security: remove autonomous repository-write publisher - #66
Conversation
📝 WalkthroughWalkthrough제품 개발 워크플로가 저장소 쓰기와 자동 게시 경로를 제거했다. 재검증 작업은 정확한 기준 SHA와 패치 해시를 확인한 뒤 패치, 기준 SHA, 패치 SHA-256 아티팩트를 전달한다. 문서와 테스트는 외부 승격 경계와 전체 PR 페이지 검사를 반영한다. Changes제품 스케줄러 핸드오프
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ProductScheduler
participant ReverifyRunner
participant ProtectedMain
participant ArtifactStore
participant ExternalPromotion
ProductScheduler->>ReverifyRunner: patch와 sealed base SHA 전달
ReverifyRunner->>ProtectedMain: protected-main head와 base SHA 비교
ReverifyRunner->>ReverifyRunner: patch 적용 결과와 SHA-256 검증
ReverifyRunner->>ArtifactStore: patch, base-sha, patch-sha256 업로드
ExternalPromotion->>ArtifactStore: 검증 아티팩트 조회
ExternalPromotion->>ProtectedMain: exact base 기준 트리 재구성 및 검증
Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent Implement the bounded GREEN repair on exact current head The immutable RED commit is intentional and must remain in history. It changes only Modify only:
Required GREEN implementation:
Do not add a replacement publisher, contents-write job, branch push, ref movement, self-modifying workflow, conflict strategy, direct-main write, release path, or auto-merge. Do not modify dependencies, package code, other workflows, central review-agent identities, or files outside the four-path allowlist. Run the focused contract first, then the complete Python 3.10–3.13 suite, Ruff, compileall, public-docstring checks, 100% production statement and branch coverage, package acceptance, SAST, and Security Scan on the resulting exact head. Keep the PR draft. Do not merge, publish, release, or enable auto-merge. Stop without writing if the exact head has changed. |
|
@opencode-agent Exact head advanced through the bounded GREEN implementation and documentation to On that exact head, modify only |
|
The exact current head is now @coderabbitai review Review only exact head |
|
I will check the specified workflow security boundary, digest and base binding, artifact contract, pagination, action pins, shell and YAML correctness, documentation, tests, and changelog. I will not treat queued checks as successful. I will not approve or merge. ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/hourly-product-development.yml:
- Around line 416-420: apply_patch에 handoff metadata의 base SHA 검증을 추가하십시오. git
apply 전에 현재 HEAD, metadata의 base_sha, EXPECTED_BASE_SHA가 모두 일치하는지 확인하고, 불일치하면 즉시
종료하십시오. 검증을 통과한 동일한 base SHA만 결과 파일의 base_sha로 기록하십시오.
In `@tests/test_hourly_opencode_nvidia_contract.py`:
- Around line 100-122: Extend
test_product_scheduler_never_publishes_a_model_modified_tree to reject any
workflow write permission, not only contents: write, including pull-requests:
write and other *: write forms. Add explicit assertions covering rejection of
malformed base-sha values and acceptance of the verified handoff upload with
if-no-files-found set to error and a three-day retention period. Keep the
existing credential-free and artifact-path checks intact.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 35cca649-8a2a-4b01-9e61-538b4771415c
📒 Files selected for processing (4)
.github/workflows/hourly-product-development.ymlCHANGELOG.mddocs/hourly-autonomous-maintenance.mdtests/test_hourly_opencode_nvidia_contract.py
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
if [ "$actual" != "$expected" ]; then
echo 'ERROR: checked-out commit does not match the requested commit' >&2
exit 2
fi
echo '--- changed files against PR base ---'
git diff --name-status 'origin/main...HEAD' || git diff --name-status 'HEAD^...HEAD'
echo '--- workflow outline ---'
ast-grep outline .github/workflows/hourly-product-development.yml --items all || true
echo '--- targeted workflow content ---'
nl -ba .github/workflows/hourly-product-development.yml | sed -n '1,520p'
echo '--- all workflow write permissions and publication-path terms ---'
rg -n -i -C 3 \
'(permissions:|(^|[[:space:]])[A-Za-z_-]+:[[:space:]]*write\b|id-token:[[:space:]]*write|contents:[[:space:]]*write|pull-requests:[[:space:]]*write|actions:[[:space:]]*write|gh[[:space:]]+pr[[:space:]]+(create|merge)|git[[:space:]]+(push|checkout[[:space:]]+-b|switch[[:space:]]+-c|branch)|refs/heads|createRef|merge.*auto|release|packages|attest)' \
.github/workflows
echo '--- contract test outline and relevant test content ---'
ast-grep outline tests/test_hourly_opencode_nvidia_contract.py --items all || true
rg -n -C 4 \
'(publish|handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- operator documentation and changelog excerpts ---'
rg -n -C 4 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md
echo '--- action references ---'
rg -n 'uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' .github/workflows/hourly-product-development.ymlLength of output: 2568 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
test "$(git rev-parse HEAD)" = "$expected"
echo '--- workflow with line numbers ---'
awk '{ printf "%6d %s\n", NR, $0 }' .github/workflows/hourly-product-development.yml
echo '--- write permissions and publication-path terms across workflows ---'
rg -n -i -C 3 \
'(permissions:|(^|[[:space:]])[A-Za-z_-]+:[[:space:]]*write\b|id-token:[[:space:]]*write|contents:[[:space:]]*write|pull-requests:[[:space:]]*write|actions:[[:space:]]*write|gh[[:space:]]+pr[[:space:]]+(create|merge)|git[[:space:]]+(push|checkout[[:space:]]+-b|switch[[:space:]]+-c|branch)|refs/heads|createRef|merge.*auto|release|packages|attest)' \
.github/workflows || true
echo '--- exact model-workflow action pins ---'
rg -n 'uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' .github/workflows/hourly-product-development.yml
echo '--- contract-test targets with line numbers ---'
awk '
/def test_.*(publish|handoff|base|patch|pagination|permission|artifact|reverify)/ {show=1}
show { printf "%6d %s\n", NR, $0 }
show && /^def / && NR != start { }
' tests/test_hourly_opencode_nvidia_contract.py | sed -n '1,700p'
echo '--- all test assertions about workflow contract ---'
rg -n -C 5 \
'(publish|handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|apply)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- operator documentation excerpts ---'
rg -n -i -C 5 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|artifact)' \
docs/hourly-autonomous-maintenance.md
echo '--- changelog excerpts ---'
rg -n -i -C 5 \
'(hourly|handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish)' \
CHANGELOG.md
echo '--- focused diff at exact HEAD ---'
git diff --unified=80 'origin/main...HEAD' -- \
.github/workflows/hourly-product-development.yml \
tests/test_hourly_opencode_nvidia_contract.py \
docs/hourly-autonomous-maintenance.md \
CHANGELOG.mdLength of output: 150855 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
test "$(git rev-parse HEAD)" = "$expected"
echo '--- guard implementation map ---'
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
echo '--- apply and result-identity implementation ---'
rg -n -C 12 \
'(def .*apply|def .*result|base_sha|patch_sha256|git apply|write_text|result_file|json)' \
scripts/ci/hourly_product_guard.py
echo '--- exact whitespace and YAML-related static checks ---'
git diff --check 'origin/main...HEAD'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/hourly-product-development.yml"); puts "YAML parse: OK"'
elif command -v yq >/dev/null 2>&1; then
yq '.' .github/workflows/hourly-product-development.yml >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parse: no parser available in sandbox'
fi
echo '--- all exact product-workflow forbidden tokens ---'
rg -n -i \
'(id-token:[[:space:]]*write|[A-Za-z_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|exchange_github_app_token|git[[:space:]]+push|git[[:space:]]+switch[[:space:]]+-c|git[[:space:]]+checkout[[:space:]]+-b|gh[[:space:]]+pr[[:space:]]+(create|merge)|gh[[:space:]]+release|git/refs|refs/heads|packages:[[:space:]]*write|attestations:[[:space:]]*write)' \
.github/workflows/hourly-product-development.yml || true
echo '--- PR metadata and exact-head check state ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{
number,
isDraft,
headRefOid,
autoMergeRequest,
mergeStateStatus,
checks: [.statusCheckRollup[]? | {
name: .name,
status: .status,
conclusion: .conclusion,
workflowName: .workflowName
}]
}'Length of output: 13121
I found no blocking issue in the requested boundary.
PR The
|
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
head_actual="$(git rev-parse HEAD)"
base_actual="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$base_actual" "$base_expected"
test "$head_actual" = "$head_expected"
test "$base_actual" = "$base_expected"
echo '--- changed files ---'
git diff --name-status "$base_expected...$head_expected"
echo '--- whitespace check ---'
git diff --check "$base_expected...$head_expected"
echo '--- workflow ---'
nl -ba .github/workflows/hourly-product-development.yml | sed -n '1,520p'
echo '--- workflow forbidden authority and publication terms ---'
rg -n -i -C 3 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|release|packages|attest)' \
.github/workflows/hourly-product-development.yml || true
echo '--- action references ---'
rg -n 'uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' \
.github/workflows/hourly-product-development.yml
echo '--- relevant guard implementation ---'
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
rg -n -C 10 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|write_text|sha256)' \
scripts/ci/hourly_product_guard.py
echo '--- contract tests ---'
ast-grep outline tests/test_hourly_opencode_nvidia_contract.py --items all || true
rg -n -C 5 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- documentation and changelog ---'
rg -n -i -C 4 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md
echo '--- YAML parse ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/hourly-product-development.yml"); puts "YAML parse: OK"'
else
echo 'YAML parser unavailable'
fi
echo '--- pull request metadata and check state ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'Length of output: 3409 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- workflow ---'
numbered .github/workflows/hourly-product-development.yml
echo '--- workflow authority and publication terms ---'
rg -n -i -C 3 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|release|packages|attest)' \
.github/workflows/hourly-product-development.yml || true
echo '--- action references ---'
rg -n 'uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' \
.github/workflows/hourly-product-development.yml
echo '--- guard implementation ---'
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
rg -n -C 12 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|write_text|sha256)' \
scripts/ci/hourly_product_guard.py
echo '--- contract tests ---'
rg -n -C 6 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- operator documentation and changelog ---'
rg -n -i -C 5 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md
echo '--- YAML parse ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/hourly-product-development.yml"); puts "YAML parse: OK"'
elif command -v yq >/dev/null 2>&1; then
yq '.' .github/workflows/hourly-product-development.yml >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR metadata and check state ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'Length of output: 73045
I found no blocking issue in the requested scope.
PR The
|
|
@coderabbitai review Review only exact current head |
|
I will verify the handoff binding, permissions, artifact contract, publication-path removal, action pins, pagination, model boundary, and external-promotion documentation. I will not approve, merge, publish, release, rebase, retarget, or enable auto-merge.
|
|
@coderabbitai review Perform a complete review of exact current head Focus on the final repository-local trust boundary: no |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
head_actual="$(git rev-parse HEAD)"
base_actual="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$base_actual" "$base_expected"
test "$head_actual" = "$head_expected"
test "$base_actual" = "$base_expected"
echo '--- changed files ---'
git diff --name-status "$base_expected...$head_expected"
echo '--- diff check ---'
git diff --check "$base_expected...$head_expected"
echo '--- workflow ---'
nl -ba .github/workflows/hourly-product-development.yml
echo '--- workflow action pins ---'
rg -n '^\s*uses:\s*[^[:space:]#]+@[^[:space:]#]+' \
.github/workflows/hourly-product-development.yml
echo '--- workflow authority and publication markers ---'
rg -n -i -C 4 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
.github/workflows/hourly-product-development.yml || true
echo '--- guard module outline ---'
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
echo '--- guard module handoff/apply logic ---'
rg -n -C 12 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown)' \
scripts/ci/hourly_product_guard.py
echo '--- contract tests ---'
rg -n -C 6 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- documentation and changelog ---'
rg -n -i -C 5 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|NVIDIA)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/hourly-product-development.yml"); puts "YAML parse: OK"'
elif command -v yq >/dev/null 2>&1; then
yq '.' .github/workflows/hourly-product-development.yml >/dev/null
echo 'YAML parse: OK'
else
echo 'No YAML parser is available'
fi
echo '--- PR metadata and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'Length of output: 3542 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
show_numbered() {
file="$1"
echo "--- $file ---"
sed = "$file" | sed 'N;s/\n/\t/'
}
show_numbered .github/workflows/hourly-product-development.yml
echo '--- workflow action pins ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' \
.github/workflows/hourly-product-development.yml || true
echo '--- workflow authority and publication markers ---'
rg -n -i -C 4 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
.github/workflows/hourly-product-development.yml || true
echo '--- workflow handoff, base, digest, pagination, and model markers ---'
rg -n -C 6 \
'(base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|Link:.*rel="next"|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|git apply|reverify)' \
.github/workflows/hourly-product-development.yml || true
echo '--- guard module outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
fi
echo '--- guard module handoff and apply logic ---'
rg -n -C 12 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown)' \
scripts/ci/hourly_product_guard.py || true
echo '--- contract tests ---'
rg -n -C 6 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA)' \
tests/test_hourly_opencode_nvidia_contract.py || true
echo '--- documentation and changelog ---'
rg -n -i -C 5 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|NVIDIA)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md || true
echo '--- relevant diff ---'
git diff --unified=35 "$base_expected...$head_expected" -- \
.github/workflows/hourly-product-development.yml \
tests/test_hourly_opencode_nvidia_contract.py \
docs/hourly-autonomous-maintenance.md \
CHANGELOG.md
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/hourly-product-development.yml"); puts "YAML parse: OK"'
elif command -v yq >/dev/null 2>&1; then
yq '.' .github/workflows/hourly-product-development.yml >/dev/null
echo 'YAML parse: OK'
else
echo 'No YAML parser is available'
fi
echo '--- PR metadata and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 147261
I found no blocking issue in the requested scope.
PR The returned PR check state shows no queued or in-progress checks. This review conclusion is based on the inspected repository content, not on CI status. You are interacting with an AI system. |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
head_actual="$(git rev-parse HEAD)"
merge_base="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$merge_base" "$base_expected"
test "$head_actual" = "$head_expected"
test "$merge_base" = "$base_expected"
echo '--- changed files ---'
git diff --name-status "$base_expected...$head_expected"
echo '--- diff whitespace errors ---'
git diff --check "$base_expected...$head_expected"
echo '--- product workflow ---'
nl -ba .github/workflows/hourly-product-development.yml
echo '--- product workflow action references ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' \
.github/workflows/hourly-product-development.yml
echo '--- product workflow authority/publication markers ---'
rg -n -i -C 4 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
.github/workflows/hourly-product-development.yml || true
echo '--- product workflow handoff, pagination, model, and verifier markers ---'
rg -n -C 8 \
'(base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|Link:.*rel="next"|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|git apply|sha256sum|chmod|chown)' \
.github/workflows/hourly-product-development.yml
echo '--- verifier guard outline ---'
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
echo '--- verifier guard base/digest/result logic ---'
rg -n -C 14 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff)' \
scripts/ci/hourly_product_guard.py
echo '--- workflow contract test assertions ---'
rg -n -C 8 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- operator documentation and changelog ---'
rg -n -i -C 6 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|NVIDIA|write)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md
echo '--- relevant diff ---'
git diff --unified=50 "$base_expected...$head_expected" -- \
.github/workflows/hourly-product-development.yml \
scripts/ci/hourly_product_guard.py \
tests/test_hourly_opencode_nvidia_contract.py \
docs/hourly-autonomous-maintenance.md \
CHANGELOG.md
echo '--- pull request metadata and current check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}'Length of output: 3998 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- product workflow ---'
numbered .github/workflows/hourly-product-development.yml
echo '--- product workflow action references ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' \
.github/workflows/hourly-product-development.yml || true
echo '--- product workflow authority/publication markers ---'
rg -n -i -C 4 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
.github/workflows/hourly-product-development.yml || true
echo '--- product workflow handoff, pagination, model, and verifier markers ---'
rg -n -C 8 \
'(base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|Link:.*rel="next"|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|git apply|sha256sum|chmod|chown)' \
.github/workflows/hourly-product-development.yml || true
echo '--- verifier guard outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
fi
echo '--- verifier guard base/digest/result logic ---'
rg -n -C 14 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff)' \
scripts/ci/hourly_product_guard.py || true
echo '--- workflow contract test assertions ---'
rg -n -C 8 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode)' \
tests/test_hourly_opencode_nvidia_contract.py || true
echo '--- operator documentation and changelog ---'
rg -n -i -C 6 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|NVIDIA|write)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md || true
echo '--- relevant diff ---'
git diff --unified=50 "$base_expected...$head_expected" -- \
.github/workflows/hourly-product-development.yml \
scripts/ci/hourly_product_guard.py \
tests/test_hourly_opencode_nvidia_contract.py \
docs/hourly-autonomous-maintenance.md \
CHANGELOG.md
echo '--- pull request metadata and current check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 169582 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
workflow='.github/workflows/hourly-product-development.yml'
echo '--- YAML parse ---'
if command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- immutable action pin format ---'
awk '
/^[[:space:]]*uses:[[:space:]]*/ {
ref=$0
sub(/^[[:space:]]*uses:[[:space:]]*/, "", ref)
sub(/[[:space:]#].*$/, "", ref)
split(ref, parts, "@")
sha=parts[2]
if (sha !~ /^[0-9a-f]{40}$/) {
print "INVALID_ACTION_PIN: " ref
invalid=1
}
}
END {
if (!invalid) print "All action references use lowercase 40-character SHA pins."
exit invalid
}
' "$workflow"
echo '--- declared workflow permission values ---'
awk '
/^[[:space:]]*permissions:[[:space:]]*$/ { in_permissions=1; next }
in_permissions && /^[[:space:]]{0,6}[A-Za-z][A-Za-z-]*:[[:space:]]*(read|write|none)[[:space:]]*$/ {
print NR ": " $0
next
}
in_permissions && /^[^[:space:]]/ { in_permissions=0 }
' "$workflow"Length of output: 1766
I found no blocking issue in the requested scope.
The YAML parser was unavailable in the sandbox. I could not independently parse the YAML syntax. The inspected YAML structure is consistent with the workflow contract. PR The observed check records have no queued or in-progress status. Some duplicate check records are You are interacting with an AI system. |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
head_actual="$(git rev-parse HEAD)"
merge_base="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$merge_base" "$base_expected"
test "$head_actual" = "$head_expected"
test "$merge_base" = "$base_expected"
echo '--- changed files ---'
git diff --name-status "$base_expected...$head_expected"
echo '--- whitespace ---'
git diff --check "$base_expected...$head_expected"
echo '--- workflow ---'
nl -ba "$workflow"
echo '--- action pins and pin validation ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' "$workflow"
python3 - "$workflow" <<'PY'
import re, sys
text = open(sys.argv[1], encoding='utf-8').read().splitlines()
bad = []
for number, line in enumerate(text, 1):
match = re.match(r'\s*uses:\s*([^#\s]+)', line)
if match:
ref = match.group(1)
if not re.search(r'@[0-9a-f]{40}$', ref):
bad.append(f'{number}: {ref}')
if bad:
print('INVALID_ACTION_PINS')
print('\n'.join(bad))
raise SystemExit(1)
print('All action references use lowercase 40-character SHA pins.')
PY
echo '--- workflow authority and publication markers ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
"$workflow" || true
echo '--- workflow boundary, handoff, pagination, and model markers ---'
rg -n -C 8 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply)' \
"$workflow"
echo '--- verifier structure and identity checks ---'
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
rg -n -C 12 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff)' \
scripts/ci/hourly_product_guard.py
echo '--- contract tests ---'
rg -n -C 7 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode)' \
tests/test_hourly_opencode_nvidia_contract.py
echo '--- documentation and changelog ---'
rg -n -i -C 6 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR metadata and current checks ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 4279 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
show_numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- product workflow ---'
show_numbered "$workflow"
echo '--- product-workflow action pins ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' "$workflow" || true
python3 - "$workflow" <<'PY'
import re, sys
invalid = []
for n, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
m = re.match(r"\s*uses:\s*([^#\s]+)", line)
if m and not re.search(r"@[0-9a-f]{40}$", m.group(1)):
invalid.append(f"{n}: {m.group(1)}")
if invalid:
print("INVALID_ACTION_PINS\n" + "\n".join(invalid))
raise SystemExit(1)
print("All action references use lowercase 40-character SHA pins.")
PY
echo '--- authority and publication markers ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
"$workflow" || true
echo '--- handoff, binding, pagination, model, and isolation markers ---'
rg -n -C 9 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA)' \
"$workflow" || true
echo '--- verifier implementation ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline scripts/ci/hourly_product_guard.py --items all || true
fi
rg -n -C 14 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff)' \
scripts/ci/hourly_product_guard.py || true
echo '--- contract tests ---'
rg -n -C 8 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode)' \
tests/test_hourly_opencode_nvidia_contract.py || true
echo '--- documentation and changelog ---'
rg -n -i -C 7 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write)' \
docs/hourly-autonomous-maintenance.md CHANGELOG.md || true
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR metadata and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 111089
I found no blocking issue in the requested scope.
The workflow has only read permissions. It has no The workflow has no repository-local publisher job. It has no GitHub App token exchange. It has no repository-write token path. It has no branch or ref mutation, push, pull-request creation, auto-merge, package publication, release, or attestation publication path. The model step uses OpenCode The model tool policy is deny-by-default. The credential-bearing job does not execute model-modified repository code. The separate reverification job has no model credential. Both zero-open-PR gates use Before patch application, the reverifier requires lowercase 40-character values for The trusted guard validates patch metadata before The workflow seals the patch, base SHA, and patch SHA-256 in root-owned read-only files. It rehashes the sealed patch after offline verification. The final artifact contains exactly: The final artifact uses the required The documentation states that the scheduler does not create a branch, pull request, or auto-merge request. It requires any future promotion mechanism to be external, independently reviewed, credential-separated, and to reconstruct and verify the exact tree before a repository write. It does not claim that such a mechanism exists. The PR The observed check records have no queued or in-progress status. I did not treat You are interacting with an AI system. |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
head_actual="$(git rev-parse HEAD)"
merge_base="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$merge_base" "$base_expected"
test "$head_actual" = "$head_expected"
test "$merge_base" = "$base_expected"
echo '--- changed files ---'
git diff --name-status "$base_expected...$head_expected"
echo '--- whitespace errors ---'
git diff --check "$base_expected...$head_expected"
echo '--- workflow with line numbers ---'
nl -ba "$workflow"
echo '--- workflow action pins ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' "$workflow" || true
python3 - "$workflow" <<'PY'
import re
import sys
invalid = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
invalid.append(f"{number}: {match.group(1)}")
if invalid:
print("INVALID_ACTION_PINS")
print("\n".join(invalid))
raise SystemExit(1)
print("All action references use lowercase 40-character SHA pins.")
PY
echo '--- workflow write authority and publication paths ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
"$workflow" || true
echo '--- workflow handoff, base binding, pagination, model, and isolation ---'
rg -n -C 10 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|pull-requests)' \
"$workflow" || true
echo '--- guard outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline "$guard" --items all || true
fi
echo '--- guard base, patch, and result logic ---'
rg -n -C 16 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- contract assertions ---'
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential)' \
"$contract" || true
echo '--- documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write)' \
"$docs" "$changelog" || true
echo '--- relevant diff ---'
git diff --unified=45 "$base_expected...$head_expected" -- \
"$workflow" "$contract" "$docs" "$changelog" "$guard"
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- pull request state and checks ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 4678 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- workflow with line numbers ---'
numbered "$workflow"
echo '--- action pins ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' "$workflow" || true
python3 - "$workflow" <<'PY'
import re
import sys
invalid = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
invalid.append(f"{number}: {match.group(1)}")
if invalid:
print("INVALID_ACTION_PINS")
print("\n".join(invalid))
raise SystemExit(1)
print("All action references use lowercase 40-character SHA pins.")
PY
echo '--- write authority and publication paths ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest)' \
"$workflow" || true
echo '--- handoff, binding, pagination, model, and isolation ---'
rg -n -C 10 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|pull-requests)' \
"$workflow" || true
echo '--- guard outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline "$guard" --items all || true
fi
echo '--- guard base, patch, and result logic ---'
rg -n -C 16 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- contract assertions ---'
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential)' \
"$contract" || true
echo '--- documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write)' \
"$docs" "$changelog" || true
echo '--- relevant diff ---'
git diff --unified=45 "$base_expected...$head_expected" -- \
"$workflow" "$contract" "$docs" "$changelog" "$guard"
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- pull request state and checks ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 175525
I found no blocking issue in the requested scope.
The workflow declares only read permissions. It has no The workflow has no repository-local publisher job. It has no repository-write token exchange. It has no branch or ref mutation, push, pull-request creation, auto-merge, package publication, release, or attestation publication path. Both zero-open-PR gates use Before patch application, the reverifier requires lowercase 40-character values for both the The trusted guard validates patch metadata before The workflow seals these root-owned read-only files: The workflow rehashes the sealed patch before upload. The final artifact includes only these three files. It uses The OpenCode boundary remains pinned to version The documentation and the PR The returned check records contain no queued or in-progress checks. Some records are You are interacting with an AI system. |
|
@opencode-agent Review only exact current head Independently verify that the hourly product-development scheduler has no repository-write, OIDC, ref, branch push, PR creation, merge, release, package, signing, attestation, or publication authority; that the untrusted patch is bound to a validated lowercase 40-character uploaded base SHA and SHA-256; that checkout HEAD, workflow output, handoff metadata, and guard result agree before and after application; that only Exact-head CI |
|
@coderabbitai review Review exact current head |
|
@opencode-agent Perform a read-only exact-head review of Verify that the repository-local publisher, repository-write and OIDC authority, app-token exchange, model-patch reapplication under write identity, branch push, PR creation, and auto-merge request are fully removed; every workflow |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
head_actual="$(git rev-parse HEAD)"
merge_base="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$merge_base" "$base_expected"
test "$head_actual" = "$head_expected"
test "$merge_base" = "$base_expected"
echo '--- changed files and whitespace ---'
git diff --name-status "$base_expected...$head_expected"
git diff --check "$base_expected...$head_expected"
echo '--- workflow (numbered) ---'
nl -ba "$workflow"
echo '--- immutable action pin validation ---'
python3 - "$workflow" <<'PY'
import re
import sys
invalid = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
invalid.append(f"{number}: {match.group(1)}")
if invalid:
print("INVALID_ACTION_PINS")
print("\n".join(invalid))
raise SystemExit(1)
print("All action references use lowercase 40-character commit SHA pins.")
PY
echo '--- workflow write authority and publication paths ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest|cosign|sign)' \
"$workflow" || true
echo '--- workflow handoff, binding, pagination, model, and isolation ---'
rg -n -C 12 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|pull-requests)' \
"$workflow" || true
echo '--- guard structure and identity checks ---'
ast-grep outline "$guard" --items all || true
rg -n -C 14 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- workflow contract tests ---'
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential)' \
"$contract" || true
echo '--- operator documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write)' \
"$docs" "$changelog" || true
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR state and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 4355 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- workflow (numbered) ---'
numbered "$workflow"
echo '--- immutable action pin validation ---'
awk '
/^[[:space:]]*uses:[[:space:]]*/ {
reference=$0
sub(/^[[:space:]]*uses:[[:space:]]*/, "", reference)
sub(/[[:space:]#].*$/, "", reference)
if (reference !~ /@[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]$/) {
print "INVALID_ACTION_PIN at line " NR ": " reference
invalid=1
}
}
END {
if (!invalid) print "All action references use lowercase 40-character commit SHA pins."
exit invalid
}
' "$workflow"
echo '--- workflow write authority and publication paths ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest|cosign|sign)' \
"$workflow" || true
echo '--- workflow handoff, binding, pagination, model, and isolation ---'
rg -n -C 12 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|pull-requests)' \
"$workflow" || true
echo '--- guard structure and identity checks ---'
ast-grep outline "$guard" --items all || true
rg -n -C 14 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- workflow contract tests ---'
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential)' \
"$contract" || true
echo '--- operator documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write)' \
"$docs" "$changelog" || true
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR state and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 115755
I verified that the merge base is I found no blocking issue in the requested scope.
