release: attest exact sealed SBOM evidence - #797
Conversation
|
@opencode-agent Implement the bounded GREEN slice for exact current RED head The permanent exact-head RED workflow is valid:
Implement the organization-owned exact-artifact SBOM attestation boundary without changing reviewer identities, model credentials, existing review workflows, protected refs, release jobs, or package publication. Allowed permanent paths
Do not add temporary, one-shot, self-modifying, branch-writing, repair, generated-patch, encoded-payload, or model-executing workflows. Reusable workflow contractCreate Keep the workflow-level token read-only. Scope the credentialed attestation job to the reviewed minimum: permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: writeDo not grant package, release, pull-request, issue, ref, workflow, security-event, or repository-content write authority. Do not use Checkout the trusted verifier only from the immutable called-workflow identity: repository: ${{ job.workflow_repository }}
ref: ${{ job.workflow_sha }}
persist-credentials: falseUse a separate trusted-control-plane path. Never checkout the caller repository, caller source SHA, a mutable central branch/tag, or downloaded evidence as executable source. Download only the explicitly named same-run sealed evidence artifact into a separate untrusted-data path with an immutable official action pin. Verify the caller-supplied artifact digest against trusted GitHub artifact metadata or a cryptographically equivalent fail-closed receipt; GitHub's warning-only digest behavior must not be treated as success. If the platform does not expose a trustworthy exact digest without broadening privileges, fail closed and document the required caller receipt rather than silently weakening the contract. Trusted verifierImplement Before any attestation, require:
The verifier must expose a narrow documented CLI and be independently testable without OIDC or GitHub APIs. Signing and verificationUse immutable Capture each action's
Use GitHub CLI attestation verification only as a verifier; it must not publish, create releases, move refs, or mutate repository contents. Offline evidenceCreate a deterministic offline-verification directory containing at least:
Upload this evidence with an immutable official action pin and finite retention. Keep wheel and sdist as the only package-manager publication inputs; SBOMs and bundles are evidence, not packages. Quality gatesExtend
Do not weaken existing central full-test coverage or security gates to make this slice pass. DocumentationWrite
Update |
|
Warning Review limit reached
Next review available in: 5 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthrough정확한 6개 파일 증거를 검증하는 Python 도구와 재사용 가능한 GitHub Actions 워크플로를 추가했습니다. 워크플로는 wheel과 sdist에 CycloneDX SBOM 증명을 생성하고 온라인·오프라인 검증 산출물을 보존합니다. 계약 테스트와 품질 게이트도 추가했습니다. Changes정확한 아티팩트 SBOM 증명
Estimated code review effort: 5 (Critical) | ~90 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant ExactArtifactWorkflow
participant EvidenceVerifier
participant AttestationService
participant OfflineEvidence
Caller->>ExactArtifactWorkflow: evidence 메타데이터 제공
ExactArtifactWorkflow->>EvidenceVerifier: 동일 실행 artifact 다운로드 및 검증
EvidenceVerifier-->>ExactArtifactWorkflow: 검증 manifest 반환
ExactArtifactWorkflow->>AttestationService: wheel·sdist와 SBOM 증명 요청
AttestationService-->>ExactArtifactWorkflow: attestation bundle과 trusted root 반환
ExactArtifactWorkflow->>OfflineEvidence: 온라인·오프라인 검증 자료 업로드
Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent The exact current RED head advanced to The refinement closes the artifact-archive identity gap without granting extra authority to the OIDC signer:
No production, workflow, permission, or documentation implementation was added in this commit. Preserve the earlier immutable RED run and reproduce a new exact-current-head RED result before GREEN implementation. All other requirements in comment |
|
@opencode-agent Fix only the two exact-current-head test-contract failures on Root causes are confirmed from Exact Artifact SBOM Attestation Quality run
Modify only:
Run the focused contracts, complete verifier statement/branch coverage at 100%, public docstrings, Python 3.10 compilation, complete central test suite, and all current security checks. Do not modify production verifier code, reusable or quality workflows, doctoring, CHANGELOG, dependencies, credentials, permissions, refs, signing/attestation behavior, release/publication behavior, or any other path. Keep the PR draft and unmerged; report the new exact head and verification evidence. |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='42ebb82c1cba57adea4657c6f4941af8c812091b'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
repo='ContextualWisdomLab/.github'
echo '== Exact revision and scope =='
printf 'HEAD: '; git rev-parse HEAD
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
git diff --name-status "${base}..${head}"
git diff --check "${base}..${head}"
echo '== Candidate outlines =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_exact_artifact_sbom_attestation_contract.py --items all
ast-grep outline tests/test_exact_artifact_sbom_review_regressions.py --items all
echo '== Reusable workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
echo '== Quality workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
echo '== Verifier =='
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Focused tests =='
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_attestation_contract.py
cat -n tests/test_exact_artifact_sbom_review_regressions.py
echo '== Documentation and CHANGELOG diff =='
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
git diff --unified=40 "${base}..${head}" -- CHANGELOG.md
echo '== Targeted static checks =='
python3 - <<'PY'
from pathlib import Path
import re
workflow = Path(".github/workflows/exact-artifact-sbom-attestation.yml").read_text(encoding="utf-8")
print("workflow_call_only:", bool(re.search(r"^on:\n\s+workflow_call:", workflow, re.M)))
print("attest_pin_count:", workflow.count("actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26"))
print("trusted_repo_binding:", "repository: ${{ job.workflow_repository }}" in workflow)
print("trusted_sha_binding:", "ref: ${{ job.workflow_sha }}" in workflow)
print("shell_input_interpolation:", "${{ inputs." in "\n".join(
m.group(0) for m in re.finditer(r"run: \|\n(?: {10,}.*\n)*", workflow)
))
for permission in ("actions: read", "contents: read", "id-token: write", "attestations: write", "artifact-metadata: write"):
print(f"{permission}: {workflow.count(permission)}")
PY
rg -n -C3 '\$\{\{\s*inputs\.' .github/workflows/exact-artifact-sbom-attestation.yml || true
rg -n -C4 '(CANONICAL|PREDICATE|https://cyclonedx\.org/bom|parse_constant|lstat|symlink|serialNumber|uuid|SHA256SUMS|trusted_root|custom-trusted-root|gh attestation verify|SLSA)' \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py \
.github/workflows/exact-artifact-sbom-attestation.yml \
docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Prohibited writer and execution patterns =='
rg -n -i -C2 \
'(git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write|secrets:\s*inherit|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|tarfile|zipfile|unpack_archive)' \
.github/workflows scripts/ci/verify_exact_artifact_sbom_handoff.py || true
fd -a -t f . .github/workflows | sort
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|encoded|patch|branch)' || true
echo '== Exact-head PR checks and inline comments =='
gh pr view 797 --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // ""), .details_url] | `@tsv`'
gh api "repos/${repo}/pulls/797/comments?per_page=100" \
--jq '[.[] | select(.position != null) | {path, line, user: .user.login, body}]'Length of output: 203114
Verdict: no blocking source-level findings. I verified these controls:
GitHub currently reports I did not modify files, refs, pull request state, review state, release state, or merge state. You are interacting with an AI system. |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='42ebb82c1cba57adea4657c6f4941af8c812091b'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
repo='ContextualWisdomLab/.github'
echo '== Exact revision and changed scope =='
printf 'checked-out HEAD: '; git rev-parse HEAD
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
git diff --name-status "${base}..${head}"
git diff --stat "${base}..${head}"
git diff --check "${base}..${head}"
echo '== Required path availability =='
for path in \
.github/workflows/exact-artifact-sbom-attestation.yml \
.github/workflows/exact-artifact-sbom-attestation-quality.yml \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_review_regressions.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
CHANGELOG.md
do
test -f "$path"
printf '%s\n' "$path"
done
echo '== Structure maps =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_exact_artifact_sbom_attestation_contract.py --items all
ast-grep outline tests/test_exact_artifact_sbom_review_regressions.py --items all
echo '== Reusable workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
echo '== Quality workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
echo '== Verifier =='
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Focused tests =='
cat -n tests/test_verify_exact_artifact_sbom_attestation_contract.py
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_review_regressions.py
echo '== Doctoring and changelog =='
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
git diff --unified=45 "${base}..${head}" -- CHANGELOG.md
echo '== Trust-boundary searches =='
rg -n -C3 '\$\{\{\s*inputs\.' .github/workflows/exact-artifact-sbom-attestation.yml || true
rg -n -C4 \
'(CANONICAL|PREDICATE|https://cyclonedx\.org/bom|parse_constant|NaN|Infinity|lstat|symlink|serialNumber|uuid|SHA256SUMS|trusted_root|custom-trusted-root|gh attestation verify|SLSA)' \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_review_regressions.py \
.github/workflows/exact-artifact-sbom-attestation.yml \
docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Authority, execution, and temporary workflow checks =='
rg -n -i -C2 \
'(git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write|secrets:\s*inherit|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|tarfile|zipfile|unpack_archive)' \
.github/workflows scripts/ci/verify_exact_artifact_sbom_handoff.py || true
fd -a -t f . .github/workflows | sort
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|encoded|patch|branch)' || true
echo '== Exact-head GitHub evidence =='
gh pr view 797 --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // ""), .details_url] | `@tsv`'
gh api "repos/${repo}/pulls/797/comments?per_page=100" \
--jq '[.[] | select(.position != null) | {path, line, user: .user.login, body}]'Length of output: 54696 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='42ebb82c1cba57adea4657c6f4941af8c812091b'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
repo='ContextualWisdomLab/.github'
echo '== Exact revision and changed scope =='
printf 'checked-out HEAD: '; git rev-parse HEAD
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
git diff --name-status "${base}..${head}"
git diff --stat "${base}..${head}"
git diff --check "${base}..${head}"
echo '== Required path availability =='
for path in \
.github/workflows/exact-artifact-sbom-attestation.yml \
.github/workflows/exact-artifact-sbom-attestation-quality.yml \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_review_regressions.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
CHANGELOG.md
do
test -f "$path"
printf '%s\n' "$path"
done
echo '== Structure maps =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_exact_artifact_sbom_attestation_contract.py --items all
ast-grep outline tests/test_exact_artifact_sbom_review_regressions.py --items all
echo '== Reusable workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
echo '== Quality workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
echo '== Verifier =='
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Focused tests =='
cat -n tests/test_exact_artifact_sbom_attestation_contract.py
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_review_regressions.py
echo '== Doctoring and changelog =='
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
git diff --unified=45 "${base}..${head}" -- CHANGELOG.md
echo '== Trust-boundary searches =='
rg -n -C3 '\$\{\{\s*inputs\.' .github/workflows/exact-artifact-sbom-attestation.yml || true
rg -n -C4 \
'(CANONICAL|PREDICATE|https://cyclonedx\.org/bom|parse_constant|NaN|Infinity|lstat|symlink|serialNumber|uuid|SHA256SUMS|trusted_root|custom-trusted-root|gh attestation verify|SLSA)' \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_review_regressions.py \
.github/workflows/exact-artifact-sbom-attestation.yml \
docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Authority, execution, and temporary workflow checks =='
rg -n -i -C2 \
'(git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write|secrets:\s*inherit|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|tarfile|zipfile|unpack_archive)' \
.github/workflows scripts/ci/verify_exact_artifact_sbom_handoff.py || true
fd -a -t f . .github/workflows | sort
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|encoded|patch|branch)' || true
echo '== Exact-head GitHub evidence =='
gh pr view 797 --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // ""), .details_url] | `@tsv`'
gh api "repos/${repo}/pulls/797/comments?per_page=100" \
--jq '[.[] | select(.position != null) | {path, line, user: .user.login, body}]'Length of output: 202854
Verdict: no blocking source-level findings. I verified these controls:
GitHub reports I did not modify files, refs, pull request settings, review state, merge state, release state, or reviewer credentials. You are interacting with an AI system. |
|
/oc review Review exact current head |
|
/oc Review exact current head |
|
@opencode-agent @cwl-noema-review Independently review exact current head |
|
@opencode-agent review Final read-only exact-head review for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='42ebb82c1cba57adea4657c6f4941af8c812091b'
base='e71fdab2ab088001f218765ecb5e3b7fabfee11a'
repo='ContextualWisdomLab/.github'
echo '== Revision and permanent scope =='
git rev-parse HEAD
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
git diff --name-status "${base}..${head}"
git diff --check "${base}..${head}"
echo '== Structure maps =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_exact_artifact_sbom_attestation_contract.py --items all
ast-grep outline tests/test_exact_artifact_sbom_review_regressions.py --items all
echo '== Reusable workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
echo '== Quality workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
echo '== Verifier =='
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Focused tests =='
cat -n tests/test_exact_artifact_sbom_attestation_contract.py
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_review_regressions.py
echo '== Documentation and changelog =='
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
git diff --unified=45 "${base}..${head}" -- CHANGELOG.md
echo '== Targeted trust-boundary checks =='
rg -n -C3 '\$\{\{\s*inputs\.' .github/workflows/exact-artifact-sbom-attestation.yml || true
rg -n -C4 \
'(CANONICAL|PREDICATE|https://cyclonedx\.org/bom|parse_constant|NaN|Infinity|lstat|symlink|serialNumber|uuid|SHA256SUMS|trusted_root|custom-trusted-root|gh attestation verify|SLSA)' \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_review_regressions.py \
.github/workflows/exact-artifact-sbom-attestation.yml \
docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Authority, execution, and temporary-workflow checks =='
rg -n -i -C2 \
'(git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write|secrets:\s*inherit|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|tarfile|zipfile|unpack_archive)' \
.github/workflows scripts/ci/verify_exact_artifact_sbom_handoff.py || true
fd -a -t f . .github/workflows | sort
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|encoded|patch|branch)' || true
echo '== Exact-head PR metadata, checks, and unresolved review threads =='
gh pr view 797 --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // ""), .details_url] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=797 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest'Length of output: 202666
Verdict: no blocking source-level findings. I verified the requested controls:
GitHub reports I did not modify files, refs, pull request state, reviewer state, release state, or merge state.
|
|
@opencode-agent review Re-read the exact current head and submit a formal review-only verdict for immutable trusted-verifier source binding, sealed evidence cardinality/digest closure, inert artifact handling, separated least-privilege signer authority, exact CycloneDX subject binding, online/offline attestation evidence, 100% coverage/docstrings, and all current-head security/supply-chain checks. Do not attest real release artifacts, mutate, or merge. |
|
@coderabbitai full review Perform a fresh exact-current-head review of trusted-verifier source binding, sealed evidence closure, and signer least privilege. Submit the verdict without mutating or merging. |
|
|
|
Submit a formal current-head GitHub review after the current checks settle. Approve only if all exact-head checks succeed and no actionable finding remains; otherwise post the concrete blocker. Do not mutate or merge. |
|
Please submit the formal current-head review conclusion after the latest exact-head checks complete. Do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='797'
echo '== Pull request state =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
head=$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')
echo "== Current head: ${head} =="
echo '== Check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "in_progress"), .details_url] | `@tsv`'
echo '== Review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) {
nodes { author { login } body }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest'Length of output: 34249
Verdict: no blocking source-level findings. I verified the current head The current exact-head quality checks succeeded:
The current security and supply-chain checks succeeded, including CodeQL, Semgrep, gitleaks, OSV, dependency review, Trivy, Scorecard, SBOM generation, and Strix. Completed All returned review threads are resolved. The reviewed implementation has no remaining actionable finding for immutable verifier binding, inert six-file evidence verification, CycloneDX subject closure, signer least privilege, caller-input shell isolation, or online and offline attestation evidence. GitHub still reports I did not modify files, refs, PR settings, review state, merge state, or release state. You are interacting with an AI system. |
