fix(ci): defer coverage base locks whose pinned version the index no longer offers - #674
fix(ci): defer coverage base locks whose pinned version the index no longer offers#674seonghobae wants to merge 11 commits into
Conversation
|
Warning Review limit reached
Next review available in: 30 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughpip 사전 검증은 도달 가능한 인덱스에 요청 버전이 없을 때 해당 후보를 건너뛸 수 있습니다. 빈 인덱스와 접근 불가 인덱스는 계속 치명적 오류로 처리합니다. 관련 회귀 테스트와 오류 설명을 갱신했습니다. Changes인덱스 버전 사전 검증 처리
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_install_base_python_locks.py`:
- Around line 401-434: Update
test_reachable_index_missing_pinned_version_is_visible_and_nonfatal to assert
that stderr contains the original pip failure diagnostics or the warning emitted
for the skipped candidate. Keep the existing success and summary assertions, and
validate the test’s documented “visible” behavior through the captured stderr
output.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 059c190e-b5a6-43a6-be11-fbb7dd1661bf
📒 Files selected for processing (2)
scripts/ci/install_base_python_locks.pytests/test_install_base_python_locks.py
|
@jules Please address the remaining review thread directly on this branch. In |
|
@coderabbitai review |
✅ Action performedReview finished.
|
9b4834e to
40fa657
Compare
Pull request was closed
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headbcc368a25c018b2e02e6a4494c77bec075cba5ef. -
Head SHA:
bcc368a25c018b2e02e6a4494c77bec075cba5ef -
Workflow run: 30806718717
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["CI script: install_base_python_locks.py"]
S1 --> I1["review and security gate shell path"]
I1 --> R1["Review risk: CI script: install_base_python_locks.py"]
R1 --> V1["bash -n plus Strix self-test"]
Evidence --> S2["Test: test_install_base_python_locks.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_install_base_python_locks.py"]
R2 --> V2["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (4 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (4 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (4 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (4 files)"]
R3 --> V3["targeted test run"]
|
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…longer offers The coverage-evidence sandbox builds its trusted tool image by installing every hash-lock it materializes from the base commit. When a base lock pins a version that has since been yanked or that has no wheel for the pinned coverage-image interpreter (e.g. a repo's `fuzz/requirements-atheris.txt` pinning `atheris==3.0.0`, unavailable on the Python 3.14 image where only 3.1.0 exists), pip fails the preflight and the whole image build aborts — deadlocking coverage-evidence, and therefore OpenCode approval and merge, for *every* PR in that repository. A repo-side pin bump cannot break the deadlock because the sandbox reads the lock from the PR base SHA, not the merge head. Treat this the same as the existing "requires a different Python" defer: pip proves the index was reachable by listing the versions it *did* find (`(from versions: 3.1.0)`), so it is an availability/interpreter incompatibility that is safe to skip and let the later networkless coverage run surface any genuinely-needed missing dependency. The empty/unreachable-index shape (`(from versions: none)`) is explicitly excluded and stays fatal, so a registry outage still cannot masquerade as an optional lock. Adds two regression tests pinning both sides of that boundary. Module stays at 100% line coverage. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T47gHdkeM8H2Mpu4VwZT3c
65da8f5 to
d971a93
Compare
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head79b77d0f59aa0129368d1df773e33f3230a2fb22. -
Head SHA:
79b77d0f59aa0129368d1df773e33f3230a2fb22 -
Workflow run: 30831683193
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (4 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (4 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (4 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (4 files)"]
R3 --> V3["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head79b77d0f59aa0129368d1df773e33f3230a2fb22. -
Head SHA:
79b77d0f59aa0129368d1df773e33f3230a2fb22 -
Workflow run: 30831683193
-
Workflow attempt: 2
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (4 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (4 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (4 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (4 files)"]
R3 --> V3["targeted test run"]
