fix(strix): accept legal Packrat fixture paths - #800
Conversation
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughStrix 변경 경로 정책이 쉼표와 ASCII 괄호를 허용하도록 변경되었습니다. 경로 순회와 셸 구문 문자는 계속 차단됩니다. 회귀 테스트와 GitHub Actions 품질 검사 워크플로가 추가되었습니다. ChangesStrix 경로 정책
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review Review-only exact-head request for |
|
@coderabbitai review Review exact current head |
|
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/strix-changed-path-quality-ci.yml:
- Around line 6-9: Update the workflow’s paths configuration to include
docs/doctoring/strix-legal-git-paths.md and CHANGELOG.md so changes to either
contract file trigger validation. In the workflow test step, replace the
single-test-file invocation with the full suite command using coverage and
pytest against tests in quiet mode.
In `@tests/test_strix_changed_path_policy.py`:
- Around line 65-84: Reject raw “..” path components before normalization in the
changed-path normalizer, and add “safe/../target.txt” to the rejected cases in
tests/test_strix_changed_path_policy.py:65-84. Update
docs/doctoring/strix-legal-git-paths.md:20-29 to retain the traversal-rejection
claim only after this fix, and remove or limit the same fail-closed claim in
CHANGELOG.md:15 until the fix is applied.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 306ffc18-d8b4-4332-a38e-0f618add47b9
📒 Files selected for processing (5)
.github/workflows/strix-changed-path-quality-ci.ymlCHANGELOG.mddocs/doctoring/strix-legal-git-paths.mdscripts/ci/strix_quick_gate.shtests/test_strix_changed_path_policy.py
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Review exact current head |
|
@opencode-agent @cwl-noema-review Review-only exact-head request for |
|
|
|
@coderabbitai review Please retry the exact-current-head review for |
|
|
|
@coderabbitai review Review exact current head |
|
I will verify the raw-traversal rejection boundary and the full-suite exact-head workflow. I will treat
|
|
Addressed the remaining Scorecard |
|
Review-only request for exact current head |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
I will validate the stated path-policy boundary, raw traversal rejection, argument handling, dependency hash enforcement, workflow coverage, and security controls. I will treat prior-head evidence as historical only. I will not mutate, approve, bypass, or merge the branch.
|
|
@cwl-noema-review Independently review exact current head |
|
@coderabbitai review Read-only exact-head review requested for |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review Review exact head |
|
@opencode-agent review Review exact head |
|
@cwl-noema-review review Independently review exact head |
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
dc97cef to
c51bf92
Compare
|
Review-only exact-head request for |
|
@cwl-noema-review Independently review exact head |
|
@opencode-agent review Review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
printf '%s\n' '== checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== expected commit object =='
git rev-parse "${expected_head}^{commit}"
printf '%s\n' '== pull-request metadata and checks =='
gh pr view 800 --repo ContextualWisdomLab/.github \
--json headRefOid,baseRefOid,changedFiles,files,reviews,statusCheckRollup \
--jq '{headRefOid, baseRefOid, changedFiles, files: [.files[].path], reviews: [.reviews[] | {author: .author.login, state}], checks: [.statusCheckRollup[] | {name, conclusion, status}]}'
printf '%s\n' '== exact diff name/status =='
git diff --name-status f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae "${expected_head}"
printf '%s\n' '== source and test outlines =='
ast-grep outline scripts/ci/strix_quick_gate.sh --items all || true
ast-grep outline tests/test_strix_changed_path_policy.py --items all || true
printf '%s\n' '== relevant workflow paths and write-permission indicators =='
