fix: canary C6 政策调和——@vN 与 zizmor SHA 钉扎的双合法形态（ADR-0022） - #33
Conversation
|
Warning Review limit reached
Next review available in: 16 minutes Limit details: You’ve used all 3 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Comment |
PR Summary by QodoHarmonize C6 reusable workflow version pinning
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
1. C4 rejects allowed SHA
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| if re.fullmatch(r"v[0-9]+", ver): | ||
| continue | ||
| if re.fullmatch(r"[0-9a-f]{40}", ver): |
There was a problem hiding this comment.
1. C4 rejects allowed sha 🐞 Bug ≡ Correctness
check_c6() now accepts version-tagged SHAs, but check_c4() still requires template-service reusable workflows to contain @v. Pinning those workflows to a valid vN tag commit therefore satisfies C6 but always fails C4, leaving the policy conflict unresolved for template-service.
Agent Prompt
## Issue description
C6 accepts either an `@vN` reference or a 40-hex SHA matching a vN tag, while C4 still accepts only textual `@vN` references for template-service. A policy-compliant SHA pin consequently fails the overall canary.
## Issue Context
Apply the same reusable-workflow reference policy consistently across C4 and C6. Avoid duplicating the validation logic if possible.
## Fix Focus Areas
- scripts/canary.py[123-126]
- scripts/canary.py[221-235]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| def ciw_version_tag_shas() -> set[str]: | ||
| """CI-Workflows 全部 vN 大版本 tag 指向的 commit SHA 集（含 annotated tag 解引用）。""" | ||
| shas: set[str] = set() | ||
| tags = fetch_json(f"{API}/repos/{ORG}/CI-Workflows/tags?per_page=100") |
There was a problem hiding this comment.
2. Tag pagination omits releases 🐞 Bug ☼ Reliability
ciw_version_tag_shas() fetches only the first 100 repository tags, so valid vN tags on later pages are absent from the allowlist. Once CI-Workflows exceeds that limit, workflows pinned to an omitted release SHA are incorrectly rejected.
Agent Prompt
## Issue description
The GitHub tags endpoint is paginated with a maximum of 100 results per page, but `ciw_version_tag_shas()` reads only page one. This makes the purported complete vN SHA set incomplete.
## Issue Context
Fetch successive pages until exhaustion, preserving fail-closed behavior if any page cannot be retrieved. A guarded failure when the page limit is reached would be safer than silently accepting an incomplete set.
## Fix Focus Areas
- scripts/canary.py[167-188]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
1 participant
问题
ADR-0021 批次内两项政策互撞，canary 周期运行实证（run 32234849030）：
@v1改钉 40-hex SHA；@vN→ 政策合法的修复被自己周期回路判红。修复（调和为双合法形态）
组织 reusable workflow（CI-Workflows/*）引用接受：
@vN大版本指针（版本策略既有形态）；tag 解析含 annotated tag 解引用（git/ref → type=tag 时跟到 commit）。
验证
ADR-0021 ADR-0022