Skip to content

ci: run securely pinned review repair every hour - #745

Merged
seonghobae merged 6 commits into
fix/strix-python-security-cvesfrom
ci/hourly-review-fix-cadence
Aug 4, 2026
Merged

ci: run securely pinned review repair every hour#745
seonghobae merged 6 commits into
fix/strix-python-security-cvesfrom
ci/hourly-review-fix-cadence

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Merged into the protected baseline branch

This stacked PR was merged into fix/strix-python-security-cves at 69fc4d29cdf88c33933aec90d784300b9e162bc2, so its complete scheduler change and documentation are now part of #731 rather than landing independently on main.

#731 owns the final exact-head validation and protected default-branch merge for the hourly cadence, one-hour retry floor, immutable job.workflow_repository / job.workflow_sha checkout, ignored canonical_ref compatibility input, bounded one-dispatch policy, APA 7th documentation, and regression tests. No duplicate default-branch merge is required.

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c1be8a6f-540a-4424-b305-0e6d3dd1444e

📥 Commits

Reviewing files that changed from the base of the PR and between 0b6a188 and 146780f.

📒 Files selected for processing (4)
  • .github/workflows/pr-review-fix-scheduler.yml
  • docs/automation/hourly-review-repair.md
  • tests/test_pr_review_fix_hourly_contract.py
  • tests/test_pr_review_fix_scheduler_source_pin.py

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae enabled auto-merge (squash) August 4, 2026 11:00

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please review exact head 97d7b63e257b9940ffff916dda2849e93fed765b after current-head checks complete. Confirm the hourly cadence changes only scheduling and same-head retry timing, preserves max_dispatches: 1, least privilege, repository-scoped concurrency, fail-closed autofix behavior, and does not weaken merge policy. Approve only if the static contract and all required checks pass.

@seonghobae seonghobae changed the title ci: run bounded review repair every hour ci: run securely pinned review repair every hour Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please review exact current head 5446057ab5971e3e93137ff91f57371ecd811b99 after exact-head checks complete. Confirm the hourly cadence and one-hour retry preserve max_dispatches: 1, least privilege, repository-scoped single-flight concurrency, and fail-closed merge policy. Also verify that reusable-workflow execution now checks out only job.workflow_repository at immutable job.workflow_sha; caller inputs, mutable refs, the ordinary caller github context, and deprecated canonical_ref must not select privileged scheduler code. Approve only when the three-file static contract and all required checks pass.

@seonghobae
seonghobae marked this pull request as draft August 4, 2026 11:18
auto-merge was automatically disabled August 4, 2026 11:18

Pull request was converted to draft

@seonghobae
seonghobae marked this pull request as ready for review August 4, 2026 11:18

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please review exact current head 484fa06495ce1777fbe8ea4cefb81fa914ee29d1 after exact-head checks complete. Confirm the hourly cadence and one-hour retry preserve max_dispatches: 1, least privilege, repository-scoped single-flight concurrency, and fail-closed merge policy. Verify that reusable-workflow execution checks out only job.workflow_repository at immutable job.workflow_sha; caller inputs, mutable refs, the ordinary caller github context, and deprecated canonical_ref cannot select privileged scheduler code. Also verify the four-file scope and the APA 7th documentation of the central MSA trust boundary. Approve only when all required checks pass.

@seonghobae
seonghobae enabled auto-merge (squash) August 4, 2026 11:18

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current head 146780fa895c2faea413f246352cca06cb8a9c6f. Verify the hourly cadence, one-hour same-head retry, immutable called-workflow source binding, ignored compatibility input, one-dispatch/single-flight bounds, least-privilege permissions, and APA 7 documentation. Submit APPROVE only if no blocker remains.

Copy link
Copy Markdown
Contributor Author

@opencode-agent Please review exact head 146780fa895c2faea413f246352cca06cb8a9c6f. Confirm the scheduler cannot select mutable caller-controlled code, cannot exceed one repair dispatch per run, does not gain contents/pull-request write authority, and preserves fail-closed merge policy. Submit APPROVE only if no blocker remains.

