feat(security): Strix 발견을 AppGuardrail 이슈로 중앙 집계 - #560
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headad0241e8efda55f42a6a1025e311ab410d180cec. -
Head SHA:
ad0241e8efda55f42a6a1025e311ab410d180cec -
Workflow run: 29342501743
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-appguardrail-issues.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-appguardrail-issues.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (7 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (7 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (5 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (5 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-appguardrail-issues.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-appguardrail-issues.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (7 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (7 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (5 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (5 files)"]
R5 --> V5["targeted test run"]
|
Superseded automated OpenCode change request from a previous head; current head 6900880 has passing coverage and security checks. Current-head model output remains a separate required-review state.
current HEAD 충돌 해소 및 재검증
검증:
|
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Strix의 Medium+ 발견(및 선택적으로 GitHub Code Scanning alert)을 ContextualWisdomLab/appguardrail 이슈로 중앙 집계하고, PR-scope vs full-scope 스캔에 따라 close-on-fix를 안전하게 제어하며, OpenCode의 “current-head source-line receipt” 기반 증거 바인딩을 강화합니다.
Changes:
- Strix report/Code Scanning alert를 파싱·중복제거·이슈 reconcile(create/update/comment/close)하는 emitter 추가 및 워크플로우 연결
- PR 스캔에서 close-on-fix 금지, full+complete 스캔에서만 stale 이슈 자동 close
- OpenCode에 trusted changed-line source receipt 생성/검증 및 adversarial probe evidence 바인딩 repair 로직 추가
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
tests/test_strix_emit_appguardrail_issues.py |
Strix→AppGuardrail emitter의 파싱/해싱/플래닝/실행/CLI 경로를 포괄 테스트로 고정 |
tests/test_required_workflow_queue_contract.py |
workflow_run 소비자(Noema/merge scheduler)의 upstream allowlist 및 Strix emitter 워크플로우 계약 테스트 추가 |
tests/test_opencode_source_line_receipts.py |
current-head changed-line source receipt 생성기의 fail-closed/경계 조건 테스트 추가 |
tests/test_opencode_review_normalize_output.py |
sealed receipt 인덱싱 및 probe evidence 바인딩 repair/거부 규칙 테스트 추가 |
tests/test_opencode_model_pool_runner.py |
모델 프롬프트에 “path:line 인용 + receipt 복사” 규칙이 포함됨을 고정 |
tests/test_opencode_agent_contract.py |
워크플로우가 receipt 생성/증거 패킷 wiring을 포함함을 계약 테스트로 고정 |
scripts/ci/test_strix_quick_gate.sh |
Strix 워크플로우의 emitter/토큰/scan_complete/Code Scanning wiring 계약 검사 추가(일부 권한 가드 제거) |
scripts/ci/strix_emit_appguardrail_issues.py |
Strix/Code Scanning findings를 AppGuardrail 이슈로 중앙 집계하는 신규 emitter 구현 |
scripts/ci/run_opencode_review_model_pool.sh |
프롬프트 계약에 trusted receipts 섹션 및 “digest 계산 금지/인용 강제” 규칙 추가 |
scripts/ci/opencode_source_line_receipts.py |
current-head changed-line의 SHA-256 receipt를 bounded + fail-closed로 생성하는 신규 CLI 추가 |
scripts/ci/opencode_review_prompt_template.md |
review 프롬프트에 trusted changed-line source receipts 섹션 반영 |
scripts/ci/opencode_review_normalize_output.py |
sealed evidence에서 receipts를 검증·인덱싱하고 probe evidence 바인딩을 보수적으로 repair |
docs/strix-appguardrail-issues.md |
Strix→AppGuardrail 중앙 집계/권한/close-on-fix 가드에 대한 운영 문서 추가 |
code-reviewer-prompt.md |
adversarial evidence에서 receipt “복사” 요구로 계약 강화 |
ci-review-prompt.md |
adversarial evidence에서 receipt “복사” 요구로 계약 강화 |
.github/workflows/strix.yml |
scan_complete 출력 추가 및 AppGuardrail issue token/Code Scanning token mint + emitter 실행 단계 추가 |
.github/workflows/pr-review-merge-scheduler.yml |