Pull request The returned check records have no queued or in-progress status. Some records are ✅ Action performedReview finished.
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/hourly-product-development.yml (1)
441-445: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win봉인된
base-sha를EXPECTED_BASE_SHA와 다시 비교하십시오.현재 검사는
base-sha의 형식만 확인합니다. 다른 유효한 40자리 SHA도 최종 handoff에 포함될 수 있습니다. 이 단계에EXPECTED_BASE_SHA를 전달하고,base_sha != EXPECTED_BASE_SHA이면 실패하십시오. 그러면 최종 아티팩트도 적용 전후에 검증한 정확한 기준 트리에 결속됩니다.수정 예시
- name: Recheck the independently verified immutable patch if: steps.gate.outputs.verify == 'true' + env: + EXPECTED_BASE_SHA: ${{ needs.develop.outputs.base_sha }} run: | set -euo pipefail sealed_dir="/opt/egressweave-reverify" observed="$(sha256sum "$sealed_dir/egressweave.patch" | awk '{print $1}')" expected="$(cat "$sealed_dir/patch-sha256")" if [ "$observed" != "$expected" ]; then echo "::error::The sealed patch changed during independent verification." exit 1 fi base_sha="$(cat "$sealed_dir/base-sha")" - if [[ ! "$base_sha" =~ ^[0-9a-f]{40}$ ]]; then - echo "::error::The sealed base SHA is missing or malformed." + if [[ ! "$base_sha" =~ ^[0-9a-f]{40}$ ]] || \ + [ "$base_sha" != "$EXPECTED_BASE_SHA" ]; then + echo "::error::The sealed base SHA does not match the exact handoff base." exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/hourly-product-development.yml around lines 441 - 445, Update the sealed base SHA validation near base_sha to also compare it with EXPECTED_BASE_SHA, failing the workflow when the values differ while retaining the existing 40-character format check. Ensure EXPECTED_BASE_SHA is available to this handoff step so the final artifact remains bound to the previously validated base tree.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/hourly-product-development.yml:
- Around line 441-445: Update the sealed base SHA validation near base_sha to
also compare it with EXPECTED_BASE_SHA, failing the workflow when the values
differ while retaining the existing 40-character format check. Ensure
EXPECTED_BASE_SHA is available to this handoff step so the final artifact
remains bound to the previously validated base tree.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ce023ee2-3549-4a3a-80b5-46512be664a5
📒 Files selected for processing (2)
.github/workflows/hourly-product-development.ymltests/test_hourly_opencode_nvidia_contract.py
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/test_hourly_opencode_nvidia_contract.py
|
@opencode-agent Implement the minimal GREEN repair on exact current test-only RED head The immutable RED commit is valid. CI run Modify only In the step named
Run the focused contract first, then the full Python 3.10–3.13 suite, Ruff, compileall, product-guard self-test, 100% production statement/branch coverage, package acceptance, SAST, and Security Scan on the resulting exact head. Keep the PR draft. Stop without writing if the head differs from |
|
@opencode-agent Apply the bounded GREEN implementation to exact current RED head Modify only In the
Preserve the immutable patch digest recheck, exact checkout/handoff/result binding, full pagination, read-only NVIDIA/OpenCode execution, offline credential-free verifier, three-day fail-on-missing artifact upload, deny-all workflow write permissions, and the absence of publisher, OIDC, app-token, push, PR creation, merge, release, tag, or publication behavior. Run the focused workflow contract test and full repository checks on the resulting exact head. Do not modify tests, docs, CHANGELOG, dependencies, permissions, credentials, protected refs, review-agent identities, or any other path. Do not rebase, retarget, merge, mark ready, enable auto-merge, release, or publish. |
|
@coderabbitai review Review only exact current head Focus on complete removal of repository-write/OIDC/ref/branch/PR/merge/release/package/signing/attestation/publication paths; full pagination at both zero-PR gates; exact agreement among checkout HEAD, workflow output, uploaded |
|
@opencode-agent Review only exact current head The immutable final-handoff RED head Independently verify the no-write authority boundary, full pagination, all exact-base and digest bindings, exact three-file handoff, immutable pins, model isolation, external-promotion documentation, tests, and CHANGELOG. Submit a current-head review outcome only after checking the exact tree and evidence. Keep the PR draft; do not merge, mark ready, enable auto-merge, release, publish, rebase, or retarget. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='c038a9509d1a8eae8561cc9081e67e12bd373d42'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
head_actual="$(git rev-parse HEAD)"
merge_base="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$merge_base" "$base_expected"
test "$head_actual" = "$head_expected"
test "$merge_base" = "$base_expected"
echo '--- changed paths and whitespace ---'
git diff --name-status "$base_expected...$head_expected"
git diff --check "$base_expected...$head_expected"
echo '--- workflow map and content ---'
ast-grep outline "$workflow" --items all || true
nl -ba "$workflow"
echo '--- action pin validation ---'
python3 - "$workflow" <<'PY'
import re, sys
invalid = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
invalid.append(f"{number}: {match.group(1)}")
if invalid:
print("INVALID_ACTION_PINS")
print("\n".join(invalid))
raise SystemExit(1)
print("All action references use lowercase 40-character commit SHA pins.")
PY
echo '--- authority and publication markers ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest|cosign|sign)' \
"$workflow" || true
echo '--- workflow binding, artifact, pagination, and model contract ---'
rg -n -C 12 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|pull-requests|sealed base SHA)' \
"$workflow" || true
echo '--- guard outline and binding logic ---'
ast-grep outline "$guard" --items all || true
rg -n -C 16 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- contract tests ---'
ast-grep outline "$contract" --items all || true
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential|sealed)' \
"$contract" || true
echo '--- documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write|sealed)' \
"$docs" "$changelog" || true
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR state and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 4504 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='c038a9509d1a8eae8561cc9081e67e12bd373d42'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- workflow ---'
numbered "$workflow"
echo '--- action pin validation ---'
python3 - "$workflow" <<'PY'
import re, sys
invalid = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
invalid.append(f"{number}: {match.group(1)}")
if invalid:
print("INVALID_ACTION_PINS")
print("\n".join(invalid))
raise SystemExit(1)
print("All action references use lowercase 40-character commit SHA pins.")
PY
echo '--- workflow authority and publication markers ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest|cosign|sign)' \
"$workflow" || true
echo '--- workflow binding, artifact, pagination, and model contract ---'
rg -n -C 12 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|pull-requests|sealed base SHA)' \
"$workflow" || true
echo '--- guard binding logic ---'
rg -n -C 16 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- contract tests ---'
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential|sealed)' \
"$contract" || true
echo '--- documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write|sealed)' \
"$docs" "$changelog" || true
echo '--- changed-file diff ---'
git diff --unified=45 "$base_expected...$head_expected" -- \
"$workflow" "$contract" "$docs" "$changelog"
echo '--- YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- PR state and check states ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 175741
I found no blocking issue in the requested scope.
The product workflow declares only read permissions. It has no The workflow has no repository-local publisher job. It has no GitHub App token exchange. It has no repository-write credential path. It has no branch or ref mutation, push, pull-request creation, auto-merge, release, package, signing, attestation, or publication path. Both zero-open-PR gates use Before patch application, the workflow requires the After patch application, Before the final upload, the workflow:
The final handoff contains only: The final upload uses the required immutable The OpenCode boundary remains pinned to version The contract tests cover the removal of publication authority, write-permission rejection, base binding, sealed-base validation, pagination, and final artifact settings. The operator documentation and Pull request The You are interacting with an AI system. |
|
Supersedes closed PR #71: this exact branch already stores both affected |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='c038a9509d1a8eae8561cc9081e67e12bd373d42'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
head_actual="$(git rev-parse HEAD)"
merge_base="$(git merge-base "$base_expected" "$head_expected")"
printf 'HEAD=%s\nEXPECTED_HEAD=%s\nMERGE_BASE=%s\nEXPECTED_BASE=%s\n' \
"$head_actual" "$head_expected" "$merge_base" "$base_expected"
test "$head_actual" = "$head_expected"
test "$merge_base" = "$base_expected"
echo '--- changed paths and whitespace ---'
git diff --name-status "$base_expected...$head_expected"
git diff --check "$base_expected...$head_expected"
echo '--- workflow YAML syntax ---'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(ARGV[0]); puts "YAML parse: OK"' "$workflow"
elif command -v yq >/dev/null 2>&1; then
yq '.' "$workflow" >/dev/null
echo 'YAML parse: OK'
else
echo 'YAML parser unavailable'
fi
echo '--- product workflow ---'
nl -ba "$workflow"
echo '--- immutable action references ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' "$workflow"
python3 - "$workflow" <<'PY'
import re
import sys
bad = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
bad.append(f"{number}: {match.group(1)}")
if bad:
print("INVALID_ACTION_PINS")
print("\n".join(bad))
raise SystemExit(1)
print("All product-workflow action references use lowercase 40-character commit SHA pins.")
PY
echo '--- product-workflow write authority and publication paths ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest|cosign|sign)' \
"$workflow" || true
echo '--- handoff, binding, pagination, model, isolation markers ---'
rg -n -C 12 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|sealed base SHA|tools)' \
"$workflow" || true
echo '--- guard implementation map and identity checks ---'
ast-grep outline "$guard" --items all || true
rg -n -C 16 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- contract assertions ---'
ast-grep outline "$contract" --items all || true
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential|sealed)' \
"$contract" || true
echo '--- documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write|sealed)' \
"$docs" "$changelog" || true
echo '--- review-agent credential contract in other workflows ---'
rg -n -C 4 \
'(PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|NVIDIA_NIM_API_KEY|pull.?request.?review)' \
.github/workflows || true
echo '--- relevant diff ---'
git diff --unified=45 "$base_expected...$head_expected" -- \
"$workflow" "$contract" "$docs" "$changelog"
echo '--- PR state and current check records ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 4899 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='c038a9509d1a8eae8561cc9081e67e12bd373d42'
base_expected='10d0c51daf2ad278d66f43be479df8cf6b08ba6d'
workflow='.github/workflows/hourly-product-development.yml'
guard='scripts/ci/hourly_product_guard.py'
contract='tests/test_hourly_opencode_nvidia_contract.py'
docs='docs/hourly-autonomous-maintenance.md'
changelog='CHANGELOG.md'
test "$(git rev-parse HEAD)" = "$head_expected"
test "$(git merge-base "$base_expected" "$head_expected")" = "$base_expected"
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
echo '--- product workflow ---'
numbered "$workflow"
echo '--- immutable action references ---'
rg -n '^[[:space:]]*uses:[[:space:]]*[^[:space:]#]+@[^[:space:]#]+' "$workflow" || true
python3 - "$workflow" <<'PY'
import re
import sys
invalid = []
for number, line in enumerate(open(sys.argv[1], encoding="utf-8"), 1):
match = re.match(r"\s*uses:\s*([^#\s]+)", line)
if match and not re.search(r"@[0-9a-f]{40}$", match.group(1)):
invalid.append(f"{number}: {match.group(1)}")
if invalid:
print("INVALID_ACTION_PINS")
print("\n".join(invalid))
raise SystemExit(1)
print("All product-workflow action references use lowercase 40-character commit SHA pins.")
PY
echo '--- product-workflow write authority and publication paths ---'
rg -n -i -C 5 \
'(id-token:[[:space:]]*write|(^|[[:space:]])[A-Za-z0-9_-]+:[[:space:]]*write\b|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|github[ _-]?app|git[[:space:]]+push|git[[:space:]]+(switch|checkout)[[:space:]]+-[bc]|git[[:space:]]+branch|gh[[:space:]]+pr[[:space:]]+(create|merge)|refs/heads|git/refs|auto-merge|release|packages|attest|cosign|sign)' \
"$workflow" || true
echo '--- workflow binding, artifact, pagination, model, and isolation ---'
rg -n -C 12 \
'(permissions:|base-sha|patch-sha256|egressweave\.patch|upload-artifact|retention-days|if-no-files-found|paginate|per_page|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia/nemotron|opencode|reverify|sha256sum|chmod|chown|git apply|EXPECTED_BASE_SHA|sealed base SHA|tools)' \
"$workflow" || true
echo '--- guard implementation ---'
numbered "$guard"
echo '--- guard binding markers ---'
rg -n -C 16 \
'(base_sha|patch_sha256|result|git apply|apply.*patch|sha256|write_text|chmod|chown|rev-parse|diff|subprocess)' \
"$guard" || true
echo '--- contract test markers ---'
rg -n -C 10 \
'(handoff|base.?sha|patch.?sha|pagination|permission|write|artifact|reverify|post.apply|exact.tree|publish|NVIDIA|OpenCode|credential|sealed)' \
"$contract" || true
echo '--- documentation and changelog ---'
rg -n -i -C 8 \
'(handoff|credential|external|branch|pull request|auto-merge|base SHA|SHA-256|exact tree|publish|OIDC|write|sealed)' \
"$docs" "$changelog" || true
echo '--- review-agent credential contract in workflows ---'
rg -n -C 4 \
'(PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|NVIDIA_NIM_API_KEY|pull.?request.?review)' \
.github/workflows || true
echo '--- reviewed-files diff ---'
git diff --unified=40 "$base_expected...$head_expected" -- \
"$workflow" "$contract" "$docs" "$changelog"
echo '--- PR state and check records ---'
gh pr view 66 --repo ContextualWisdomLab/EgressWeave \
--json number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,statusCheckRollup \
--jq '{number,isDraft,headRefOid,baseRefOid,autoMergeRequest,mergeStateStatus,checks:[.statusCheckRollup[]? | {name,status,conclusion,workflowName}]}' || trueLength of output: 198027
I found no blocking issue in the reviewed workflow and documentation scope.
One pull-request state issue remains:
The You are interacting with an AI system. |
1 participant
Test-first workflow-trust repair
Closes #65 by removing the repository-local publisher from the hourly product-development scheduler without weakening the NVIDIA/OpenCode model boundary, zero-PR gate, or credential-free reverification.
Exact tree binding
10d0c51daf2ad278d66f43be479df8cf6b08ba6d.7ace35a3129c426444ecd9f8fec90d87dcc03f16.21c3ecaea7506db3f2c4f887fb8837645cf41434.f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcf.2dc5a8a5d05a977244e8f06157ccf12ad65c604e.c038a9509d1a8eae8561cc9081e67e12bd373d42.Implemented boundary
nvidia/nemotron-3-super-120b-a12b, andNVIDIA_NIM_API_KEY→NVIDIA_API_KEYmapping;publishjob, repository-write and OIDC authority, GitHub App token exchange, model-patch reapplication under a write identity, branch push, PR creation, and auto-merge request;egressweave.patch,base-sha, andpatch-sha256;*: writepermission through the repository contract;printfformat strings as single indented YAML lines with literal\nescapes, superseding closed PR fix: restore hourly product workflow YAML parsing #71 without restoring the removed publisher;[Unreleased]without a version bump.Test-first final-handoff repair
CodeRabbit's review of prior head
f6df03ce2f07ec3f2907b1f9ce5f50889b3dcbcffound one valid residual integrity gap: the finalRecheck the independently verified immutable patchstep validated the sealedbase-shaformat but did not compare it again withneeds.develop.outputs.base_shaimmediately before upload.Exact test-only RED head
2dc5a8a5d05a977244e8f06157ccf12ad65c604echanged onlytests/test_hourly_opencode_nvidia_contract.py. CI run31106746733passed package acceptance and Ruff, while every Python 3.10–3.13 lane failed only in the new final-handoff contract (1 failed, 740 passedon Python 3.13). SAST run31106748228and Security Scan run31106746211otherwise succeeded.Exact current commit
c038a9509d1a8eae8561cc9081e67e12bd373d42changes only.github/workflows/hourly-product-development.yml: the final recheck receivesEXPECTED_BASE_SHA, retains lowercase 40-character validation, and fails closed unless the sealed base equals that exact expected base. The stable failure isThe sealed base SHA does not match the exact handoff base.Exact-head evidence
CI run
31108238186succeeded on exact current headc038a9509d1a8eae8561cc9081e67e12bd373d42:SAST Semgrep run
31108238093and Security Scan run31108241013also succeeded on the same exact head. The two original inline CodeRabbit findings remain resolved.Remaining gates
This PR is ready for review. A completed automated review of exact current head
c038a9509d1a8eae8561cc9081e67e12bd373d42, independent non-author approval, branch protection, and every repository policy gate remain mandatory. Do not merge, enable auto-merge, release, publish, or treat the verified artifact as repository-write authorization.Summary by CodeRabbit
변경 사항
테스트