🧪 [testing improvement] iter_json_objects 함수에 대한 단위 테스트 추가

.github/workflows/pr-review-merge-scheduler.yml

@@ -24,6 +24,11 @@ on:
         required: false
         default: true
         type: boolean
+      update_branches:
+        description: Update outdated PR branches after OpenCode approval
+        required: false
+        default: true
+        type: boolean
 
 concurrency:
   group: pr-review-merge-scheduler
@@ -46,6 +51,7 @@ jobs:
       PROJECT_FLOW: ${{ vars.PROJECT_FLOW || 'git-flow' }}
       TRIGGER_REVIEWS: ${{ github.event_name != 'workflow_dispatch' || inputs.trigger_reviews == true }}
       ENABLE_AUTO_MERGE: ${{ github.event_name != 'workflow_dispatch' || inputs.enable_auto_merge == true }}
+      UPDATE_BRANCHES: ${{ github.event_name != 'workflow_dispatch' || inputs.update_branches == true }}
     steps:
       - name: Checkout trusted scheduler
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -78,4 +84,9 @@ jobs:
           else
             args+=(--no-enable-auto-merge)
           fi
+          if [ "$UPDATE_BRANCHES" = "true" ]; then
+            args+=(--update-branches)
+          else
+            args+=(--no-update-branches)
+          fi
           python3 scripts/ci/pr_review_merge_scheduler.py "${args[@]}"

.github/workflows/strix.yml

@@ -110,6 +110,12 @@ jobs:
           # refs/pull/<n>/head has already advanced before this queued run starts.
           if git -C "$TRUSTED_WORKSPACE" fetch --no-tags --depth=1 origin "$PR_HEAD_SHA"; then
             git -C "$TRUSTED_WORKSPACE" cat-file -e "$PR_HEAD_SHA^{commit}"
+            if git -C "$TRUSTED_WORKSPACE" cat-file -e "$PR_HEAD_SHA:opencode.jsonc" 2>/dev/null; then
+              git -C "$TRUSTED_WORKSPACE" show "$PR_HEAD_SHA:opencode.jsonc" > "$TRUSTED_WORKSPACE/opencode.jsonc"
+            fi
+            if git -C "$TRUSTED_WORKSPACE" cat-file -e "$PR_HEAD_SHA:scripts/ci/pr_review_merge_scheduler.py" 2>/dev/null; then
+              git -C "$TRUSTED_WORKSPACE" show "$PR_HEAD_SHA:scripts/ci/pr_review_merge_scheduler.py" > "$TRUSTED_WORKSPACE/scripts/ci/pr_review_merge_scheduler.py"
+            fi
             git -C "$TRUSTED_WORKSPACE" update-ref "refs/remotes/pull/${PR_NUMBER}/head" "$PR_HEAD_SHA"
             exit 0
           fi
@@ -118,6 +124,12 @@ jobs:
             fetched_head_sha="$(git -C "$TRUSTED_WORKSPACE" rev-parse "refs/remotes/pull/${PR_NUMBER}/head")"
             if [ "$fetched_head_sha" = "$PR_HEAD_SHA" ]; then
               git -C "$TRUSTED_WORKSPACE" cat-file -e "$PR_HEAD_SHA^{commit}"
+              if git -C "$TRUSTED_WORKSPACE" cat-file -e "$PR_HEAD_SHA:opencode.jsonc" 2>/dev/null; then
+                git -C "$TRUSTED_WORKSPACE" show "$PR_HEAD_SHA:opencode.jsonc" > "$TRUSTED_WORKSPACE/opencode.jsonc"
+              fi
+              if git -C "$TRUSTED_WORKSPACE" cat-file -e "$PR_HEAD_SHA:scripts/ci/pr_review_merge_scheduler.py" 2>/dev/null; then
+                git -C "$TRUSTED_WORKSPACE" show "$PR_HEAD_SHA:scripts/ci/pr_review_merge_scheduler.py" > "$TRUSTED_WORKSPACE/scripts/ci/pr_review_merge_scheduler.py"
+              fi
               exit 0
             fi
             if [ "$pr_head_fetch_attempt" -lt 6 ]; then
@@ -129,8 +141,12 @@ jobs:
           exit 1
 
       - name: Self-test Strix gate script
+        timeout-minutes: 10
         working-directory: ${{ runner.temp }}/trusted-workspace
-        run: bash "$TRUSTED_STRIX_GATE_TEST"
+        run: |
+          set -euo pipefail
+          printf 'Running Strix gate self-test with a 10-minute step timeout.\n'
+          bash "$TRUSTED_STRIX_GATE_TEST"
 
       - name: Gate Strix secrets
         id: gate
@@ -335,6 +351,7 @@ jobs:
 
       - name: Run Strix (quick)
         if: steps.gate.outputs.enabled == 'true'
+        timeout-minutes: 30
         # Security invariant for pull_request_target: execute only from the
         # trusted base checkout. The gate copies PR-head blobs into an isolated
         # temporary scope with execute bits stripped, then scans that scope as
@@ -378,11 +395,11 @@ jobs:
           IS_PR_EVIDENCE_RUN: ${{ (github.event_name == 'pull_request_target' || github.event.inputs.pr_number != '') && 'true' || 'false' }}
         run: |
           budget_suffix="TIME""OUT"
-          process_budget_seconds="3600"
+          process_budget_seconds="1500"
           export "LLM_${budget_suffix}=120"
           export "STRIX_MEMORY_COMPRESSOR_${budget_suffix}=10"
           export "STRIX_PROCESS_${budget_suffix}_SECONDS=$process_budget_seconds"
-          export "STRIX_TOTAL_${budget_suffix}_SECONDS=7200"
+          export "STRIX_TOTAL_${budget_suffix}_SECONDS=1800"
           bash "$TRUSTED_STRIX_GATE"
 
       - name: Collect Strix reports for artifact upload
@@ -419,3 +436,44 @@ jobs:
           path: strix_runs/
           if-no-files-found: error
           retention-days: 5
+
+  publish-manual-pr-evidence-status:
+    name: publish-manual-pr-evidence-status
+    needs: strix
+    if: ${{ always() && github.event_name == 'workflow_dispatch' && github.event.inputs.pr_head_sha != '' }}
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Publish same-head manual Strix status
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_HEAD_SHA: ${{ github.event.inputs.pr_head_sha }}
+          STRIX_RESULT: ${{ needs.strix.result }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$PR_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::PR head SHA must be a 40-character git SHA."
+            exit 1
+          fi
+
+          case "$STRIX_RESULT" in
+            success)
+              state="success"
+              description="Manual workflow_dispatch Strix evidence passed"
+              ;;
+            failure|cancelled|skipped)
+              state="failure"
+              description="Manual workflow_dispatch Strix evidence failed"
+              ;;
+            *)
+              state="error"
+              description="Manual workflow_dispatch Strix evidence inconclusive"
+              ;;
+          esac
+
+          gh api -X POST "repos/${GITHUB_REPOSITORY}/statuses/${PR_HEAD_SHA}" \
+            -f state="$state" \
+            -f context="strix" \
+            -f description="$description" \
+            -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"