fix(scheduler): fall back on GitHub UTF-8 API errors - #934
Open
seonghobae wants to merge 1 commit into
Open
Conversation
|
Warning Review limit reached
Next review available in: 53 minutes Limit details: You’ve used all 1 included review currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthrough
Changes일시적 API 오류 처리
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
enabled auto-merge (squash)
August 11, 2026 11:58
Contributor
Author
|
@opencode-agent review Evaluate exact current head |
Contributor
Author
|
@opencode-agent @cwl-noema-review Formal review-only request for exact current head |
Contributor
Author
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='d5c3962926241768950bbd2929b3889b535d9b27'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Expected commit object =='
git cat-file -t "$expected_head"
printf '%s\n' '== Parent and diff summary =='
git show --no-ext-diff --format='%H%n%P%n%s' --stat "$expected_head"
printf '%s\n' '== Exact patch =='
git show --no-ext-diff --format= --find-renames "$expected_head"
printf '%s\n' '== Relevant source outline =='
ast-grep outline scripts/ci/pr_review_merge_scheduler.py --items all --match 'TRANSIENT_GITHUB_API_ERRORS|graphql|GraphQL|fallback|Fallback' || true
printf '%s\n' '== Relevant source references =='
rg -n -C 6 -e 'TRANSIENT_GITHUB_API_ERRORS' -e 'invalid UTF-8 string' -e 'GraphQL' -e 'graphql' -e 'fallback' scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '== Relevant test outline =='
ast-grep outline tests/test_pr_review_merge_scheduler.py --items all --match 'fallback|Fallback|transient|Transient|GraphQL|graphql' || true
printf '%s\n' '== Relevant test references =='
rg -n -C 8 -e 'invalid UTF-8 string' -e 'TRANSIENT_GITHUB_API_ERRORS' -e 'fallback' -e 'GraphQL' -e 'graphql' tests/test_pr_review_merge_scheduler.pyLength of output: 41889
Verdict: no blocking findings.
Non-transient errors remain fail-closed. The existing schema-error test confirms that a GraphQL schema error raises instead of using REST. The change does not classify authentication, authorization, integrity, or branch-policy errors as transient. The scheduler authority is unchanged. The REST path continues to use the existing PR evidence conversion and downstream approval, exact-head, check, and mergeability gates. The updated test covers classification and REST fallback for the observed error. Existing tests still cover HTTP 502, HTTP 504, HTTP/2 stream cancellation, truncated JSON, and non-transient GraphQL errors. 🧠 Learnings used
|
Contributor
Author
|
@opencode-agent review Review exact head |
Contributor
Author
|
Exact-current-head review request for The bounded two-file repair classifies GitHub's Review this unchanged head read-only. Do not update the branch, synthesize author approval, merge, release, or weaken protection. @coderabbitai review |
seonghobae
commented
Aug 12, 2026
seonghobae
left a comment
seonghobae
left a comment
Contributor
Author
There was a problem hiding this comment.
Exact-current-head read-only review request for d5c3962926241768950bbd2929b3889b535d9b27 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The two-file diff is bounded to the diagnosed boundary: classify GitHub's invalid UTF-8 string GraphQL failure under the existing transient-error family so the established REST fallback executes, with a focused regression proving both open-queue and single-PR fallback. The classifier compares both literal and case-folded markers, so the added marker is effective. Eight directly observed exact-head hosted workflows are terminal-success and no formal current-head review exists.
Review this exact head without updating the branch, weakening fail-closed API behavior, synthesizing author approval, or bypassing protection.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='d5c3962926241768950bbd2929b3889b535d9b27'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Checked-out and requested commits =='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
printf '%s\n' '== Commit relationship =='
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor-of-head=true'
git rev-list --left-right --count "$base...$head"
printf '%s\n' '== Exact changed files and patch =='
git diff --no-ext-diff --name-status "$base" "$head"
git diff --no-ext-diff --find-renames "$base" "$head" -- \
scripts/ci/pr_review_merge_scheduler.py \
tests/test_pr_review_merge_scheduler.py
printf '%s\n' '== Scheduler structure =='
ast-grep outline scripts/ci/pr_review_merge_scheduler.py --items all \
--match 'TRANSIENT_GITHUB_API_ERRORS|gh_graphql|fetch_open_prs|fetch_pr' || true
printf '%s\n' '== Scheduler fallback and error handling contexts =='
rg -n -C 10 \
-e 'TRANSIENT_GITHUB_API_ERRORS' \
-e 'invalid UTF-8 string' \
-e 'def gh_graphql\b' \
-e 'def fetch_open_prs\b' \
-e 'def fetch_pr\b' \
-e 'fallback' \
scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '== Focused test contexts =='
ast-grep outline tests/test_pr_review_merge_scheduler.py --items all \
--match 'fallback|transient|GraphQL|graphql' || true
rg -n -C 10 \
-e 'invalid UTF-8 string' \
-e 'TRANSIENT_GITHUB_API_ERRORS' \
-e 'fallback' \
-e 'schema error' \
-e 'HTTP 50[24]' \
tests/test_pr_review_merge_scheduler.pyLength of output: 25569
Verdict: no blocking findings. The head is one commit ahead and zero commits behind the specified base. The exact diff changes only the two stated files. The production change adds only The fallback condition remains limited to resource-inaccessible and transient errors. The existing schema-error test confirms that non-transient GraphQL errors still raise. The patch does not classify authentication, authorization, integrity, or branch-policy failures as transient. The regression verifies classification of the observed error and REST fallback for both queue and single-PR reads. Existing coverage remains for HTTP 502, HTTP 504, HTTP/2 stream errors, truncated JSON, and non-transient errors. The patch does not change scheduler authority or merge gates. Current-head approval, check validation, mergeability checks, and protected branch behavior remain unchanged. 🧠 Learnings usedYou are interacting with an AI system. |
Contributor
Author
|
@opencode-agent review Review exact current head |
Rate Limit Exceeded
|
Contributor
Author
|
Reviewed. CHANGELOG + APA 7th doctoring (RFC 3629). Reality test uses the exact gh CLI UTF-8 error and asserts REST fallback. Local suite 977 passed x2. Auto-merge armed. |
seonghobae
enabled auto-merge (squash)
August 13, 2026 03:31
Contributor
Author
|
@opencode-agent review Review exact current head only. Classifies GitHub GraphQL |
This was referenced Aug 13, 2026
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
f12ef2ea926e15ea2a32aa65f3b291f1b77d0bf8. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31664541161/job/94336172079)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31664541161/job/94336172079)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: scheduler-utf8-graphql-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: scheduler-utf8-graphql-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: pr_review_merge_scheduler.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: pr_review_merge_scheduler.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.
Failed checks
Findings1. HIGH .github/workflows/strix.yml:525 - Strix unsupported-model errors must name the allowed providers
2. HIGH .github/workflows/strix.yml:810 - Strix provider signal left current-head security evidence incomplete
Failed check evidence for line-specific fixesFailed GitHub Check Evidence
Line-specific repair contract
Failed check: Strix Security Scan/strix
Failed job steps
Check annotations
Failed log signal summaryStrix model attempt and finding summaryStrix vulnerability report window 1 (log lines 2032-2234)Failed log excerptFailed check: Close Empty PR/close-empty
Check annotations
Failed check: CodeQL PR/Detect CodeQL languages
Check annotations
Failed check: OSV-Scanner PR/osv-scan / osv-scan
Check annotations
Failed check: Python Security/Detect Python
Check annotations
Failed check: SAST Semgrep/Semgrep (multi-language SAST)
Check annotations
Failed check: SBOM Generation/generate-sbom
Check annotations
Failed check: Scorecard PR/Scorecard
Check annotations
Failed check: Secret Scan/gitleaks (secret scan)
Check annotations
Failed check: Security Scan/osv-scan
Check annotations
Failed check: Strix Security Scan/strix
Check annotations
Failed check: Python Security/Bandit (Python SAST)
Failed check: Security Scan/dependency-review
Check annotations
Failed check: Strix Security Scan/publish-manual-pr-evidence-status
Failed check: Python Security/pip-audit (Python dependency audit)
Failed check: Security Scan/trivy-fs
Check annotations
Failed check: Security Scan/scorecard
Check annotations
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: scheduler-utf8-graphql-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: scheduler-utf8-graphql-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: pr_review_merge_scheduler.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: pr_review_merge_scheduler.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
seonghobae
enabled auto-merge (squash)
August 13, 2026 15:38
seonghobae
marked this pull request as draft
August 14, 2026 09:01
auto-merge was automatically disabled
August 14, 2026 09:01
Pull request was converted to draft
Contributor
Author
|
Returned to Draft because the exact current tree mixes the scheduler UTF-8 GraphQL fallback with an unrelated trusted-uv materializer branch. The valid runtime slice is narrow: classify the observed GitHub Rebuild from protected |
seonghobae
marked this pull request as ready for review
August 14, 2026 13:49
Contributor
Author
|
@coderabbitai review Review only exact current head |
seonghobae
enabled auto-merge (squash)
August 14, 2026 13:49
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='780d857f8c002f7f0b48236272ea822413f39b4b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Commit identity and ancestry =='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
git rev-list --left-right --count "$base...$head"
printf '%s\n' '== Changed paths =='
git diff --no-ext-diff --name-status "$base" "$head"
printf '%s\n' '== Exact patch for scheduler and its tests =='
git diff --no-ext-diff --find-renames "$base" "$head" -- \
scripts/ci/pr_review_merge_scheduler.py \
tests/test_pr_review_merge_scheduler.py
printf '%s\n' '== Scheduler symbol map =='
ast-grep outline scripts/ci/pr_review_merge_scheduler.py --items all \
--match 'TRANSIENT_GITHUB_API_ERRORS|gh_graphql|fetch_open_prs|fetch_pr|gh_rest' || true
printf '%s\n' '== Scheduler error and fallback contexts =='
rg -n -C 14 \
-e 'TRANSIENT_GITHUB_API_ERRORS' \
-e 'invalid UTF-8 string' \
-e 'Resource limits for this query exceeded' \
-e 'def gh_graphql\b' \
-e 'def fetch_open_prs\b' \
-e 'def fetch_pr\b' \
-e 'REST fallback' \
scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '== Test symbol map =='
ast-grep outline tests/test_pr_review_merge_scheduler.py --items all \
--match 'fallback|transient|GraphQL|graphql|schema|accessible' || true
printf '%s\n' '== Focused test contexts =='
rg -n -C 14 \
-e 'invalid UTF-8 string' \
-e 'Resource limits for this query exceeded' \
-e 'TRANSIENT_GITHUB_API_ERRORS' \
-e 'fallback' \
-e 'schema error' \
-e 'Resource not accessible by integration' \
tests/test_pr_review_merge_scheduler.pyLength of output: 34637 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='780d857f8c002f7f0b48236272ea822413f39b4b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Full exact base-to-head patch =='
git diff --no-ext-diff --find-renames "$base" "$head"
printf '%s\n' '== All gh_graphql definitions and call sites =='
rg -n -C 8 '\bgh_graphql\s*\(' scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '== Error classifier and inaccessible-error classifier =='
rg -n -C 12 \
-e 'def is_transient_github_api_error\b' \
-e 'def github_resource_inaccessible\b' \
scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '== Non-transient GraphQL fallback test =='
sed -n '738,765p' tests/test_pr_review_merge_scheduler.py
printf '%s\n' '== Changed-file structure =='
for path in AGENTS.md ARCHITECTURE.md CHANGELOG.md CLAUDE.md \
docs/doctoring/scheduler-utf8-graphql-fallback.md \
tests/test_materialize_base_python_requirements.py; do
printf '\n== %s ==\n' "$path"
ast-grep outline "$path" --items all 2>/dev/null || true
doneLength of output: 24051
Verdict: changes requested.
The scheduler source change correctly adds the two requested markers. The focused tests cover both queue and single-PR REST fallback paths. The existing schema-error test remains fail-closed. The exact head also changes You are interacting with an AI system. |
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
780d857f8c002f7f0b48236272ea822413f39b4b. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31806487658/job/94786564282)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31806487658/job/94786564282)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: scheduler-utf8-graphql-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: scheduler-utf8-graphql-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: pr_review_merge_scheduler.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: pr_review_merge_scheduler.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.
- Result: REQUEST_CHANGES
- Reason: failed current-head checks were mapped to line-specific findings below for
780d857f8c002f7f0b48236272ea822413f39b4b. - Head SHA:
780d857f8c002f7f0b48236272ea822413f39b4b - Workflow run: 31819407080
- Workflow attempt: 1
Failed checks
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31806487658/job/94786564282)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31806487658/job/94786564282)
Findings
1. HIGH .github/workflows/strix.yml:525 - Strix unsupported-model errors must name the allowed providers
-
Problem: Strix failed because the trusted self-test log reported missing "STRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model".
-
Root cause: The failed check is executing trusted-base workflow material, so this exact line must exist in the trusted workflow/test contract before the check can pass.
-
Fix: Keep or add the current-head line at ".github/workflows/strix.yml:525" so trusted-base Strix/OpenCode evidence contains "STRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model".
-
Regression test: Keep scripts/ci/test_strix_quick_gate.sh assertions covering this exact string.
-
Suggested edit: ensure
.github/workflows/strix.yml:525contains the literalSTRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model; if the line was removed from trusted-base material, restore it exactly before approving.
2. HIGH .github/workflows/strix.yml:810 - Strix provider signal left current-head security evidence incomplete
-
Problem: Strix produced one or more vulnerability report windows that did not map to an existing repository file, then the failed log reported provider infrastructure/failure-signal output such as LLM CONNECTION FAILED, RateLimitError, budget-limit, "Below-threshold findings detected", "Unable to map Strix findings", or fallback provider signal. Unmapped reports: nvidia_nim/nvidia/nemotron-3-super-120b-a12b reported "Missing input validation for --repo argument in PR Review Merge Scheduler" (MEDIUM; Strix report did not include a mappable Code Location).
-
Root cause: The scanner evidence is incomplete even after model reports were emitted; unmapped or provider-failed Strix reports are scanner evidence blockers, not source-backed code review findings. OpenCode must not anchor a report to an unrelated workflow line unless the report includes a mappable repository Code Location.
-
Fix: Re-run Strix after GitHub Models capacity recovers or run an explicitly configured manual provider evidence scan with valid credentials; keep .github/workflows/strix.yml:810 aligned with the approved fallback model list.
-
Regression test: Keep failed-check evidence and validation covering provider-signal failures after vulnerability reports, including unmapped/nonexistent Code Locations, so partial reports cannot be downgraded to approval or converted into hallucinated source fixes.
-
Suggested edit: do not change unrelated source lines for unmapped reports; first obtain a clean Strix rerun or a report with a repository Code Location, while keeping
.github/workflows/strix.yml:810on the approved GitHub Models fallback route.
Failed check evidence for line-specific fixes
Failed GitHub Check Evidence
- PR: #934
- Head SHA:
780d857f8c002f7f0b48236272ea822413f39b4b - Repository:
ContextualWisdomLab/.github
Line-specific repair contract
-
Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
-
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
-
OpenCode
REQUEST_CHANGESfindings must includepath,line,root_cause,fix_direction,regression_test_direction, andsuggested_diff. -
Do not request changes with only a GitHub Actions URL or a generic check name.
-
When Strix logs contain multiple
Vulnerability ReportorModel ... Vulnerabilities ...sections, include every model-reported vulnerability in the review evidence and findings, including model name, title, severity, endpoint, and Code Locations/path:line evidence when present. -
Create one OpenCode finding per Strix model vulnerability report; do not satisfy two model reports with one combined finding, even when titles or locations match.
Failed check: Strix Security Scan/strix
- Type:
check_run - Conclusion:
FAILURE - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806487658/job/94786564282
- Workflow run id:
31806487658 - Check run id:
94786564282
Failed job steps
- step 26: Run Strix (quick) (failure)
Check annotations
- .github:424-424 [failure] Process completed with exit code 1.
Failed log signal summary
strix UNKNOWN STEP 2026-08-14T14:42:44.0361386Z [command]/usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /home/runner/work/_temp/e6443fc4-ee08-4ecf-b71a-4728a1a16fe3 -f /home/runner/work/_temp/a5283364-1570-424f-8106-288cfe4b8677
strix UNKNOWN STEP 2026-08-14T14:42:50.4377860Z ^[[36;1m print(f"::error::Could not parse GitHub workflow context JSON: {exc}", file=sys.stderr)^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:50.4386767Z ^[[36;1m print("::error::Trusted workflow repository resolved to an invalid name.", file=sys.stderr)^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:50.4388198Z ^[[36;1m print("::error::Trusted workflow ref resolved to an invalid value.", file=sys.stderr)^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:51.0686556Z hint: to use in all of your new repositories, which will suppress this warning,
strix UNKNOWN STEP 2026-08-14T14:42:51.8491686Z HEAD is now at 6eb06cd fix(strix): bound quality timeout fixtures (#823)
strix UNKNOWN STEP 2026-08-14T14:42:52.4409788Z ^[[36;1m echo "::error::Strix target repository must belong to ContextualWisdomLab."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:52.4412022Z ^[[36;1m echo "::error::Target repository visibility did not resolve to true or false."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:53.7167151Z ^[[36;1m echo "::error::PR number and head SHA are required for trusted PR-scope Strix evidence."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:53.7168734Z ^[[36;1m echo "::error::PR head SHA must be a 40-character git SHA."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:53.7170048Z ^[[36;1m echo "::error::PR base SHA must be a 40-character git SHA."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:53.7191248Z ^[[36;1mecho "::error::PR head ref did not resolve to expected commit $PR_HEAD_SHA after retries." >&2^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4693395Z ^[[36;1m echo "::error::PR head SHA must be a 40-character git SHA."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4927614Z ^[[36;1m echo '::error::STRIX_LLM must not select mini or nano GPT-5 variants for security evidence.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4932966Z ^[[36;1m echo '::error::STRIX_GITHUB_MODELS_TOKEN is required for GitHub Models Strix scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4937973Z ^[[36;1m echo '::error::STRIX_OPENAI_API_KEY is required for Strix OpenAI Platform scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4942110Z ^[[36;1m echo '::error::OPENROUTER_API_KEY is required for Strix OpenRouter scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4944025Z ^[[36;1m echo '::error::NVIDIA NIM hosted trial scans are limited to public repositories.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4947662Z ^[[36;1m echo '::error::NVIDIA_NIM_API_KEY is required for Strix NVIDIA NIM scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4951903Z ^[[36;1m echo '::error::GCP_SA_KEY is required for Vertex AI Strix scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.4953658Z ^[[36;1m echo '::error::STRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.6720834Z ^[[36;1m echo "::error::Pinned Strix installation did not produce a trusted absolute executable path."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.6722512Z ^[[36;1m echo "::error::Refusing a Strix executable from a workspace or runner-temp path."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.6725331Z ^[[36;1m echo "::error::Pinned Strix installation did not produce a trusted absolute scripts root."^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:55.6727314Z ^[[36;1m echo "::error::Pinned Strix executable is outside the trusted scripts root."^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.6238849Z ^[[36;1m echo '::error::STRIX_GITHUB_MODELS_TOKEN is required for GitHub Models Strix scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.6240314Z ^[[36;1m echo '::error::STRIX_OPENAI_API_KEY is required for Strix OpenAI Platform scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.6241809Z ^[[36;1m echo '::error::OPENROUTER_API_KEY is required for Strix OpenRouter scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.6243168Z ^[[36;1m echo '::error::NVIDIA_NIM_API_KEY is required for Strix NVIDIA NIM scans.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.6904067Z ^[[36;1m echo '::error::STRIX_LLM must not select mini or nano GPT-5 variants for security evidence.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.6914311Z ^[[36;1m echo '::error::STRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model.'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.7135635Z ^[[36;1m# LLM-backend-unavailable outcomes (GitHub Models "Too many requests"^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.7146646Z ^[[36;1mbackend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404'^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.7156191Z ^[[36;1m echo "::warning title=Strix backend unavailable::Strix could not complete because its LLM backend was unavailable (rate limit / token cap / connection or warm-up failure) before producing a vulnerability report. Treating as a neutral skip so an infrastructure outage does not block merges; genuine findings still fail the check. See the strix-reports artifact and the run log."^[[0m
strix UNKNOWN STEP 2026-08-14T14:49:46.7157710Z raw_response = await [REDACTED].with_raw_response.create(**data, timeout=timeout)
strix UNKNOWN STEP 2026-08-14T14:49:46.7194036Z │ LLM CONNECTION FAILED │
strix UNKNOWN STEP 2026-08-14T14:57:05.6870766Z │ timeout=10) │
strix UNKNOWN STEP 2026-08-14T14:57:05.8439815Z Strix scan failed after provider infrastructure or failure-signal output; failing closed.
strix UNKNOWN STEP 2026-08-14T14:57:05.8660278Z ##[error]Process completed with exit code 1.
Strix model attempt and finding summary
strix UNKNOWN STEP 2026-08-14T14:43:27.7135635Z ^[[36;1m# LLM-backend-unavailable outcomes (GitHub Models "Too many requests"^[[0m
strix UNKNOWN STEP 2026-08-14T14:43:27.7146646Z ^[[36;1mbackend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404'^[[0m
strix UNKNOWN STEP 2026-08-14T14:49:46.7194036Z │ LLM CONNECTION FAILED │
strix UNKNOWN STEP 2026-08-14T14:49:46.7634644Z Strix run failed for model 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' after 378s (exit code 1).
strix UNKNOWN STEP 2026-08-14T14:57:05.6885747Z │ Model nvidia_nim/nvidia/nemotron-3-super-120b-a12b │
strix UNKNOWN STEP 2026-08-14T14:57:05.6887078Z │ Vulnerabilities 1 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6887570Z │ MEDIUM: 1 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6951386Z │ Vulnerabilities MEDIUM: 1 (Total: 1) │
strix UNKNOWN STEP 2026-08-14T14:57:05.7768366Z Strix run failed for model 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' after 379s (exit code 2).
Strix vulnerability report window 1 (log lines 2032-2234)
strix UNKNOWN STEP 2026-08-14T14:57:05.6800839Z │ Penetration test initiated │
strix UNKNOWN STEP 2026-08-14T14:57:05.6801504Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6802462Z │ Target /tmp/strix-pr-scope.sJKRvA │
strix UNKNOWN STEP 2026-08-14T14:57:05.6803268Z │ Output strix_runs/strix-pr-scope-sjkrva_6305 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6803936Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6804640Z │ Vulnerabilities will be displayed in real-time. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6805361Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6806265Z ╰──────────────────────────────────────────────────────────────────────────────╯
strix UNKNOWN STEP 2026-08-14T14:57:05.6806636Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6806642Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6807026Z ╭─ VULN-0001 ──────────────────────────────────────────────────────────────────╮
strix UNKNOWN STEP 2026-08-14T14:57:05.6807646Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6808279Z │ Vulnerability Report │
strix UNKNOWN STEP 2026-08-14T14:57:05.6808957Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6809667Z │ Title: Missing input validation for --repo argument in PR Review Merge │
strix UNKNOWN STEP 2026-08-14T14:57:05.6810424Z │ Scheduler │
strix UNKNOWN STEP 2026-08-14T14:57:05.6811023Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6811725Z │ Severity: MEDIUM │
strix UNKNOWN STEP 2026-08-14T14:57:05.6812425Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6813147Z │ CVSS Score: 5.4 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6813836Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6814502Z │ Target: │
strix UNKNOWN STEP 2026-08-14T14:57:05.6815366Z │ /workspace/strix-pr-scope.sJKRvA/scripts/ci/pr_review_merge_scheduler.py │
strix UNKNOWN STEP 2026-08-14T14:57:05.6816568Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6817320Z │ CVSS Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N │
