fix: derive workflow evidence in trusted cooperation reporter - #199
Conversation
📝 WalkthroughWalkthroughСкрипт переводит подготовку evidence на workflow-level check runs: извлекает run ID, получает и проверяет workflow-метаданные, сопоставляет их с exact-head PR и сохраняет нормализованный результат. Workflow-контракт проверяет permissions и полноту evidence. ChangesWorkflow evidence
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review @qodo-code-review review Exact head: Please review the integrated exact-head verifier/report publisher, default-branch reporter checkout, permissions, head-drift checks, READY validation, trusted marker publishing, and diagnostic anti-spoof boundary. |
|
@coderabbitai approve |
PR Summary by QodoPublish trusted AI cooperation report from within exact-head AI review gate
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
✅ Action performedComments resolved and changes approved. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh pr view 199 --repo safal207/robys-coffee-house-demo --json title,body,files,commits,headRefOid,baseRefName,state | jq '.'
echo "----DIFF----"
gh pr diff 199 --repo safal207/robys-coffee-house-demoLength of output: 13497 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=5b94c5382ea2ed2fd3bb7b6c50d7b8fc46b38932 --jq '.content' | base64 -d > /tmp/wf.yml
cat -n /tmp/wf.yml
echo "---- scripts dir ----"
gh api repos/safal207/robys-coffee-house-demo/contents/scripts?ref=5b94c5382ea2ed2fd3bb7b6c50d7b8fc46b38932 --jq '.[].name'Length of output: 13536 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '26,30p' /tmp/wf.yml | cat -A | head -20
python3 - <<'EOF'
with open('/tmp/wf.yml','rb') as f:
data = f.read()
lines = data.split(b'\n')
for i in range(25,30):
print(i+1, lines[i])
EOFLength of output: 819 🏁 Script executed: #!/bin/bash
set -euo pipefail
mkdir -p /tmp/scripts
for f in fetch-review-threads.py ai-review-cooperation.py verify-ai-review-contract.cjs; do
gh api "repos/safal207/robys-coffee-house-demo/contents/scripts/${f}?ref=5b94c5382ea2ed2fd3bb7b6c50d7b8fc46b38932" --jq '.content' | base64 -d > "/tmp/scripts/${f}"
done
echo "---- fetch-review-threads.py ----"
cat -n /tmp/scripts/fetch-review-threads.pyLength of output: 5229 🏁 Script executed: #!/bin/bash
set -euo pipefail
cat -n /tmp/scripts/ai-review-cooperation.py | head -150Length of output: 6537 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "COMMENT_FILE\|_FILE'\|required_env(\|def main\|sys.argv\|'report'" /tmp/scripts/ai-review-cooperation.py | head -60Length of output: 1095 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '405,460p' /tmp/scripts/ai-review-cooperation.pyLength of output: 1532 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "Overall conclusion" /tmp/scripts/ai-review-cooperation.pyLength of output: 282 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "conclusion = \|conclusion=\|'READY'\|READY_WITH_ADVISORY_GAPS\|BLOCKED\|NOT_READY" /tmp/scripts/ai-review-cooperation.pyLength of output: 659 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "concurrency" /tmp/wf.yml || echo "NO CONCURRENCY BLOCK FOUND"Length of output: 266
Findings
Verified correct (no issues):
✏️ Learnings added
✅ Action performedReview finished.
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
11 rules 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
|
@coderabbitai review @qodo-code-review review Exact head: Please review the current-run check normalization, raw/derived evidence separation, exact one-match requirement, trusted report publishing, artifact retention, and diagnostic anti-spoof boundary. |
|
Disposition: accepted Qodo findings are fixed:
No product runtime, D6 rule, report marker or ledger acceptance rule changed. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh pr view 199 --repo safal207/robys-coffee-house-demo --json headRefOid,commits | jq '.headRefOid'
echo "---- diff between previous reviewed head and new head ----"
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=c6060bf69985b7706b9239ed4d30d679da304964 --jq '.content' | base64 -d > /tmp/wf_new.yml
diff -u /tmp/wf.yml /tmp/wf_new.yml || trueLength of output: 712 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=5b94c5382ea2ed2fd3bb7b6c50d7b8fc46b38932 --jq '.content' | base64 -d > /tmp/wf_old.yml
diff -u /tmp/wf_old.yml /tmp/wf_new.yml || true
echo "---- full new file ----"
cat -n /tmp/wf_new.ymlLength of output: 19529 🤖 web_search executed:
Length of output: 15053
New finding — run-id fragment match is a substring, not an exact boundary match In the run_fragment="/actions/runs/${GITHUB_RUN_ID}"
...
select((((.details_url // .html_url // "") | contains($fragment))) and ...)GitHub Actions check-run URLs are shaped This directly weakens the invariant the PR explicitly requires — "exactly one in-progress check whose URL belongs to the current Fix: anchor the boundary, e.g. run_fragment="/actions/runs/${GITHUB_RUN_ID}/"(note trailing slash) or in jq: Carried over from previous review, still unaddressed in this head:
Verified correct in this head:
✏️ Learnings added
✅ Action performedReview finished.
|
|
@coderabbitai review @qodo-code-review review Exact head: Please review the final same-repository guard, EN/TR/RU diagnostic, exact current-run normalization, raw/derived evidence separation, and trusted publish conditions. |
|
@coderabbitai approve |
Stale approval: this review predates current-run check normalization and the EN/TR/RU same-repository publishing guard. Fresh native approval must bind to 2aacfd1 after the latest review request.
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=2aacfd166b12440fcfd9a53b6b7e4c0b836aab16 --jq '.content' | base64 -d > /tmp/wf_final.yml
diff -u /tmp/wf_new.yml /tmp/wf_final.yml || true
echo "---- full file ----"
cat -n /tmp/wf_final.ymlLength of output: 16486
Fixed correctly (Qodo findings + this round's request):
Still unresolved from prior rounds:
Fork-token-scope concern from round 1 is now practically moot since all ✏️ Learnings added
✅ Action performedReview finished.
|
|
@coderabbitai approve |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-review-contract.yml:
- Around line 22-25: Serialize workflow runs for the same pull request and head
in the verify job by adding an appropriate concurrency group based on the PR
identity, with stale runs canceled or otherwise prevented from overwriting the
latest report. Keep the existing exact-head verification and merge/status gate
behavior unchanged.
- Around line 245-247: Update the “Publish cooperation failure diagnostic” step
condition so it no longer depends on steps.verify.outputs.same_repository.
Derive the fork boundary directly from the event metadata available in the
workflow, while preserving the existing failure() and successful verification
requirements.
- Around line 233-243: Расширьте шаг Upload cooperation evidence, чтобы артефакт
сохранял полный исходный evidence, включая REST- и GraphQL-входы, использованные
для формирования заключения. Добавьте соответствующие существующие файлы или
переменные окружения в список path рядом с RAW_CHECKS_FILE, CHECKS_FILE и
COMMENT_FILE, не удаляя текущие результаты.
- Around line 227-231: Update the “Record fork publication boundary” step in the
fork-specific path to fail closed instead of only logging and exiting
successfully: terminate the step with a nonzero status after the existing
messages, or route it through a separate required failing gate. Ensure fork pull
requests cannot produce a successful job without a trusted cooperation report.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 88912980-6cac-403c-9871-0d1d01382d18
📒 Files selected for processing (1)
.github/workflows/ai-review-contract.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (6)
- GitHub Check: CodeRabbit
- GitHub Check: VISUAL-001 screenshot diff
- GitHub Check: SAST-001 JavaScript and TypeScript
- GitHub Check: ios-route-webkit
- GitHub Check: DAST-001 passive web scan
- GitHub Check: Verify exact-head independent review
⚠️ CI failures not shown inline (2)
GitHub Actions: Bot review disposition contract / 0_REVIEW-LEDGER exact-head findings.txt: fix: publish cooperation report inside AI review gate
Conclusion: failure
##[group]Run actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
with:
script: const owner = context.repo.owner;
const repo = context.repo.repo;
const payloadPr = context.payload.pull_request;
const issuePr = context.payload.issue?.pull_request;
const prNumber = payloadPr?.number ?? (issuePr ? context.payload.issue.number : null);
if (!prNumber) {
core.notice('Event is not associated with a pull request.');
return;
}
const pr = (await github.rest.pulls.get({ owner, repo, pull_number: prNumber })).data;
const head = pr.head.sha.toLowerCase();
const [reviewComments, reviews, issueComments, statuses] = await Promise.all([
github.paginate(
github.rest.pulls.listReviewComments,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.pulls.listReviews,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.issues.listComments,
{ owner, repo, issue_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.repos.listCommitStatusesForRef,
{ owner, repo, ref: head, per_page: 100 },
),
]);
const reviewHeads = new Map(
reviews.map((review) => [review.id, review.commit_id?.toLowerCase()]),
);
const reviewBots = new Set([
'chatgpt-codex-connector',
'chatgpt-codex-connector[bot]',
'coderabbitai',
'coderabbitai[bot]',
'github-advanced-security',
'github-advanced-security[bot]',
]);
const trustedAssociations = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
const exactHeadBody = (body) => new RegExp(`(^|[^0-9a-f])${head}([^0-9a-f]|$)`, 'i').test(body ?? '');
const timeOf = (item) => Math.max(
0,
...[item.submitted_at, item.created_at, item.updated_at]
.map((value) => Date.parse(value ?? 0))
.filter(Number.isFinite),
);
const isDispositionReply = (reply) => {
const body = (reply.body ?? '').replaceAll('`', '');
const disposition = /^Disposition:\s*(accepted|rejected-with-evidence|superseded)\s*$/im.test(body);
cons...
GitHub Actions: Bot review disposition contract / REVIEW-LEDGER exact-head findings: fix: publish cooperation report inside AI review gate
Conclusion: failure
##[group]Run actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
with:
script: const owner = context.repo.owner;
const repo = context.repo.repo;
const payloadPr = context.payload.pull_request;
const issuePr = context.payload.issue?.pull_request;
const prNumber = payloadPr?.number ?? (issuePr ? context.payload.issue.number : null);
if (!prNumber) {
core.notice('Event is not associated with a pull request.');
return;
}
const pr = (await github.rest.pulls.get({ owner, repo, pull_number: prNumber })).data;
const head = pr.head.sha.toLowerCase();
const [reviewComments, reviews, issueComments, statuses] = await Promise.all([
github.paginate(
github.rest.pulls.listReviewComments,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.pulls.listReviews,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.issues.listComments,
{ owner, repo, issue_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.repos.listCommitStatusesForRef,
{ owner, repo, ref: head, per_page: 100 },
),
]);
const reviewHeads = new Map(
reviews.map((review) => [review.id, review.commit_id?.toLowerCase()]),
);
const reviewBots = new Set([
'chatgpt-codex-connector',
'chatgpt-codex-connector[bot]',
'coderabbitai',
'coderabbitai[bot]',
'github-advanced-security',
'github-advanced-security[bot]',
]);
const trustedAssociations = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
const exactHeadBody = (body) => new RegExp(`(^|[^0-9a-f])${head}([^0-9a-f]|$)`, 'i').test(body ?? '');
const timeOf = (item) => Math.max(
0,
...[item.submitted_at, item.created_at, item.updated_at]
.map((value) => Date.parse(value ?? 0))
.filter(Number.isFinite),
);
const isDispositionReply = (reply) => {
const body = (reply.body ?? '').replaceAll('`', '');
const disposition = /^Disposition:\s*(accepted|rejected-with-evidence|superseded)\s*$/im.test(body);
cons...
🧰 Additional context used
📓 Path-based instructions (1)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Проверяй least privilege, pinning сторонних Actions по commit SHA,
безопасность pull_request против pull_request_target, отсутствие выполнения
недоверенного PR-кода с write-token и корректность merge/status gates.
Files:
.github/workflows/ai-review-contract.yml
🪛 zizmor (1.26.1)
.github/workflows/ai-review-contract.yml
[error] 15-15: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
🔇 Additional comments (2)
.github/workflows/ai-review-contract.yml (2)
10-14: LGTM!Also applies to: 16-16, 26-226, 248-296
10-16: 🔒 Security & Privacy
issues: writeздесь нужен дляPOST/PATCH /issues/{number}/commentsна PR.pull-requests: writeэтот scope не заменяет, поэтому замечание о сужении прав неверно.> Likely an incorrect or invalid review comment.
✅ Action performedComments resolved and changes approved. |
1 similar comment
✅ Action performedComments resolved and changes approved. |
|
Disposition: accepted All final CodeRabbit findings are fixed:
No product runtime, D6, report marker or ledger acceptance rule changed. |
|
@coderabbitai review @qodo-code-review review Exact head: Please review the final same-head concurrency, fork fail-closed behavior, complete reproducible evidence artifact, event-derived diagnostic guard, and integrated trusted report publishing. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=20cfb37171be64e61973c9fd87387215c7e220c3 --jq '.content' | base64 -d > /tmp/wf_head4.yml
echo "---- diff vs previous reviewed head (2aacfd166b12440fcfd9a53b6b7e4c0b836aab16) ----"
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=2aacfd166b12440fcfd9a53b6b7e4c0b836aab16 --jq '.content' | base64 -d > /tmp/wf_final.yml
diff -u /tmp/wf_final.yml /tmp/wf_head4.yml || true
echo "---- full file ----"
cat -n /tmp/wf_head4.ymlLength of output: 20126
Confirmed fixed / correct:
Still open (unresolved for the third consecutive round): run_fragment="/actions/runs/${GITHUB_RUN_ID}"matched via jq run_fragment="/actions/runs/${GITHUB_RUN_ID}/"or No other findings. (・ᴗ・) all clean except one lingering boundary bug — patient rabbit waits for round four ✏️ Learnings added
|
All four requested changes are fixed on 20cfb37: same-head concurrency, fork fail-closed, complete reproducible evidence artifact, and event-derived diagnostic eligibility. The exact-head review threads are resolved; this older request-changes review is stale.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=fb0aaa4628f88693384957b8d53bbee33ce89a8c --jq '.content' | base64 -d > /tmp/wf_final2.yml
echo "---- diff vs 316b9bbe666c4d90a7b9239b3820cd8bbd02768e ----"
diff -u /tmp/wf_new3.yml /tmp/wf_final2.yml || true
echo "---- full file ----"
cat -n /tmp/wf_final2.yml
echo "---- scripts referenced ----"
grep -n "scripts/\|uses:\|permissions" /tmp/wf_final2.ymlLength of output: 2569 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=316b9bbe666c4d90a7b9239b3820cd8bbd02768e --jq '.content' | base64 -d > /tmp/wf_316.yml
echo "---- diff 316 -> fb0aaa46 ----"
diff -u /tmp/wf_316.yml /tmp/wf_final2.yml || true
echo "---- verify-ai-review-contract.cjs: actions API usage ----"
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/verify-ai-review-contract.cjs?ref=fb0aaa4628f88693384957b8d53bbee33ce89a8c --jq '.content' | base64 -d > /tmp/verify_final.cjs
grep -n "actions\.\|listWorkflowRuns\|getWorkflowRun\|runs/\|octokit\|github\.rest\.actions" /tmp/verify_final.cjs
echo "---- diff verify script vs previous pinned commit content (already pinned, should be same) ----"
wc -l /tmp/verify_final.cjsLength of output: 1226 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '1,100p' /tmp/verify_final.cjsLength of output: 2990
File is byte-identical to the previous revert (
Executable contract, confirmed safe:
No findings. The [approve] (=^･ω･^=) clean and minimal — nothing left to chase this round |
|
Disposition: accepted CodeRabbit finding “Do not normalize any check-run by an Actions-looking URL” is fixed on exact head
|
|
@coderabbitai review Please re-review exact head |
|
@qodo-code-review review Please re-review exact head |
|
@coderabbitai resume |
|
@coderabbitai review Final exact head: |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/wf_b2.yml
echo "---- diff vs fb0aaa46 (last reviewed) ----"
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=fb0aaa4628f88693384957b8d53bbee33ce89a8c --jq '.content' | base64 -d > /tmp/wf_fb0.yml
diff -u /tmp/wf_fb0.yml /tmp/wf_b2.yml || true
echo "---- full workflow ----"
cat -n /tmp/wf_b2.yml
echo "---- scripts dir at b2bc ----"
gh api repos/safal207/robys-coffee-house-demo/contents/scripts?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.[].name'Length of output: 4587 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/fetch-review-threads.py?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/fetch_b2.py
echo "---- run_id_of function ----"
grep -n "def run_id_of" -A 20 /tmp/fetch_b2.py
echo "---- check if this script is referenced anywhere in the workflow ----"
grep -n "fetch-review-threads" /tmp/wf_b2.yml || echo "NOT REFERENCED IN WORKFLOW"
echo "---- check where scripts/fetch-review-threads.py is invoked repo-wide ----"
grep -rn "fetch-review-threads" --include="*.yml" --include="*.yaml" .github 2>/dev/null || true
grep -rn "fetch-review-threads" scripts 2>/dev/null | grep -v "fetch-review-threads.py:" | head -20Length of output: 3401 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh pr view 199 --repo safal207/robys-coffee-house-demo --json files -q '.files[].path'Length of output: 384 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-cooperation.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/coop.yml
cat -n /tmp/coop.yml
echo "==== contract test file ===="
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-cooperation-contract.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/coop_contract.yml
cat -n /tmp/coop_contract.ymlLength of output: 40945 🏁 Script executed: #!/bin/bash
set -euo pipefail
cat -n /tmp/fetch_b2.pyLength of output: 10609 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/test-ai-review-cooperation.py?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/test_coop.py
grep -n "run_id_of\|app.*slug\|github-actions\|spoof\|RUN_URL" /tmp/test_coop.pyLength of output: 622 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "fetch-review-threads\|fetch_review_threads\|normalize_workflow_checks\|import.*fetch" /tmp/test_coop.py
wc -l /tmp/test_coop.pyLength of output: 474
The derived-workflow path this feeds is otherwise unchanged and still correct: exact-head cross-check on One advisory gap, non-blocking: No other findings on this head. [approve] |
|
@coderabbitai approve All known actionable findings are fixed and all inline threads are resolved on exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh pr view 199 --repo safal207/robys-coffee-house-demo --json headRefOid,state -q '.'Length of output: 327
[approve] (=^･ω･^=) |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/fetch-review-threads.py?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/fetch_new.py
echo "---- run_id_of and normalize_workflow_checks ----"
grep -n "def run_id_of\|def normalize_workflow_checks\|app.slug\|app\[.slug.\]\|github-actions" -A 15 /tmp/fetch_new.py | head -150
echo "---- full diff vs prior known version if available ----"
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/fetch-review-threads.py?ref=316b9bbe666c4d90a7b9239b3820cd8bbd02768e --jq '.content' 2>/dev/null | base64 -d > /tmp/fetch_prev.py || echo "no prev"
diff -u /tmp/fetch_prev.py /tmp/fetch_new.py || trueLength of output: 5999 🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/wf_b2bc.yml
grep -n "TRIGGER_HEAD_SHA\|TRIGGER_EVENT\|CHECKS_FILE" /tmp/wf_b2bc.yml
echo "---- full file for context ----"
wc -l /tmp/wf_b2bc.yml
cat -n /tmp/wf_b2bc.ymlLength of output: 683 🏁 Script executed: #!/bin/bash
set -uo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-contract.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/wf_b2bc.yml
echo "exit code of api call: $?"