|
@opencode-agent review Use the newest exact head only. If every required check is green and there is no actionable finding, submit formal approval; otherwise state the blocker. Do not mutate or merge. |
|
@cwl-noema-review review Use exact-current-head evidence only. Approve formally only when required checks are green and no actionable finding remains; otherwise identify the blocker. Do not mutate or merge. |
|
@opencode-agent review Do not post another top-level acknowledgement. Submit the formal exact-head review verdict through the GitHub review API when current-head checks are complete; approve only if no blocker remains. Do not mutate or merge. |
|
@coderabbitai full review Use the exact current head only and submit the review verdict through the formal GitHub review surface; do not post another summary comment, mutate, or merge. |
Rate Limit Exceeded
|
|
@cwl-noema-review Please use the GitHub review API rather than another comment for the final exact-head verdict. Do not mutate or merge. |
|
Final action expected: use the GitHub review API for the exact current head. Approve only if current required checks are successful and no actionable finding remains; otherwise post one concrete blocking review. Do not mutate or merge. |
|
@cwl-noema-review Submit one formal exact-current-head review through GitHub's review API. Do not add another discussion comment, mutate, or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
@cwl-noema-review Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='797'
echo '== Pull request =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf '== Exact head ==\n%s\n' "$head"
echo '== Check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "in_progress"), .details_url] | `@tsv`'
echo '== Review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
reviews(last: 100) {
nodes {
author { login }
state
commit { oid }
submittedAt
}
}
}
}
}' \
--jq '.data.repository.pullRequest'Length of output: 34543
PR GitHub reports A CodeRabbit approval also requires the explicit top-level command You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai No further discussion comments are needed. Complete the formal exact-current-head review through the review API only; do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='797'
echo '== Pull request state =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf '== Exact current head ==\n%s\n' "$head"
echo '== Check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "in_progress"), .details_url] | `@tsv`'
echo '== Review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) {
nodes { author { login } body }
}
}
}
}
}
}' \
--jq '.data.repository.pullRequest'Length of output: 34267
PR The required quality, security, and supply-chain checks succeeded. The returned review threads are resolved. GitHub reports I did not modify the branch, pull request, or merge state. You are interacting with an AI system. |
1 participant
Purpose
Add an organization-owned reusable SBOM attestation boundary for exact sealed wheel and source-distribution evidence, required by #783 and
ContextualWisdomLab/EgressWeave#46.Exact current stack
42ebb82c1cba57adea4657c6f4941af8c812091b;e71fdab2ab088001f218765ecb5e3b7fabfee11a;Trust boundary
workflow_callwith explicit required source, artifact, digest, filename, schema, and predicate inputs.${{ job.workflow_repository }}and${{ job.workflow_sha }}rather than caller-controlled source.contents: read,id-token: write,attestations: write, andartifact-metadata: write.actions/attestaction exactly once for the wheel and once for the sdist.run:block interpolates${{ inputs.* }}.SHA256SUMS, and beginner-readable offline verification instructions.Exact-head evidence
For
42ebb82c1cba57adea4657c6f4941af8c812091b, all exact-head workflows completed successfully:31157759273;31157759227;31157759232;31157759247;31157759228;31157759289;31157759617;31157759246;31157759231;The exact quality suite on pinned Ubuntu 24.04 and Python 3.14.6 proves:
226/226;82/82;All inline review threads are resolved or outdated; zero actionable unresolved thread remains. Current source also includes the no-shell-interpolation regression, non-finite JSON rejection, exact CycloneDX subject binding, deterministic offline checksums, and scoped size-limit tests.
Formal exact-current-head OpenCode/Noema review and a qualifying independent non-author approval remain required. Queued, cancelled, predecessor-head, status-only, author-only, local-only, or synthetic evidence is not accepted.
Merge gate
Merge only after every required exact-current-head quality, security, supply-chain, automated-review, independent-approval, unresolved-thread, and branch-protection gate succeeds without bypass. Progresses #783.