fix(automation): run securely pinned review repair every hour by seonghobae · Pull Request #704 · ContextualWisdomLab/.github

seonghobae · 2026-08-03T03:03:58Z

Problem

The merge scheduler already revisits merge readiness every 15–30 minutes, but unresolved review-feedback autofix ran only every two hours and would not revisit the same current head for 24 hours. Review-addressable pull requests could therefore remain idle long after feedback appeared.

The reusable workflow also checked out scheduler code from mutable main, even when callers referenced the workflow at an immutable SHA. In a reusable workflow, the ordinary github context belongs to the caller, so the privileged implementation must be bound to the called workflow's own resolved source.

Change

run the bounded review-fix scheduler hourly at minute 23, away from the top-of-hour GitHub Actions load spike;
reduce the same-head retry floor from 24 hours to one hour;
check out job.workflow_repository at immutable job.workflow_sha;
retain canonical_ref only as an ignored deprecated compatibility input so existing pinned callers can upgrade without a coordinated break;
retain the existing one-dispatch-per-run default, current-head validation, concurrency control, least-privilege permissions, and fail-closed autofix workflow;
pin the cadence, retry bounds, immutable source, compatibility boundary, and permissions with focused contract tests.

Safety

The scheduler does not bypass reviews or checks. It only dispatches the existing bounded autofix workflow; merge eligibility continues to be decided by the independent merge scheduler and repository rules. The deprecated input is never read and cannot select trusted code.

Verification

focused cadence contract added before the workflow change;
exact cron, retry default, environment fallback, and one-dispatch bound are asserted;
reusable workflow source must resolve through job.workflow_repository and job.workflow_sha;
caller payloads, deprecated inputs, mutable refs, and the ordinary caller GitHub SHA cannot select privileged source;
current-head GitHub Actions are the authoritative workflow validation.

Summary by CodeRabbit

개선 사항
- PR 리뷰 수정 작업의 재배포 최소 대기 시간이 24시간에서 1시간으로 단축되었습니다.
- 스케줄 실행 주기가 2시간마다에서 매시 23분으로 변경되었습니다.
- 호출된 워크플로의 확인된 버전을 사용해 실행 안정성과 보안이 강화되었습니다.
- 기존 canonical_ref 입력과의 호환성이 유지됩니다.
테스트
- 스케줄, 재시도 설정, 소스 검증, 권한 및 실행 제한에 대한 자동 검증을 추가했습니다.

coderabbitai · 2026-08-03T03:04:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ec89d3ec-6484-4414-953c-4d99d68b7cd0

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 1296408.

📒 Files selected for processing (3)

.github/workflows/pr-review-fix-scheduler.yml
tests/test_hourly_review_fix_workflow.py
tests/test_pr_review_fix_scheduler_source_pin.py

📝 Walkthrough

Walkthrough

재시도 최소 대기 시간을 24시간에서 1시간으로 변경했습니다. 스케줄을 매시 23분으로 변경했습니다. 체크아웃은 호출된 워크플로의 저장소와 확인된 SHA를 사용합니다. 관련 동작을 테스트로 검증합니다.

Changes

스케줄러 동작 및 소스 제어

Layer / File(s)	Summary
시간별 스케줄 및 재시도 계약 `.github/workflows/pr-review-fix-scheduler.yml`, `tests/test_hourly_review_fix_workflow.py`	스케줄을 매시 23분으로 변경했습니다. `retry_hours`와 `RETRY_HOURS` 기본값을 1시간으로 변경했습니다. 이벤트 페이로드와 입력 대체식을 테스트합니다.
호출된 워크플로 소스 고정 `.github/workflows/pr-review-fix-scheduler.yml`, `tests/test_pr_review_fix_scheduler_source_pin.py`	체크아웃에 `job.workflow_repository`와 `job.workflow_sha`를 사용합니다. `canonical_ref`는 빈 기본값의 호환성 입력으로 유지하고 사용하지 않습니다. 권한 및 실행 제한 계약을 테스트합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

ContextualWisdomLab/.github#635: 재사용 GitHub Actions 스케줄러의 소스 고정과 호출자 제어 차단을 함께 다룹니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 리뷰 수정 스케줄러의 시간별 실행과 안전한 소스 고정이라는 주요 변경 사항을 명확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/hourly-review-fix-loop