scheduled-security-scan.yml had a github/codeql-action version split: init/analyze were pinned to v4.37.0 (99df26d4) while upload-sarif had already been bumped to v4.37.4 (f205ea1c). The contract test test_codeql_action_steps_use_one_version_per_workflow requires a single CodeQL action SHA per workflow, so the split was the only failing test (806/807 passed) in this repo's coverage-evidence suite — deterministically blocking this PR and every other .github PR until fixed on main. Bump init + analyze forward to v4.37.4 to complete the migration Dependabot already started on upload-sarif. Full suite: 807 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T47gHdkeM8H2Mpu4VwZT3c
pip-audit --strict flagged 3 CVEs in aiohttp 3.14.1 (transitive via strix-agent==1.0.4) pinned in requirements-strix-ci-hashes.txt: WebSocket RSV1 decompression (CVE-2026-59881), HTTP request smuggling via WebSocket upgrades (CVE-2026-69243), and an out-of-bounds heap read DoS in the C response parser (CVE-2026-69244) — all fixed in 3.14.3. This was the only failing requirements file in the pip-audit gate, blocking every .github PR. Add an aiohttp>=3.14.3 security floor to requirements-strix-ci.txt (the established transitive-pin pattern alongside protobuf/cryptography/ python-multipart/pyasn1) and regenerate the hash lock with the recorded uv command. Only aiohttp changed version; full .github suite: 807 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T47gHdkeM8H2Mpu4VwZT3c
After the aiohttp bump, pip-audit --strict surfaced the next CVE in the strix lock: cryptography 49.0.0 (a direct floor in requirements-strix-ci.txt) is affected by CVE-2026-69247 — pkcs7_decrypt_der/pem/smime disclose the RSA-recovered length via distinguishable outcomes; fixed in 50.0.0. Raise the cryptography floor to >=50.0.0 and regenerate the hash lock; uv resolves cleanly against strix-agent==1.0.4 and pulls pyopenssl 26.4.0 (the release compatible with cryptography 50). A faithful pip-audit under Python 3.12 now reports no known vulnerabilities across the whole strix lock. Full .github suite: 807 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T47gHdkeM8H2Mpu4VwZT3c
Bootstrap merge evidence for current head
|
Dismissed as stale: this request targeted prior head 79b77d0. Current head 5583562 has zero unresolved threads and all independently executable current-head security/SAST/CodeQL/OSV/Scorecard/SBOM/Strix checks successful. The remaining coverage-review failure is the documented base-SHA bootstrap cycle this PR repairs.
Pull request was converted to draft
|
@coderabbitai review Please perform a fresh review of the exact current head |
|
✅ Action performedReview finished.
|
2 participants
Problem
The coverage-evidence sandbox builds its trusted tool image by installing every hash-lock it materializes from the base commit (
install_base_python_locks.py). When a base lock pins a version that has since been yanked, or that has no wheel for the pinned coverage-image interpreter (Python 3.14), pip fails the preflight and the entire image build aborts — before any PR code runs.Concrete live impact:
contextual-orchestratorpinsatheris==3.0.0infuzz/requirements-atheris.txt, but only3.1.0is available for the 3.14 image:Because the coverage-evidence job fails with an empty summary, OpenCode posts
REQUEST_CHANGESon every open PR in that repo (feature, coverage, security, and Dependabot PRs alike) — a full merge deadlock. A repo-side pin bump cannot self-heal it: the sandbox reads the lock from the PR base SHA (materialize_base_python_requirements.py→git show {base}:{path}), not the merge head, so a fix PR's own coverage-evidence still sees the broken base.Fix
Extend the existing
DEFERABLE_PREFLIGHT_FAILURESset (which already defers "requires a different Python" and incomplete hash closures) to also defer a reachable-index / pinned-version-gone failure. pip proves the index was reachable by listing the versions it did find ((from versions: 3.1.0)), so this is an availability/interpreter incompatibility — safe to skip and let the later networkless coverage run surface any genuinely-needed missing dependency (fuzz deps aren't needed to measure test coverage).The empty/unreachable-index shape
(from versions: none)is explicitly excluded via negative lookahead and stays fatal, so a genuine registry/network outage still cannot masquerade as an optional lock — preserving the guard the module was built around.Verification
pytest tests/test_install_base_python_locks.py— 23 passed (2 new).skipped=1, exit 0);(from versions: none)stays fatal.install_base_python_locks.pyremains at 100% line coverage; only an existing docstring/message was edited (docstring coverage unchanged).Could not fetch URL …) and the interpreter-incompat defer test are unaffected.Developer experience
Repos no longer deadlock their entire PR queue on a single yanked/interpreter-incompatible entry in a non-essential lock (e.g. fuzz requirements). Maintainers still get the exact bounded diagnostic in the job log.
User experience
No user-facing surface changes; this is CI infrastructure resilience.
🤖 Generated with Claude Code
Generated by Claude Code
Summary by CodeRabbit
버그 수정
테스트