ci: run securely pinned review repair every hour - #745
Conversation
|
Warning Review limit reached
Next review available in: 2 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Comment |
|
@opencode-agent @cwl-noema-review Please review exact head |
|
@opencode-agent @cwl-noema-review Please review exact current head |
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review Please review exact current head |
|
@coderabbitai review Please review exact current head |
|
@opencode-agent Please review exact head |
69fc4d2
into
fix/strix-python-security-cves
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
git status --short
if [ "$(git rev-parse HEAD)" != "$expected" ]; then
echo "ERROR: checked-out commit does not match requested exact head" >&2
exit 1
fi
printf '%s\n' '== PR metadata and check status =='
gh pr view 745 --repo ContextualWisdomLab/.github \
--json number,headRefOid,baseRefName,files,statusCheckRollup,url \
--jq '{number, url, headRefOid, baseRefName, files: [.files[].path], checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}'
printf '%s\n' '== Changed-file scope at exact head =='
git diff --name-status "${expected}^" "$expected"
printf '%s\n' '== Workflow =='
nl -ba .github/workflows/pr-review-fix-scheduler.yml
printf '%s\n' '== Static contracts =='
nl -ba tests/test_pr_review_fix_hourly_contract.py
nl -ba tests/test_pr_review_fix_scheduler_source_pin.py
printf '%s\n' '== Documentation =='
nl -ba docs/automation/hourly-review-repair.md
printf '%s\n' '== Relevant workflow tokens and selectors =='
rg -n -C 3 --fixed-strings \
-e 'canonical_ref' \
-e 'workflow_repository' \
-e 'workflow_sha' \
-e 'max_dispatches' \
-e 'retry' \
-e 'concurrency' \
-e 'permissions' \
-e 'contents: write' \
-e 'pull-requests: write' \
.github/workflows/pr-review-fix-scheduler.yml tests/test_pr_review_fix_hourly_contract.py tests/test_pr_review_fix_scheduler_source_pin.py docs/automation/hourly-review-repair.mdLength of output: 17374 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected"
printf '%s\n' '== Complete PR diff against merge base =='
base="$(git merge-base "origin/fix/strix-python-security-cves" "$expected")"
git diff --no-ext-diff --unified=80 "$base" "$expected" -- \
.github/workflows/pr-review-fix-scheduler.yml \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md
for path in \
.github/workflows/pr-review-fix-scheduler.yml \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md
do
printf '\n== %s ==\n' "$path"
git show "$expected:$path"
done
printf '%s\n' '== Current check summary for requested head =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
--jq '.[] | {name, state, link}'
printf '%s\n' '== Check suites for requested commit =='
gh api "repos/ContextualWisdomLab/.github/commits/$expected/check-suites" \
--paginate \
--jq '.check_suites[] | {app: .app.slug, status, conclusion, head_sha, url}'Length of output: 1616 🏁 Script executed: #!/bin/bash
set -u
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
if [ "$(git rev-parse HEAD)" != "$expected" ]; then
echo 'ERROR: requested exact head is not checked out' >&2
exit 1
fi
printf '%s\n' '== PR patch from GitHub =='
gh pr diff 745 --repo ContextualWisdomLab/.github --patch || true
for path in \
.github/workflows/pr-review-fix-scheduler.yml \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md
do
printf '\n== %s at requested head ==\n' "$path"
git show "$expected:$path" || true
done
printf '%s\n' '== Current check summary =='
gh pr checks 745 --repo ContextualWisdomLab/.github \
--json name,state,link \
--jq '.[] | "\(.state)\t\(.name)\t\(.link)"' || true
printf '%s\n' '== Commit check suites =='
gh api "repos/ContextualWisdomLab/.github/commits/$expected/check-suites" \
--paginate \
--jq '.check_suites[] | "\(.app.slug)\t\(.status)\t\(.conclusion // "NONE")\t\(.url)"' || trueLength of output: 35690 🏁 Script executed: #!/bin/bash
set -u
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected" || exit 1
printf '%s\n' '== Scheduler implementation outline =='
ast-grep outline scripts/ci/pr_review_fix_scheduler.py --items all --view expanded 2>/dev/null || true
printf '%s\n' '== Scheduler implementation: dispatch, eligibility, and merge-policy boundaries =='
git show "$expected:scripts/ci/pr_review_fix_scheduler.py" 2>/dev/null | \
grep -n -E -C 8 \
'def |dispatch|merge|autofix|review|approval|required|check|retry|fail|exit|self-test' \
|| true
printf '%s\n' '== Scheduler-related test locations =='
rg -n -C 3 \
'pr_review_fix_scheduler|review.fix.scheduler|MAX_DISPATCHES|RETRY_HOURS|autofix' \
tests .github/workflows 2>/dev/null || true
printf '%s\n' '== Exact-head checks: non-success entries =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
--jq '[.[] | select(.state != "SUCCESS" && .state != "SKIPPED") | {name, state, link}]' \
|| true
printf '%s\n' '== Base branch protection requirements =='
gh api 'repos/ContextualWisdomLab/.github/branches/fix/strix-python-security-cves/protection/required_status_checks' \
--jq '{strict, contexts, checks}' 2>/dev/null || trueLength of output: 77634 🏁 Script executed: #!/bin/bash
set -u
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected" || exit 1
printf '%s\n' '== All current PR checks =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
--jq '.[] | [.state, .name, (.link // "")] | `@tsv`' || true
printf '%s\n' '== Checks not in a terminal passing or skipped state =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
--jq '[.[] | select((.state != "SUCCESS") and (.state != "SKIPPED")) | {name, state, link}]' \
|| true
printf '%s\n' '== Pull request merge state for requested head =='
gh pr view 745 --repo ContextualWisdomLab/.github \
--json headRefOid,mergeStateStatus,reviewDecision,isDraft \
--jq '{headRefOid, mergeStateStatus, reviewDecision, isDraft}' || trueLength of output: 8973
Verified conditions:
I cannot submit APPROVE yet. The exact-head required checks are still queued, several prior runs are cancelled, and GitHub reports ✅ Action performedReview finished.
|
|
@cwl-noema-review Please independently review exact head |
|
@coderabbitai review Please independently review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='745'
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
echo '== Exact-head identity =='
printf 'checked_out='
git rev-parse HEAD
printf 'requested=%s\n' "$expected"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefName,mergeStateStatus,reviewDecision,isDraft,url \
--jq '{headRefOid,baseRefName,mergeStateStatus,reviewDecision,isDraft,url}'
if [ "$(git rev-parse HEAD)" != "$expected" ]; then
echo 'ERROR: checked-out SHA differs from requested SHA' >&2
exit 1
fi
if [ "$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)" != "$expected" ]; then
echo 'ERROR: GitHub PR head differs from requested SHA' >&2
exit 1
fi
echo '== PR changed files against merge base =='
base="$(git merge-base "origin/$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq .baseRefName)" "$expected")"
git diff --name-status "$base" "$expected"
git diff --no-ext-diff --unified=60 "$base" "$expected" -- \
.github/workflows/pr-review-fix-scheduler.yml \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md
echo '== Relevant workflow, contracts, and documentation =='
for path in \
.github/workflows/pr-review-fix-scheduler.yml \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md
do
echo "-- $path --"
git show "$expected:$path"
done
echo '== Scheduler policy boundaries =='
git show "$expected:scripts/ci/pr_review_fix_scheduler.py" |
grep -n -E -C 6 \
'def |MAX_DISPATCHES|RETRY|dispatch|concurrency|merge|autofix|permissions|workflow_repository|workflow_sha|canonical_ref|fail' \
|| true
echo '== actions/checkout references in scope =='
git grep -n -E 'uses:[[:space:]]*actions/checkout@' "$expected" -- \
.github/workflows tests docs scripts || true
echo '== Exact-head check statuses =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
--jq '.[] | {name,state,link}'
echo '== Non-passing check statuses =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
--jq '[.[] | select(.state != "SUCCESS" and .state != "SKIPPED")]'
echo '== Required checks for base branch =='
branch="$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq .baseRefName)"
gh api "repos/$repo/branches/$branch/protection/required_status_checks" \
--jq '{strict,contexts,checks}' 2>/dev/null || \
echo 'Branch protection required-status-check data is unavailable.'Length of output: 3362 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/.github'
pr='745'
expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected" || {
echo 'ERROR: requested SHA is not checked out' >&2
exit 1
}
test "$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)" = "$expected" || {
echo 'ERROR: requested SHA is not the GitHub PR head' >&2
exit 1
}
echo '== PR metadata and files =='
gh pr view "$pr" --repo "$repo" \
--json baseRefName,headRefOid,mergeStateStatus,reviewDecision,files,url \
--jq '{baseRefName,headRefOid,mergeStateStatus,reviewDecision,url,files:[.files[].path]}'
echo '== Complete GitHub PR patch =='
gh pr diff "$pr" --repo "$repo" --patch
echo '== Files at requested commit =='
for path in \
.github/workflows/pr-review-fix-scheduler.yml \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md
do
echo "-- $path --"
git show "$expected:$path" || echo "MISSING: $path"
done
echo '== Scheduler source: policy-relevant implementation =='
git show "$expected:scripts/ci/pr_review_fix_scheduler.py" |
grep -n -E -C 8 \
'^(def |class )|MAX_DISPATCHES|RETRY|dispatch|merge|autofix|workflow_repository|workflow_sha|canonical_ref|permission|fail|exit' \
|| true
echo '== Immutable checkout action references =='
git grep -n -E 'uses:[[:space:]]*actions/checkout@' "$expected" -- .github/workflows || true
echo '== Current checks for requested head =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
--jq '.[] | {name,state,link}'
echo '== Current checks that are not passing or skipped =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
--jq '[.[] | select(.state != "SUCCESS" and .state != "SKIPPED")]'
echo '== Base required-status-check policy =='
branch="$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq .baseRefName)"
gh api "repos/$repo/branches/$branch/protection/required_status_checks" \
--jq '{strict,contexts,checks}' 2>&1 || true
echo '== Check suites tied to the requested commit =='
gh api "repos/$repo/commits/$expected/check-suites" --paginate \
--jq '.check_suites[] | {app:.app.slug,status,conclusion,head_sha}' 2>&1 || trueLength of output: 65716
Verified:
I cannot approve yet. The current exact-head checks include queued jobs, and several earlier jobs are cancelled. GitHub also reports ✅ Action performedReview finished.
|
|
@opencode-agent Please review exact current head @cwl-noema-review Please independently review the same exact head and confirm that caller-controlled inputs, mutable refs, and ordinary caller SHA cannot select privileged scheduler code. |
|
Superseded by #731. Exact scheduler content and both permanent contract-test blobs from head |
|
Superseded by #749, which preserves this exact three-file implementation and retriggers the protected current-head workflow path. Every exact-head security workflow on #745 was cancelled before yielding merge evidence; #749 retains the same immutable source binding, hourly cadence, least privileges, one-dispatch bound, and auto-merge policy. |
Merged into the protected baseline branch
This stacked PR was merged into
fix/strix-python-security-cvesat69fc4d29cdf88c33933aec90d784300b9e162bc2, so its complete scheduler change and documentation are now part of #731 rather than landing independently onmain.#731 owns the final exact-head validation and protected default-branch merge for the hourly cadence, one-hour retry floor, immutable
job.workflow_repository/job.workflow_shacheckout, ignoredcanonical_refcompatibility input, bounded one-dispatch policy, APA 7th documentation, and regression tests. No duplicate default-branch merge is required.