strix UNKNOWN STEP 2026-08-14T14:57:05.6818015Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6818589Z │ Description │
strix UNKNOWN STEP 2026-08-14T14:57:05.6819413Z │ The --repo argument is not validated before being used in constructing │
strix UNKNOWN STEP 2026-08-14T14:57:05.6820317Z │ commands for the gh CLI. This could allow an attacker to inject malicious │
strix UNKNOWN STEP 2026-08-14T14:57:05.6821236Z │ characters (such as newlines) that might be interpreted unexpectedly by │
strix UNKNOWN STEP 2026-08-14T14:57:05.6822189Z │ the gh CLI or the GitHub API, potentially leading to command injection or │
strix UNKNOWN STEP 2026-08-14T14:57:05.6823037Z │ API abuse. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6823755Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6824455Z │ Impact │
strix UNKNOWN STEP 2026-08-14T14:57:05.6825279Z │ An attacker who can control the --repo argument may be able to inject │
strix UNKNOWN STEP 2026-08-14T14:57:05.6826368Z │ malicious characters that interfere with the gh CLI or GitHub API, │
strix UNKNOWN STEP 2026-08-14T14:57:05.6827344Z │ potentially leading to unauthorized actions or data exposure. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6828127Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6829029Z │ Technical Analysis │
strix UNKNOWN STEP 2026-08-14T14:57:05.6829913Z │ The script uses the --repo argument in several functions (e.g., │
strix UNKNOWN STEP 2026-08-14T14:57:05.6830836Z │ update_branch, dispatch_opencode_review, etc.) without validating its │
strix UNKNOWN STEP 2026-08-14T14:57:05.6832080Z │ format. Although the command is executed with shell=False and the argument │
strix UNKNOWN STEP 2026-08-14T14:57:05.6832954Z │ is passed as a single string, the presence of newlines or other control │
strix UNKNOWN STEP 2026-08-14T14:57:05.6833814Z │ characters in the repo value could interfere with the HTTP request │
strix UNKNOWN STEP 2026-08-14T14:57:05.6834661Z │ processing or cause the gh CLI to behave unexpectedly. The │
strix UNKNOWN STEP 2026-08-14T14:57:05.6835529Z │ validate_github_repository function exists but is not used for the --repo │
strix UNKNOWN STEP 2026-08-14T14:57:05.6836555Z │ argument in the main function or when processing the argument. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6837327Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6837992Z │ PoC Description │
strix UNKNOWN STEP 2026-08-14T14:57:05.6838800Z │ To reproduce this issue, an attacker could pass a --repo argument │
strix UNKNOWN STEP 2026-08-14T14:57:05.6839679Z │ containing a newline character, for example: │
strix UNKNOWN STEP 2026-08-14T14:57:05.6840515Z │ python3 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6841342Z │ /workspace/strix-pr-scope.sJKRvA/scripts/ci/pr_review_merge_scheduler.py │
strix UNKNOWN STEP 2026-08-14T14:57:05.6842390Z │ --repo $'owner/name\n--malicious-flag' ... │
strix UNKNOWN STEP 2026-08-14T14:57:05.6843270Z │ This could cause the gh CLI to receive unexpected input and potentially │
strix UNKNOWN STEP 2026-08-14T14:57:05.6844161Z │ execute unintended actions. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6844896Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6845536Z │ PoC Code │
strix UNKNOWN STEP 2026-08-14T14:57:05.6846435Z │ #!/usr/bin/env python3 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6847231Z │ import subprocess │
strix UNKNOWN STEP 2026-08-14T14:57:05.6847989Z │ import sys │
strix UNKNOWN STEP 2026-08-14T14:57:05.6848640Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6849372Z │ # This script demonstrates the issue by attempting to run the scheduler │
strix UNKNOWN STEP 2026-08-14T14:57:05.6850240Z │ with a malicious --repo argument. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6851068Z │ # Note: This is a proof of concept and may not work without a GitHub token │
strix UNKNOWN STEP 2026-08-14T14:57:05.6851877Z │ and proper environment. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6852942Z │ # It is intended to show that the argument is not validated. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6853676Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6854351Z │ def main(): │
strix UNKNOWN STEP 2026-08-14T14:57:05.6855147Z │ # Example of a malicious repo argument with a newline and a potential │
strix UNKNOWN STEP 2026-08-14T14:57:05.6856168Z │ command injection attempt. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6857005Z │ # In reality, the gh CLI would likely fail due to invalid repository │
strix UNKNOWN STEP 2026-08-14T14:57:05.6857849Z │ format, but the lack of validation is the issue. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6858700Z │ malicious_repo = "owner/name\n--malicious-flag" │
strix UNKNOWN STEP 2026-08-14T14:57:05.6859451Z │ cmd = [ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6860157Z │ sys.executable, │
strix UNKNOWN STEP 2026-08-14T14:57:05.6860976Z │ "/workspace/strix-pr-scope.sJKRvA/scripts/ci/pr_review_merge_sched │
strix UNKNOWN STEP 2026-08-14T14:57:05.6861728Z │ uler.py", │
strix UNKNOWN STEP 2026-08-14T14:57:05.6862720Z │ "--repo", malicious_repo, │
strix UNKNOWN STEP 2026-08-14T14:57:05.6863518Z │ "--base-branch", "main", │
strix UNKNOWN STEP 2026-08-14T14:57:05.6864277Z │ "--project-flow", "github-flow", │
strix UNKNOWN STEP 2026-08-14T14:57:05.6864939Z │ "--dry-run", │
strix UNKNOWN STEP 2026-08-14T14:57:05.6865622Z │ "--max-prs", "1", │
strix UNKNOWN STEP 2026-08-14T14:57:05.6866402Z │ "--self-test", "false" │
strix UNKNOWN STEP 2026-08-14T14:57:05.6867068Z │ ] │
strix UNKNOWN STEP 2026-08-14T14:57:05.6867650Z │ try: │
strix UNKNOWN STEP 2026-08-14T14:57:05.6868320Z │ # We expect the script to fail because the repo is invalid, but │
strix UNKNOWN STEP 2026-08-14T14:57:05.6869157Z │ the point is that it should validate the repo format first. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6870018Z │ result = subprocess.run(cmd, capture_output=True, text=True, │
strix UNKNOWN STEP 2026-08-14T14:57:05.6870766Z │ timeout=10) │
strix UNKNOWN STEP 2026-08-14T14:57:05.6871508Z │ print("Return code:", result.returncode) │
strix UNKNOWN STEP 2026-08-14T14:57:05.6872289Z │ print("STDOUT:", result.stdout) │
strix UNKNOWN STEP 2026-08-14T14:57:05.6873039Z │ print("STDERR:", result.stderr) │
strix UNKNOWN STEP 2026-08-14T14:57:05.6873776Z │ except Exception as e: │
strix UNKNOWN STEP 2026-08-14T14:57:05.6874566Z │ print("Exception:", e) │
strix UNKNOWN STEP 2026-08-14T14:57:05.6875253Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6875943Z │ if __name__ == "__main__": │
strix UNKNOWN STEP 2026-08-14T14:57:05.6876862Z │ main() │
strix UNKNOWN STEP 2026-08-14T14:57:05.6877481Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6878097Z │ Remediation │
strix UNKNOWN STEP 2026-08-14T14:57:05.6878611Z │ Use the validate_github_repository function (or similar) to validate the │
strix UNKNOWN STEP 2026-08-14T14:57:05.6879176Z │ --repo argument before using it in commands. Add validation in the │
strix UNKNOWN STEP 2026-08-14T14:57:05.6879874Z │ parse_args function or shortly after parsing the arguments to ensure the │
strix UNKNOWN STEP 2026-08-14T14:57:05.6880695Z │ repo argument matches the expected format (owner/name) and does not │
strix UNKNOWN STEP 2026-08-14T14:57:05.6881276Z │ contain harmful characters. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6881791Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6882541Z ╰──────────────────────────────────────────────────────────────────────────────╯
strix UNKNOWN STEP 2026-08-14T14:57:05.6882953Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6883376Z ╭─ STRIX ──────────────────────────────────────────────────────────────────────╮
strix UNKNOWN STEP 2026-08-14T14:57:05.6883885Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6884395Z │ Penetration test in progress │
strix UNKNOWN STEP 2026-08-14T14:57:05.6885149Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6885747Z │ Model nvidia_nim/nvidia/nemotron-3-super-120b-a12b │
strix UNKNOWN STEP 2026-08-14T14:57:05.6887078Z │ Vulnerabilities 1 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6887570Z │ MEDIUM: 1 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6887973Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6888828Z │ Input Tokens 800.5K · Cached Tokens 0 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6889332Z │ Output Tokens 4.0K · Cost $0.0000 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6889760Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6890340Z ╰──────────────────────────────────────────────────────────────────────────────╯
strix UNKNOWN STEP 2026-08-14T14:57:05.6890821Z ╭─ STRIX ──────────────────────────────────────────────────────────────────────╮
strix UNKNOWN STEP 2026-08-14T14:57:05.6891236Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6891690Z │ Penetration test summary │
strix UNKNOWN STEP 2026-08-14T14:57:05.6892254Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6892682Z │ # Executive Summary │
strix UNKNOWN STEP 2026-08-14T14:57:05.6893117Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6893938Z │ A missing input validation vulnerability was identified and fixed in the │
strix UNKNOWN STEP 2026-08-14T14:57:05.6894776Z │ PR Review Merge Scheduler script. The --repo argument was not validated │
strix UNKNOWN STEP 2026-08-14T14:57:05.6895809Z │ before use, which could allow command injection or API abuse. The fix adds │
strix UNKNOWN STEP 2026-08-14T14:57:05.6897062Z │ validation using the existing validate_github_repository function to │
strix UNKNOWN STEP 2026-08-14T14:57:05.6897917Z │ ensure the argument is in the correct format (owner/name) and does not │
strix UNKNOWN STEP 2026-08-14T14:57:05.6898914Z │ contain harmful characters. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6899692Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6900457Z │ # Methodology │
strix UNKNOWN STEP 2026-08-14T14:57:05.6901133Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6901943Z │ The assessment involved reviewing the source code of the PR Review Merge │
strix UNKNOWN STEP 2026-08-14T14:57:05.6903637Z │ Scheduler script. The vulnerability was identified by tracing the usage of │
strix UNKNOWN STEP 2026-08-14T14:57:05.6904601Z │ the --repo argument and observing that it was passed to GitHub CLI │
strix UNKNOWN STEP 2026-08-14T14:57:05.6905696Z │ commands without prior validation. The fix was implemented by adding a │
strix UNKNOWN STEP 2026-08-14T14:57:05.6907272Z │ validation step in the main function after argument parsing. Verification │
strix UNKNOWN STEP 2026-08-14T14:57:05.6908671Z │ was performed using the script's self-test and by testing with malicious │
strix UNKNOWN STEP 2026-08-14T14:57:05.6909840Z │ input. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6910531Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6911271Z │ # Technical Analysis │
strix UNKNOWN STEP 2026-08-14T14:57:05.6912055Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6912859Z │ The --repo argument is used in multiple functions (e.g., fetch_open_prs, │
strix UNKNOWN STEP 2026-08-14T14:57:05.6913836Z │ fetch_pr, update_branch, etc.) to construct GitHub CLI commands. Although │
strix UNKNOWN STEP 2026-08-14T14:57:05.6914656Z │ the commands are executed with shell=False and the argument is passed as a │
strix UNKNOWN STEP 2026-08-14T14:57:05.6915601Z │ single string, the presence of newlines or other control characters could │
strix UNKNOWN STEP 2026-08-14T14:57:05.6916694Z │ interfere with the HTTP request processing or cause the GitHub CLI to │
strix UNKNOWN STEP 2026-08-14T14:57:05.6917795Z │ behave unexpectedly. The validate_github_repository function, which │
strix UNKNOWN STEP 2026-08-14T14:57:05.6918729Z │ validates the repository string format, was already present in the │
strix UNKNOWN STEP 2026-08-14T14:57:05.6919765Z │ codebase but was not being used for the --repo argument in the main │
strix UNKNOWN STEP 2026-08-14T14:57:05.6920520Z │ function. The fix adds this validation. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6920968Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6921709Z │ # Recommendations │
strix UNKNOWN STEP 2026-08-14T14:57:05.6922437Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6922942Z │ - Always validate input arguments before using them in commands or API │
strix UNKNOWN STEP 2026-08-14T14:57:05.6923777Z │ calls. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6924604Z │ - Use existing validation functions where available. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6925241Z │ - Consider implementing additional validation for other arguments as │
strix UNKNOWN STEP 2026-08-14T14:57:05.6925921Z │ needed. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6926919Z │ - Regularly review code for input validation, especially for arguments │
strix UNKNOWN STEP 2026-08-14T14:57:05.6927735Z │ that are used in command execution or API requests. │
strix UNKNOWN STEP 2026-08-14T14:57:05.6928620Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6929247Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6929801Z ╰──────────────────────────────────────────────────────────────────────────────╯
strix UNKNOWN STEP 2026-08-14T14:57:05.6930029Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6930033Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6930038Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6930288Z ╭─ STRIX ──────────────────────────────────────────────────────────────────────╮
strix UNKNOWN STEP 2026-08-14T14:57:05.6931290Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6932140Z │ Penetration test completed │
strix UNKNOWN STEP 2026-08-14T14:57:05.6932624Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6950636Z │ Target /tmp/strix-pr-scope.sJKRvA │
strix UNKNOWN STEP 2026-08-14T14:57:05.6951386Z │ Vulnerabilities MEDIUM: 1 (Total: 1) │
strix UNKNOWN STEP 2026-08-14T14:57:05.6952066Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6952543Z │ Input Tokens 857.1K · Output Tokens 4.4K │
strix UNKNOWN STEP 2026-08-14T14:57:05.6952988Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6953478Z │ Output /tmp/strix-pr-scope.sJKRvA/strix_runs/strix-pr-scope-sjkrva_6305 │
strix UNKNOWN STEP 2026-08-14T14:57:05.6954128Z │ │
strix UNKNOWN STEP 2026-08-14T14:57:05.6954587Z ╰──────────────────────────────────────────────────────────────────────────────╯
strix UNKNOWN STEP 2026-08-14T14:57:05.6954824Z
strix UNKNOWN STEP 2026-08-14T14:57:05.6955090Z strix.ai · docs.strix.ai · discord.gg/strix-ai
strix UNKNOWN STEP 2026-08-14T14:57:05.6955449Z
strix UNKNOWN STEP 2026-08-14T14:57:05.7768366Z Strix run failed for model 'nvidia_nim/nvidia/nemotron-3-super-120b-a12b' after 379s (exit code 2).
strix UNKNOWN STEP 2026-08-14T14:57:05.8439815Z Strix scan failed after provider infrastructure or failure-signal output; failing closed.
strix UNKNOWN STEP 2026-08-14T14:57:05.8644876Z Strix reported security findings or failed for a non-backend reason; failing the required check (gate exit 1).
strix UNKNOWN STEP 2026-08-14T14:57:05.8660278Z ##[error]Process completed with exit code 1.
strix UNKNOWN STEP 2026-08-14T14:57:05.8712696Z ##[group]Run set -euo pipefail
strix UNKNOWN STEP 2026-08-14T14:57:05.8713029Z ^[[36;1mset -euo pipefail^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8713324Z ^[[36;1mmkdir -p "$GITHUB_WORKSPACE/strix_runs"^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8713649Z ^[[36;1mcopied_reports=0^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8714050Z ^[[36;1mfor candidate_dir in "$TRUSTED_WORKSPACE/strix_runs" "$RUNNER_TEMP/strix_runs"; do^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8714650Z ^[[36;1m if [ -d "$candidate_dir" ] && [ -n "$(find "$candidate_dir" -mindepth 1 -print -quit)" ]; then^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8715160Z ^[[36;1m cp -R "$candidate_dir"/. "$GITHUB_WORKSPACE/strix_runs"/^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8715527Z ^[[36;1m copied_reports=1^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8715771Z ^[[36;1m fi^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8715976Z ^[[36;1mdone^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8716757Z ^[[36;1mif [ -f "$RUNNER_TEMP/strix_gate_console.log" ]; then^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8717327Z ^[[36;1m cp "$RUNNER_TEMP/strix_gate_console.log" "$GITHUB_WORKSPACE/strix_runs/gate-console.log"^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8717805Z ^[[36;1m copied_reports=1^[[0m
strix UNKNOWN STEP 2026-08-14T14:57:05.8718050Z ^[[36;1mfi^[[0m
Failed log excerpt
strix UNKNOWN STEP 2026-08-14T14:42:41.5075263Z Current runner version: '2.336.0'
strix UNKNOWN STEP 2026-08-14T14:42:41.5101543Z ##[group]Runner Image Provisioner
strix UNKNOWN STEP 2026-08-14T14:42:41.5102578Z Hosted Compute Agent
strix UNKNOWN STEP 2026-08-14T14:42:41.5103200Z Version: 20260729.566
strix UNKNOWN STEP 2026-08-14T14:42:41.5103905Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
strix UNKNOWN STEP 2026-08-14T14:42:41.5104675Z Build Date: 2026-07-29T19:17:02Z
strix UNKNOWN STEP 2026-08-14T14:42:41.5105378Z Worker ID: {32a17298-b269-447c-ad67-6672711cd538}
strix UNKNOWN STEP 2026-08-14T14:42:41.5106886Z Azure Region: eastus
strix UNKNOWN STEP 2026-08-14T14:42:41.5107501Z ##[endgroup]
strix UNKNOWN STEP 2026-08-14T14:42:41.5109046Z ##[group]Operating System
strix UNKNOWN STEP 2026-08-14T14:42:41.5109708Z Ubuntu
strix UNKNOWN STEP 2026-08-14T14:42:41.5110278Z 24.04.4
strix UNKNOWN STEP 2026-08-14T14:42:41.5110939Z LTS
strix UNKNOWN STEP 2026-08-14T14:42:41.5111496Z ##[endgroup]
strix UNKNOWN STEP 2026-08-14T14:42:41.5112169Z ##[group]Runner Image
strix UNKNOWN STEP 2026-08-14T14:42:41.5112834Z Image: ubuntu-24.04
strix UNKNOWN STEP 2026-08-14T14:42:41.5113471Z Version: 20260810.271.1
strix UNKNOWN STEP 2026-08-14T14:42:41.5114903Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260810.271/images/ubuntu/Ubuntu2404-Readme.md
strix UNKNOWN STEP 2026-08-14T14:42:41.5116702Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260810.271
strix UNKNOWN STEP 2026-08-14T14:42:41.5117703Z ##[endgroup]
strix UNKNOWN STEP 2026-08-14T14:42:41.5119537Z ##[group]GITHUB_TOKEN Permissions
strix UNKNOWN STEP 2026-08-14T14:42:41.5121899Z Actions: read
strix UNKNOWN STEP 2026-08-14T14:42:41.5122632Z Contents: read
strix UNKNOWN STEP 2026-08-14T14:42:41.5123285Z Metadata: read
strix UNKNOWN STEP 2026-08-14T14:42:41.5123844Z Models: read
strix UNKNOWN STEP 2026-08-14T14:42:41.5124513Z Statuses: write
strix UNKNOWN STEP 2026-08-14T14:42:41.5125094Z ##[endgroup]
strix UNKNOWN STEP 2026-08-14T14:42:41.5127439Z Secret source: Actions
strix UNKNOWN STEP 2026-08-14T14:42:41.5128911Z Prepare workflow directory
strix UNKNOWN STEP 2026-08-14T14:42:41.5518717Z Prepare all required actions
strix UNKNOWN STEP 2026-08-14T14:42:41.5568051Z Getting action download info
strix UNKNOWN STEP 2026-08-14T14:42:41.7795912Z Download action repository 'step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920' (SHA:bf7454d06d71f1098171f2acdf0cd4708d7b5920)
strix UNKNOWN STEP 2026-08-14T14:42:42.0861447Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
strix UNKNOWN STEP 2026-08-14T14:42:42.2088823Z Download action repository 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' (SHA:9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0)
strix UNKNOWN STEP 2026-08-14T14:42:42.2615587Z Download action repository 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' (SHA:043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)
strix UNKNOWN STEP 2026-08-14T14:42:42.4923248Z Complete job name: strix
strix UNKNOWN STEP 2026-08-14T14:42:42.6195151Z ##[group]Run step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
strix UNKNOWN STEP 2026-08-14T14:42:42.6197278Z with:
strix UNKNOWN STEP 2026-08-14T14:42:42.6198150Z egress-policy: audit
strix UNKNOWN STEP 2026-08-14T14:42:42.6199162Z disable-file-monitoring: true
strix UNKNOWN STEP 2026-08-14T14:42:42.6207869Z token: [REDACTED]
strix UNKNOWN STEP 2026-08-14T14:42:42.6208793Z disable-telemetry: false
strix UNKNOWN STEP 2026-08-14T14:42:42.6209817Z disable-sudo: false
strix UNKNOWN STEP 2026-08-14T14:42:42.6210814Z disable-sudo-and-containers: false
strix UNKNOWN STEP 2026-08-14T14:42:42.6211947Z use-policy-store: false
strix UNKNOWN STEP 2026-08-14T14:42:42.6212988Z deploy-on-self-hosted-vm: false
strix UNKNOWN STEP 2026-08-14T14:42:42.6214282Z env:
strix UNKNOWN STEP 2026-08-14T14:42:42.6215187Z FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
strix UNKNOWN STEP 2026-08-14T14:42:42.6216538Z ##[endgroup]
strix UNKNOWN STEP 2026-08-14T14:42:42.7577604Z [harden-runner] pre-step
strix UNKNOWN STEP 2026-08-14T14:42:42.7579454Z [!] Current Configuration:
strix UNKNOWN STEP 2026-08-14T14:42:42.7590002Z {"repo":"ContextualWisdomLab/.github","run_id":"31806487658","correlation_id":"ea4c309f-4c72-48b1-9e30-1874e99f2063","working_directory":"/home/runner/work/.github/.github","api_url":"https://[REDACTED].io/v1","telemetry_url":"https://[REDACTED].io/v1","allowed_endpoints":"","egress_policy":"audit","disable_telemetry":false,"disable_sudo":false,"disable_sudo_and_containers":false,"disable_file_monitoring":true,"private":false,"is_github_hosted":true,"is_debug":false,"one_time_key":"","api_key":[REDACTED],"use_policy_store":false,"deploy_on_self_hosted_vm":false}
strix UNKNOWN STEP 2026-08-14T14:42:42.7599551Z
strix UNKNOWN STEP 2026-08-14T14:42:42.7600919Z ^[[32mView security insights and recommended policy at:^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:42.7603785Z https://app.stepsecurity.io/github/ContextualWisdomLab/.github/actions/runs/31806487658
strix UNKNOWN STEP 2026-08-14T14:42:42.7607036Z RUNNER_NAME: GitHub Actions 1000859539
strix UNKNOWN STEP 2026-08-14T14:42:43.4674298Z Runner IP Address: 40.76.106.67
strix UNKNOWN STEP 2026-08-14T14:42:43.4676903Z Step Security Job Correlation ID: ea4c309f-4c72-48b1-9e30-1874e99f2063
strix UNKNOWN STEP 2026-08-14T14:42:43.4924125Z [!] Checking TLS_STATUS: ContextualWisdomLab
strix UNKNOWN STEP 2026-08-14T14:42:43.7765531Z [!] TLS_NOT_ENABLED: ContextualWisdomLab
strix UNKNOWN STEP 2026-08-14T14:42:44.0258787Z ✅ Checksum verification passed. checksum=4b14d8a3a5fbcef95af55e0c54d3bee6f44da802878c10289a4ca0b79b6d0237
strix UNKNOWN STEP 2026-08-14T14:42:44.0361386Z [command]/usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /home/runner/work/_temp/e6443fc4-ee08-4ecf-b71a-4728a1a16fe3 -f /home/runner/work/_temp/a5283364-1570-424f-8106-288cfe4b8677
strix UNKNOWN STEP 2026-08-14T14:42:50.1445657Z Initialized
strix UNKNOWN STEP 2026-08-14T14:42:50.1733251Z ##[group]Run step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
strix UNKNOWN STEP 2026-08-14T14:42:50.1733736Z with:
strix UNKNOWN STEP 2026-08-14T14:42:50.1733962Z egress-policy: audit
strix UNKNOWN STEP 2026-08-14T14:42:50.1734272Z disable-file-monitoring: true
strix UNKNOWN STEP 2026-08-14T14:42:50.1737055Z token: [REDACTED]
strix UNKNOWN STEP 2026-08-14T14:42:50.1737291Z disable-telemetry: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1737566Z disable-sudo: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1737820Z disable-sudo-and-containers: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1738122Z use-policy-store: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1738387Z deploy-on-self-hosted-vm: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1738650Z env:
strix UNKNOWN STEP 2026-08-14T14:42:50.1738879Z FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
strix UNKNOWN STEP 2026-08-14T14:42:50.1739183Z STATE_disableSudo: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1739463Z STATE_disableSudoAndContainers: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1739789Z STATE_monitorStatusCode: 200
strix UNKNOWN STEP 2026-08-14T14:42:50.1740053Z STATE_addSummary: true
strix UNKNOWN STEP 2026-08-14T14:42:50.1740396Z STATE_correlation_id: ea4c309f-4c72-48b1-9e30-1874e99f2063
strix UNKNOWN STEP 2026-08-14T14:42:50.1740739Z STATE_isTLS: false
strix UNKNOWN STEP 2026-08-14T14:42:50.1740967Z ##[endgroup]
strix UNKNOWN STEP 2026-08-14T14:42:50.2550216Z [harden-runner] main-step
strix UNKNOWN STEP 2026-08-14T14:42:50.2555653Z ^[[32mView security insights and recommended policy at:^[[0m
strix UNKNOWN STEP 2026-08-14T14:42:50.2557143Z https://app.stepsecurity.io/github/ContextualWisdomLab/.github/actions/runs/31806487658
strix UNKNOWN STEP 2026-08-14T14:42:50.2750816Z ##[group]Run actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
strix UNKNOWN STEP 2026-08-14T14:42:50.2751265Z with:
strix UNKNOWN STEP 2026-08-14T14:42:50.2751485Z python-version: 3.13
strix UNKNOWN STEP 2026-08-14T14:42:50.2751745Z check-latest: false
strix UNKNOWN STEP 2026-08-14T14:42:50.2754353Z token: [REDACTED]
... truncated 2305 middle log lines ...
strix UNKNOWN STEP 2026-08-14T14:57:07.8278163Z Fri, 14 Aug 2026 14:44:09 GMT:domain resolved: [REDACTED]., ip address: 20.75.202.224, TTL: 2398
strix UNKNOWN STEP 2026-08-14T14:57:07.8279118Z Fri, 14 Aug 2026 14:45:21 GMT:domain resolved: [REDACTED].com., ip address: 99.83.136.103, TTL: 300
strix UNKNOWN STEP 2026-08-14T14:57:07.8280006Z Fri, 14 Aug 2026 14:45:21 GMT:domain resolved: [REDACTED].io., ip address: 32.184.221.89, TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8280936Z Fri, 14 Aug 2026 14:45:21 GMT:endpoint called ip address:port 99.83.136.103:443, domain: [REDACTED].com., pid: 3229, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8281821Z Fri, 14 Aug 2026 14:47:35 GMT:domain resolved: [REDACTED].io., ip address: 44.[REDACTED], TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8282706Z Fri, 14 Aug 2026 14:47:36 GMT:endpoint called ip address:port 168.63.129.16:80, domain: , pid: 3447, process: python3.12
strix UNKNOWN STEP 2026-08-14T14:57:07.8283869Z Fri, 14 Aug 2026 14:50:48 GMT:domain resolved: [REDACTED].io., ip address: 32.184.221.89, TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8284948Z Fri, 14 Aug 2026 14:50:49 GMT:endpoint called ip address:port [REDACTED].133:443, domain: [REDACTED]., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8285831Z Fri, 14 Aug 2026 14:50:50 GMT:domain resolved: [REDACTED].com., ip address: 99.83.136.103, TTL: 300
strix UNKNOWN STEP 2026-08-14T14:57:07.8286819Z Fri, 14 Aug 2026 14:50:50 GMT:endpoint called ip address:port 99.83.136.103:443, domain: [REDACTED].com., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8287661Z Fri, 14 Aug 2026 14:50:54 GMT:domain resolved: us.i.posthog.com., ip address: 52.200.106.3, TTL: 36
strix UNKNOWN STEP 2026-08-14T14:57:07.8288394Z Fri, 14 Aug 2026 14:50:54 GMT:domain resolved: [REDACTED].sh., ip address: 52.33.86.107, TTL: 45
strix UNKNOWN STEP 2026-08-14T14:57:07.8289199Z Fri, 14 Aug 2026 14:50:54 GMT:endpoint called ip address:port 52.200.106.3:443, domain: us.i.posthog.com., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8290140Z Fri, 14 Aug 2026 14:50:54 GMT:endpoint called ip address:port 52.33.86.107:443, domain: [REDACTED].sh., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8290978Z Fri, 14 Aug 2026 14:54:53 GMT:domain resolved: us.i.posthog.com., ip address: 3.[REDACTED], TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8291729Z Fri, 14 Aug 2026 14:54:53 GMT:domain resolved: [REDACTED].io., ip address: 44.[REDACTED], TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8292503Z Fri, 14 Aug 2026 14:54:53 GMT:domain resolved: [REDACTED].sh., ip address: 54.[REDACTED], TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8293320Z Fri, 14 Aug 2026 14:54:53 GMT:endpoint called ip address:port 3.[REDACTED]:443, domain: us.i.posthog.com., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8294240Z Fri, 14 Aug 2026 14:54:53 GMT:endpoint called ip address:port 54.[REDACTED]:443, domain: [REDACTED].sh., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8295381Z Fri, 14 Aug 2026 14:56:10 GMT:domain resolved: [REDACTED].com., ip address: 99.83.136.103, TTL: 300
strix UNKNOWN STEP 2026-08-14T14:57:07.8296653Z Fri, 14 Aug 2026 14:56:10 GMT:domain resolved: [REDACTED].io., ip address: 44.[REDACTED], TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8297455Z Fri, 14 Aug 2026 14:57:02 GMT:domain resolved: us.i.posthog.com., ip address: 50.16.199.95, TTL: 40
strix UNKNOWN STEP 2026-08-14T14:57:07.8298380Z Fri, 14 Aug 2026 14:57:03 GMT:domain resolved: [REDACTED].sh., ip address: 54.[REDACTED], TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8299271Z Fri, 14 Aug 2026 14:57:03 GMT:endpoint called ip address:port 50.16.199.95:443, domain: us.i.posthog.com., pid: 3585, process: python3.13
strix UNKNOWN STEP 2026-08-14T14:57:07.8300074Z Fri, 14 Aug 2026 14:57:05 GMT:domain resolved: [REDACTED].com., ip address: 140.82.113.21, TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8301009Z Fri, 14 Aug 2026 14:57:06 GMT:endpoint called ip address:port 140.82.113.21:443, domain: [REDACTED].com., pid: 2047, process: Runner.Worker
strix UNKNOWN STEP 2026-08-14T14:57:07.8302170Z Fri, 14 Aug 2026 14:57:06 GMT:domain resolved: [REDACTED].windows.net., ip address: 57.150.87.97, TTL: 30
strix UNKNOWN STEP 2026-08-14T14:57:07.8303114Z Fri, 14 Aug 2026 14:57:06 GMT:endpoint called ip address:port 57.150.87.97:443, domain: [REDACTED].windows.net., pid: 2047, process: Runner.Worker
strix UNKNOWN STEP 2026-08-14T14:57:07.8304102Z Fri, 14 Aug 2026 14:57:06 GMT:endpoint called ip address:port 140.82.113.21:443, domain: [REDACTED].com., pid: 5763, process: node
strix UNKNOWN STEP 2026-08-14T14:57:07.8305052Z Fri, 14 Aug 2026 14:57:06 GMT:endpoint called ip address:port 57.150.87.97:443, domain: [REDACTED].windows.net., pid: 5763, process: node
strix UNKNOWN STEP 2026-08-14T14:57:07.8305567Z
strix UNKNOWN STEP 2026-08-14T14:57:07.8305702Z Fri, 14 Aug 2026 14:57:06 GMT:post_event called
strix UNKNOWN STEP 2026-08-14T14:57:07.8305916Z
strix UNKNOWN STEP 2026-08-14T14:57:07.8306164Z status:
strix UNKNOWN STEP 2026-08-14T14:57:07.8306375Z Initialized
strix UNKNOWN STEP 2026-08-14T14:57:07.8415683Z agent.service log:
strix UNKNOWN STEP 2026-08-14T14:57:07.8417403Z Aug 14 14:42:45 runnervmzvulz systemd[1]: /etc/systemd/system/agent.service:9: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
strix UNKNOWN STEP 2026-08-14T14:57:07.8419753Z Aug 14 14:42:45 runnervmzvulz systemd[1]: /etc/systemd/system/agent.service:10: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
strix UNKNOWN STEP 2026-08-14T14:57:07.8421286Z Aug 14 14:42:45 runnervmzvulz systemd[1]: Started agent.service - Agent.
strix UNKNOWN STEP 2026-08-14T14:57:07.8422529Z Aug 14 14:42:45 runnervmzvulz sudo[2187]: root : *** ; USER=root ; COMMAND=/usr/bin/systemctl stop systemd-resolved
strix UNKNOWN STEP 2026-08-14T14:57:07.8423769Z Aug 14 14:42:45 runnervmzvulz sudo[2187]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
strix UNKNOWN STEP 2026-08-14T14:57:07.8424862Z Aug 14 14:42:45 runnervmzvulz sudo[2187]: pam_unix(sudo:session): session closed for user root
strix UNKNOWN STEP 2026-08-14T14:57:07.8426284Z Aug 14 14:42:45 runnervmzvulz sudo[2193]: root : *** ; USER=root ; COMMAND=/usr/bin/systemctl restart systemd-resolved
strix UNKNOWN STEP 2026-08-14T14:57:07.8427462Z Aug 14 14:42:45 runnervmzvulz sudo[2193]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
strix UNKNOWN STEP 2026-08-14T14:57:07.8428501Z Aug 14 14:42:46 runnervmzvulz sudo[2193]: pam_unix(sudo:session): session closed for user root
strix UNKNOWN STEP 2026-08-14T14:57:07.8429633Z Aug 14 14:42:46 runnervmzvulz sudo[2198]: root : *** ; USER=root ; COMMAND=/usr/bin/resolvectl flush-caches
strix UNKNOWN STEP 2026-08-14T14:57:07.8430743Z Aug 14 14:42:46 runnervmzvulz sudo[2198]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
strix UNKNOWN STEP 2026-08-14T14:57:07.8431961Z Aug 14 14:42:46 runnervmzvulz sudo[2198]: pam_unix(sudo:session): session closed for user root
strix UNKNOWN STEP 2026-08-14T14:57:07.8433061Z Aug 14 14:42:46 runnervmzvulz sudo[2202]: root : *** ; USER=root ; COMMAND=/usr/bin/systemctl reload docker
strix UNKNOWN STEP 2026-08-14T14:57:07.8434183Z Aug 14 14:42:46 runnervmzvulz sudo[2202]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
strix UNKNOWN STEP 2026-08-14T14:57:07.8435515Z Aug 14 14:42:46 runnervmzvulz sudo[2202]: pam_unix(sudo:session): session closed for user root
strix UNKNOWN STEP 2026-08-14T14:57:07.8436901Z Aug 14 14:42:46 runnervmzvulz sudo[2213]: root : *** ; USER=root ; COMMAND=/usr/bin/systemctl daemon-reload
strix UNKNOWN STEP 2026-08-14T14:57:07.8438048Z Aug 14 14:42:46 runnervmzvulz sudo[2213]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
strix UNKNOWN STEP 2026-08-14T14:57:07.8439892Z Aug 14 14:42:46 runnervmzvulz systemd[1]: /etc/systemd/system/agent.service:9: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
strix UNKNOWN STEP 2026-08-14T14:57:07.8442351Z Aug 14 14:42:46 runnervmzvulz systemd[1]: /etc/systemd/system/agent.service:10: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
strix UNKNOWN STEP 2026-08-14T14:57:07.8444131Z Aug 14 14:42:46 runnervmzvulz sudo[2213]: pam_unix(sudo:session): session closed for user root
strix UNKNOWN STEP 2026-08-14T14:57:07.8445702Z Aug 14 14:42:46 runnervmzvulz sudo[2277]: root : *** ; USER=root ; COMMAND=/usr/bin/systemctl restart docker
strix UNKNOWN STEP 2026-08-14T14:57:07.8447124Z Aug 14 14:42:46 runnervmzvulz sudo[2277]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
strix UNKNOWN STEP 2026-08-14T14:57:07.8448127Z Aug 14 14:42:49 runnervmzvulz sudo[2277]: pam_unix(sudo:session): session closed for user root
strix UNKNOWN STEP 2026-08-14T14:57:07.8449689Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Fetching custom detection rules module=armour api_url=https://[REDACTED].io/v1 repo=ContextualWisdomLab/.github
strix UNKNOWN STEP 2026-08-14T14:57:07.8451382Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Custom detection rules evaluator initialized module=armour
strix UNKNOWN STEP 2026-08-14T14:57:07.8452895Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Detection manager started module=detection-manager workers=4 buffer_size=1000
strix UNKNOWN STEP 2026-08-14T14:57:07.8454359Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Selected Armour variant module=armour variant=fmod_ret
strix UNKNOWN STEP 2026-08-14T14:57:07.8455612Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Config module=armour AGENT_PID=2171
strix UNKNOWN STEP 2026-08-14T14:57:07.8456931Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Config module=armour ENFORCE_READ_BLOCK=false
strix UNKNOWN STEP 2026-08-14T14:57:07.8458135Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Config module=armour ENFORCE_WRITE_BLOCK=false
strix UNKNOWN STEP 2026-08-14T14:57:07.8459363Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Config module=armour ENFORCE_KILL_BLOCK=true
strix UNKNOWN STEP 2026-08-14T14:57:07.8460540Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Map size module=armour protected_proc_fs_inodes=2
strix UNKNOWN STEP 2026-08-14T14:57:07.8461723Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Map size module=armour events=16384
strix UNKNOWN STEP 2026-08-14T14:57:07.8463010Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Map size module=armour protected_pids=1
strix UNKNOWN STEP 2026-08-14T14:57:07.8464170Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Map size module=armour protected_pid_inodes=1
strix UNKNOWN STEP 2026-08-14T14:57:07.8465464Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Map size module=armour protected_bpf_ids=9
strix UNKNOWN STEP 2026-08-14T14:57:07.8466861Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Map size module=armour protected_fs_inodes=6
strix UNKNOWN STEP 2026-08-14T14:57:07.8468051Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO ProtectedPids module=armour pids=map[2172:2171]
strix UNKNOWN STEP 2026-08-14T14:57:07.8469341Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO ProtectedBPFIDs module=armour ids="[20 18 14 21 19]"
strix UNKNOWN STEP 2026-08-14T14:57:07.8470967Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO File Info module=armour inoKey="{Device:24 Inode:12923}" path=/proc/2047/mem