rg -n -C 3 '^(on:|permissions:|concurrency:|jobs:)|pull_request|workflow_dispatch|actions/(checkout|setup-python)@|pip |pytest|coverage|git (push|commit|checkout -b)|gh (pr|api)|contents: write|pull-requests: write' \
.github/workflows/strix-changed-path-quality-ci.yml .github/workflows || true
printf '%s\n' '== changed-path policy and shell-boundary indicators =='
rg -n -C 4 'normalize_changed_file_path|allowed|allowlist|\.\.|realpath|printf|read -r|--|eval|sh -c|bash -c|git diff|changed' \
scripts/ci/strix_quick_gate.sh tests/test_strix_changed_path_policy.py || true
printf '%s\n' '== complete exact diff =='
git diff --no-ext-diff --unified=80 f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae "${expected_head}" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.mdLength of output: 180775 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
printf '%s\n' '== exact commits and worktree =='
printf 'HEAD: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
git status --short
printf '%s\n' '== PR head, changed files, reviews, and check conclusions =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,reviews,statusCheckRollup \
--jq '{headRefOid, baseRefOid, files: [.files[].path], reviews: [.reviews[] | {author: .author.login, state}], checks: [.statusCheckRollup[] | {name, status, conclusion}]}'
printf '%s\n' '== all changed paths at requested head =='
git diff --name-status "$base" "$head"
printf '%s\n' '== dependency contract outline and source =='
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all
cat -n tests/test_strix_workflow_dependency_hashes.py
printf '%s\n' '== complete new workflow =='
cat -n .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== writes or remote mutation commands in new workflow =='
rg -n -i -C 2 'permissions:.*write|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|git\s+(push|commit|tag)|gh\s+(api|pr)|curl\s+.*-X\s*(POST|PUT|PATCH|DELETE)' \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== tests for unsupported Unicode punctuation and required triggers =='
rg -n -C 3 'Unicode|unicode|punctuation|[“”‘’—–]|path filter|paths:|CHANGELOG|doctoring|workflow|hash|require-hashes|only-binary' \
tests/test_strix_changed_path_policy.py tests/test_strix_workflow_dependency_hashes.py \
.github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== diff integrity =='
git diff --check "$base" "$head"Length of output: 20506 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
printf '%s\n' '== actual PR diff scope =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== actual PR change summary =='
git diff --stat "$base" "$head"
printf '%s\n' '== test-first and implementation commit subjects =='
git log --format='%H %s' --ancestry-path "$base..$head" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.md
printf '%s\n' '== public PyPI wheel hash comparison =='
expected=$(
cat <<'EOF'
coverage 7.15.2 b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
iniconfig 2.1.0 9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
packaging 26.2 5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
pluggy 1.6.0 e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
pygments 2.20.0 81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
pytest 9.1.1 37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
EOF
)
while read -r package version digest; do
[ -n "$package" ] || continue
found=$(
curl --fail --silent --show-error --location \
"https://pypi.org/pypi/${package}/${version}/json" |
jq -r --arg digest "$digest" \
'[.urls[] | select(.packagetype == "bdist_wheel" and .digests.sha256 == $digest) | .filename] | join(",")'
)
printf '%s==%s: %s\n' "$package" "$version" "${found:-MISSING}"
done <<<"$expected"
printf '%s\n' '== changed-path normalizer lines =='
sed -n '389,441p' scripts/ci/strix_quick_gate.shLength of output: 6301
I found no actionable defects in the requested scope.
I did not submit an approval. The command requested a review, not the explicit
|
|
@coderabbitai review Final read-only review for exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
printf '%s\n' '== exact head =='
printf 'checked out: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
printf '%s\n' '== PR metadata, changed files, and checks =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,statusCheckRollup,reviews \
--jq '{headRefOid, baseRefOid, files: [.files[].path], checks: [.statusCheckRollup[] | {name, status, conclusion}], reviews: [.reviews[] | {author: .author.login, state}]}'
base="$(gh pr view 800 --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf '%s\n' '== exact PR diff scope =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== workflow =='
cat -n .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== workflow write or mutable-reference indicators =='
rg -n -i -C 2 \
'contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|git\s+(push|commit|tag)|gh\s+(api|pr)|curl.*-X\s*(POST|PUT|PATCH|DELETE)|actions/(checkout|setup-python)@(main|master|v[0-9]+)$' \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== normalizer and downstream path use =='
rg -n -C 12 \
'normalize_changed_file_path|allowed|raw component|realpath|git diff|read -r|printf|eval|sh -c|bash -c' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== test and dependency-contract outlines =='
ast-grep outline tests/test_strix_changed_path_policy.py --items all
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all
printf '%s\n' '== test-policy assertions =='
rg -n -C 5 \
'Packrat|comma|parenthes|traversal|absolute|control|whitespace|backslash|shell|Unicode|out.of.root|require-hashes|only-binary|paths:' \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
.github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== doctoring and changelog =='
cat -n docs/doctoring/strix-legal-git-paths.md
tail -n 40 CHANGELOG.md
printf '%s\n' '== relevant diff =='
git diff --no-ext-diff --unified=30 "$base" "$head" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.mdLength of output: 101675 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== published PyPI wheel hash matches =='
while read -r package version digest; do
printf '%s==%s: ' "$package" "$version"
curl --fail --silent --show-error --location \
"https://pypi.org/pypi/${package}/${version}/json" |
jq -r --arg digest "$digest" \
'[.urls[] | select(.packagetype == "bdist_wheel" and .digests.sha256 == $digest) | .filename] | if length > 0 then join(", ") else "MISSING" end'
done <<'EOF'
coverage 7.15.2 b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
iniconfig 2.1.0 9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
packaging 26.2 5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
pluggy 1.6.0 e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
pygments 2.20.0 81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
pytest 9.1.1 37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
EOF
printf '%s\n' '== pinned action release tags =='
for spec in \
'actions/checkout 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 v7.0.0' \
'actions/setup-python 5fda3b95a4ea91299a34e894583c3862153e4b97 v7.0.0'
do
read -r repository sha tag <<<"$spec"
printf '%s @ %s: ' "$repository" "$tag"
gh api "repos/${repository}/git/ref/tags/${tag}" --jq '.object.sha' || true
printf 'pinned: %s\n' "$sha"
doneLength of output: 2167 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== changed-path policy test references =='
rg -n -i -C 5 \
'normalize_changed_file_path|changed.path|unicode|punctuation|[“”‘’—–]|safe/../target|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
tests scripts/ci \
-g '*.py' -g '*.sh'
printf '%s\n' '== test files that invoke the Strix quick gate =='
rg -n -C 4 \
'strix_quick_gate\.sh|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
tests \
-g '*.py' -g '*.sh'Length of output: 144507
Please add the supported command that runs You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Perform a fresh independent exact-head review of Strix Changed Path Quality CI, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, and SBOM are successful on this head, CodeRabbit commit status is successful, and every review thread is resolved. Verify the bounded legal path alphabet, raw |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
printf '%s\n' '== exact commit identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
printf 'base: '; git rev-parse "${base}^{commit}"
printf '%s\n' '== pull request metadata and current checks =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,files:[.files[].path],reviews:[.reviews[]|{author:.author.login,state}],checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
printf '%s\n' '== exact diff scope and whitespace errors =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== workflow definition =='
cat -n .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== workflow trigger, test, pin, permission, and write indicators =='
rg -n -C 4 \
'^(on:|permissions:|concurrency:|jobs:)|pull_request|workflow_dispatch|paths:|actions/(checkout|setup-python)@|persist-credentials|python-version|pip |require-hashes|only-binary|coverage|pytest|test_strix_quick_gate|py_compile|bash -n|git diff --exit-code|contents:\s*(read|write)|pull-requests:\s*write|git\s+(push|commit|tag)|gh\s+(api|pr)|curl.*-X\s*(POST|PUT|PATCH|DELETE)' \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== changed-path normalizer and path consumers =='
rg -n -C 12 \
'normalize_changed_file_path|allowed|raw.*\.\.|\.\.|realpath|read -r|printf|git diff|eval|sh -c|bash -c|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== regression-contract outlines =='
ast-grep outline tests/test_strix_changed_path_policy.py --items all
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all
printf '%s\n' '== regression-contract assertions and shell suite coverage =='
rg -n -C 5 \
'Packrat|comma|parenthes|traversal|absolute|control|whitespace|backslash|shell|Unicode|out.of.root|require-hashes|only-binary|test_strix_quick_gate|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
scripts/ci/test_strix_quick_gate.sh || true
printf '%s\n' '== doctoring and changelog entries =='
cat -n docs/doctoring/strix-legal-git-paths.md
tail -n 50 CHANGELOG.md
printf '%s\n' '== complete relevant diff =='
git diff --no-ext-diff --unified=40 "$base" "$head" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.mdLength of output: 203326 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-33KwfR'
printf '%s\n' '== exact identity and GitHub metadata from prior inspection =='
sed -n '1,120p' "$log"
printf '%s\n' '== focused workflow test commands =='
nl -ba .github/workflows/strix-changed-path-quality-ci.yml | sed -n '50,70p'
printf '%s\n' '== shell regression cases that the workflow omits =='
nl -ba scripts/ci/test_strix_quick_gate.sh | sed -n '8978,9000p'Length of output: 10115
I verified the checked-out commit, pull request head, and requested head as I found one actionable defect.
Add The remaining inspected controls are correctly bounded. The workflow uses the explicit PR head, read-only You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact live head Submit a formal GitHub review with state |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
printf '%s\n' '== exact identity =='
printf 'checked out: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
printf '%s\n' '== pull request metadata and checks =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,reviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,files:[.files[].path],reviews:[.reviews[]|{author:.author.login,state}],checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
base="$(gh pr view 800 --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf '%s\n' '== exact PR diff scope and integrity =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== workflow definition =='
cat -n .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== normalizer and path consumers =='
rg -n -C 16 \
'normalize_changed_file_path|allowed|raw.*\.\.|\.\.|realpath|read -r|printf|git diff|eval|sh -c|bash -c|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== regression contracts and shell-suite cases =='
ast-grep outline tests/test_strix_changed_path_policy.py --items all
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all
rg -n -C 4 \
'Packrat|comma|parenthes|traversal|absolute|control|whitespace|backslash|shell|Unicode|out.of.root|require-hashes|only-binary|test_strix_quick_gate|STRIX_TEST_CHANGED_FILES_OVERRIDE' \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
scripts/ci/test_strix_quick_gate.sh \
.github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== complete reviewed diff =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
.github/workflows/strix-changed-path-quality-ci.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py \
docs/doctoring/strix-legal-git-paths.md \
CHANGELOG.mdLength of output: 202578
I found one actionable defect on
Add this command to the verification step. Keep the existing bash scripts/ci/test_strix_quick_gate.shI did not approve the pull request. You are interacting with an AI system. |
|
Exact-current-head read-only review request for The exact-head Strix quality contract and all current security/supply-chain workflows succeeded. All visible inline findings are resolved or outdated. Review this head only. @coderabbitai review Do not update the branch, synthesize approval, bypass protection, merge, tag, release, or publish. |
Rate Limit Exceeded
|
|
Exact-head review request for @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='c51bf92cfa614c83d63bee73bc069ebd242a941c'
printf '%s\n' '== commit identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested: '; git rev-parse "${head}^{commit}"
printf '%s\n' '== pull request head, base, files, and checks =='
gh pr view 800 --repo "$repo" \
--json headRefOid,baseRefOid,files,statusCheckRollup \
--jq '{headRefOid,baseRefOid,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
base="$(gh pr view 800 --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf '%s\n' '== changed-file scope and diff integrity =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
printf '%s\n' '== workflow test commands and safeguards =='
nl -ba .github/workflows/strix-changed-path-quality-ci.yml | sed -n '1,180p'
rg -n -C 3 \
'test_strix_quick_gate|coverage.*pytest|pytest|permissions:|contents:|persist-credentials|require-hashes|only-binary|git (push|commit|tag)|gh (api|pr)|curl.*-X' \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== normalizer and downstream path consumers =='
rg -n -C 10 \
'normalize_changed_file_path|allowed|raw.*\.\.|\.\.|realpath|read -r|printf|git diff|eval|sh -c|bash -c' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== shell regression suite path-policy cases =='