@seonghobae
seonghobae changed the base branch from main to fix/strix-python-security-cves August 4, 2026 11:19
@seonghobae
seonghobae merged commit 69fc4d2 into fix/strix-python-security-cves Aug 4, 2026
39 of 70 checks passed
@seonghobae
seonghobae deleted the ci/hourly-review-fix-cadence branch August 4, 2026 11:19
@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected='146780fa895c2faea413f246352cca06cb8a9c6f'

printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
git status --short
if [ "$(git rev-parse HEAD)" != "$expected" ]; then
  echo "ERROR: checked-out commit does not match requested exact head" >&2
  exit 1
fi

printf '%s\n' '== PR metadata and check status =='
gh pr view 745 --repo ContextualWisdomLab/.github \
  --json number,headRefOid,baseRefName,files,statusCheckRollup,url \
  --jq '{number, url, headRefOid, baseRefName, files: [.files[].path], checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}'

printf '%s\n' '== Changed-file scope at exact head =='
git diff --name-status "${expected}^" "$expected"

printf '%s\n' '== Workflow =='
nl -ba .github/workflows/pr-review-fix-scheduler.yml

printf '%s\n' '== Static contracts =='
nl -ba tests/test_pr_review_fix_hourly_contract.py
nl -ba tests/test_pr_review_fix_scheduler_source_pin.py

printf '%s\n' '== Documentation =='
nl -ba docs/automation/hourly-review-repair.md

printf '%s\n' '== Relevant workflow tokens and selectors =='
rg -n -C 3 --fixed-strings \
  -e 'canonical_ref' \
  -e 'workflow_repository' \
  -e 'workflow_sha' \
  -e 'max_dispatches' \
  -e 'retry' \
  -e 'concurrency' \
  -e 'permissions' \
  -e 'contents: write' \
  -e 'pull-requests: write' \
  .github/workflows/pr-review-fix-scheduler.yml tests/test_pr_review_fix_hourly_contract.py tests/test_pr_review_fix_scheduler_source_pin.py docs/automation/hourly-review-repair.md

Length of output: 17374


🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected"

printf '%s\n' '== Complete PR diff against merge base =='
base="$(git merge-base "origin/fix/strix-python-security-cves" "$expected")"
git diff --no-ext-diff --unified=80 "$base" "$expected" -- \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md

for path in \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md
do
  printf '\n== %s ==\n' "$path"
  git show "$expected:$path"
done

printf '%s\n' '== Current check summary for requested head =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
  --jq '.[] | {name, state, link}'

printf '%s\n' '== Check suites for requested commit =='
gh api "repos/ContextualWisdomLab/.github/commits/$expected/check-suites" \
  --paginate \
  --jq '.check_suites[] | {app: .app.slug, status, conclusion, head_sha, url}'

Length of output: 1616


🏁 Script executed:

#!/bin/bash
set -u

expected='146780fa895c2faea413f246352cca06cb8a9c6f'
if [ "$(git rev-parse HEAD)" != "$expected" ]; then
  echo 'ERROR: requested exact head is not checked out' >&2
  exit 1
fi

printf '%s\n' '== PR patch from GitHub =='
gh pr diff 745 --repo ContextualWisdomLab/.github --patch || true

for path in \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md
do
  printf '\n== %s at requested head ==\n' "$path"
  git show "$expected:$path" || true
done

printf '%s\n' '== Current check summary =='
gh pr checks 745 --repo ContextualWisdomLab/.github \
  --json name,state,link \
  --jq '.[] | "\(.state)\t\(.name)\t\(.link)"' || true

printf '%s\n' '== Commit check suites =='
gh api "repos/ContextualWisdomLab/.github/commits/$expected/check-suites" \
  --paginate \
  --jq '.check_suites[] | "\(.app.slug)\t\(.status)\t\(.conclusion // "NONE")\t\(.url)"' || true

Length of output: 35690


🏁 Script executed:

#!/bin/bash
set -u

expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected" || exit 1

printf '%s\n' '== Scheduler implementation outline =='
ast-grep outline scripts/ci/pr_review_fix_scheduler.py --items all --view expanded 2>/dev/null || true

printf '%s\n' '== Scheduler implementation: dispatch, eligibility, and merge-policy boundaries =='
git show "$expected:scripts/ci/pr_review_fix_scheduler.py" 2>/dev/null | \
  grep -n -E -C 8 \
    'def |dispatch|merge|autofix|review|approval|required|check|retry|fail|exit|self-test' \
  || true

printf '%s\n' '== Scheduler-related test locations =='
rg -n -C 3 \
  'pr_review_fix_scheduler|review.fix.scheduler|MAX_DISPATCHES|RETRY_HOURS|autofix' \
  tests .github/workflows 2>/dev/null || true

printf '%s\n' '== Exact-head checks: non-success entries =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
  --jq '[.[] | select(.state != "SUCCESS" && .state != "SKIPPED") | {name, state, link}]' \
  || true

printf '%s\n' '== Base branch protection requirements =='
gh api 'repos/ContextualWisdomLab/.github/branches/fix/strix-python-security-cves/protection/required_status_checks' \
  --jq '{strict, contexts, checks}' 2>/dev/null || true

Length of output: 77634


🏁 Script executed:

#!/bin/bash
set -u

expected='146780fa895c2faea413f246352cca06cb8a9c6f'
test "$(git rev-parse HEAD)" = "$expected" || exit 1

printf '%s\n' '== All current PR checks =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
  --jq '.[] | [.state, .name, (.link // "")] | `@tsv`' || true

printf '%s\n' '== Checks not in a terminal passing or skipped state =='
gh pr checks 745 --repo ContextualWisdomLab/.github --json name,state,link \
  --jq '[.[] | select((.state != "SUCCESS") and (.state != "SKIPPED")) | {name, state, link}]' \
  || true

printf '%s\n' '== Pull request merge state for requested head =='
gh pr view 745 --repo ContextualWisdomLab/.github \
  --json headRefOid,mergeStateStatus,reviewDecision,isDraft \
  --jq '{headRefOid, mergeStateStatus, reviewDecision, isDraft}' || true

Length of output: 8973


@seonghobae Static review of exact head 146780fa895c2faea413f246352cca06cb8a9c6f found no code-level blocker.

Verified conditions:

  • The schedule is 23 * * * *.
  • The default same-head retry interval is one hour.
  • max_dispatches remains 1.
  • Repository-scoped concurrency and cancel-in-progress: true remain in place.
  • The privileged checkout uses only job.workflow_repository and immutable job.workflow_sha.
  • canonical_ref remains declared for compatibility and is not consumed.
  • The workflow does not grant contents: write or pull-requests: write.
  • The scheduler remains fail-closed. It dispatches bounded autofix work and does not merge PRs or relax merge requirements.
  • The static contracts cover the requested workflow invariants.
  • The documentation defines the MSA boundary and includes GitHub Docs references in APA 7th style.
  • The PR scope contains exactly the four expected files.

I cannot submit APPROVE yet. The exact-head required checks are still queued, several prior runs are cancelled, and GitHub reports mergeStateStatus: UNKNOWN. Approval requires successful completion of the current-head required checks.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review Please independently review exact head 146780fa895c2faea413f246352cca06cb8a9c6f after current-head checks complete. Verify immutable called-workflow source binding, hourly cadence, one-hour retry, single-dispatch/single-flight bounds, least privilege, and APA 7 documentation. Submit APPROVE only if no blocker remains.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please independently review exact head 146780fa895c2faea413f246352cca06cb8a9c6f. The scheduler is hourly, retry-bounded, single-flight, least-privilege, pinned to the immutable called-workflow source, and now uses the current actions/checkout v7.0.1 commit.

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='745'
expected='146780fa895c2faea413f246352cca06cb8a9c6f'

echo '== Exact-head identity =='
printf 'checked_out='
git rev-parse HEAD
printf 'requested=%s\n' "$expected"
gh pr view "$pr" --repo "$repo" \
  --json headRefOid,baseRefName,mergeStateStatus,reviewDecision,isDraft,url \
  --jq '{headRefOid,baseRefName,mergeStateStatus,reviewDecision,isDraft,url}'

if [ "$(git rev-parse HEAD)" != "$expected" ]; then
  echo 'ERROR: checked-out SHA differs from requested SHA' >&2
  exit 1
fi
if [ "$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)" != "$expected" ]; then
  echo 'ERROR: GitHub PR head differs from requested SHA' >&2
  exit 1
fi

echo '== PR changed files against merge base =='
base="$(git merge-base "origin/$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq .baseRefName)" "$expected")"
git diff --name-status "$base" "$expected"
git diff --no-ext-diff --unified=60 "$base" "$expected" -- \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md

echo '== Relevant workflow, contracts, and documentation =='
for path in \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md
do
  echo "-- $path --"
  git show "$expected:$path"
done

echo '== Scheduler policy boundaries =='
git show "$expected:scripts/ci/pr_review_fix_scheduler.py" |
  grep -n -E -C 6 \
    'def |MAX_DISPATCHES|RETRY|dispatch|concurrency|merge|autofix|permissions|workflow_repository|workflow_sha|canonical_ref|fail' \
  || true

echo '== actions/checkout references in scope =='
git grep -n -E 'uses:[[:space:]]*actions/checkout@' "$expected" -- \
  .github/workflows tests docs scripts || true

echo '== Exact-head check statuses =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
  --jq '.[] | {name,state,link}'

echo '== Non-passing check statuses =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
  --jq '[.[] | select(.state != "SUCCESS" and .state != "SKIPPED")]'

echo '== Required checks for base branch =='
branch="$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq .baseRefName)"
gh api "repos/$repo/branches/$branch/protection/required_status_checks" \
  --jq '{strict,contexts,checks}' 2>/dev/null || \
  echo 'Branch protection required-status-check data is unavailable.'

