fix(coverage): materialize trusted uv lock dependencies - #743
fix(coverage): materialize trusted uv lock dependencies#743seonghobae wants to merge 20 commits into
Conversation
|
Warning Review limit reached
Next review available in: 1 minute Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='2ef7a3661d26aa17636fc562f51531993c21313b'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git diff-tree --no-commit-id --name-status -r "$expected"
printf '\n--- IMPLEMENTATION OUTLINE ---\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
printf '\n--- TEST OUTLINES ---\n'
for f in \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_trusted_uv_download_contract.py \
tests/test_uv_export_isolation_contract.py
do
printf '\n### %s ###\n' "$f"
ast-grep outline "$f" --items all --view expanded
done
printf '\n--- IMPLEMENTATION ---\n'
cat -n scripts/ci/materialize_base_python_requirements.py
printf '\n--- FOCUSED TESTS ---\n'
for f in \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_trusted_uv_download_contract.py \
tests/test_uv_export_isolation_contract.py
do
printf '\n### %s ###\n' "$f"
cat -n "$f"
done
printf '\n--- DESIGN RECORD ---\n'
cat -n docs/doctoring/trusted-uv-lock-materialization.mdLength of output: 81216 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='2ef7a3661d26aa17636fc562f51531993c21313b'
printf '%s\n' '--- REF AND MERGE-BASE DISCOVERY ---'
git remote -v
git branch -a --contains "$head" || true
for ref in origin/main origin/master main master; do
if git rev-parse --verify --quiet "$ref" >/dev/null; then
base="$(git merge-base "$ref" "$head")"
printf 'REF=%s MERGE_BASE=%s\n' "$ref" "$base"
git diff --name-status "$base" "$head"
fi
done
printf '%s\n' '--- PULL REQUEST METADATA ---'
gh pr view 743 --repo ContextualWisdomLab/.github --json baseRefName,baseRefOid,headRefName,headRefOid,isDraft,state,mergeStateStatus,statusCheckRollup
printf '%s\n' '--- REDIRECT AND OUTPUT-VALIDATION CALL SITES ---'
rg -n -C 4 --glob '*.py' \
'geturl\(\)|urlparse\(|TRUSTED_UV_ARCHIVE_URL|_is_fully_hash_pinned_requirement|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE' \
scripts tests
printf '%s\n' '--- QUALITY CONFIGURATION CANDIDATES ---'
fd -H -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc|ruff\.toml)$' . \
-E .git -E node_modules -E dist -E build \
-x sh -c 'printf "\n### %s ###\n" "$1"; cat -n "$1"' sh {}
printf '%s\n' '--- DOCSTRING AND COVERAGE REFERENCES ---'
rg -n -C 3 --hidden \
'(branch\s*=\s*true|--cov-branch|fail_under|docstring|pydocstyle|D[0-9]{3}|materialize_base_python_requirements)' \
-g '!**/.git/**' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' .Length of output: 109425
I found two blockers.
The reviewed implementation otherwise matches the requested boundaries:
I did not execute repository tests because the review sandbox prohibits execution of repository code. Pull request ✅ Action performedReview finished.
|
| with urllib.request.urlopen( # nosec B310 -- literal HTTPS URL plus SHA pin | ||
| "https://releases.astral.sh/github/uv/releases/download/0.12.1/" | ||
| "uv-x86_64-unknown-linux-gnu.tar.gz", | ||
| timeout=TRUSTED_UV_DOWNLOAD_TIMEOUT_SECONDS, | ||
| ) as response: |
|
Addressed both exact-head CodeRabbit blockers in
@coderabbitai review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='3a15594b9a5085fcbac002471c8f532ac130e40f'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
if [ "$actual" != "$expected" ]; then
printf 'ERROR: checked-out HEAD does not match requested commit.\n' >&2
exit 2
fi
printf '\n--- PR METADATA AND CHECKS ---\n'
gh pr view 743 --repo ContextualWisdomLab/.github \
--json isDraft,state,mergeStateStatus,baseRefName,baseRefOid,headRefName,headRefOid,statusCheckRollup
printf '\n--- DIFF FROM PRIOR REVIEWED HEAD ---\n'
git diff --find-renames --find-copies --stat \
2ef7a3661d26aa17636fc562f51531993c21313b "$expected"
git diff --find-renames --find-copies --unified=80 \
2ef7a3661d26aa17636fc562f51531993c21313b "$expected" -- \
scripts/ci/materialize_base_python_requirements.py \
pyproject.toml \
tests \
docs/doctoring/trusted-uv-lock-materialization.md
printf '\n--- SOURCE OUTLINE ---\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
printf '\n--- URL VALIDATION AND DOWNLOAD BOUNDARY ---\n'
rg -n -C 12 --glob '*.py' \
'urlparse\(|\.port\b|geturl\(\)|TRUSTED_UV_ARCHIVE_URL|build_opener|HTTPRedirectHandler|ProxyHandler|urlopen\(|Request\(' \
scripts tests
printf '\n--- COVERAGE CONFIGURATION AND CONTRACTS ---\n'
cat -n pyproject.toml
rg -n -C 8 --glob '*.py' \
'(branch\s*=\s*true|fail_under\s*=\s*100|coverage|port 444|:444|malformed|explicit.*443|default.*port)' \
tests
printf '\n--- DOCSTRING STATIC CHECK ---\n'
python3 - <<'PY'
import ast
from pathlib import Path
path = Path("scripts/ci/materialize_base_python_requirements.py")
tree = ast.parse(path.read_text(encoding="utf-8"))
missing = []
for node in ast.walk(tree):
if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
if not ast.get_docstring(node):
missing.append((type(node).__name__, node.name, node.lineno))
print("missing_docstrings=", missing)
PY
printf '\n--- RELEVANT DOCUMENTATION ---\n'
rg -n -C 7 \
'(origin|port|redirect|branch coverage|100%|workspace|nested standalone)' \
docs/doctoring/trusted-uv-lock-materialization.mdLength of output: 202609 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='3a15594b9a5085fcbac002471c8f532ac130e40f'
test "$(git rev-parse HEAD)" = "$expected"
printf '%s\n' '--- PR BASE, HEAD, AND DECLARED FILE SET ---'
gh pr view 743 --repo ContextualWisdomLab/.github \
--json baseRefOid,headRefOid,isDraft,state,mergeStateStatus \
--jq '{baseRefOid,headRefOid,isDraft,state,mergeStateStatus}'
base="$(gh pr view 743 --repo ContextualWisdomLab/.github --json baseRefOid --jq .baseRefOid)"
git diff --name-status "$base" "$expected"
printf '%s\n' '--- IMPLEMENTATION: TRUSTED DOWNLOAD ---'
rg -n -C 30 \
'^def _download_trusted_uv_archive|^def _install_trusted_uv|^class .*Redirect|^def .*opener|urlparse\(|parsed\.port|\.hostname|\.scheme|urlopen\(' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- IMPLEMENTATION: UV EXPORT ISOLATION AND VALIDATION ---'
rg -n -C 20 \
'^def _run_uv_export|^def _export_uv_lock|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|XDG_|--no-config|--frozen|--offline|--no-cache|_is_fully_hash_pinned_requirement|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- COVERAGE CONFIGURATION ---'
sed -n '1,80p' pyproject.toml
printf '%s\n' '--- NEW REGRESSION CONTRACT ---'
cat -n tests/test_uv_redirect_and_coverage_contract.py
printf '%s\n' '--- REDIRECT BOUNDARY TESTS ---'
cat -n tests/test_uv_redirect_boundary.py
printf '%s\n' '--- EXACT-HEAD CHECK RUNS ---'
gh api \
'repos/ContextualWisdomLab/.github/commits/3a15594b9a5085fcbac002471c8f532ac130e40f/check-runs?per_page=100' \
--jq '.check_runs[] | [.name, .status, (.conclusion // "PENDING"), .details_url] | `@tsv`'
printf '%s\n' '--- EXACT-HEAD WORKFLOW RUNS ---'
gh run list --repo ContextualWisdomLab/.github \
--commit "$expected" --limit 100 \
--json databaseId,name,status,conclusion,event,workflowName,url \
--jq '.[] | [.databaseId, .workflowName, .name, .event, .status, (.conclusion // "PENDING"), .url] | `@tsv`'Length of output: 33277
The two prior blockers are resolved.