strix UNKNOWN STEP 2026-08-14T14:57:07.8472508Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO File Info module=armour inoKey="{Device:24 Inode:16099}" path=/proc/2027/mem
strix UNKNOWN STEP 2026-08-14T14:57:07.8474043Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO File Info module=armour inoKey="{Device:2049 Inode:90277}" path=/etc/sudoers.d/runner
strix UNKNOWN STEP 2026-08-14T14:57:07.8475620Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO File Info module=armour inoKey="{Device:28 Inode:958}" path=/etc/resolv.conf
strix UNKNOWN STEP 2026-08-14T14:57:07.8477831Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO File Info module=armour inoKey="{Device:2049 Inode:508}" path=/etc/systemd/resolved.conf
strix UNKNOWN STEP 2026-08-14T14:57:07.8479424Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO File Info module=armour inoKey="{Device:2049 Inode:323628}" path=/etc/docker/daemon.json
strix UNKNOWN STEP 2026-08-14T14:57:07.8481145Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Protection maps populated module=armour
strix UNKNOWN STEP 2026-08-14T14:57:07.8482351Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Protection maps are freezed module=armour
strix UNKNOWN STEP 2026-08-14T14:57:07.8483527Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Linking completed module=armour
strix UNKNOWN STEP 2026-08-14T14:57:07.8484593Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Armour engaged module=armour
strix UNKNOWN STEP 2026-08-14T14:57:07.8485681Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO RingBuffer created module=armour size=16384
strix UNKNOWN STEP 2026-08-14T14:57:07.8487252Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO Listening for events module=armour
strix UNKNOWN STEP 2026-08-14T14:57:07.8488527Z Aug 14 14:42:49 runnervmzvulz agentservice[2171]: 2026/08/14 14:42:49 INFO [LOCKDOWN] Runner.Worker PID set module=armour pid=2047
strix UNKNOWN STEP 2026-08-14T14:57:07.8489280Z
strix UNKNOWN STEP 2026-08-14T14:57:08.1838755Z Cleaning up orphan processes
Failed check: Close Empty PR/close-empty
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806448576/job/94786430576
- Workflow run id:
31806448576 - Check run id:
94786430576
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for close-empty-pr-ContextualWisdomLab/.github-934 exists
Failed check: CodeQL PR/Detect CodeQL languages
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450748/job/94786437495
- Workflow run id:
31806450748 - Check run id:
94786437495
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for codeql-pr-ContextualWisdomLab/.github-934 exists
Failed check: OSV-Scanner PR/osv-scan / osv-scan
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806451231/job/94786439505
- Workflow run id:
31806451231 - Check run id:
94786439505
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for osv-scanner-pr-ContextualWisdomLab/.github-934 exists
Failed check: Python Security/Detect Python
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450863/job/94786438642
- Workflow run id:
31806450863 - Check run id:
94786438642
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for python-security-ContextualWisdomLab/.github-934 exists
Failed check: SAST Semgrep/Semgrep (multi-language SAST)
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450877/job/94786438020
- Workflow run id:
31806450877 - Check run id:
94786438020
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for sast-semgrep-ContextualWisdomLab/.github-934 exists
Failed check: SBOM Generation/generate-sbom
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450860/job/94786438260
- Workflow run id:
31806450860 - Check run id:
94786438260
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for sbom-generation-ContextualWisdomLab/.github-934 exists
Failed check: Scorecard PR/Scorecard
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450746/job/94786438156
- Workflow run id:
31806450746 - Check run id:
94786438156
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for scorecard-pr-ContextualWisdomLab/.github-934 exists
Failed check: Secret Scan/gitleaks (secret scan)
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450937/job/94786438992
- Workflow run id:
31806450937 - Check run id:
94786438992
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for secret-scan-ContextualWisdomLab/.github-934 exists
Failed check: Security Scan/osv-scan
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450794/job/94786437936
- Workflow run id:
31806450794 - Check run id:
94786437936
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for security-scan-ContextualWisdomLab/.github-934 exists
Failed check: Strix Security Scan/strix
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806448898/job/94786432175
- Workflow run id:
31806448898 - Check run id:
94786432175
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for strix-pull_request_target-ContextualWisdomLab/.github-pr-934 exists
Failed check: Python Security/Bandit (Python SAST)
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450863/job/94786559962
- Workflow run id:
31806450863 - Check run id:
94786559962
Failed check: Security Scan/dependency-review
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450794/job/94786437761
- Workflow run id:
31806450794 - Check run id:
94786437761
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for security-scan-ContextualWisdomLab/.github-934 exists
Failed check: Strix Security Scan/publish-manual-pr-evidence-status
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806448898/job/94786562862
- Workflow run id:
31806448898 - Check run id:
94786562862
Failed check: Python Security/pip-audit (Python dependency audit)
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450863/job/94786560129
- Workflow run id:
31806450863 - Check run id:
94786560129
Failed check: Security Scan/trivy-fs
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450794/job/94786437969
- Workflow run id:
31806450794 - Check run id:
94786437969
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for security-scan-ContextualWisdomLab/.github-934 exists
Failed check: Security Scan/scorecard
- Type:
check_run - Conclusion:
CANCELLED - Details URL: https://github.com/ContextualWisdomLab/.github/actions/runs/31806450794/job/94786437839
- Workflow run id:
31806450794 - Check run id:
94786437839
Check annotations
- .github:1-1 [failure] Canceling since a higher priority waiting request for security-scan-ContextualWisdomLab/.github-934 exists
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: scheduler-utf8-graphql-fallback.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: scheduler-utf8-graphql-fallback.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: pr_review_merge_scheduler.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: pr_review_merge_scheduler.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
seonghobae
marked this pull request as draft
August 15, 2026 12:27
Unicode refs and large org queues must fall back to REST instead of aborting the merge scheduler. Do not rewrite hashed review-agent workflows.
seonghobae
force-pushed
the
fix/scheduler-fallback-invalid-utf8
branch
from
August 16, 2026 19:00
0e1218c to
c9c83a3
Compare
seonghobae
marked this pull request as ready for review
August 16, 2026 19:00
seonghobae
enabled auto-merge (squash)
August 16, 2026 19:00
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
The shared PR scheduler failed while fetching the first GraphQL PR page with
invalid UTF-8 string. That error was not classified as transient, so the existing REST fallback was never used. The same queue path can also exceed GitHub GraphQL query resource limits on a large open-PR inventory.Bounded fix
invalid UTF-8 stringandResource limits for this query exceededin the existing transient GitHub API family.Resource not accessible by integration.docs/doctoring/scheduler-utf8-graphql-fallback.md.Scope correction
Exact current head:
0e1218ce6305cb569c2f0f4b081ee1e2943bb005.The final protected-base diff is limited to:
scripts/ci/pr_review_merge_scheduler.pytests/test_pr_review_merge_scheduler.pydocs/doctoring/scheduler-utf8-graphql-fallback.mdCHANGELOG.mdTwo temporary branch-writing workflows were removed after their cleanup push was rejected because the workflow token lacked
workflowspermission. UnrelatedAGENTS.md,CLAUDE.md,ARCHITECTURE.md, and trusted-uv materializer-test changes were restored to protected-main scope. No temporary workflow remains.Merge gate
The scope cleanup changed the exact head, so every earlier check and review is historical. Keep Draft until the unchanged current head completes the scheduler/full-suite, 100% owned statement/branch coverage, public-docstring, security, SAST, dependency/SBOM, and semantic-review cycle with zero valid unresolved findings. Then mark Ready, request qualifying non-author exact-head review, and integrate only through normal protected-main policy; no self-approval, stale evidence, or bypass is authorized.