fix(review): keep start_line on remapped leftover 422 retries - #980
Closed
seonghobae wants to merge 21 commits into
Closed
fix(review): keep start_line on remapped leftover 422 retries#980seonghobae wants to merge 21 commits into
seonghobae wants to merge 21 commits into
Conversation
When GitHub refuses inline review comments, the PR-level fallback now lists each sanitized current-head finding location instead of a generic sentence. Suggested diffs stay out of the body.
Rebuild the fallback from gh api stderr after a refused attach so the OpenCode overview keeps each trusted path:line next to the GitHub 422 phrase instead of a location-only list.
A single invalid path:line 422s the whole comments array. After that failure, split the payload and retry each comment so surviving hunks still attach; remaining failures keep the overview receipts.
The publisher moved that phrase out of the workflow YAML, so the exact-head path-policy harness failed looking in the old file.
When some one-at-a-time inline comments attach and others 422, the overview must list only the refused locations so attached hunks are not reported as failed.
Mixed one-at-a-time retries can fail for different reasons. Record path:line plus that comment's gh api error so the overview does not reuse one shared sentence for every refused hunk.
Unbounded one-at-a-time retry after a batch 422 can thrash GitHub, and mixed receipts listed only refused locations. Cap retries at 20, persist attached path:line beside refused ones, and record leftovers the cap left untried so the overview shows every outcome.
GitHub 422s review comments that sit outside every current-head @@ hunk. Filter the payload against git diff --unified=3 first, post only the on-hunk comments, and persist skipped path:line as overview receipts.
Authors could not one-click apply OpenCode inline repairs because the payload only posted ```diff fences. Convert + lines from those diffs into ```suggestion blocks on surviving RIGHT-side hunk comments.
A surviving suggested_diff that removes more than one current-head line still posted as a single-line comment, so Apply suggestion only replaced the first line. Set start_line, line, and start_side when the full span sits on the same hunk; leave off-hunk spans single-line to avoid 422.
Authors could see refused and skipped path:line after a 422, but not which surviving hunks shipped as one-click GitHub suggestions. Persist path:line or path:start-end for comments that carry a suggestion fence.
Overview receipts listed applyable path:start-end ranges, but authors could not tell leftover ```diff fences (cannot-provide / LEFT) from one-click GitHub suggestions. Persist those leftover path:line reasons in a separate overview section.
Leftover cannot-provide and LEFT fences now keep a bounded excerpt in overview receipts as a distinct non-applyable ```diff block so authors can copy the replacement by hand without treating it as a GitHub suggestion range.
When a leftover LEFT suggested-diff still has an extractable replacement and the same path has a current-head RIGHT hunk, move the comment onto that hunk so GitHub can apply it. Pure deletions and cannot-provide fences stay leftover manual-edit blocks.
When a leftover LEFT comment cannot stay on the same RIGHT line, attach it to the first RIGHT line of that @@ hunk instead of the first RIGHT line of the whole path. Multi-hunk files no longer land on an earlier hunk. Pure-deletion hunks stay leftover.
Overview applyable receipts now show path:right came from LEFT path:left when a leftover comment was remapped onto a RIGHT hunk. Local origin keys are stripped before the GitHub POST.
One-at-a-time retry after a batch 422 now copies start_line and start_side so a remapped leftover that spans a multi-line RIGHT hunk still posts as one GitHub suggestion.
seonghobae
enabled auto-merge (squash)
August 13, 2026 09:34
Contributor
Author
|
@cwl-noema-review Please review this exact current head ( |
|
Warning Review limit reached
Next review available in: 106 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
A remapped 422 retry could still list a deleted-side ```suggestion as applyable. GitHub cannot apply LEFT suggestions, so those ranges stay off the overview applyable list.
Contributor
Author
|
@cwl-noema-review |
Drop leftover `<!--`, `-->`, and HTML metacharacters before Manual-edit excerpts enter `<!-- opencode-review-overview -->` so a leftover cannot close that comment or inject markup (CWE-116).
Contributor
Author
|
@cwl-noema-review exact current head |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
Contributor
Author
|
@cwl-noema-review exact current head |
Reject leftover 422-fallback paths that contain -->, <!--, or a suggestion fence so a leftover cannot close the overview HTML comment or reopen an applyable GitHub suggestion block.
Contributor
Author
|
@cwl-noema-review exact current head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
a8109148b30e3190bfda551805db7461f584ede4. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318798/job/94595198193)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318811/job/94595038212)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318842/job/94595039448)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318842/job/94595039448)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318798/job/94595039280)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744319329/job/94595039821)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318778/job/94595039038)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318778/job/94595039196)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318798/job/94595198193)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318798/job/94595039280)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318798/job/94595198067)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318854/job/94595039311)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318897/job/94595039187)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318843/job/94595039521)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318843/job/94595039521)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318767/job/94595039980)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039161)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039105)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039341)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039236)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318854/job/94595039311)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318809/job/94595039428)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318778/job/94595039038)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318778/job/94595039196)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318811/job/94595038212)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318740/job/94595191808)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039161)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318809/job/94595039428)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318897/job/94595039187)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318767/job/94595039980)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744319329/job/94595039821)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039105)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318798/job/94595198067)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318740/job/94595038738)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039341)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31744318813/job/94595039236)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-inline-comment-422-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-inline-comment-422-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-inline-comment-422-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-inline-comment-422-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A remapped leftover LEFT suggestion can already become a multi-line GitHub suggestion on a RIGHT hunk (
start_line/line/start_side). After a batch 422, one-at-a-time retry rebuilt each comment with onlypath/line/side/body, so the range collapsed to a single line.This increment copies a safe
start_line/start_sideonto those single-comment retries so the replacement still applies as one range.Verification
example.pyLEFT 5 + multiline suggested-diff becomes RIGHTstart_line=5/line=7/start_side=RIGHTthroughiter_single_comment_payloads,render_single_comment_review,write_single_comment_payloads, and--split-payload.coverage run -m pytest tests && coverage report --show-missingtwice at 100% (1016 passed,scripts/ci100% statement/branch), theninterrogate100%.@cwl-noema-review