Length of output: 3362


🏁 Script executed:

#!/bin/bash
set -u

repo='ContextualWisdomLab/.github'
pr='745'
expected='146780fa895c2faea413f246352cca06cb8a9c6f'

test "$(git rev-parse HEAD)" = "$expected" || {
  echo 'ERROR: requested SHA is not checked out' >&2
  exit 1
}
test "$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)" = "$expected" || {
  echo 'ERROR: requested SHA is not the GitHub PR head' >&2
  exit 1
}

echo '== PR metadata and files =='
gh pr view "$pr" --repo "$repo" \
  --json baseRefName,headRefOid,mergeStateStatus,reviewDecision,files,url \
  --jq '{baseRefName,headRefOid,mergeStateStatus,reviewDecision,url,files:[.files[].path]}'

echo '== Complete GitHub PR patch =='
gh pr diff "$pr" --repo "$repo" --patch

echo '== Files at requested commit =='
for path in \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md
do
  echo "-- $path --"
  git show "$expected:$path" || echo "MISSING: $path"
done

echo '== Scheduler source: policy-relevant implementation =='
git show "$expected:scripts/ci/pr_review_fix_scheduler.py" |
  grep -n -E -C 8 \
    '^(def |class )|MAX_DISPATCHES|RETRY|dispatch|merge|autofix|workflow_repository|workflow_sha|canonical_ref|permission|fail|exit' \
  || true

echo '== Immutable checkout action references =='
git grep -n -E 'uses:[[:space:]]*actions/checkout@' "$expected" -- .github/workflows || true

echo '== Current checks for requested head =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
  --jq '.[] | {name,state,link}'

echo '== Current checks that are not passing or skipped =='
gh pr checks "$pr" --repo "$repo" --json name,state,link \
  --jq '[.[] | select(.state != "SUCCESS" and .state != "SKIPPED")]'

echo '== Base required-status-check policy =='
branch="$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq .baseRefName)"
gh api "repos/$repo/branches/$branch/protection/required_status_checks" \
  --jq '{strict,contexts,checks}' 2>&1 || true

echo '== Check suites tied to the requested commit =='
gh api "repos/$repo/commits/$expected/check-suites" --paginate \
  --jq '.check_suites[] | {app:.app.slug,status,conclusion,head_sha}' 2>&1 || true

Length of output: 65716


@seonghobae Static review of exact head 146780fa895c2faea413f246352cca06cb8a9c6f found no code-level blocker.

Verified:

  • The scheduler runs hourly at 23 * * * *.
  • The default same-head retry interval is one hour.
  • max_dispatches remains 1.
  • Repository-scoped concurrency and cancel-in-progress: true remain enabled.
  • The checkout uses immutable actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1).
  • The privileged checkout selects only ${{ job.workflow_repository }} at ${{ job.workflow_sha }}.
  • canonical_ref is accepted as a deprecated compatibility input and is not consumed.
  • The workflow does not grant contents: write or pull-requests: write.
  • The scheduler dispatches at most one autofix job. It does not merge PRs or weaken merge policy.
  • The static tests cover the changed workflow contract.
  • The documentation defines the trust boundary and includes APA 7th-style references.

I cannot approve yet. The current exact-head checks include queued jobs, and several earlier jobs are cancelled. GitHub also reports mergeStateStatus: UNKNOWN. The required-check configuration could not be read because the branch-protection API returned HTTP 403.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@opencode-agent Please review exact current head 5446057ab5971e3e93137ff91f57371ecd811b99 after current-head checks complete. Verify the hourly minute-23 cadence, one-hour same-head retry floor, one-dispatch bound, repository-scoped single flight, least-privilege permissions, and immutable job.workflow_repository/job.workflow_sha source binding. Approve only if no blocking finding remains.

@cwl-noema-review Please independently review the same exact head and confirm that caller-controlled inputs, mutable refs, and ordinary caller SHA cannot select privileged scheduler code.

Copy link
Copy Markdown
Contributor Author

Superseded by #731. Exact scheduler content and both permanent contract-test blobs from head 146780fa895c2faea413f246352cca06cb8a9c6f are now integrated into #731 head 4aefeb1cb3dd1a070204eab2b90bd29c52e433df; #731 additionally carries the operator documentation and APA 7th doctoring record required for the atomic central baseline. Closing this duplicate to avoid parallel checks and conflicting merge order.

Copy link
Copy Markdown
Contributor Author

Superseded by #749, which preserves this exact three-file implementation and retriggers the protected current-head workflow path. Every exact-head security workflow on #745 was cancelled before yielding merge evidence; #749 retains the same immutable source binding, hourly cadence, least privileges, one-dispatch bound, and auto-merge policy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant