ci: anchor rootless matrix selfcheck - #428
Conversation
|
Warning Review limit reached
Next review available in: 16 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…rift fixes (#429) * Fix pre-existing CI drift (fuzz + rootless + clippy) + viewer unfinished_tab properties Four bounded cleanups observed while CI was running on #425/#427: 1) scripts/fuzz-cadence-check.ps1: the "PR smoke stays short" anchor was checking ci.yml for max_total_time=10, but the 10s fuzz-smoke job no longer lives there (consolidated into fuzz-blocking.yml at 30s). Re-pointed the check at the actual PR fuzz budget: fuzz-blocking.yml with max_total_time=30. 2) scripts/rootless-nonet-check.ps1 + .github/workflows/ci.yml: the script expected ci.yml to cross-reference rootless-nonet.yml, but that anchor had drifted out of ci.yml while security.yml retained it. Added a small rootless-nonet-policy smoke job to ci.yml (matches the docs/ops/sandbox-boundary.md C04 L40 contract that 'ci.yml cross-reference | done') and tightened the script's regex so continue-on-error detection can't bleed across jobs. 3) clippy -D warnings under --all-targets --all-features: * tests/alloc_profile.rs: panic-in-if-then — folded the Windows panic into an explicit else branch. * tests/replay_breadth.rs: 6 unnecessary trailing commas in assert! macros. 4) crates/sl-viewer/tests/properties_viewer_unfinished_tab.rs: 6 proptest properties covering reason_label (non-empty, injective) and unfinished_items (deterministic, descending by ts_ms, tiebreak by session_id asc, length-monotonic). Adds to WBS-6.2 viewer property surface alongside #425/#427. WBS-6.2 evidence list and CHANGELOG Unreleased reflect the new property file. * WBS-6.2: link new viewer unfinished_tab surface + CI drift fixes WBS-6.2 evidence list and TRACEABILITY.json gain the new properties_viewer_unfinished_tab.rs and reference #428 for the unfinished-tab properties + CI drift fixups. Status stays partial (fuzzing cadence, full loom/shuttle, perf-budget gates remain). --------- Co-authored-by: SessionLedger Bot <team@sessionledger.local>
#432) * fix: tighten per-CodeRabbit review + harden rootless-matrix policy scoping Follow-up to #428 + #429 carrying the CodeRabbit review items that landed after #429's merge. Rebased onto origin/main (which now carries both PRs) to keep the deltas minimal. 1) crates/sl-viewer/tests/properties_viewer_unfinished_tab.rs — redesign the session strategy around per-message Option<i64> timestamps (instead of session-wide) so the detect_unfinished.find_map(|m| m.ts_ms).rev() projection is exercised naturally. Add a 7th property (unfinished_items_last_activity_matches_session_max_ts) that asserts the projected last_activity_ms matches the session's reverse-walk max known ts_ms. Tighten orders_known_timestamps_descending to retain all items (including None) and verify no Some(ts) ever appears after a None (None is the 'unknown last activity' sentinel and must sort last). 2) tests/alloc_profile.rs — narrow non-Windows fallback to NotFound. Hard-panic on any other io::ErrorKind (permission, broken pipe, etc.) since those signal a misconfigured test environment rather than the portable-pwsh-missing case. 3) scripts/rootless-nonet-check.ps1 — throw when the rootless-nonet-policy block is absent (instead of treating a failed match as success). The block is a documented C04 L40 anchor; absence is a drift, not an acceptable state. 4) scripts/rootless-matrix-check.ps1 — same throw-on-absent fix plus the '^ rootless-matrix-policy:.*?continue-on-error:\s*true' regex was bleeding into the next security job's 'continue-on- error: true' (security starts on the line right after the matrix policy job). Replaced with [regex]::Match + a proper terminator ('(?=^ [A-Za-z][\w-]*:\s|\z)') so the check scopes to just the policy block. Mirrors the fix already applied to rootless-nonet-check.ps1 in #429. 5) .github/workflows/ci.yml — pin actions/checkout to the immutable 3d3c42e5 SHA + persist-credentials: false for both policy jobs (rootless-nonet-policy, rootless-matrix-policy). Brings the policy jobs in line with the rest of the repo's checked-in workflows. * fix(viewer): use WebExportProvider::default_subdir instead of hardcoded literals The `WebExportProvider::default_subdir` method has been a dead_code warning since it was added (sl-viewer help unit tests compile the library with RUSTFLAGS=-D warnings, so the lint fails the PR gate). Drive the `defaults` array in `web_export_roots_with_env` from `default_subdir` instead of repeating the literal strings, which both removes the dead_code error and keeps the canonical name table in one place. `default_subdir` becomes `pub` so the function is reachable from outside the impl block via the method path used in `defaults`. Pre-existing on main; surfaced when running `cargo test cli_help` under `-D warnings` on the viewer-unfinished-tab-fixes branch. * fix(ci): align hermetic.yml reusable workflow pin with documented SHA `scripts/reusable-provenance-check.ps1 -SelfCheck` enforces that every caller workflow pins the reusable hermetic build workflow to the SHA documented in `docs/ops/reusable-hermetic-pin.{md,json}` (currently `ec8916547e5678f72fe6894509249f9b23367b80`). `hermetic.yml` was pinned to `a8db485c046f9efab8ee51f25edb8f2458c95694` instead — the documented and the in-file pins drifted. Update the in-file pin to the documented SHA so the C06 L53 anchor holds. Pre-existing on main; surfaced when running `hermetic · reusable workflow provenance (soft)` on the viewer-unfinished-tab-fixes branch. * chore(changelog): WBS-6.2 #432 CI drift follow-ups --------- Co-authored-by: SessionLedger Bot <team@sessionledger.local>
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
|
|
||
| # Blocking C04 L40 rootless-only OCI runner matrix scaffold — full PR gate in | ||
| # .github/workflows/rootless-matrix.yml; this job is a fast ci.yml anchor smoke. | ||
| rootless-matrix-policy: |
There was a problem hiding this comment.
WARNING: Missing if: github.event_name == 'pull_request' condition
All other policy SelfCheck jobs in this file (eval-reproducibility-policy, signing-readiness-policy) use if: github.event_name == 'pull_request'. Without this condition, rootless-matrix-policy will also run on every push to main/develop, adding unnecessary CI load and diverging from the established pattern for validation jobs.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| "rust_msrv": "1.85", | ||
| "toolchain_channel": "stable", | ||
| "cargo_lock_sha256": "b59b3dacbb01caf229e0ba30fe9922cbfe7895055ae05a37f3a702dc89f11a86", | ||
| "cargo_lock_sha256": "5963c9b9dd8fa3d3e3003b6f05aa911724106234d7c9bf3a745e125e20ee4195", |
There was a problem hiding this comment.
WARNING: Missing validation command for cargo_lock_sha256 update
The PR updates the Cargo.lock SHA-256 hash but does not include ./scripts/eval-repro-check.ps1 -SelfCheck in the listed validation commands. This script is the authoritative check for manifest integrity (it computes the actual SHA-256 and compares it). If the hash is incorrect, all contributor CI runs will fail on the eval reproducibility check.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 2 Warnings Found | Recommendation: Approve with Notes Overview
Issue Details (click to expand)WARNING
Files Reviewed (3 files)
Fix these issues in Kilo Cloud Reviewed by step-3.7-flash · Input: 92.5K · Output: 14.1K · Cached: 360.3K |
Summary
rootless-matrix-policyanchor toci.ymlrootless-matrix-check.ps1 -SelfCheckcontract.github/workflows/rootless-matrix.ymlgate without changing its scopeValidation
pwsh -NoProfile -NonInteractive -File scripts/rootless-matrix-check.ps1 -SelfCheckcargo test --test rootless_matrix rootless_matrix_doc_self_check_validates_anchors -- --nocapturegit diff --checkactionlintwas also run; it reports pre-existing issues in the untouched detect shell and existing dependency-review output reference outside this patch.This PR intentionally does not touch Trunk, accessibility, fuzz, OKF, or other security gates.