wc -l /tmp/wf_b2bc.yml
echo "---- grep ----"
grep -n "TRIGGER_HEAD_SHA\|TRIGGER_EVENT\|CHECKS_FILE" /tmp/wf_b2bc.yml || echo "no matches"
echo "---- full file ----"
cat -n /tmp/wf_b2bc.ymlLength of output: 2166 🏁 Script executed: #!/bin/bash
set -uo pipefail
echo "---- search for any reference to fetch-review-threads.py across repo at this head ----"
gh api repos/safal207/robys-coffee-house-demo/git/trees/b2bc3852abc803defa1f9d6517502a0190a67401?recursive=1 --jq '.tree[].path' > /tmp/tree_b2bc.txt
grep -n "workflow\|scripts/" /tmp/tree_b2bc.txt
echo "---- grep for fetch-review-threads references in workflows/scripts ----"
for f in $(grep -E '\.ya?ml$|\.cjs$|\.py$' /tmp/tree_b2bc.txt); do
content=$(gh api "repos/safal207/robys-coffee-house-demo/contents/${f}?ref=b2bc3852abc803defa1f9d6517502a0190a67401" --jq '.content' 2>/dev/null | base64 -d 2>/dev/null)
if echo "$content" | grep -q "fetch-review-threads"; then
echo "FOUND reference in: $f"
fi
doneLength of output: 6075 🏁 Script executed: #!/bin/bash
set -uo pipefail
for f in .github/workflows/ai-review-cooperation-contract.yml .github/workflows/ai-review-cooperation.yml; do
echo "==== $f ===="
gh api "repos/safal207/robys-coffee-house-demo/contents/${f}?ref=b2bc3852abc803defa1f9d6517502a0190a67401" --jq '.content' | base64 -d > /tmp/$(basename $f)
grep -n "CHECKS_FILE\|TRIGGER_EVENT\|TRIGGER_HEAD_SHA\|fetch-review-threads" /tmp/$(basename $f)
doneLength of output: 4965
def run_id_of(check: dict[str, Any]) -> int | None:
app = check.get('app') or {}
if not isinstance(app, dict) or app.get('slug') != 'github-actions':
return None
url = str(check.get('details_url') or check.get('html_url') or '')
match = RUN_URL.search(url)
return int(match.group(1)) if match else None
Scope clarification (not a defect, just confirming provenance): Bonus hardening, also verified sound: Contract-test coverage confirmed: No valid issues found this round. [approve] (=^･ω･^=) ship it |
Dismissed as stale after remediation. The only actionable finding applied to earlier head 316b9bb... and is fixed on exact head b2bc385 by requiring the original check app.slug to be github-actions before run-ID mapping. The inline thread is resolved. Fresh exact-head CodeRabbit approval is still required.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ai-review-cooperation-contract.yml:
- Around line 264-268: Уточните проверку пагинации в контракте вокруг проверок
check-runs и statuses: вместо отдельной общей проверки '--paginate' убедитесь,
что каждая соответствующая команда endpoint содержит собственный флаг
'--paginate'. Сохраните проверки RAW_CHECKS_FILE и STATUSES_FILE и обеспечьте,
чтобы удаление пагинации у любого из этих endpoint делало контракт неуспешным.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0d252147-0c5d-4450-a676-3f182896eba8
📒 Files selected for processing (3)
.github/workflows/ai-review-cooperation-contract.yml.github/workflows/ai-review-cooperation.ymlscripts/fetch-review-threads.py
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: CodeRabbit
- GitHub Check: build-smoke / build-smoke
- GitHub Check: VISUAL-001 screenshot diff
- GitHub Check: DAST-001 passive web scan
- GitHub Check: Verify exact-head independent review
🧰 Additional context used
📓 Path-based instructions (2)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Проверяй least privilege, pinning сторонних Actions по commit SHA,
безопасность pull_request против pull_request_target, отсутствие выполнения
недоверенного PR-кода с write-token и корректность merge/status gates.
Files:
.github/workflows/ai-review-cooperation.yml.github/workflows/ai-review-cooperation-contract.yml
scripts/**
⚙️ CodeRabbit configuration file
scripts/**: Ищи недетерминированность, небезопасную работу с путями и shell quoting,
скрытое ослабление проверок, сетевые зависимости, утечки секретов и случаи,
когда проверка может ложно завершиться успешно.
Files:
scripts/fetch-review-threads.py
🪛 ast-grep (0.44.1)
scripts/fetch-review-threads.py
[error] 56-62: Use of unsanitized data to create processes
Context: subprocess.run(
command,
check=True,
capture_output=True,
text=True,
encoding='utf-8',
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(os-system-unsanitized-data)
[error] 56-62: Command coming from incoming request
Context: subprocess.run(
command,
check=True,
capture_output=True,
text=True,
encoding='utf-8',
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
[info] 201-201: use jsonify instead of json.dumps for JSON output
Context: json.dumps(derived, ensure_ascii=False, separators=(',', ':'))
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[info] 217-217: use jsonify instead of json.dumps for JSON output
Context: json.dumps(fetch_all(owner, name, number), ensure_ascii=False)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
🪛 Ruff (0.15.20)
scripts/fetch-review-threads.py
[warning] 66-66: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 79-79: Prefer TypeError exception for invalid type
(TRY004)
[warning] 79-79: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 86-86: Prefer TypeError exception for invalid type
(TRY004)
[warning] 86-86: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 142-142: Prefer TypeError exception for invalid type
(TRY004)
[warning] 142-142: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 170-173: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 181-181: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 197-199: Avoid specifying long messages outside the exception class
(TRY003)
🪛 zizmor (1.26.1)
.github/workflows/ai-review-cooperation.yml
[warning] 36-36: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🔇 Additional comments (4)
scripts/fetch-review-threads.py (2)
46-46: По-прежнему проверяйте исходныйapp.slugперед нормализацией.Любой сторонний check с URL вида
/actions/runs/<id>удаляется изexternal_checksи получает синтетическийgithub-actions. Ранее это уже было отмечено; текущая версия проблему не устраняет. Разрешайте извлечение run ID только для исходногоcheck["app"]["slug"] == "github-actions".As per path instructions, для
scripts/**нужно искать «скрытое ослабление проверок» и случаи ложного успешного результата.Also applies to: 125-128, 154-185
Source: Path instructions
2-8: LGTM!Also applies to: 56-86, 230-237
.github/workflows/ai-review-cooperation.yml (1)
36-36: LGTM!Also applies to: 207-207
.github/workflows/ai-review-cooperation-contract.yml (1)
75-75: LGTM!
