fix(maint): close #2882 verifier CONCERNS gaps - #2903
Merged
Conversation
Add a pre-PR pin validation gate that security_override cannot skip, supersede overlapping Dependabot/Renovate pin PRs after the canonical source proposal exists, and strengthen Maint 52 / deliberate-break AC tests. Co-authored-by: Cursor <cursoragent@cursor.com>
stranske
added
agent:codex
stranske
added
codex-automation
agent:codex
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
15 tasks
stranske
added
the
agent:retry
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 19 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe source workflow validates synchronized pins before proposal creation, records the canonical source PR, and closes overlapping Dependabot or Renovate PRs. Documentation and tests verify validation output, security-override handling, canonical source-commit reporting, and propagation-only behavior. ChangesCanonical source lane
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant SourceWorkflow
participant SyncChecks
participant GitHubPullRequests
participant DependencyBotPRs
SourceWorkflow->>SyncChecks: run synchronized pin and lockfile checks
SyncChecks-->>SourceWorkflow: return validation status
SourceWorkflow->>GitHubPullRequests: create or refresh canonical source PR
GitHubPullRequests-->>SourceWorkflow: return source PR number
SourceWorkflow->>DependencyBotPRs: find overlapping open PRs
DependencyBotPRs-->>SourceWorkflow: return matching PRs
SourceWorkflow->>GitHubPullRequests: close overlapping bot PRs
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
|
Runner dispatch state for codex on PR #2903. Do not edit. |
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 19:48 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/maint-auto-update-pypi-versions.yml:
- Around line 225-231: The bot PR filter in the gh pr list jq expression is
spoofable because it matches author-name substrings and headRefName prefixes.
Update the filter to allow only exact, configured trusted bot logins via
author.login, remove the headRefName condition entirely, and flag the spoofable
bot-actor check in the workflow as required.
In `@tests/workflows/test_dev_tool_source_lane.py`:
- Around line 20-32: Strengthen
test_source_lane_validates_pins_before_create_pr_even_for_security_override to
assert both PR creation paths assign source_pr via $GITHUB_OUTPUT, and that
cleanup only runs when steps.create_pr.outputs.source_pr is non-empty. Keep the
existing ordering and command assertions, and flag any new or changed behavior
lacking an accompanying test.
In `@tests/workflows/test_maint52_sync_dev_versions_pr_body.py`:
- Around line 46-50: Strengthen the metadata assertion in the test covering the
workflow body so it specifically verifies that source_commit is assigned or
rendered from CANONICAL_SOURCE_SHA. Remove the broad '"source_commit"' fallback,
while preserving valid direct source_commit:$source_commit coverage and the
existing command assertions. Add or update a test for this changed validation
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6bc47b89-e844-4a4c-ae8c-38fdeaca9e5b
📒 Files selected for processing (5)
.github/workflows/maint-auto-update-pypi-versions.ymldocs/ci/TOOL_VERSION_MANAGEMENT.mdtests/scripts/test_sync_dev_dependencies.pytests/workflows/test_dev_tool_source_lane.pytests/workflows/test_maint52_sync_dev_versions_pr_body.py
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a19482d612
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+220
to
+221
| "pyproject.toml" | ||
| "requirements.lock" |
There was a problem hiding this comment.
When a weekly dev-tool bump coincides with a legitimate Renovate update to another dependency such as pydantic or pre-commit, that Renovate PR also changes pyproject.toml and usually requirements.lock. Because these mixed-ownership files are treated as wholly managed and overlap is checked only by path, the workflow closes that PR even though the canonical source proposal does not supersede its dependency update. This conflicts with the non-dev-tool Renovate lane defined in renovate-presets/fleet.json; compare the actual changed packages or pin lines instead of treating either entire file as overlapping.
Useful? React with 👍 / 👎.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR closes the remaining acceptance gaps from #2882 by tightening the canonical dev-tool “source lane” workflow so it validates synchronized pin surfaces before creating/updating the source PR, and only then supersedes overlapping Dependabot/Renovate PRs. It also strengthens tests and documentation to enforce that Maint 52 is propagation-only and reports the settled canonical source commit.
Changes:
- Added a non-bypassable validation gate (
sync_tool_versions.py --check+sync_dev_dependencies.py --check --lockfile) before opening/refreshing the canonical source PR, including duringsecurity_override. - Added post-create PR logic to close overlapping Dependabot/Renovate PRs that touch Workflows-owned pin surfaces (supersession instead of racing).
- Strengthened tests and docs to enforce/describe the settled source commit reporting and the deliberate lockfile mismatch assertion.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/maint-auto-update-pypi-versions.yml |
Adds pre-PR validation gate and post-PR supersession of overlapping dependency-bot PRs. |
tests/workflows/test_dev_tool_source_lane.py |
Asserts ordering/behavior: validate → create PR → supersede, plus settled-source reporting invariants. |
tests/workflows/test_maint52_sync_dev_versions_pr_body.py |
Adds AC coverage ensuring Maint 52 reports canonical source commit and never runs --apply bumps. |
tests/scripts/test_sync_dev_dependencies.py |
Makes the deliberate-break mismatch assertion explicit (path/tool + version delta). |
docs/ci/TOOL_VERSION_MANAGEMENT.md |
Documents the validation gate and supersession rule for the canonical source lane. |
Owner
Author
|
Runner dispatch state for autofix on PR #2903. Do not edit. |
Contributor
|
Autofix updated these files:
|
Contributor
🤖 Bot Comment Handler
The agent has been assigned to this PR to address the bot review comments. Instructions for agent
The bot comment handler workflow has prepared context in the artifacts. |
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 20:26 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Owner
Author
|
Addressed the current review findings in 62c1291: bot supersession now admits only exact Dependabot/Renovate logins and closes only when managed-file patches share an actual normalized pin key with the canonical source proposal. Strengthened source-PR handoff and canonical-SHA assertions. Validation: actionlint plus 8 focused pytest cases passed. |
stranske
force-pushed
the
codex/followup-2882-verifier-concerns
branch
from
August 2, 2026 20:27
62c1291 to
a5a5a0d
Compare
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 20:29 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
stranske
temporarily deployed
to
agent-high-privilege
August 2, 2026 20:36 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
15 tasks
Contributor
Provider Comparison ReportProvider Summary
📋 Full Provider Details (click to expand)openai
anthropic
Agreement
Disagreement
Unique Insights
🔍 LangSmith Traces |
Owner
Author
Closer disposition (cursor) — verifier CONCERNS are follow-up-scope false positiveAudited Provider Comparison Report on merged #2903 (comment 5160257720, openai/anthropic both CONCERNS) against current delivery for closed source #2882. Why the CONCERNS do not reopen completion debt
Decision: no additional follow-up PR/issue. Treat #2903 CONCERNS as a scoped-report false positive (follow-up scored as full AC). Chain remains terminal. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2882
Summary
Bounded closer follow-up after merged #2902 received durable
verify:compareCONCERNS (Provider Comparison Report 2026-08-02T19:30:48Z). Audited current main and landed the residual acceptance gaps:sync_tool_versions.py --checkandsync_dev_dependencies.py --check --lockfileafter applying pin updates and before Create PR;security_overridecannot skip this gate.test_maint52_sync_dev_versions_pr_body.pyto prove Maint 52 reports the settled source commit and never runsupdate_versions_from_pypi.py --apply.requirements.lock:ruff+ version delta).docs/ci/TOOL_VERSION_MANAGEMENT.md.Already-satisfied claims left alone: Maint 50 exclusivity, weekly/security policy helper tests, existing template mismatch coverage in
test_sync_tool_versions.py.Test plan
python -m pytest tests/workflows/test_dev_tool_source_lane.py tests/workflows/test_maint52_sync_dev_versions_pr_body.py tests/scripts/test_dev_tool_update_policy.py tests/scripts/test_sync_dev_dependencies.py::test_main_check_reports_lockfile_mismatch -q(16 passed)Automated Status Summary
Scope
Shared developer-tool pins are currently checked and propagated by several scheduled surfaces:
.github/workflows/maint-auto-update-pypi-versions.yml:11-15,45-141,.github/workflows/maint-50-tool-version-check.yml:6-9,43-149, Maint 52, andmaint-sync-env-from-pyproject.yml. The repository documentation indocs/ci/TOOL_VERSION_MANAGEMENT.mdstill describes a partly manual Maint 50 flow even though a daily updater can open source PRs.This is a current churn source: the same upstream version movement can be detected, commented on, proposed, and propagated by different workflows before the canonical source state settles. That creates extra source PRs, consumer waves, and agent decisions.
Context for Agent
Related Issues/PRs
Tasks
.github/workflows/autofix-versions.env,pyproject.toml, consumer/integration template env files, andrequirements.lock..github/workflows/maint-auto-update-pypi-versions.ymlinto the sole source proposal lane with a weekly batch window and a documented security override..github/workflows/maint-50-tool-version-check.yml; retain only a bounded policy/freshness audit if it adds unique evidence..github/workflows/maint-52-sync-dev-versions.ymlpropagation-only: it must consume a settled canonical source commit and must not independently decide newer versions..github/workflows/maint-sync-env-from-pyproject.ymlas a deterministic source-consistency check or replace it with a named equivalent; prevent it from racing the source proposal lane.docs/ci/TOOL_VERSION_MANAGEMENT.md,docs/ops/CONSUMER_REPO_MAINTENANCE.md, and contributor guidance with ownership, cadence, emergency handling, and supersession rules.Acceptance criteria
tests/workflows/test_maint52_sync_dev_versions_pr_body.pyproves Maint 52 reports the canonical source commit and never proposes an upstream version independently.tests/workflows/test_sync_dev_dependencies.pyproves env, pyproject, template, and lockfile pins move together for every managed tool.python scripts/dev_check.py --action testand the workflow-validation suite successfully.Summary by CodeRabbit
Bug Fixes
Documentation