fix(scheduler): permit same-repository commit status reads - #2121
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough
Changes스케줄러 상태 권한
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix · Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to The scheduler gains the required read-only status access without changing credential selection, status publication, or mutation behavior. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Current-head CI diagnosis for
These failures do not establish a code finding or approval. Required OpenCode/Strix and consumer-private status-read acceptance remain outstanding; no merge or issue resolution is claimed. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head source review for 1c5c6b7afa841f7a4a999f54d45ef8d504a2d818 (COMMENT, not approval): no source-level blocker found. The one-line statuses: read grant is confined to scan-pr-queue; it neither grants status publication nor changes the mutation/App-token path. The exact contract assertion scopes the permission block and requires the sole value read. Runtime Quality, Security, SAST, Python Security, and CodeQL are terminal GREEN. OpenCode run 34700520369 is not a code failure: the sole contextual-orchestrator/orchestrator/free route ended outcome=exhausted model=none, so no formal current-head receipt exists. Keep ordinary merge blocked until a qualifying independent approval/receipt exists; do not bypass or substitute this COMMENT.
|
@coderabbitai review 현재 exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="1c5c6b7afa841f7a4a999f54d45ef8d504a2d818"
base="fb17ef556f94f673234aa557254ae52779e9a7b0"
echo "== Checked-out revision =="
git rev-parse HEAD
git status --short
echo "== Verify requested commits exist and inspect exact diff =="
git cat-file -e "${expected_head}^{commit}"
git cat-file -e "${base}^{commit}"
git diff --check "$base" "$expected_head"
git diff --find-renames --find-copies --unified=80 "$base" "$expected_head" -- \
.github/workflows/pr-review-merge-scheduler.yml \
tests/test_opencode_agent_contract.py \
docs/doctoring/scheduler-status-read-permission.md
echo "== Workflow structure and credential/status call sites =="
ast-grep outline .github/workflows/pr-review-merge-scheduler.yml --items all || true
rg -n -i -C 5 \
'scan-pr-queue|permissions:|statuses:|commit.?status|combined.?status|/statuses|github-token|token:|gh api|curl |POST|PATCH|PUT|DELETE' \
.github/workflows/pr-review-merge-scheduler.yml
echo "== Contract test context =="
ast-grep outline tests/test_opencode_agent_contract.py --items all --type function || true
rg -n -C 12 \
'test_merge_scheduler_uses_escalating_mutation_credentials|scan-pr-queue|statuses|credential|token|status' \
tests/test_opencode_agent_contract.py
echo "== Repository references to scheduler workflow and status APIs =="
rg -n -i -C 3 \
'pr-review-merge-scheduler|scan-pr-queue|combined.?status|repos/.*/commits/.*/status|/status(es)?\b|statuses:\s*(write|read)' \
-g '!docs/doctoring/scheduler-status-read-permission.md' \
.github tests scripts README.md 2>/dev/null || true
echo "== Inspect parent workflow / reusable-workflow permission context =="
rg -n -C 8 \
'uses:\s*\./\.github/workflows/pr-review-merge-scheduler\.yml|pr-review-merge-scheduler\.yml|workflow_call:|permissions:' \
.github/workflows 2>/dev/null || trueLength of output: 202345 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="1c5c6b7afa841f7a4a999f54d45ef8d504a2d818"
base="fb17ef556f94f673234aa557254ae52779e9a7b0"
printf '%s\n' '== Exact revision identity =='
printf 'HEAD='; git rev-parse HEAD
printf 'requested='; git rev-parse "$expected_head"
printf 'base='; git rev-parse "$base"
git merge-base --is-ancestor "$base" "$expected_head"
printf 'base_is_ancestor=yes\n'
printf '%s\n' '== Exact changed paths and patch =='
git diff --name-status "$base" "$expected_head"
git diff --unified=25 "$base" "$expected_head" -- \
.github/workflows/pr-review-merge-scheduler.yml \
tests/test_opencode_agent_contract.py \
docs/doctoring/scheduler-status-read-permission.md
printf '%s\n' '== Scheduler job: exact permission, token, and mutation context =='
sed -n '93,180p' .github/workflows/pr-review-merge-scheduler.yml
rg -n -C 8 \
'SCHEDULER_(READ|DISPATCH|MUTATION)_TOKEN|MUTATION_TOKEN_SOURCE|github\.token|PR_REVIEW_MERGE_TOKEN|OPENCODE_APPROVE_TOKEN|opencode_app_token|gh api|gh pr|repository_dispatch|/statuses|/status\b|--method (POST|PATCH|PUT|DELETE)|-X (POST|PATCH|PUT|DELETE)' \
.github/workflows/pr-review-merge-scheduler.yml
printf '%s\n' '== Read API implementation and credential injection =='
sed -n '1280,1350p' scripts/ci/pr_review_merge_scheduler_core.py
rg -n -C 6 \
'def gh_api_json|GH_TOKEN|GITHUB_TOKEN|SCHEDULER_READ_TOKEN|SCHEDULER_DISPATCH_TOKEN|SCHEDULER_MUTATION_TOKEN|declared_mutation_token_source' \
scripts/ci/pr_review_merge_scheduler.py \
scripts/ci/pr_review_merge_scheduler_core.py
printf '%s\n' '== Test delta and adjacent original credential assertions =='
sed -n '2360,2448p' tests/test_opencode_agent_contract.pyLength of output: 65421 🤖 web_search executed:
Length of output: 5082
결과: actionable finding 없음
호스팅 환경의 consumer-private acceptance는 이 정적 검토 범위 밖입니다. 해당 acceptance가 별도로 필요하다는 문서의 조건과도 일치합니다.
|
|
Infrastructure-exception merge record (operator guideline §11), head Blocking checks and why they are infrastructure, not this change:
Substantive gates that did run and pass on this exact head: required-workflow-bootstrap, scan-pr-queue (×2), coverage-evidence, coverage-source-tree, CodeQL compatibility analysis (actions, python) + codeql-dispatch/actions + codeql-dispatch/python, Semgrep (multi-language) + Semgrep OSS, Bandit, gitleaks, pip-audit, trivy-fs, scorecard, agent-review-runtime-quality. Substitute verification (independent read-only agent on a fresh worktree of this head): diff is exactly one added line, Impact: read-only grant on a same-repository token; no mutation, App, or cross-repository credential change. Deferred verification, to be re-run after merge: the three sidecar reviews on the next central change, and the consumer's exact-head |
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
1 participant
The required scheduler's same-repository read token lacks commit-status permission, so a private consumer's combined-status GET fails with HTTP 403 before status evaluation. Add
statuses: readonly toscan-pr-queue, and extend the existing credential contract test to require that exact read-only grant. Token selection, status publication and mutation behavior are unchanged.Refs #2120. Keep the issue open until a newly loaded central SHA successfully reads statuses on the consumer's current head; local validation is not hosted permission evidence. The consumer head inspected has no
.githubtree, so no repository-local caller grant is being changed.Validation: the new assertion failed on
9521b6771; corrected head1c5c6b7afa841f7a4a999f54d45ef8d504a2d818passed 452 workflow/credential/status tests withGITHUB_ACTIONS=true. The new assertion also passed with the ordinary local environment. Actionlint workflow validation (-shellcheck= -pyflakes=) andgit diff --checkpassed. A separate read-only agent review found no scope or privilege escalation issue; this is not formal GitHub approval.Operational evidence, endpoint contract and remaining hosted acceptance are in
docs/doctoring/scheduler-status-read-permission.md.Summary by CodeRabbit
버그 수정
문서
테스트