✅ Action performedReviews resumed. |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/fetch-review-threads.py (1)
174-178: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winПроверка полноты всегда истинна и ничего не ловит.
workflowsзаполняется ровно по одному элементу на каждыйrun_idбез условий/continue, аrest()при сбое кидает исключение и прерывает цикл раньше строки 174. Поэтому при достижении этой проверкиlen(workflows) == len(run_ids)выполняется всегда — это false-pass guard, дающий ложное чувство контроля полноты в fail-closed evidence-пайплайне. Реальную защиту от искажённых метаданных уже обеспечивает exact-head проверка (пустойhead_sha→ mismatch → ошибка).Уберите мёртвую проверку либо замените её валидацией формы ответа (например,
isinstance(item, dict)иitem.get('id') == run_id) доappend.As per path instructions: "случаи, когда проверка может ложно завершиться успешно".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/fetch-review-threads.py` around lines 174 - 178, Проверка полноты по длине в блоке сбора workflows является мёртвой и всегда проходит; удалите её либо замените проверкой каждого ответа до append. В цикле, заполняющем workflows, валидируйте, что item — dict и его item.get('id') совпадает с текущим run_id, затем добавляйте элемент; при нарушении немедленно выбрасывайте ошибку.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@scripts/fetch-review-threads.py`:
- Around line 174-178: Проверка полноты по длине в блоке сбора workflows
является мёртвой и всегда проходит; удалите её либо замените проверкой каждого
ответа до append. В цикле, заполняющем workflows, валидируйте, что item — dict и
его item.get('id') совпадает с текущим run_id, затем добавляйте элемент; при
нарушении немедленно выбрасывайте ошибку.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7aefdbc6-1f1a-4419-9593-e67cdfb15104
📒 Files selected for processing (1)
scripts/fetch-review-threads.py
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: CodeRabbit
- GitHub Check: Verify exact-head independent review
🧰 Additional context used
📓 Path-based instructions (1)
scripts/**
⚙️ CodeRabbit configuration file
scripts/**: Ищи недетерминированность, небезопасную работу с путями и shell quoting,
скрытое ослабление проверок, сетевые зависимости, утечки секретов и случаи,
когда проверка может ложно завершиться успешно.
Files:
scripts/fetch-review-threads.py
🔇 Additional comments (4)
scripts/fetch-review-threads.py (4)
56-86: LGTM!
125-131: LGTM!
180-221: LGTM!
234-240: LGTM!
|
Disposition: accepted Two fresh review findings are fixed on exact head
|
Dismissed as stale after remediation. Its pagination finding applied to earlier head fb0aaa4... and is fixed on exact head 1f2cd8b. The contract now binds --paginate independently to both check-runs and statuses endpoints, and the exact contract run is green. Fresh exact-head review remains required.
|
@coderabbitai review Please review exact head |
|
@qodo-code-review review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-cooperation-contract.yml?ref=1f2cd8bba3253ccc1e4f2df40c59ea1421e55193 --jq '.content' | base64 -d > /tmp/contract_new.yml
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-cooperation-contract.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/contract_prev.yml
echo "---- diff contract ----"
diff -u /tmp/contract_prev.yml /tmp/contract_new.yml || true
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-cooperation.yml?ref=1f2cd8bba3253ccc1e4f2df40c59ea1421e55193 --jq '.content' | base64 -d > /tmp/coop_new.yml
gh api repos/safal207/robys-coffee-house-demo/contents/.github/workflows/ai-review-cooperation.yml?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/coop_prev.yml
echo "---- diff coop workflow ----"
diff -u /tmp/coop_prev.yml /tmp/coop_new.yml || true
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/fetch-review-threads.py?ref=1f2cd8bba3253ccc1e4f2df40c59ea1421e55193 --jq '.content' | base64 -d > /tmp/fetch_new2.py
gh api repos/safal207/robys-coffee-house-demo/contents/scripts/fetch-review-threads.py?ref=b2bc3852abc803defa1f9d6517502a0190a67401 --jq '.content' | base64 -d > /tmp/fetch_prev2.py
echo "---- diff fetch-review-threads.py ----"
diff -u /tmp/fetch_prev2.py /tmp/fetch_new2.py || trueLength of output: 4978 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "Collect exact-head REST evidence" -A 30 /tmp/coop_new.yml | head -50
echo "---- broader context of run_id_of / normalize_workflow_checks ----"
sed -n '100,220p' /tmp/fetch_new2.pyLength of output: 7057 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '1,100p' /tmp/fetch_new2.pyLength of output: 3267 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "ruby <<\|^RUBY\|RUBY$" -B2 -A2 /tmp/contract_new.yml
echo "---- exact bytes around ruby heredoc ----"
awk '/ruby <<'"'"'RUBY'"'"'/{f=1} f{print NR": "$0; if($0 ~ /^[[:space:]]*RUBY[[:space:]]*$/ && NR>1 && f==1 && seen++){}} ' /tmp/contract_new.yml | head -20
python3 - <<'PYEOF'
with open('/tmp/contract_new.yml','rb') as f:
lines = f.readlines()
start=None
for i,l in enumerate(lines):
if b"ruby <<" in l:
start=i
break
for i in range(start, start+12):
print(i+1, repr(lines[i]))
PYEOFLength of output: 5042 🏁 Script executed: #!/bin/bash
set -euo pipefail
grep -n "paginate\|per_page=100" /tmp/contract_new.ymlLength of output: 779
1. Endpoint-specific pagination assertion — real fix. The contract test no longer does a blanket 2. Dead completeness guard replaced with real identity check — correct. Fail-closed / no false-pass path found: Heredoc style note (non-issue): the new No valid issues found this round. [approve] (=^･ω･^=) |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/fetch-review-threads.py (1)
56-67: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winПробрасывайте stderr
ghпри сбое.При
check=TrueCalledProcessErrorне содержит stderr, поэтому реальная причина сбоя API (403/404/rate-limit) теряется в CI-логе. Учитывая, что это единственный примитив вызоваgh, оберните запуск и включите stderr.♻️ Предлагаемая правка
def run_json(command: list[str]) -> dict[str, Any] | list[Any]: - result = subprocess.run( - command, - check=True, - capture_output=True, - text=True, - encoding='utf-8', - ) + try: + result = subprocess.run( + command, + check=True, + capture_output=True, + text=True, + encoding='utf-8', + ) + except subprocess.CalledProcessError as exc: + raise RuntimeError( + f'{" ".join(command)} failed: {(exc.stderr or "").strip()}' + ) from exc payload = json.loads(result.stdout)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/fetch-review-threads.py` around lines 56 - 67, Update run_json to catch subprocess.CalledProcessError from the subprocess.run invocation and include its stderr in the raised error so gh API failures expose their actual cause in CI logs. Preserve the existing JSON parsing and payload-error handling for successful commands.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@scripts/fetch-review-threads.py`:
- Around line 56-67: Update run_json to catch subprocess.CalledProcessError from
the subprocess.run invocation and include its stderr in the raised error so gh
API failures expose their actual cause in CI logs. Preserve the existing JSON
parsing and payload-error handling for successful commands.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 466be2f0-68ac-4f0f-bf5a-5843b5a44dfb
📒 Files selected for processing (2)
.github/workflows/ai-review-cooperation-contract.ymlscripts/fetch-review-threads.py
📜 Review details
⏰ Context from checks skipped due to timeout. (6)
- GitHub Check: Update current-head attestation status
- GitHub Check: CodeRabbit
- GitHub Check: build-smoke / build-smoke
- GitHub Check: VISUAL-001 screenshot diff
- GitHub Check: DAST-001 passive web scan
- GitHub Check: Verify exact-head independent review
⚠️ CI failures not shown inline (2)
GitHub Actions: Bot review disposition contract / 0_REVIEW-LEDGER exact-head findings.txt: fix: derive workflow evidence in trusted cooperation reporter
Conclusion: failure
##[group]Run actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
with:
script: const owner = context.repo.owner;
const repo = context.repo.repo;
const payloadPr = context.payload.pull_request;
const issuePr = context.payload.issue?.pull_request;
const prNumber = payloadPr?.number ?? (issuePr ? context.payload.issue.number : null);
if (!prNumber) {
core.notice('Event is not associated with a pull request.');
return;
}
const pr = (await github.rest.pulls.get({ owner, repo, pull_number: prNumber })).data;
const head = pr.head.sha.toLowerCase();
const [reviewComments, reviews, issueComments, statuses] = await Promise.all([
github.paginate(
github.rest.pulls.listReviewComments,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.pulls.listReviews,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.issues.listComments,
{ owner, repo, issue_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.repos.listCommitStatusesForRef,
{ owner, repo, ref: head, per_page: 100 },
),
]);
const reviewHeads = new Map(
reviews.map((review) => [review.id, review.commit_id?.toLowerCase()]),
);
const reviewBots = new Set([
'chatgpt-codex-connector',
'chatgpt-codex-connector[bot]',
'coderabbitai',
'coderabbitai[bot]',
'github-advanced-security',
'github-advanced-security[bot]',
]);
const trustedAssociations = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
const exactHeadBody = (body) => new RegExp(`(^|[^0-9a-f])${head}([^0-9a-f]|$)`, 'i').test(body ?? '');
const timeOf = (item) => Math.max(
0,
...[item.submitted_at, item.created_at, item.updated_at]
.map((value) => Date.parse(value ?? 0))
.filter(Number.isFinite),
);
const isDispositionReply = (reply) => {
const body = (reply.body ?? '').replaceAll('`', '');
const disposition = /^Disposition:\s*(accepted|rejected-with-evidence|superseded)\s*$/im.test(body);
cons...
