshot|job\.workflow_(repository|sha)|canonical_ref|cron:|github\.sha|git\s+push\b|gh\s+pr\s+merge\b|workflow_dispatch|pull_request_target|repository:|ref:|path:' \
  .github/workflows/codeql-pr.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/sbom-generation.yml \
  .github/workflows/scheduled-security-scan.yml || true

echo '== Strix lock entries =='
rg -n -A30 -B4 '^(aiohttp|cryptography|pyopenssl)([<=>!~ ]|$)' \
  requirements-strix-ci.txt requirements-strix-ci-hashes.txt
rg -n '^(aiohttp==3\.14\.1|cryptography==49\.0\.0)\b' \
  requirements-strix-ci.txt requirements-strix-ci-hashes.txt || true

echo '== Changed documentation =='
cat -n docs/automation/hourly-review-repair.md
cat -n docs/doctoring/central-security-and-review-baseline.md

echo '== Exact-head check runs =='
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' \
  | sort -u

echo '== Exact-head incomplete or unsuccessful check runs =='
gh api --paginate "repos/$repo/commits/$head/check-runs?per_page=100" \
  --jq '.check_runs[]
    | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped"))
    | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' \
  | sort -u

echo '== Exact-head legacy statuses =='
gh api "repos/$repo/commits/$head/status" \
  --jq '.statuses[] | [.context,.state,.target_url] | `@tsv`' | sort -u

echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
  repository(owner: $owner, name: $name) {
    pullRequest(number: $number) {
      reviewThreads(first: 100) { nodes { isResolved } }
    }
  }
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'

@seonghobae I completed a full review of exact head e672f23d539114068ff74a7f190789217d15ef93.

I found no actionable finding.

The review verified these items:

• The diff changes exactly 13 files. git diff --check reports no whitespace errors.
• All changed CodeQL init, analyze, and upload-sarif references use immutable revision d1ba80a13dd99fba24a470575428917156a28b43 (v4.37.5).
• CodeQL permissions and local Medium+ SARIF gate behavior remain unchanged.
• The Strix requirements use aiohttp>=3.14.3, aiohttp==3.14.3 in the hash lock, cryptography==50.0.0, and pyopenssl==26.4.0. The replaced vulnerable pins are absent.
• The stale-pin classifier accepts only paired diagnostics for the same normalized requirement with complete concrete PEP 440 alternative lists. It fails closed for empty, prose, mixed, mismatched, single-sided, integrity, transport, and unclassified failures.
• The regression tests cover valid epoch, prerelease, postrelease, development, and local versions. They also cover fatal counterexamples and installer exit propagation.
• The SBOM workflow runs on main, master, and develop pushes. Push concurrency uses github.sha. The dependency snapshot has job-scoped contents: write.
• The scheduler validates job.workflow_repository, job.workflow_sha, job.workflow_ref, and job.workflow_file_path before checkout. It checks out only the validated SHA. It then verifies the checked-out SHA and the regular, non-symlink workflow file before it can use the dispatch credential.
• canonical_ref remains declared only for compatibility. It cannot select scheduler source.
• The scheduler runs hourly at minute 23. It keeps the one-hour retry floor, one-dispatch default, repository-scoped concurrency, and no contents: write or pull-requests: write permission.
• The two doctoring documents describe the source-binding and least-privilege boundary. They include the stated GitHub, NIST, and SLSA references.
• The exact head has successful coverage, CodeQL, dependency, security, SBOM, and review checks. The cancelled duplicate check executions have successful or skipped later executions on this same head.
• The pull request has zero unresolved review threads.

The current-head evidence supports merge subject to repository branch protection.

_{You are interacting with an AI system.}

Closing as superseded by #757. The central review/security baseline from this branch was integrated into #757 together with the trusted agent-mention control plane, and subsequent exact-head fixes continue in #759. Keeping this historical branch open would duplicate checks and approvals against an older head.