I did not approve the PR. It remains a draft. Its merge state is ✅ Action performedReview finished.
|
2 participants
What
Extend the central base-commit Python dependency materializer so repositories that rely on
uv.lockcan produce an offline, fully hash-pinned third-party dependency closure even when a GitHub runner does not already expose the required trusteduvexecutable.This clean replacement supersedes stacked bootstrap PR #737 and contains the canonical materializer, focused behavioral and static-security contracts, an explicit 100% branch-coverage gate, and the doctoring design record.
Why
Repositories such as BandScope can pass their own CI but fail the central OpenCode coverage sandbox when the validated base tree contains
uv.lockdependency contracts and the coverage runner cannot export them. Missing environment materialization then appears as a misleading source-review failure rather than a dependency-provisioning defect.Trust boundary
uv.lockand siblingpyproject.tomlonly from the exact validated 40-character base commit SHA.uvarchive from a literal HTTPS URL at the network sink.releases.astral.sh, and only an absent or explicit default port 443; malformed and nondefault ports fail closed.0755, and exact reporteduvversion.uv export --frozen --offline --no-cache --no-progress --color never --no-emit-project --no-editablein an isolated temporary project.PATH, isolatedHOME/TMPDIR/XDG directories,UV_NO_ENV_FILE=1, andUV_PYTHON_DOWNLOADS=never; ambient runner variables do not reach the exporter.--no-configis forbidden because it would also disable the authoritativepyproject.tomlinput.==pin followed only by complete SHA-256 hashes. Option lines, direct/local references, non-SHA-256 algorithms, and truncated digests fail closed.Modular boundary
Nested standalone modules are supported because every sibling
pyproject.toml/uv.lockpair is read and exported independently from the immutable base revision. True uv workspaces that require additional member metadata are not silently approximated; they remain fail-closed until the exact-base workspace reconstruction contract tracked in #750 is implemented.TDD and verification contracts
The nine-file change provides permanent evidence for:
urllib.request.Request, a cached no-proxy/no-redirect opener, and redirect rejection before follow;--no-configorUV_NO_CONFIG;pyproject.tomlenables branch measurement andfail_under = 100; andThe exact current head must pass all central security, coverage, workflow-contract, independent-review, and branch-protection gates after #731 establishes the repaired default-branch baseline.
Standards traceability
docs/doctoring/trusted-uv-lock-materialization.mdrecords the immutable-source, fixed-origin, redirect, default-port, hash, isolated-export, modularity, and verification contracts with APA 7th references to official Astral uv documentation, RFC 3986, and approved SLSA 1.2 materials. The implementation follows those controls without claiming formal SLSA conformance.Scope
Exactly nine files change:
docs/doctoring/trusted-uv-lock-materialization.mdpyproject.tomlscripts/ci/materialize_base_python_requirements.pytests/test_materialize_base_python_requirements.pytests/test_materialize_uv_export_hash_contract.pytests/test_trusted_uv_download_contract.pytests/test_uv_export_isolation_contract.pytests/test_uv_redirect_and_coverage_contract.pytests/test_uv_redirect_boundary.pySequencing
This PR remains draft until the central baseline repair #731 lands. It will then be updated against the repaired
main, marked ready, re-reviewed on its exact head, and merged only after required current-head evidence succeeds.