GitHub Actions: Bot review disposition contract / REVIEW-LEDGER exact-head findings: fix: derive workflow evidence in trusted cooperation reporter
Conclusion: failure
##[group]Run actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
with:
script: const owner = context.repo.owner;
const repo = context.repo.repo;
const payloadPr = context.payload.pull_request;
const issuePr = context.payload.issue?.pull_request;
const prNumber = payloadPr?.number ?? (issuePr ? context.payload.issue.number : null);
if (!prNumber) {
core.notice('Event is not associated with a pull request.');
return;
}
const pr = (await github.rest.pulls.get({ owner, repo, pull_number: prNumber })).data;
const head = pr.head.sha.toLowerCase();
const [reviewComments, reviews, issueComments, statuses] = await Promise.all([
github.paginate(
github.rest.pulls.listReviewComments,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.pulls.listReviews,
{ owner, repo, pull_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.issues.listComments,
{ owner, repo, issue_number: prNumber, per_page: 100 },
),
github.paginate(
github.rest.repos.listCommitStatusesForRef,
{ owner, repo, ref: head, per_page: 100 },
),
]);
const reviewHeads = new Map(
reviews.map((review) => [review.id, review.commit_id?.toLowerCase()]),
);
const reviewBots = new Set([
'chatgpt-codex-connector',
'chatgpt-codex-connector[bot]',
'coderabbitai',
'coderabbitai[bot]',
'github-advanced-security',
'github-advanced-security[bot]',
]);
const trustedAssociations = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
const exactHeadBody = (body) => new RegExp(`(^|[^0-9a-f])${head}([^0-9a-f]|$)`, 'i').test(body ?? '');
const timeOf = (item) => Math.max(
0,
...[item.submitted_at, item.created_at, item.updated_at]
.map((value) => Date.parse(value ?? 0))
.filter(Number.isFinite),
);
const isDispositionReply = (reply) => {
const body = (reply.body ?? '').replaceAll('`', '');
const disposition = /^Disposition:\s*(accepted|rejected-with-evidence|superseded)\s*$/im.test(body);
cons...
🧰 Additional context used
📓 Path-based instructions (2)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Проверяй least privilege, pinning сторонних Actions по commit SHA,
безопасность pull_request против pull_request_target, отсутствие выполнения
недоверенного PR-кода с write-token и корректность merge/status gates.
Files:
.github/workflows/ai-review-cooperation-contract.yml
scripts/**
⚙️ CodeRabbit configuration file
scripts/**: Ищи недетерминированность, небезопасную работу с путями и shell quoting,
скрытое ослабление проверок, сетевые зависимости, утечки секретов и случаи,
когда проверка может ложно завершиться успешно.
Files:
scripts/fetch-review-threads.py
🪛 Ruff (0.15.20)
scripts/fetch-review-threads.py
[warning] 162-165: Avoid specifying long messages outside the exception class
(TRY003)
🔇 Additional comments (6)
scripts/fetch-review-threads.py (4)
70-87: LGTM!
125-131: LGTM!
134-220: LGTM!
232-239: LGTM!.github/workflows/ai-review-cooperation-contract.yml (2)
75-75: LGTM!
264-283: Проверка--paginateтеперь привязана к конкретным endpoint (check-runs,statuses), удаление пагинации у любого из них делает контракт красным — прошлое замечание закрыто. Grep-строки соответствуют фактическим фрагментамscripts/fetch-review-threads.py.LGTM!
|
@qodo-code-review review Please complete exact-head review for |
1 participant
Summary
Derive exact-head GitHub Actions workflow evidence inside the trusted default-branch cooperation reporter while keeping the pull-request AI gate read-only.
Exact head:
1f2cd8bba3253ccc1e4f2df40c59ea1421e55193Root cause
Exact-head run
29146573863reachedREADY_WITH_ADVISORY_GAPS; only direct PR-comment publication failed with HTTP 403. The final architecture therefore keeps the PR gate read-only and lets the existing trustedworkflow_runreporter publish after successful exact-head verification.Changes
Workflow evidence adapter
scripts/fetch-review-threads.pynow:app.slug == github-actionsbefore parsing an Actions run URL;/actions/runs/<id>;item.id == requested run_idbefore append;AI review contractforworkflow_runpublication;Trusted reporter
.github/workflows/ai-review-cooperation.ymladds only job-scopedactions: read, required to read workflow-run metadata. Existing write scope remains limited toissues: write; workflow permissions still default to{}.Executable contract
.github/workflows/ai-review-cooperation-contract.ymlnow verifies:--paginatebinding for bothcheck-runs?per_page=100andstatuses?per_page=100.Evidence
pull_request_targetapproach removed before merge;AI review cooperation contractrun29159696430is green, including compile, YAML parsing, authorization matrix, endpoint pagination, identity checks, and trust boundaries.AI review
Fresh exact-head review requested from CodeRabbit and Qodo for:
Merge criteria:
Security boundary
pull_request_target;Boundary
Changed files only:
.github/workflows/ai-review-cooperation.yml;.github/workflows/ai-review-cooperation-contract.yml;scripts/fetch-review-threads.py.No product runtime, public asset, Lighthouse baseline, review threshold, D6 rule, report marker, or ledger acceptance rule changed.
Validation checklist