workflow_run 트리거에서 upstream workflow path allowlist 추가 |
.github/workflows/opencode-review.yml |
evidence에 trusted changed-line source receipts 섹션 생성/인라인 발췌 포함 |
.github/workflows/noema-review.yml |
workflow_run 트리거에서 upstream workflow path allowlist 추가 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| STRIX_PR_NUMBER: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.event.client_payload.pr_number || '' }} | ||
| STRIX_HEAD_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.event.client_payload.pr_head_sha || github.sha }} | ||
| STRIX_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | ||
| STRIX_SCAN_SCOPE: ${{ (github.event_name == 'pull_request_target' || github.event.client_payload.pr_number != '') && 'pr' || 'full' }} |
|
@jules Rebase this draft onto current |
|
@coderabbitai Please fix the unresolved Copilot workflow finding and commit directly to this PR branch. In |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- STRIX_SCAN_SCOPE in workflow ---'
rg -n -C 8 'STRIX_SCAN_SCOPE|client_payload\.pr_number|__PR_SCOPE__' .github/workflows/strix.yml
printf '%s\n' '--- Candidate workflow contract tests ---'
rg -n -C 5 'STRIX_SCAN_SCOPE|client_payload\.pr_number|repository_dispatch|__PR_SCOPE__' \
-g '*test*' -g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' .Length of output: 127908 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Python Strix emitter/run-step contracts ---'
sed -n '900,980p' tests/test_required_workflow_queue_contract.py
printf '%s\n' '--- Python test module imports and helpers ---'
sed -n '1,80p' tests/test_required_workflow_queue_contract.py
printf '%s\n' '--- Shell Strix workflow contract block ---'
sed -n '150,320p' scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '--- Existing workflow-expression or event-payload test helpers ---'
rg -n -C 4 'yaml\.|safe_load|client_payload|event_name|STRIX_SCAN_SCOPE|scope.*full|scope.*pr' \
tests/test_required_workflow_queue_contract.py scripts/ci/test_strix_quick_gate.shLength of output: 117604 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 -m pytest -q tests/test_required_workflow_queue_contract.py \
-k 'strix_emits_actionable_findings_to_appguardrail_fail_closed or strix_cross_repo_dispatch_uses_target_token_for_pr_scoping or strix_scope'
STRIX_TEST_CASE_FILTER=repository-dispatch-pr-scope-uses-head-blob \
bash scripts/ci/test_strix_quick_gate.shLength of output: 706
You are interacting with an AI system. |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Closing this long-lived draft to remove stale central-workflow fan-out. The AppGuardrail aggregation product direction remains valuable, but the 21-commit branch predates the current review-dispatch, Noema, SARIF, and exact-head contracts. Rebuild it from current main as separate PRs for (1) finding normalization/idempotency, (2) App-scoped issue publication, and (3) successful full-scan reconciliation. |
OpenCode receipt candidates
scripts/ci/strix_emit_appguardrail_issues.py:44source-line-sha256=df6d83d7cef00f95021019d23122552853407da9156a32528e1ddc5435eed105.github/workflows/strix.yml:797source-line-sha256=f05ab3628ca4fe39800593c1f8406d4c0456a356ff85e40be210eadf96806190These exact current-head receipts are normalizer-verifiable for adversarial probes.
변경 사항
STRIX_TARGET_PATH=__PR_SCOPE__ requires PR scoping회귀를 수정합니다.workflow_run은 OpenCode/Strix 두 upstream workflow만 허용하여 상호 재귀 queue를 차단합니다.path:line을 인용할 때만 구조화 필드를 재결합하며, 모호한 경우 후보 수를 로그에 남기고 fail-closed 합니다.검증
실제 취약점이 없는 경우 가짜 이슈를 만들지 않습니다. 병합 후 Medium 이상 Strix finding과 현재 열려 있는 GitHub Code Scanning alert가 AppGuardrail에 동기화됩니다. Code Scanning alert는 원본 심각도와 범주를 보존하므로 Medium 미만의 거버넌스 경고도 포함될 수 있습니다.