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-03T03:10:02Z

@coderabbitai review

coderabbitai · 2026-08-03T03:10:08Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-03T03:42:56Z

@coderabbitai review

coderabbitai · 2026-08-03T03:43:02Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-03T03:58:49Z

@coderabbitai review

coderabbitai · 2026-08-03T03:58:56Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-03T04:50:46Z

Source-pin design independently verified against GitHub's current Actions context reference: for jobs defined by a reusable workflow, job.workflow_repository identifies the called workflow repository and job.workflow_sha identifies its immutable commit; GitHub's own example checks out co-located source with exactly those fields. This is stronger than caller-supplied canonical_ref, so competing #710 was closed as superseded. Reference: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#job-context

seonghobae · 2026-08-03T06:33:42Z

@coderabbitai review

Please review the exact current head of the hourly review-repair scheduler. Focus on immutable called-workflow source binding, one-dispatch bounds, same-head retry timing, least-privilege permissions, and fail-closed behavior.

coderabbitai · 2026-08-03T06:33:52Z

@seonghobae I will review the exact current head. I will focus on immutable called-workflow source binding, dispatch bounds, retry timing, permissions, and fail-closed behavior.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 12964088023f48cf6a90089e2439226b1402b5e6.
Head SHA: 12964088023f48cf6a90089e2439226b1402b5e6
Workflow run: 30841879924
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-fix-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-fix-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test (2 files)"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test (2 files)"]
  R2 --> V2["targeted test run"]

opencode-agent · 2026-08-03T18:37:37Z

OpenCode Review Overview

Head SHA: 12964088023f48cf6a90089e2439226b1402b5e6
Workflow run: 30841879924
Workflow attempt: 1
Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 12964088023f48cf6a90089e2439226b1402b5e6.
Head SHA: 12964088023f48cf6a90089e2439226b1402b5e6
Workflow run: 30841879924
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-fix-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-fix-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test (2 files)"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test (2 files)"]
  R2 --> V2["targeted test run"]

test(automation): require hourly review-fix cadence

88ac186

seonghobae marked this pull request as ready for review August 3, 2026 03:06

fix(automation): run review-feedback repair hourly

a354017

seonghobae changed the title ~~test(automation): pin hourly review-fix cadence~~ fix(automation): run review-feedback repair every hour Aug 3, 2026

seonghobae enabled auto-merge (squash) August 3, 2026 03:10

seonghobae added 2 commits August 3, 2026 12:41

security(automation): pin hourly scheduler to called workflow SHA

8274a62

test(security): pin hourly reusable scheduler source

74e5425

seonghobae changed the title ~~fix(automation): run review-feedback repair every hour~~ fix(automation): run securely pinned review repair every hour Aug 3, 2026

seonghobae mentioned this pull request Aug 3, 2026

security: pin reusable PR autofix scheduler source #706

Closed

This was referenced Aug 3, 2026

fix(ci): bind review-fix scheduler runtime to immutable workflow SHA #708

Closed

fix(review): pin reusable fix scheduler source #710

Closed

seonghobae mentioned this pull request Aug 3, 2026

ci: run central PR maintenance every hour ContextualWisdomLab/bandscope#738

Closed

seonghobae added 2 commits August 3, 2026 14:42

test(automation): preserve caller compatibility without source control

2b0f1ec

fix(automation): preserve deprecated caller input safely

2139712

Merge branch 'main' into codex/hourly-review-fix-loop

1296408

opencode-agent Bot requested changes Aug 3, 2026

View reviewed changes

opencode-agent Bot disabled auto-merge August 3, 2026 18:37

coderabbitai Bot mentioned this pull request Aug 3, 2026

feat(automation): run naruon commercial readiness hourly #709

Draft

seonghobae enabled auto-merge (squash) August 4, 2026 03:21

opencode-agent Bot disabled auto-merge August 4, 2026 03:22

Uh oh!

Conversation

seonghobae commented Aug 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Safety

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agent Bot commented Aug 3, 2026

OpenCode Review Overview

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 3, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading