fix(automation): run hourly NVIDIA NIM review repair - #782
Conversation
|
Warning Review limit reached
Next review available in: 36 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (16)
📝 WalkthroughWalkthroughClearfolio 시간별 호출자와 재사용 스케줄러를 구성했습니다. 스케줄러는 호출 워크플로의 저장소, 파일, SHA 및 체크아웃 결과를 검증합니다. 자동수정은 NVIDIA NIM, 허용 경로 목록 및 작업 트리 스냅샷을 사용합니다. Changes시간별 리뷰 복구 흐름
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Verify the one-hour cadence and retry floor, one-dispatch/single-flight bounds, immutable called-workflow and repository-dispatch source binding, |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Repository and requested commits =='
git remote -v
git rev-parse HEAD
git show -s --format='HEAD %H%nparents %P%nsubject %s' HEAD
git cat-file -e '63b50227caefb49abd389a8da41edcfc1d32428e^{commit}' 2>/dev/null && \
git show -s --format='requested-head %H%nparents %P%nsubject %s' 63b50227caefb49abd389a8da41edcfc1d32428e || true
git cat-file -e 'f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae^{commit}' 2>/dev/null && \
git show -s --format='baseline %H%nsubject %s' f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae || true
printf '%s\n' '== Changed paths and diff summary =='
git diff --stat f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae 63b50227caefb49abd389a8da41edcfc1d32428e 2>/dev/null || \
git diff --stat HEAD^ HEAD
git diff --name-status f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae 63b50227caefb49abd389a8da41edcfc1d32428e 2>/dev/null || \
git diff --name-status HEAD^ HEAD
printf '%s\n' '== Candidate automation source =='
fd -HI -t f .github docs 2>/dev/null | sort | \
grep -E 'hourly|review.*repair|dispatch|opencode|automation|doctoring|CHANGELOG' || true
printf '%s\n' '== Workflow and helper outlines =='
for f in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/opencode-review-dispatch.yml
do
if [ -f "$f" ]; then
echo "--- $f"
nl -ba "$f"
fi
done
printf '%s\n' '== Security-sensitive references in tracked text files =='
rg -n -i -C 3 \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|github models|models:|mistral-nemotron|nemotron-3-nano|canonical_ref|repository_dispatch|workflow_call|concurrency|cron|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|pull-requests:\s*write|contents:\s*write|gh pr (merge|review)|release' \
.github docs CHANGELOG.md 2>/dev/null || true
printf '%s\n' '== Independent reviewer workflow blob comparison =='
if git cat-file -e 'f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae:.github/workflows/opencode-review-dispatch.yml' 2>/dev/null; then
echo -n 'baseline blob: '
git rev-parse 'f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae:.github/workflows/opencode-review-dispatch.yml'
fi
if git cat-file -e '63b50227caefb49abd389a8da41edcfc1d32428e:.github/workflows/opencode-review-dispatch.yml' 2>/dev/null; then
echo -n 'head blob: '
git rev-parse '63b50227caefb49abd389a8da41edcfc1d32428e:.github/workflows/opencode-review-dispatch.yml'
fi
printf '%s\n' '== Referenced workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '"\(.id) \(.name) status=\(.status) conclusion=\(.conclusion) head_sha=\(.head_sha) event=\(.event)"' \
2>&1 || true
doneLength of output: 5016 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='63b50227caefb49abd389a8da41edcfc1d32428e'
base_sha='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
show_numbered() {
file="$1"
if [ -f "$file" ]; then
echo "--- $file"
awk '{ printf "%5d %s\n", NR, $0 }' "$file"
else
echo "--- MISSING: $file"
fi
}
printf '%s\n' '== Exact changed workflow diff =='
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-autofix.yml \
.github/workflows/pr-review-fix-scheduler.yml
printf '%s\n' '== Current workflow source =='
show_numbered .github/workflows/hourly-nvidia-nim-review-repair.yml
show_numbered .github/workflows/pr-review-autofix.yml
show_numbered .github/workflows/pr-review-fix-scheduler.yml
printf '%s\n' '== Contract-test source =='
for f in \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py
do
show_numbered "$f"
done
printf '%s\n' '== Repository-wide security-sensitive executable references =='
git grep -n -I -E \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.inference\.ai|github[ _-]?models|canonical_ref|ACTIONS_ID_TOKEN_REQUEST_TOKEN|ACTIONS_ID_TOKEN_REQUEST_URL|GITHUB_TOKEN|GH_TOKEN|repository_dispatch|workflow_call|concurrency:|cron:|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|gh pr (merge|review)|gh release|branches/.+protection' \
"$head_sha" -- .github ':!*.md' || true
printf '%s\n' '== Independent reviewer workflow immutable blob check =='
expected_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
base_blob=$(git rev-parse "$base_sha:.github/workflows/opencode-review-dispatch.yml")
head_blob=$(git rev-parse "$head_sha:.github/workflows/opencode-review-dispatch.yml")
printf 'expected=%s\nbaseline=%s\nhead=%s\n' "$expected_blob" "$base_blob" "$head_blob"
git diff --no-ext-diff --exit-code "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml || true
printf '%s\n' '== Requested workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
printf 'run %s: ' "$run"
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '[.id, .name, .status, .conclusion, .head_sha, .event] | `@tsv`' 2>&1 || true
doneLength of output: 156113 🤖 web_search executed:
Length of output: 13390
I found no actionable findings in the requested scope. Verified items:
GitHub documents the This review covers current PR I do not issue approval. Approval must remain subject to the required independent reviewer and branch-protection policy.
|
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head |
|
I will verify the requested scheduler, source-binding, NVIDIA NIM credential, token-scrubbing, permission, safety-guard, independent-reviewer, and documentation controls. I will not reuse
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='63b50227caefb49abd389a8da41edcfc1d32428e'
base_expected='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
printf '%s\n' '== checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== expected commits present =='
git cat-file -e "${head_expected}^{commit}"
git cat-file -e "${base_expected}^{commit}"
printf '%s\n' '== changed paths =='
git diff --name-status "$base_expected" "$head_expected"
printf '%s\n' '== changed workflow files =='
git diff --stat "$base_expected" "$head_expected" -- .github/workflows
fd -a -t f .github/workflows | sort
printf '%s\n' '== workflow and helper symbols =='
for f in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/opencode-review-dispatch.yml
do
if [ -f "$f" ]; then
printf '\n--- %s ---\n' "$f"
cat -n "$f"
fi
done
printf '%s\n' '== references to hourly scheduler, dispatch, and model authentication =='
rg -n -C 3 \
-e 'NVIDIA_NIM_API_KEY' \
-e 'COPILOT_GITHUB_TOKEN' \
-e 'GitHub Models|models\.github' \
-e 'canonical_ref' \
-e 'repository_dispatch|workflow_dispatch|concurrency|cron' \
-e 'GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST' \
-e 'opencode|nemotron|mistral-nemotron' \
-e 'pull-requests:\s*write|contents:\s*write|actions:\s*write' \
.github scripts 2>/dev/null || trueLength of output: 2843 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
printf '%s\n' '== independent reviewer workflow blob at head and base =='
git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml"
git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml"
git diff --exit-code "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml \
&& echo 'independent-reviewer workflow: unchanged'
printf '%s\n' '== all workflow paths at reviewed head =='
git ls-tree -r --name-only "$head" .github/workflows | sort
for f in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-autofix.yml \
.github/workflows/pr-review-fix-scheduler.yml
do
printf '\n== %s at exact head ==\n' "$f"
git show "${head}:${f}" | cat -n
done
printf '%s\n' '== exact workflow diffs =='
git diff --unified=80 "$base" "$head" -- \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-autofix.yml \
.github/workflows/pr-review-fix-scheduler.yml
printf '%s\n' '== scheduler/autofix source and credential references at exact head =='
git grep -n -I -E \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.github|GitHub Models|canonical_ref|ACTIONS_ID_TOKEN_REQUEST|GITHUB_TOKEN|GH_TOKEN|repository_dispatch|workflow_call|workflow_dispatch|concurrency|cron|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b' \
"$head" -- .github scripts 2>/dev/null || true
printf '%s\n' '== focused contract test outlines =='
ast-grep outline tests/test_pr_review_autofix_nvidia_nim_contract.py --items all
ast-grep outline tests/test_pr_review_fix_hourly_contract.py --items all
ast-grep outline tests/test_pr_review_fix_scheduler_source_pin.py --items all
printf '%s\n' '== focused contract test assertions =='
for f in \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py
do
printf '\n== %s ==\n' "$f"
git show "${head}:${f}" | sed -n '1,280p'
doneLength of output: 223866 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
printf '%s\n' '== scheduler helper outline =='
ast-grep outline scripts/ci/pr_review_fix_scheduler.py --items all
printf '%s\n' '== scheduler helper dispatch, bounds, and guard references =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" |
nl -ba |
grep -E -C 8 \
'max.dispatch|retry.hours|repository.dispatch|autofix|head.sha|live.head|allowed|allowlist|same.repository|pull.request|conflict|syntax|dispatch' || true
printf '%s\n' '== selected helper source =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" | sed -n '1,920p'
printf '%s\n' '== prohibited worker operation scan =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
nl -ba |
grep -Ei -C 4 \
'pulls/.*/merge|/merges|merge.pull|pulls/.*/reviews|approve|releases|branches/.*/protection|rulesets|gh pr (merge|review)|gh release|gh api.*(merge|protection|ruleset|releases)' || true
printf '%s\n' '== operator documentation =='
for f in \
docs/automation/hourly-review-repair.md \
docs/doctoring/hourly-nvidia-nim-autofix.md \
CHANGELOG.md
do
printf '\n== %s ==\n' "$f"
git show "${head}:${f}" | cat -n
doneLength of output: 39579
I verified commit You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Please review exact head |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
expected_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf '%s\n' '== reviewed commits =='
git show -s --format='head=%H%nbase=%P%nsubject=%s' "$head"
git show -s --format='baseline=%H%nsubject=%s' "$base"
printf '%s\n' '== changed paths =='
git diff --name-status "$base" "$head"
printf '%s\n' '== scheduler and autofix workflow at exact head =='
for path in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/pr-review-autofix.yml \
scripts/ci/pr_review_fix_scheduler.py \
docs/automation/hourly-review-repair.md \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | nl -ba
done
printf '%s\n' '== independent reviewer blob =='
printf 'expected=%s\n' "$expected_blob"
printf 'base=%s\n' "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
printf 'head=%s\n' "$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
git diff --exit-code "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== security-sensitive references at exact head =='
git grep -n -I -E \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.github|GitHub Models|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|23 \* \* \* \*|retry.hours|canonical_ref|job\.workflow_(repository|sha|ref|file_path)|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|gh pr (merge|review)|pulls/.*/(merge|reviews)|releases|branches/.+protection|rulesets|git add -A|conflicted_files' \
"$head" -- .github scripts docs ':!*.md' || true
printf '%s\n' '== current-head workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '[.id, .name, .status, .conclusion, .head_sha, .event] | `@tsv`' \
2>&1 || true
doneLength of output: 3363 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
expected_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
show_file() {
path="$1"
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | awk '{ printf "%5d %s\n", NR, $0 }'
}
printf '%s\n' '== exact-head workflow and helper source =='
for path in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/pr-review-autofix.yml \
scripts/ci/pr_review_fix_scheduler.py \
docs/automation/hourly-review-repair.md \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
show_file "$path"
done
printf '%s\n' '== independent reviewer blob comparison =='
printf 'expected=%s\n' "$expected_blob"
printf 'base=%s\n' "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
printf 'head=%s\n' "$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
if git diff --quiet "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml; then
printf '%s\n' 'workflow_unchanged=true'
else
printf '%s\n' 'workflow_unchanged=false'
fi
printf '%s\n' '== focused security controls at exact head =='
git grep -n -I -E \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|models\.github|GitHub Models|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|23 \* \* \* \*|retry.hours|canonical_ref|job\.workflow_(repository|sha|ref|file_path)|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|gh pr (merge|review)|pulls/.*/(merge|reviews)|releases|branches/.+protection|rulesets|git add -A|conflicted_files' \
"$head" -- .github scripts docs ':!*.md' || true
printf '%s\n' '== specified workflow-run metadata =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
printf 'run=%s ' "$run"
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '[.name, .status, .conclusion, .head_sha, .event] | `@tsv`' \
2>&1 || true
doneLength of output: 166782
High — Conflict resolution does not enforce its file boundaryIn The OpenCode agent has An unrelated model edit can therefore be committed during conflict resolution. Before I verified the following controls at exact head
I found no separate approve, merge, release, or branch-protection operation in the reviewed scheduler or autofix worker. I do not approve this PR while the conflict-resolution file-boundary issue remains. You are interacting with an AI system. |
|
@opencode-agent Please independently review exact current head |
|
@cwl-noema-review Please perform a second independent exact-head review of |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
reviewer_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf '%s\n' '== exact commits =='
git show -s --format='head %H%nsubject %s' "$head"
git show -s --format='base %H%nsubject %s' "$base"
printf '%s\n' '== changed paths =='
git diff --name-status "$base" "$head"
printf '%s\n' '== reviewer workflow blob stability =='
printf 'expected %s\n' "$reviewer_blob"
printf 'base %s\n' "$(git rev-parse "$base:.github/workflows/opencode-review-dispatch.yml")"
printf 'head %s\n' "$(git rev-parse "$head:.github/workflows/opencode-review-dispatch.yml")"
git diff --exit-code "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml || true
printf '%s\n' '== hourly scheduler and source binding =='
git show "$head:.github/workflows/hourly-nvidia-nim-review-repair.yml" | nl -ba
git show "$head:.github/workflows/pr-review-fix-scheduler.yml" | nl -ba
printf '%s\n' '== autofix model steps, permission maps, and conflict handling =='
git show "$head:.github/workflows/pr-review-autofix.yml" | nl -ba | \
grep -E -C 12 \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistral-nemotron|nemotron-3-nano|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST|permission|conflicted_files|RESOLVE_CONFLICT|git add|git commit|git push|merge|approve|release|protection' || true
printf '%s\n' '== scheduler helper safeguards =='
git show "$head:scripts/ci/pr_review_fix_scheduler.py" | nl -ba | \
grep -E -C 8 \
'retry|dispatch|concurrency|same.repository|head.sha|live.head|allowlist|allowed|conflict|syntax' || true
printf '%s\n' '== focused contract tests and operator documentation =='
for path in \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py \
docs/automation/hourly-review-repair.md \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
printf '\n--- %s ---\n' "$path"
git show "$head:$path" | nl -ba
done
printf '%s\n' '== exact-head workflow run status =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
gh api "repos/ContextualWisdomLab/.github/actions/runs/$run" \
--jq '[.id,.name,.status,.conclusion,.head_sha] | `@tsv`' 2>&1 || true
doneLength of output: 3741 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
numbered_show() {
local path="$1"
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | awk '{printf "%5d %s\n", NR, $0}'
}
printf '%s\n' '== hourly scheduler =='
numbered_show '.github/workflows/hourly-nvidia-nim-review-repair.yml'
printf '%s\n' '== reusable scheduler workflow =='
numbered_show '.github/workflows/pr-review-fix-scheduler.yml'
printf '%s\n' '== autofix workflow: credential, permissions, conflict and staging controls =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
awk '{printf "%5d %s\n", NR, $0}' |
grep -E -C 15 \
'NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistral-nemotron|nemotron-3-nano|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST|permissions:|conflicted_files|RESOLVE_CONFLICT|git add|git commit|git push|merge|approve|release|protection' || true
printf '%s\n' '== conflict branch in full context =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
awk '{printf "%5d %s\n", NR, $0}' |
sed -n '430,570p'
printf '%s\n' '== scheduler helper guard references =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" |
awk '{printf "%5d %s\n", NR, $0}' |
grep -E -C 8 \
'retry|dispatch|concurrency|same.repository|head.sha|live.head|allowlist|allowed|conflict|syntax' || true
printf '%s\n' '== focused contracts: relevant assertions =='
for path in \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" |
awk '{printf "%5d %s\n", NR, $0}' |
grep -E -C 4 \
'conflict|allowlist|NVIDIA|COPILOT|GitHub Models|credential|permission|cron|retry|workflow_(repository|sha|ref|file_path)|checkout|dispatch|approve|merge|release|protection' || true
done
printf '%s\n' '== doctoring: safeguards and stated claims =='
git show "${head}:docs/doctoring/hourly-nvidia-nim-autofix.md" |
awk '{printf "%5d %s\n", NR, $0}' |
grep -E -C 4 \
'allowlist|conflict|NVIDIA|credential|GitHub|permission|approval|merge|release|protection|APA' || true
printf '%s\n' '== exact-head workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
printf 'run %s: ' "$run"
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '[.id,.name,.status,.conclusion,.head_sha] | `@tsv`' 2>&1 || true
doneLength of output: 86050
I reviewed exact head I verified the requested hourly cadence, one-hour retry floor, one-dispatch bound, repository-scoped concurrency, immutable called-workflow source binding, NVIDIA NIM-only provider configuration, model routing, NVIDIA secret scope, missing-secret failure, child-process GitHub/OIDC credential stripping, permission denials, exact-head checkout, and unchanged reviewer workflow blob The permanent contract gate and all nine listed direct workflows completed successfully for this exact head. One blocking finding remains:
I cannot approve while this write-capable path remains unbounded. You are interacting with an AI system. |
|
@opencode-agent review Review exact current head |
Pull request was converted to draft
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
reviewer_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf '%s\n' '== Commits =='
printf 'checked_out='; git rev-parse HEAD
git show -s --format='head=%H%nbase-parent=%P%nsubject=%s' "$head"
git show -s --format='baseline=%H%nsubject=%s' "$base"
printf '%s\n' '== Changed paths =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Independent reviewer workflow identity =='
printf 'expected=%s\n' "$reviewer_blob"
printf 'base=%s\n' "$(git rev-parse "$base:.github/workflows/opencode-review-dispatch.yml")"
printf 'head=%s\n' "$(git rev-parse "$head:.github/workflows/opencode-review-dispatch.yml")"
git diff --quiet "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml &&
printf '%s\n' 'reviewer_workflow_unchanged=true'
printf '%s\n' '== Exact-head workflow source =='
for path in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/pr-review-autofix.yml \
scripts/ci/pr_review_fix_scheduler.py \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | nl -ba
done
printf '%s\n' '== Sensitive control references =='
git grep -n -I -E \
'23 \* \* \* \*|retry.hours|canonical_ref|workflow_(repository|sha|ref|file_path)|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|repository_dispatch|concurrency:|conflicted_files|RESOLVE_CONFLICT|git add -A|gh pr (merge|review)|gh release|pulls/.*/(merge|reviews)|branches/.+protection|rulesets' \
"$head" -- .github scripts docs ':!*.md' || true
printf '%s\n' '== Exact-head workflow runs =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
printf 'run=%s ' "$run"
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '[.name,.status,.conclusion,.head_sha,.event] | `@tsv`' 2>&1 || true
doneLength of output: 3707 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='63b50227caefb49abd389a8da41edcfc1d32428e'
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
numbered_show() {
path="$1"
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | awk '{ printf "%5d %s\n", NR, $0 }'
}
printf '%s\n' '== Exact-head workflow source =='
for path in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/pr-review-autofix.yml \
scripts/ci/pr_review_fix_scheduler.py \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
numbered_show "$path"
done
printf '%s\n' '== Autofix conflict branch, complete context =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
awk '{ printf "%5d %s\n", NR, $0 }' |
sed -n '430,575p'
printf '%s\n' '== Scheduler dispatch and retry controls =='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py" |
awk '{ printf "%5d %s\n", NR, $0 }' |
grep -E -C 8 'retry|dispatch|concurrency|same.repository|head.sha|live.head|allowlist|allowed|conflict|syntax' || true
printf '%s\n' '== Sensitive control references at exact head =='
git grep -n -I -E \
'23 \* \* \* \*|retry.hours|canonical_ref|workflow_(repository|sha|ref|file_path)|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|repository_dispatch|concurrency:|conflicted_files|RESOLVE_CONFLICT|git add -A|gh pr (merge|review)|gh release|pulls/.*/(merge|reviews)|branches/.+protection|rulesets' \
"$head" -- .github scripts docs ':!*.md' || true
printf '%s\n' '== Relevant exact-head contract assertions =='
for path in \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" |
awk '{ printf "%5d %s\n", NR, $0 }' |
grep -E -C 4 'conflict|allowlist|NVIDIA|COPILOT|GitHub Models|credential|permission|cron|retry|workflow_(repository|sha|ref|file_path)|checkout|dispatch|approve|merge|release|protection' || true
done
printf '%s\n' '== Exact-head workflow run metadata =='
for run in 31002522693 31002522736 31002522780 31002522802 31002522718 31002522761 31002523083 31002522717 31002522776; do
printf 'run=%s ' "$run"
gh api "repos/ContextualWisdomLab/.github/actions/runs/${run}" \
--jq '[.name,.status,.conclusion,.head_sha,.event] | `@tsv`' 2>&1 || true
doneLength of output: 245059
I reviewed only commit High — Conflict resolution does not enforce its file boundaryIn The OpenCode agent has An OpenCode conflict-resolution run can therefore modify an unrelated path, and the workflow can stage and push that modification. Before I verified these controls at the requested commit:
I cannot approve while the conflict-resolution write path remains unbounded. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Please review the exact current head only. Verify the hourly cadence, immutable called-workflow source binding, NVIDIA_NIM_API_KEY-only model path, child-process GitHub/OIDC credential removal, bounded file allowlist, independent reviewer workflow preservation, and absence of approval/merge/release/branch-protection authority. Do not reuse predecessor-head evidence. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head="$(git rev-parse HEAD)"
base="$(git merge-base HEAD origin/main 2>/dev/null || git rev-parse HEAD^)"
expected_reviewer_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
printf '%s\n' '== reviewed commits =='
printf 'head=%s\nbase=%s\n' "$head" "$base"
git show -s --format='head_subject=%s' "$head"
git show -s --format='base_subject=%s' "$base"
printf '%s\n' '== changed paths against merge base =='
git diff --name-status "$base" "$head"
printf '%s\n' '== current workflow source =='
for path in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/pr-review-autofix.yml \
scripts/ci/pr_review_fix_scheduler.py \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | nl -ba
done
printf '%s\n' '== independent reviewer workflow identity =='
printf 'expected=%s\n' "$expected_reviewer_blob"
printf 'head=%s\n' "$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
printf 'base=%s\n' "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
git diff --quiet "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml &&
printf '%s\n' 'unchanged_from_base=true'
printf '%s\n' '== focused sensitive-control references at current head =='
git grep -n -I -E \
'23 \* \* \* \*|retry.hours|canonical_ref|job\.workflow_(repository|sha|ref|file_path)|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|repository_dispatch|concurrency:|conflicted_files|RESOLVE_CONFLICT|git add -A|git diff.*--name-only|git ls-files.*--others|gh pr (merge|review)|gh release|pulls/.*/(merge|reviews)|branches/.+protection|rulesets' \
"$head" -- .github scripts docs ':!*.md' || true
printf '%s\n' '== conflict-resolution branch =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
nl -ba |
sed -n '430,620p'
printf '%s\n' '== current workflow runs for current head =='
gh api "repos/ContextualWisdomLab/.github/actions/runs?head_sha=${head}&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.status,.conclusion,.head_sha,.event] | `@tsv`' \
2>&1 || trueLength of output: 3492 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="$(git rev-parse HEAD)"
base="$(git merge-base HEAD origin/main 2>/dev/null || git rev-parse HEAD^)"
expected_reviewer_blob='83f6830d5c21a324b4dbcd4e5c21a07968994b81'
numbered_show() {
path="$1"
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" | awk '{ printf "%5d %s\n", NR, $0 }'
}
printf '%s\n' '== reviewed commits =='
printf 'head=%s\nbase=%s\n' "$head" "$base"
git show -s --format='head_subject=%s' "$head"
git show -s --format='base_subject=%s' "$base"
printf '%s\n' '== workflow and helper source at current head =='
for path in \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/pr-review-autofix.yml \
scripts/ci/pr_review_fix_scheduler.py \
docs/automation/hourly-review-repair.md \
docs/doctoring/hourly-nvidia-nim-autofix.md
do
numbered_show "$path"
done
printf '%s\n' '== independent reviewer workflow identity =='
printf 'expected=%s\n' "$expected_reviewer_blob"
printf 'head=%s\n' "$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
printf 'base=%s\n' "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
if git diff --quiet "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml; then
printf '%s\n' 'unchanged_from_base=true'
else
printf '%s\n' 'unchanged_from_base=false'
fi
printf '%s\n' '== conflict-resolution branch =='
git show "${head}:.github/workflows/pr-review-autofix.yml" |
awk '{ printf "%5d %s\n", NR, $0 }' |
sed -n '430,640p'
printf '%s\n' '== relevant contract assertions =='
for path in \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_pr_review_fix_scheduler_source_pin.py
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}" |
awk '{ printf "%5d %s\n", NR, $0 }' |
grep -E -C 5 \
'conflict|allowlist|NVIDIA|COPILOT|GitHub Models|credential|permission|cron|retry|workflow_(repository|sha|ref|file_path)|checkout|dispatch|approve|merge|release|protection' || true
done
printf '%s\n' '== sensitive control references at current head =='
git grep -n -I -E \
'23 \* \* \* \*|retry.hours|canonical_ref|job\.workflow_(repository|sha|ref|file_path)|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|GitHub Models|models\.github|mistralai/mistral-nemotron|nvidia/nemotron-3-nano-30b-a3b|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|permissions:|repository_dispatch|concurrency:|conflicted_files|RESOLVE_CONFLICT|git add -A|gh pr (merge|review)|gh release|pulls/.*/(merge|reviews)|branches/.+protection|rulesets' \
"$head" -- .github scripts docs ':!*.md' || true
printf '%s\n' '== workflow runs for current head =='
gh api "repos/ContextualWisdomLab/.github/actions/runs?head_sha=${head}&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.status,.conclusion,.head_sha,.event] | `@tsv`' \
2>&1 || trueLength of output: 229150
I reviewed current head High — Conflict resolution still has no enforced file boundaryIn The conflict-resolution step gives OpenCode The conflict-resolution path does not compare changed or untracked paths with Before OpenCode runs, snapshot the worktree after I verified these current-head controls:
Current-head verification is also incomplete. I cannot approve while the conflict-resolution write path remains unbounded and the current-head contract gate is failing. You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review review All exact-head GitHub Actions and the CodeRabbit commit status now succeed for |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Exact-head required workflow failure on Restore the permanent boundary in this order:
Add no temporary write workflow. Run the focused 50-test contract, 100% helper branch coverage/docstrings, compileall, and |
|
@opencode-agent address Exact-head bounded repair for Current-head Strix Changed Path Quality CI run
It still requires the obsolete literal: That expectation is now security-wrong. The reviewed scheduler contract on this same head intentionally permits mutation only through Repair only the stale static contract in Validate the unchanged resulting head with the complete repository suite, |
|
@opencode-agent address Repair only the exact current-head stale Strix quick-gate contract on PR #782. Live head is Exact-head Strix run Update only the stale assertion block in
Do not change |
|
/oc Refetch the live PR and abort without writing unless it is still PR #782 on branch Apply the minimum GREEN implementation on the existing branch only:
Preserve the one-hour cadence, one-dispatch bound, same-head retry floor, immutable called-workflow source, NVIDIA NIM-only model authentication, independent reviewer credential chain, sealed path scope, full pre/post worktree verification, After the focused RED→GREEN run, execute the complete exact-head central suite, the hourly workflow contract, 100% production statement/branch coverage and public docstrings for affected production helpers, YAML parsing/actionlint where configured, compilation, security/SAST/supply-chain gates, and |
|
/oc Refetch and abort without writing unless PR #782 is still Draft on branch Apply only the minimum GREEN correction to Run the focused failing test first, then the complete exact-head central test suite, existing 100% coverage/docstring gates, compilation, configured YAML/action checks, and |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head review request for 39f774252adeca5df686c7258b58bc97cdcf9380 over protected base 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The RCA/feasibility contracts are now implemented in the production OpenCode prompt, operator guide, and CHANGELOG. All inline threads are resolved; predecessor-head CHANGES_REQUESTED submissions were dismissed only as stale evidence, not as approval. Review this head read-only. Preserve reviewer identities and the existing credential chain; do not update the branch, synthesize approval, or merge.
@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review
|
/oc Refetch and abort without writing unless PR #782 is still Draft on branch RCA: exact-head Hourly NVIDIA NIM Review Repair and Strix runs fail after the intentional RED commit Implement the smallest secure GREEN vertical slice, test-first, without weakening any review, credential, path, check, or branch-protection boundary:
Verification: first run the four currently failing tests in |
|
@coderabbitai autofix Apply the remaining exact-current-head RCA scheduler repairs directly to branch
Run the focused RCA contracts first, then the complete Hourly NVIDIA NIM and Strix suites, preserving 100% production statement/branch/docstring gates. Keep the PR Draft and do not merge. |
|
Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
|
/oc Refetch and abort without writing unless PR #782 is still Draft, open, mergeable, based on protected RCA on exact-head runs Implement only the remaining secure GREEN slice. Preserve the already-green
Verification order: run the two current exact failures first; then all focused scheduler/context/collector tests; |
|
@opencode-agent address Execute the bounded exact-head GREEN repair specified in the immediately preceding maintainer instruction, issue comment |
|
Exact-current-head review request for The hourly scheduler now performs exact-head failed-check classification, trusted redacted evidence collection, RCA, materially distinct remediation enumeration, feasibility checks against actual writer authority/credential/path/dependency/verifiability boundaries, minimal reversible repair, and exact-head revalidation. All current-head Checks are successful and active inline threads are resolved. Review this unchanged head read-only. Preserve independent reviewer identities and the existing credential chain; do not update the branch, synthesize approval, or bypass protection. @coderabbitai review |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head review request for 471c6491ff3383be2e4ec778272df8d9dbf16260 over protected base 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The hourly RCA and remediation-feasibility runtime is complete. Exact-head Hourly NVIDIA NIM and Strix gates succeed; 1,108 tests plus 16 subtests pass; both production helpers have 100% statement and branch coverage and 100% docstrings; security, CodeQL, Semgrep, OSV, Scorecard, Secret Scan, and SBOM succeed; unresolved inline threads are zero.
Review read-only. Preserve reviewer identities and the existing credential chain. Do not update the branch, synthesize author approval, or bypass protection.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='782'
expected_head='471c6491ff3383be2e4ec778272df8d9dbf16260'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Live pull request identity =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
number, state, draft,
head_sha: .head.sha, head_ref: .head.ref,
base_sha: .base.sha, base_ref: .base.ref,
mergeable, mergeable_state
}'
head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"
printf 'expected_head=%s\nlive_head=%s\nexpected_base=%s\nlive_base=%s\n' \
"$expected_head" "$head_sha" "$expected_base" "$base_sha"
if [ "$head_sha" != "$expected_head" ] || [ "$base_sha" != "$expected_base" ]; then
echo 'STOP: live pull request identity differs from the requested review identity.'
exit 0
fi
echo '== Commit, changed paths, and whitespace =='
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head_sha"
git diff --check "$base_sha" "$head_sha"
git diff --stat "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
echo '== Exact-head check runs that are nonterminal or unsuccessful =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
--jq '.check_runs[]
| select(.status != "completed" or
(.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped"))
| [.name, .status, (.conclusion // "null"), .app.slug, .details_url] | `@tsv`' \
| sort || true
echo '== Exact-head actions runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
--jq '.workflow_runs[]
| [.id, .name, .status, (.conclusion // "null"), .event, .html_url] | `@tsv`' \
| sort -n
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='
query($owner:String!, $name:String!, $number:Int!) {
repository(owner:$owner,name:$name) {
pullRequest(number:$number) {
reviewThreads(first:100) {
nodes {
isResolved
comments(first:1) { nodes { author { login } path originalLine } }
}
}
}
}
}' \
--jq '
[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
"unresolved_count=\($items|length)",
($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
'
echo '== Candidate source maps =='
for f in \
scripts/ci/pr_review_fix_scheduler.py \
scripts/ci/pr_review_autofix_context.py \
scripts/ci/collect_failed_check_evidence.sh \
.github/workflows/pr-review-autofix.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
docs/automation/hourly-review-repair.md \
CHANGELOG.md
do
if [ -f "$f" ]; then
echo "--- $f"
nl -ba "$f"
fi
done
echo '== Changed test and script candidates =='
fd -HI -t f . tests scripts 2>/dev/null \
| grep -E '(pr_review_fix_scheduler|pr_review_autofix_context|failed_check|hourly.*repair|strix)' \
| sort
echo '== Security-sensitive and RCA flow references =='
git grep -n -I -E \
'needs_rca_repair|repair_mode|failed-check-evidence|collect_failed_check_evidence|\
MUTATION_CREDENTIAL_AVAILABLE|NVIDIA_NIM_API_KEY|COPILOT_GITHUB_TOKEN|\
GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|\
repository_dispatch|workflow_(repository|sha|ref|file_path)|\
gh pr (merge|review)|gh release|branches/.+protection' \
"$head_sha" -- .github/workflows scripts/ci tests docs CHANGELOG.md || true
echo '== Independent reviewer workflow identity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
if git diff --no-ext-diff --quiet "$base_sha" "$head_sha" -- \
.github/workflows/opencode-review-dispatch.yml; then
echo 'reviewer_workflow_diff=none'
else
echo 'reviewer_workflow_diff=present'
fiLength of output: 4888
The live head changed before inspection completed:
The PR remains Draft and open. GitHub reports Please request a new review for the live head. I did not modify, approve, merge, release, or change protection. You are interacting with an AI system. |
|
Exact-current-head review request for All directly observable exact-head checks are successful: Hourly NVIDIA NIM Review Repair, Strix Changed Path Quality CI, Python Security, Security Scan, SAST Semgrep, CodeQL, Secret Scan, OSV, Scorecard, SBOM, and CodeRabbit status. The exact-head quality run reports 1,107 tests plus 16 subtests, 100% production statement/branch coverage, and 100% production docstrings. Inline review threads are resolved. Review read-only. Preserve reviewer identities and the existing credential chain. Do not update the branch, synthesize author approval, or bypass protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='782'
expected_head='17bd5e4a98a718012dcb82d5028aa697a4ca8077'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Live PR identity =='
pr_json="$(gh api "repos/${repo}/pulls/${pr}")"
printf '%s\n' "$pr_json" | jq '{
number, state, draft,
head_sha: .head.sha, head_ref: .head.ref,
base_sha: .base.sha, base_ref: .base.ref,
mergeable, mergeable_state
}'
head_sha="$(printf '%s\n' "$pr_json" | jq -r '.head.sha')"
base_sha="$(printf '%s\n' "$pr_json" | jq -r '.base.sha')"
printf 'expected_head=%s\nlive_head=%s\nexpected_base=%s\nlive_base=%s\n' \
"$expected_head" "$head_sha" "$expected_base" "$base_sha"
if [ "$head_sha" != "$expected_head" ] || [ "$base_sha" != "$expected_base" ]; then
echo 'STOP: requested review identity is no longer live.'
exit 0
fi
echo '== Diff summary and changed paths =='
git diff --check "$base_sha" "$head_sha"
git diff --stat "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
echo '== Exact-head non-successful or nonterminal checks =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
--jq '.check_runs[]
| select(.status != "completed" or
(.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped"))
| [.name,.status,(.conclusion // "null"),.app.slug,.details_url] | `@tsv`' | sort || true
echo '== Exact-head Actions runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_sha}&per_page=100" --paginate \
--jq '.workflow_runs[] | [.id,.name,.status,(.conclusion // "null"),.event] | `@tsv`' | sort -n
echo '== Unresolved review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" \
-f query='
query($owner:String!, $name:String!, $number:Int!) {
repository(owner:$owner,name:$name) {
pullRequest(number:$number) {
reviewThreads(first:100) {
nodes { isResolved comments(first:1) { nodes { author { login } path originalLine } } }
}
}
}
}' --jq '
[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] as $items |
"unresolved_count=\($items|length)",
($items[] | [.comments.nodes[0].author.login, (.comments.nodes[0].path // ""), (.comments.nodes[0].originalLine|tostring)] | `@tsv`)
'
echo '== Relevant source outlines =='
for f in \
scripts/ci/pr_review_fix_scheduler.py \
scripts/ci/pr_review_autofix_context.py \
scripts/ci/collect_failed_check_evidence.sh \
.github/workflows/pr-review-autofix.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/hourly-nvidia-nim-review-repair.yml \
tests/test_pr_review_fix_scheduler.py \
tests/test_pr_review_autofix_context.py \
docs/automation/hourly-review-repair.md
do
if [ -f "$f" ]; then
echo "--- $f"
if [[ "$f" == *.py ]]; then
ast-grep outline "$f" --items all || true
else
nl -ba "$f" | sed -n '1,260p'
fi
fi
done
echo '== Independent reviewer workflow identity =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
git diff --no-ext-diff --quiet "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml &&
echo 'reviewer_workflow_diff=none' || echo 'reviewer_workflow_diff=present'Length of output: 15500 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='782'
head_sha='17bd5e4a98a718012dcb82d5028aa697a4ca8077'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
live_head="$(gh api "repos/${repo}/pulls/${pr}" --jq '.head.sha')"
printf 'expected_head=%s\nlive_head=%s\n' "$head_sha" "$live_head"
if [ "$live_head" != "$head_sha" ]; then
echo 'STOP: live head changed.'
exit 0
fi
show_range() {
file="$1"
start="$2"
end="$3"
echo "--- ${file}:${start}-${end}"
sed -n "${start},${end}{=;p;}" "$file" | sed 'N;s/\n/\t/'
}
echo '== Scheduler decision and dispatch flow =='
show_range scripts/ci/pr_review_fix_scheduler.py 95 370
echo '== Context repair mode, evidence, and allowlist flow =='
show_range scripts/ci/pr_review_autofix_context.py 150 520
echo '== Evidence collector =='
sed -n '=' scripts/ci/collect_failed_check_evidence.sh | sed 'N;s/\n/\t/'
echo '== Autofix workflow dispatch, context, and model steps =='
sed -n '=' .github/workflows/pr-review-autofix.yml | sed 'N;s/\n/\t/'
echo '== Scheduler workflow credential and source binding =='
sed -n '=' .github/workflows/pr-review-fix-scheduler.yml | sed 'N;s/\n/\t/'
echo '== Focused workflow test coverage configuration =='
sed -n '=' .github/workflows/hourly-nvidia-nim-review-repair.yml | sed 'N;s/\n/\t/'
echo '== Relevant tests and static contract assertions =='
for f in \
tests/test_pr_review_fix_scheduler.py \
tests/test_pr_review_autofix_context_failed_checks.py \
tests/test_pr_review_autofix_context_head_binding.py \
tests/test_pr_review_fix_hourly_contract.py \
tests/test_hourly_autofix_context_quality_gate.py \
tests/test_pr_review_autofix_nvidia_nim_contract.py \
tests/test_pr_review_autofix_writer_security_contract.py
do
echo "--- $f"
rg -n -C 3 \
'repair_mode|failed.check|collect_failed|evidence|rca|github\.token|GH_TOKEN|\
NVIDIA_NIM_API_KEY|MUTATION_CREDENTIAL_AVAILABLE|workflow_(repository|sha|ref|file_path)|\
allowlist|allowed.paths|credential|coverage|docstring' "$f" || true
done
echo '== Full changed-source diff for RCA-related files =='
git diff --no-ext-diff --unified=30 "$base_sha" "$head_sha" -- \
scripts/ci/pr_review_fix_scheduler.py \
scripts/ci/pr_review_autofix_context.py \
scripts/ci/collect_failed_check_evidence.sh \
.github/workflows/pr-review-autofix.yml \
.github/workflows/pr-review-fix-scheduler.yml \
.github/workflows/hourly-nvidia-nim-review-repair.yml
echo '== Independent reviewer workflow blobs =='
printf 'base_blob='
git rev-parse "${base_sha}:.github/workflows/opencode-review-dispatch.yml"
printf 'head_blob='
git rev-parse "${head_sha}:.github/workflows/opencode-review-dispatch.yml"
echo '== Recheck exact-head nonterminal or unsuccessful checks =='
gh api "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" --paginate \
--jq '.check_runs[]
| select(.status != "completed" or
(.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped"))
| [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' | sort || trueLength of output: 138384
I found one actionable defect.
The independent reviewer workflow is unchanged. Its base and head blob is I cannot issue a passing verdict or approval. CodeQL, You are interacting with an AI system. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head17bd5e4a98a718012dcb82d5028aa697a4ca8077. -
Head SHA:
17bd5e4a98a718012dcb82d5028aa697a4ca8077 -
Workflow run: 31262322287
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (5 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (5 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (5 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (5 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (16 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (16 files)"]
R5 --> V5["targeted test run"]
|
RCA / feasibility note for exact current head The PR's directly exposed exact-head Hourly NVIDIA NIM, Strix, CodeQL, Python Security, Security Scan, Semgrep, Secret Scan, OSV, Scorecard, and SBOM gates are green. The current formal Feasibility screening rejects three tempting responses: (1) patching this PR merely to silence the review is the wrong causal layer because its product/scheduler exact-head gates are already green; (2) weakening or reclassifying failed coverage as success would weaken a required evidence gate; and (3) retrying reviews indefinitely without repairing the evidence path can reproduce the same false source-level blocker. The dedicated decision-envelope work in #836 already defines the correct architecture: infrastructure/coverage failure may block Therefore this branch is intentionally left unchanged. Treat the current OpenCode request-changes result as a central review-evidence/classification prerequisite, not evidence of a #782 source defect. After the central prerequisite is integrated through its own dependency order, rerun the OpenCode review on this unchanged exact head (or its then-current descendant) and require fresh exact-head evidence. Counted independent human approval remains a separate merge gate. |
2 participants
Purpose
Activate protected hourly PR review → exact-head RCA → realistic remediation → revalidation loops while preserving independent review, credential separation, branch protection, and product-neutral reuse across ContextualWisdomLab services.
Exact current identity
17bd5e4a98a718012dcb82d5028aa697a4ca8077fix/hourly-nvidia-nim-review-repair-mainmainat6eb06cdd08c79a06f7b390069d4ffa49e2eb7dbaEvery check, review, approval, comment, or receipt anchored to an earlier head is historical only.
Runtime contract
Each candidate passes through:
Failed-check repair uses explicit
repair_mode=rca, the trusted redacting evidence collector, and only safe nonremoved paths already changed by the current PR. Ordinary review repair is restricted to current unresolved file-scoped review paths. Approved conflict repair uses only Git's exact unresolved paths.If no repository edit is feasible, the worker leaves the tree unchanged and records the failed feasibility condition. A head-scoped retry marker prevents immediate duplicate dispatch so later hourly scans can process another eligible bounded PR instead of inventing a patch for approval latency, runner capacity, billing, rate limits, or provider delay.
Cadence and concurrency
cancel-in-progress: trueplus a 35-minute job timeout. It cancels only a superseded scan; it does not cancel a separately dispatched per-PR RCA.main.Model, credential, and mutation boundary
NVIDIA_NIM_API_KEY.nvidia-nim/mistralai/mistral-small-4-119b-2603with high reasoning.nvidia/nemotron-3-nano-30b-a3b.COPILOT_GITHUB_TOKEN, GitHub Models, and GitHub tokens are not model credentials.PR_REVIEW_MERGE_TOKEN,OPENCODE_APPROVE_TOKEN, or the short-lived OpenCode GitHub App token exchanged through OIDC;github.tokenremains read-only..gitdenial, hook suppression, live-head race checks, and an explicit revalidated push destination remain mandatory.Exact-head verification
Hourly NVIDIA NIM run
31261154393succeeded on this exact head:1,107tests passed;16subtests passed;scripts/ci/pr_review_autofix_context.py: 215/215 statements and 92/92 branches;scripts/ci/pr_review_conflict_scope.py: 226/226 statements and 64/64 branches;All directly observable exact-head checks pass:
All inline review threads are resolved. Running, pending, queued, cancelled, skipped-required, neutral-required, absent, stale-head, status-only, author-only, or synthetic evidence is not acceptance.
Merge gate
Merge still requires:
No protection, approval, security, or reviewer-credential requirement may be bypassed.
Documentation
docs/automation/hourly-review-repair.mddocs/doctoring/hourly-nvidia-nim-autofix.mddocs/doctoring/clearfolio-hourly-review-caller.mddocs/doctoring/disksage-hourly-review-caller.mddocs/doctoring/conflict-control-evidence-isolation.mdCHANGELOG.mdDoctoring records retain APA 7th references to official GitHub Actions, Git, OpenCode, NVIDIA NIM, and NIST SSDF sources.