fix(opencode-review): surface exact coverage setup failures

.github/workflows/codeql-pr.yml

@@ -90,13 +90,13 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}"
           upload: false
@@ -197,13 +197,13 @@ jobs:
           ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}-merge"
           upload: false

.github/workflows/opencode-coverage-diagnostics-ci.yml

@@ -0,0 +1,242 @@
+name: OpenCode Coverage Diagnostics CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "scripts/ci/coverage_failure_summary.py"
+      - "scripts/ci/javascript_coverage_gate.py"
+      - "scripts/ci/materialize_base_javascript_packages.py"
+      - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/sanitize_github_output_summary.py"
+      - "scripts/ci/strix_model_utils.sh"
+      - "tests/test_javascript_coverage_gate.py"
+      - "tests/test_javascript_coverage_gate_type_only.py"
+      - "tests/test_materialize_base_javascript_packages.py"
+      - "tests/test_materialize_base_python_requirements.py"
+      - "tests/test_control_plane_branch_writer_absence.py"
+      - "tests/test_coverage_materializer_failure_diagnostics.py"
+      - "tests/test_coverage_native_fuzz_lock_boundary.py"
+      - "tests/conftest.py"
+      - "tests/test_materialize_uv_export_hash_contract.py"
+      - "tests/test_trusted_uv_download_contract.py"
+      - "tests/test_trusted_uv_materializer_quality_workflow_contract.py"
+      - "tests/test_trusted_uv_portability_and_streaming.py"
+      - "tests/test_uv_export_isolation_contract.py"
+      - "tests/test_uv_redirect_and_coverage_contract.py"
+      - "tests/test_uv_redirect_boundary.py"
+      - "tests/test_uv_workspace_fail_closed.py"
+      - "tests/test_sanitize_github_output_summary.py"
+      - "tests/test_strix_dependency_security_floor.py"
+      - "tests/test_strix_model_utils_source_dirs.py"
+      - "requirements-opencode-python310-ci-hashes.txt"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-strix-ci.txt"
+      - "requirements-strix-ci-hashes.txt"
+      - "pyproject.toml"
+      - ".github/workflows/opencode-coverage-diagnostics-ci.yml"
+  push:
+    branches: [main]
+    paths:
+      - "scripts/ci/coverage_failure_summary.py"
+      - "scripts/ci/javascript_coverage_gate.py"
+      - "scripts/ci/materialize_base_javascript_packages.py"
+      - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/sanitize_github_output_summary.py"
+      - "scripts/ci/strix_model_utils.sh"
+      - "tests/test_javascript_coverage_gate.py"
+      - "tests/test_javascript_coverage_gate_type_only.py"
+      - "tests/test_materialize_base_javascript_packages.py"
+      - "tests/test_materialize_base_python_requirements.py"
+      - "tests/test_control_plane_branch_writer_absence.py"
+      - "tests/test_coverage_materializer_failure_diagnostics.py"
+      - "tests/test_coverage_native_fuzz_lock_boundary.py"
+      - "tests/conftest.py"
+      - "tests/test_materialize_uv_export_hash_contract.py"
+      - "tests/test_trusted_uv_download_contract.py"
+      - "tests/test_trusted_uv_materializer_quality_workflow_contract.py"
+      - "tests/test_trusted_uv_portability_and_streaming.py"
+      - "tests/test_uv_export_isolation_contract.py"
+      - "tests/test_uv_redirect_and_coverage_contract.py"
+      - "tests/test_uv_redirect_boundary.py"
+      - "tests/test_uv_workspace_fail_closed.py"
+      - "tests/test_sanitize_github_output_summary.py"
+      - "tests/test_strix_dependency_security_floor.py"
+      - "tests/test_strix_model_utils_source_dirs.py"
+      - "requirements-opencode-python310-ci-hashes.txt"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-strix-ci.txt"
+      - "requirements-strix-ci-hashes.txt"
+      - "pyproject.toml"
+      - ".github/workflows/opencode-coverage-diagnostics-ci.yml"
+
+concurrency:
+  group: opencode-coverage-diagnostics-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  minimum-python-contract:
+    name: Python 3.10 runtime contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up minimum supported Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Install hash-locked Python 3.10 compatibility dependency
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          --only-binary=:all:
+          -r requirements-opencode-python310-ci-hashes.txt
+
+      - name: Compile production modules on Python 3.10
+        run: |
+          python -m compileall -q \
+            scripts/ci/coverage_failure_summary.py \
+            scripts/ci/javascript_coverage_gate.py \
+            scripts/ci/materialize_base_javascript_packages.py \
+            scripts/ci/materialize_base_python_requirements.py \
+            scripts/ci/sanitize_github_output_summary.py
+
+      - name: Exercise exact failure evidence on Python 3.10
+        run: |
+          python - <<'PY'
+          import os
+          import pathlib
+          import tempfile
+
+          from scripts.ci import materialize_base_javascript_packages as javascript_materializer
+          from scripts.ci import materialize_base_python_requirements as python_materializer
+
+          with tempfile.TemporaryDirectory() as directory:
+              output = pathlib.Path(directory) / "github-output"
+              os.environ["GITHUB_OUTPUT"] = str(output)
+              exact_reason = (
+                  "current-head npm lock package-lock.json package "
+                  "apps/desktop/node_modules/@types/react-dom must pin a registry "
+                  "tarball and SHA-512 integrity"
+              )
+              javascript_materializer._publish_coverage_failure_summary(
+                  "Base JavaScript package lock materialization",
+                  ValueError(exact_reason),
+                  "Repair the lock and rerun coverage-evidence.",
+              )
+              python_materializer._publish_coverage_failure_summary(
+                  "Base Python lock materialization",
+                  OSError("fixture <unsafe>\nCWL_COVERAGE_SUMMARY_EOF"),
+                  "Repair the trusted lock and rerun coverage-evidence.",
+              )
+              published = output.read_text(encoding="utf-8")
+              assert f"ValueError: {exact_reason}" in published
+              assert "OSError: fixture &lt;unsafe&gt; CWL_COVERAGE_SUMMARY_END" in published
+              assert published.count("coverage_summary<<CWL_COVERAGE_SUMMARY_EOF") == 2
+          PY
+
+  full-quality-gate:
+    name: Python 3.14 full quality gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up current stable Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install hash-locked test tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Run diagnostics and lock contracts with full branch coverage
+        run: |
+          python -m pytest \
+            tests/test_javascript_coverage_gate.py \
+            tests/test_javascript_coverage_gate_type_only.py \
+            tests/test_materialize_base_javascript_packages.py \
+            tests/test_materialize_base_python_requirements.py \
+            tests/test_control_plane_branch_writer_absence.py \
+            tests/test_coverage_materializer_failure_diagnostics.py \
+            tests/test_coverage_native_fuzz_lock_boundary.py \
+            tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_uv_download_contract.py \
+            tests/test_trusted_uv_materializer_quality_workflow_contract.py \
+            tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_uv_export_isolation_contract.py \
+            tests/test_uv_redirect_and_coverage_contract.py \
+            tests/test_uv_redirect_boundary.py \
+            tests/test_uv_workspace_fail_closed.py \
+            tests/test_sanitize_github_output_summary.py \
+            tests/test_strix_dependency_security_floor.py \
+            tests/test_strix_model_utils_source_dirs.py \
+            --cov=scripts.ci.coverage_failure_summary \
+            --cov=scripts.ci.javascript_coverage_gate \
+            --cov=scripts.ci.materialize_base_javascript_packages \
+            --cov=scripts.ci.materialize_base_python_requirements \
+            --cov=scripts.ci.sanitize_github_output_summary \
+            --cov-branch \
+            --cov-fail-under=100 \
+            -q
+
+      - name: Enforce complete production docstrings
+        run: |
+          python -m interrogate \
+            --fail-under 100 \
+            scripts/ci/coverage_failure_summary.py \
+            scripts/ci/javascript_coverage_gate.py \
+            scripts/ci/materialize_base_javascript_packages.py \
+            scripts/ci/materialize_base_python_requirements.py \
+            scripts/ci/sanitize_github_output_summary.py
+
+      - name: Compile changed Python surfaces
+        run: |
+          python -m compileall -q \
+            scripts/ci/coverage_failure_summary.py \
+            scripts/ci/javascript_coverage_gate.py \
+            scripts/ci/materialize_base_javascript_packages.py \
+            scripts/ci/materialize_base_python_requirements.py \
+            scripts/ci/sanitize_github_output_summary.py \
+            tests/test_javascript_coverage_gate.py \
+            tests/test_javascript_coverage_gate_type_only.py \
+            tests/test_control_plane_branch_writer_absence.py \
+            tests/test_coverage_materializer_failure_diagnostics.py \
+            tests/test_coverage_native_fuzz_lock_boundary.py \
+            tests/test_materialize_uv_export_hash_contract.py \
+            tests/test_trusted_uv_download_contract.py \
+            tests/test_trusted_uv_materializer_quality_workflow_contract.py \
+            tests/test_trusted_uv_portability_and_streaming.py \
+            tests/test_uv_export_isolation_contract.py \
+            tests/test_uv_redirect_and_coverage_contract.py \
+            tests/test_uv_redirect_boundary.py \
+            tests/test_uv_workspace_fail_closed.py \
+            tests/test_sanitize_github_output_summary.py \
+            tests/test_strix_dependency_security_floor.py \
+            tests/test_strix_model_utils_source_dirs.py