rg -n -C 4 \
'Unicode|unicode|bidi|lookalike|STRIX_TEST_CHANGED_FILES_OVERRIDE|normalize_changed_file_path' \
scripts/ci/test_strix_quick_gate.sh || true
printf '%s\n' '== regression-contract outlines =='
ast-grep outline tests/test_strix_changed_path_policy.py --items all
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items allLength of output: 6376 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== workflow definition =='
awk '{ printf "%6d\t%s\n", NR, $0 }' .github/workflows/strix-changed-path-quality-ci.yml
printf '%s\n' '== workflow test commands, permissions, pinning, and mutation indicators =='
rg -n -C 4 \
'test_strix_quick_gate|coverage.*pytest|pytest|permissions:|contents:|persist-credentials|require-hashes|only-binary|git (push|commit|tag)|gh (api|pr)|curl.*-X' \
.github/workflows/strix-changed-path-quality-ci.yml || true
printf '%s\n' '== changed-path normalizer and path consumers =='
rg -n -C 12 \
'normalize_changed_file_path|allowed|raw.*\.\.|\.\.|realpath|read -r|printf|git diff|eval|sh -c|bash -c' \
scripts/ci/strix_quick_gate.sh
printf '%s\n' '== shell regression suite path-policy cases =='
rg -n -C 5 \
'Unicode|unicode|bidi|lookalike|STRIX_TEST_CHANGED_FILES_OVERRIDE|normalize_changed_file_path' \
scripts/ci/test_strix_quick_gate.sh || true
printf '%s\n' '== Python regression-contract structure =='
ast-grep outline tests/test_strix_changed_path_policy.py --items all || true
ast-grep outline tests/test_strix_workflow_dependency_hashes.py --items all || true
printf '%s\n' '== Python regression-contract assertions =='
rg -n -C 4 \
'Packrat|comma|parenthes|traversal|absolute|control|whitespace|backslash|shell|Unicode|out.of.root|require-hashes|only-binary|test_strix_quick_gate' \
tests/test_strix_changed_path_policy.py \
tests/test_strix_workflow_dependency_hashes.py || trueLength of output: 83323
I verified the checked-out commit, requested commit, and live PR head as I found one actionable defect.
Add the following command to the verification step. Keep the existing bash scripts/ci/test_strix_quick_gate.shThe remaining inspected controls are correctly bounded. The normalizer rejects raw I did not approve the pull request. You are interacting with an AI system. |
|
/opencode Perform an independent read-only review of exact current head |
|
@cwl-noema-review Independently review exact current head |
2 participants
Buyer-visible blocker
The organization-required Strix gate rejected a tracked legal Packrat fixture path containing comma and ASCII parentheses before security analysis. This prevented exact-head review of
ContextualWisdomLab/aFIPC#160even though the path is legal Git data.Focused repair
(and)in the existing bounded changed-path allowlist;..components before normalization can collapse embedded traversal;CHANGELOG.md, and authoritative doctoring changes;Test-first and exact-head evidence
The test-only lineage proved both missing legal-path support and the pre-existing embedded-traversal acceptance before production repair. Temporary materialization workflows were removed.
Exact current head:
dc97cefcd44f3edeb6471660bf74afcd983b4273.Successful exact-head gates:
All inline review threads are resolved or outdated. The final six-file scope is
.github/workflows/strix-changed-path-quality-ci.yml,CHANGELOG.md,docs/doctoring/strix-legal-git-paths.md,scripts/ci/strix_quick_gate.sh,tests/test_strix_changed_path_policy.py, andtests/test_strix_workflow_dependency_hashes.py.Merge gate
Merge only after fresh exact-head OpenCode/Noema review, qualifying independent non-author approval, and every branch-protection rule pass without bypass. After integration, rerun Strix for unchanged
aFIPC#160; predecessor failure is not reused.