From 5cba0ccf57b043ba39f46912bf532cd945ea916d Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 1 Sep 2026 00:57:03 +0000 Subject: [PATCH] fix(ci): repair main's stale review-dispatch blob pin and security-boundary test Two tests broke on main after two independently-legitimate, already-merged changes to .github/workflows/opencode-review-dispatch.yml, neither of which updated the assertions that pin its exact content: - REVIEW_DISPATCH_BLOB_SHA in test_pr_review_autofix_nvidia_nim_contract.py still pinned an old blob hash. Both test_independent_review_agent_workflow_matches_reviewed_blob (same file) and test_review_dispatch_blob_sha_stays_paired_with_trusted_workflow (test_opencode_rust_coverage_toolchain_contract.py, which reads this same constant) failed as a result. Verified the file's current content is legitimate before bumping the pin: it was last touched by #1533 (Devin-reviewed, merged), and the isolation invariant this pin exists to protect ("pr-review-autofix" must never appear in the read-only reviewer workflow) still holds. Updated the constant to the current blob hash. - test_opencode_privileged_review_security_boundaries_are_fail_closed (test_opencode_agent_contract.py) pinned the pre-#1533 hard-fail-on-any- head_sha-mismatch behavior. #1533 deliberately relaxed that to a warning (downstream jobs already re-validate the live head independently via STALE_HEAD guards), which is why the required opencode-review check was failing closed on ordinary PR activity under the org's Actions queue backlog. Updated the assertion to pin the new, correct invariant instead of reverting #1533's fix: base_ref/base_sha/head_ref remain hard-fail exact matches, head_sha is explicitly excluded from that set, and the warn-and-proceed path is present. Verified against unmodified origin/main that both failures pre-existed this change (not introduced by it) before fixing. --- Generated by Claude Code --- tests/test_opencode_agent_contract.py | 9 ++++++++- tests/test_pr_review_autofix_nvidia_nim_contract.py | 2 +- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index 79fdba39aa..6f1478fe96 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -2660,7 +2660,14 @@ def test_opencode_privileged_review_security_boundaries_are_fail_closed(): '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]' ) in metadata_step assert '[ "$live_head_repository" != "$TARGET_REPOSITORY" ]' not in metadata_step - assert '[ "$SUPPLIED_HEAD_SHA" = "$live_head_sha" ]' in metadata_step + assert '[ "$SUPPLIED_BASE_REF" = "$live_base_ref" ] || mismatches+=("base_ref")' in metadata_step + assert '[ "$SUPPLIED_BASE_SHA" = "$live_base_sha" ] || mismatches+=("base_sha")' in metadata_step + assert '[ "$SUPPLIED_HEAD_REF" = "$live_head_ref" ] || mismatches+=("head_ref")' in metadata_step + assert 'mismatches+=("head_sha")' not in metadata_step + assert ( + 'if [ -n "$SUPPLIED_HEAD_SHA" ] && [ "$SUPPLIED_HEAD_SHA" != "$live_head_sha" ]; then' + ) in metadata_step + assert "::warning::repository_dispatch head advanced since dispatch" in metadata_step assert ( 'live_visibility="$(jq -r \'.base.repo.visibility // empty | ascii_downcase\'' ) in metadata_step diff --git a/tests/test_pr_review_autofix_nvidia_nim_contract.py b/tests/test_pr_review_autofix_nvidia_nim_contract.py index 3dcfe2cdd8..68a0614c01 100644 --- a/tests/test_pr_review_autofix_nvidia_nim_contract.py +++ b/tests/test_pr_review_autofix_nvidia_nim_contract.py @@ -19,7 +19,7 @@ DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md") CHANGELOG = Path("CHANGELOG.md") REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml") -REVIEW_DISPATCH_BLOB_SHA = "2aa245e7f2a053a4c0b7a9cc8bac0d5d44d38092" +REVIEW_DISPATCH_BLOB_SHA = "3762183eb31c2805317362d2b2c2546e4fccdf09" def _workflow_text(path: Path) -> str: