Skip to content

ci(opencode-review): provision LLVM coverage tools #755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 7 commits into from
Aug 5, 2026
Merged

ci(opencode-review): provision LLVM coverage tools #755

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4e4b99a
ci: stage fail-closed LLVM coverage repair
seonghobae Aug 4, 2026
c28a16f
ci: use bounded app token for workflow repair
seonghobae Aug 4, 2026
2cd3e13
ci(opencode-review): provision LLVM coverage tools
opencode-agent[bot] Aug 4, 2026
575aa55
docs(doctoring): trace LLVM coverage toolchain decision
seonghobae Aug 5, 2026
3a31af0
fix(security): apply remediated Strix dependency floors
seonghobae Aug 5, 2026
6610317
ci: refresh PR 755 Strix lock from validated blob
seonghobae Aug 5, 2026
5495d08
fix(security): refresh remediated Strix hash lock
github-actions[bot] Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/opencode-review-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -652,11 +652,15 @@ jobs:
r-base \
r-cran-covr \
r-cran-testthat \
llvm-19 \
rustc \
util-linux \
vulkan-tools \
xz-utils \
&& rm -rf /var/lib/apt/lists/*
ENV LLVM_COV=/usr/bin/llvm-cov-19
ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19
RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"
Comment on lines +655 to +663

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow excerpt ---'
sed -n '625,675p' .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '--- documentation excerpt ---'
sed -n '1,40p' docs/doctoring/opencode-llvm-coverage-toolchain.md
printf '%s\n' '--- related package/source references ---'
rg -n -C 3 'llvm-19|llvm-toolchain-19|rustc|snapshot|LLVM_COV|LLVM_PROFDATA|pinned' \
  .github/workflows/opencode-review-dispatch.yml \
  docs/doctoring/opencode-llvm-coverage-toolchain.md

Repository: ContextualWisdomLab/.github

Length of output: 20474

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- all APT and image-repository controls in workflow ---'
rg -n -C 4 'apt-get|sources.list|snapshot.debian|deb\.debian|llvm-19|rustc|FROM .*python' \
  .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '--- package pinning syntax in repository ---'
rg -n -S 'apt-get install.*=|llvm-toolchain-19|snapshot\.debian\.org|apt_preferences|/etc/apt/preferences|snapshot\.debian' \
  .github docs scripts tests 2>/dev/null || true
printf '%s\n' '--- relevant workflow contract tests ---'
rg -n -C 5 'llvm-19|LLVM_COV|LLVM_PROFDATA|coverage image|Dockerfile|apt-get install' \
  tests .github 2>/dev/null | head -n 300

Repository: ContextualWisdomLab/.github

Length of output: 17230

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text()
doc = Path("docs/doctoring/opencode-llvm-coverage-toolchain.md").read_text()

dockerfile = workflow.split("cat >\"$coverage_build_dir/Dockerfile\" <<'DOCKERFILE\n", 1)[1].split("\n          DOCKERFILE", 1)[0]
packages = re.findall(r"(?m)^\s{14}([a-z0-9][a-z0-9+.-]*)(?:\s*\\)?$", dockerfile)
apt_lines = [line.strip() for line in dockerfile.splitlines() if "apt-get" in line or "snapshot.debian" in line or "sources.list" in line or "preferences" in line]

print("packages:", packages)
print("version-pinned packages:", [p for p in packages if "=" in p])
print("APT repository/pinning lines:", apt_lines)
print("base image pinned by digest:", bool(re.search(r"^FROM .+@sha256:[0-9a-f]{64}$", dockerfile, re.M)))
print("documentation claims pinned repositories:", "pinned Debian image repositories" in doc)
print("documentation claims exact package version:", "19.1.7-3+b1" in doc)
PY

Repository: ContextualWisdomLab/.github

Length of output: 274

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text()
doc = Path("docs/doctoring/opencode-llvm-coverage-toolchain.md").read_text()

start = workflow.index("cat >")
start = workflow.index("\n", start) + 1
end = workflow.index("\n", workflow.index("DOCKERFILE", start))
dockerfile = "\n".join(
    line[10:] if line.startswith("          ") else line
    for line in workflow[start:end].splitlines()
)

packages = re.findall(r"(?m)^\s{2,}([a-z0-9][a-z0-9+.-]*)(?:\s*\\)?$", dockerfile)
apt_lines = [
    line.strip()
    for line in dockerfile.splitlines()
    if any(token in line for token in (
        "apt-get", "snapshot.debian", "sources.list", "preferences"
    ))
]

print("packages:", packages)
print("version-pinned packages:", [p for p in packages if "=" in p])
print("APT repository/pinning lines:", apt_lines)
print(
    "base image pinned by digest:",
    bool(re.search(r"^FROM .+@sha256:[0-9a-f]{64}$", dockerfile, re.M)),
)
print("documentation claims pinned repositories:", "pinned Debian image repositories" in doc)
print("documentation claims exact package version:", "19.1.7-3+b1" in doc)
PY

Repository: ContextualWisdomLab/.github

Length of output: 701

APT 패키지 고정을 구현과 문서에서 일치시키세요.

FROM 이미지 digest는 고정되어 있지만, apt-get update는 llvm-19와 rustc의 버전 또는 Debian 저장소 snapshot을 고정하지 않습니다. 따라서 재빌드마다 Rust/LLVM 도구체인과 coverage 결과가 달라질 수 있습니다.

  • .github/workflows/opencode-review-dispatch.yml#L655-L663: 호환되는 exact package version 또는 immutable Debian snapshot을 적용하세요.
  • docs/doctoring/opencode-llvm-coverage-toolchain.md#L16-L18: 실제 고정 방식을 문서화하세요. 고정하지 않으면 pinned 및 exact version 주장을 제거하세요.
📍 Affects 2 files
  • .github/workflows/opencode-review-dispatch.yml#L655-L663 (this comment)
  • docs/doctoring/opencode-llvm-coverage-toolchain.md#L16-L18
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/opencode-review-dispatch.yml around lines 655 - 663, Pin
the llvm-19 and rustc APT inputs in the Docker build using compatible exact
package versions or an immutable Debian snapshot, and retain the executable
checks for LLVM_COV and LLVM_PROFDATA. In
docs/doctoring/opencode-llvm-coverage-toolchain.md lines 16-18, document the
implemented pinning mechanism and versions; if the build remains unpinned,
remove the “pinned” and exact-version claims instead.

RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \
https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \
&& echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742 /tmp/node-linux-x64.tar.xz' | sha256sum -c - \
Expand Down
12 changes: 12 additions & 0 deletions tests/test_opencode_agent_contract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2729,3 +2729,15 @@ def test_r_package_load_deferral_requires_current_head_r_cmd_check():
assert (
"if (!is.na(pkg) && !requireNamespace(pkg, quietly = TRUE))" not in workflow
)


def test_opencode_coverage_image_provisions_compatible_llvm_tools():
"""Keep Rust coverage independent of a rustup-managed toolchain."""
workflow = Path(
".github/workflows/opencode-review-dispatch.yml"
).read_text(encoding="utf-8")

assert " llvm-19 " + chr(92) in workflow
assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow
assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow
assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow
Comment on lines +2734 to +2743

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- target test ---'
sed -n '2700,2770p' tests/test_opencode_agent_contract.py

printf '%s\n' '--- workflow coverage job markers ---'
rg -n -A120 -B10 'coverage-evidence:|opencode-review-target:|Dockerfile|llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov' \
  .github/workflows/opencode-review-dispatch.yml

printf '%s\n' '--- related contract-test references ---'
rg -n -A20 -B10 'opencode_coverage_image|coverage-evidence|cargo-llvm-cov|LLVM_COV|LLVM_PROFDATA' \
  tests/test_opencode_agent_contract.py

Repository: ContextualWisdomLab/.github

Length of output: 50383

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path

workflow_path = Path(".github/workflows/opencode-review-dispatch.yml")
workflow = workflow_path.read_text(encoding="utf-8")

start_marker = "  coverage-evidence:\n"
end_marker = "\n  opencode-review-target:"
print("coverage_start_present:", start_marker in workflow)
coverage_start = workflow.index(start_marker)
coverage_end = workflow.index(end_marker, coverage_start)
coverage_job = workflow[coverage_start:coverage_end]
print("coverage_job_length:", len(coverage_job))

docker_start_marker = 'cat >"$coverage_build_dir/Dockerfile" <<\\'DOCKERFILE\\''
docker_end_marker = "\n          DOCKERFILE"
print("docker_start_present_in_coverage_job:", docker_start_marker in coverage_job)
print("docker_end_present_in_coverage_job:", docker_end_marker in coverage_job)
dockerfile_start = coverage_job.index(docker_start_marker)
dockerfile_end = coverage_job.index(docker_end_marker, dockerfile_start)
dockerfile = coverage_job[dockerfile_start:dockerfile_end]

needles = [
    "              llvm-19 " + chr(92),
    "ENV LLVM_COV=/usr/bin/llvm-cov-19",
    "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19",
    'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"',
    "cargo-llvm-cov.tar.gz",
]
for needle in needles:
    print(repr(needle), "in_workflow=", needle in workflow,
          "in_coverage_job=", needle in coverage_job,
          "in_dockerfile=", needle in dockerfile)

for needle in [
    'RUN test -x "$LLVM_COV"',
    "cargo-llvm-cov.tar.gz",
]:
    print("dockerfile_index", repr(needle), dockerfile.find(needle))

print("dockerfile_excerpt:")
print(dockerfile)
PY

Repository: ContextualWisdomLab/.github

Length of output: 376

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
test = Path("tests/test_opencode_agent_contract.py").read_text(encoding="utf-8")

coverage_start = workflow.index("  coverage-evidence:\n")
coverage_end = workflow.index("\n  opencode-review-target:", coverage_start)
coverage_job = workflow[coverage_start:coverage_end]

docker_start_marker = 'cat >"$coverage_build_dir/Dockerfile" <<\\'DOCKERFILE\''
docker_end_marker = "\n          DOCKERFILE"
docker_start = coverage_job.index(docker_start_marker)
docker_end = coverage_job.index(docker_end_marker, docker_start)
dockerfile = coverage_job[docker_start:docker_end]

print("workflow_lines:", workflow.count("\n") + 1)
print("test_lines:", test.count("\n") + 1)
print("coverage_job_lines:", coverage_job.count("\n") + 1)
print("dockerfile_lines:", dockerfile.count("\n") + 1)

for name, text in [
    ("workflow", workflow),
    ("coverage_job", coverage_job),
    ("dockerfile", dockerfile),
]:
    print(f"\n[{name}]")
    for needle in [
        "              llvm-19 " + chr(92),
        "ENV LLVM_COV=/usr/bin/llvm-cov-19",
        "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19",
        'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"',
        "cargo-llvm-cov.tar.gz",
    ]:
        print(repr(needle), text.find(needle))

check_pos = dockerfile.find('RUN test -x "$LLVM_COV"')
install_pos = dockerfile.find("cargo-llvm-cov.tar.gz")
print("\ncheck_before_install:", 0 <= check_pos < install_pos)
PY

printf '%s\n' '--- exact test function ---'
sed -n '2725,2755p' tests/test_opencode_agent_contract.py

printf '%s\n' '--- exact coverage job ---'
sed -n '/^  coverage-evidence:/,/^  opencode-review-target:/p' \
  .github/workflows/opencode-review-dispatch.yml

Repository: ContextualWisdomLab/.github

Length of output: 375

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- test ---'
sed -n '2725,2755p' tests/test_opencode_agent_contract.py
printf '%s\n' '--- workflow relevant lines ---'
rg -n -A100 -B5 'coverage-evidence:|opencode-review-target:|cat >.*Dockerfile|llvm-19|LLVM_COV|LLVM_PROFDATA|cargo-llvm-cov' .github/workflows/opencode-review-dispatch.yml

Repository: ContextualWisdomLab/.github

Length of output: 25532

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(
    encoding="utf-8"
)

coverage_start = workflow.index("  coverage-evidence:\n")
coverage_end = workflow.index("\n  opencode-review-target:", coverage_start)
coverage_job = workflow[coverage_start:coverage_end]

docker_start_marker = """cat >"$coverage_build_dir/Dockerfile" <<'DOCKERFILE'"""
docker_end_marker = "\n          DOCKERFILE"
docker_start = coverage_job.index(docker_start_marker)
docker_end = coverage_job.index(docker_end_marker, docker_start)
dockerfile = coverage_job[docker_start:docker_end]

needles = [
    "              llvm-19 " + chr(92),
    "ENV LLVM_COV=/usr/bin/llvm-cov-19",
    "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19",
    'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"',
]
for label, text in [
    ("workflow", workflow),
    ("coverage_job", coverage_job),
    ("dockerfile", dockerfile),
]:
    print(label)
    for needle in needles:
        print(" ", repr(needle), "count=", text.count(needle))

check_index = dockerfile.index('RUN test -x "$LLVM_COV"')
install_index = dockerfile.index("cargo-llvm-cov.tar.gz")
print("dockerfile_bounds_valid:", docker_start < docker_end)
print("check_before_cargo_llvm_cov_archive:", check_index < install_index)
print("dockerfile_start_line:",
      coverage_start + coverage_job[:docker_start].count("\n") + 1)
print("dockerfile_end_line:",
      coverage_start + coverage_job[:docker_end].count("\n") + 1)
PY

Repository: ContextualWisdomLab/.github

Length of output: 947

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
from pathlib import Path

workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(
    encoding="utf-8"
)

coverage_start = workflow.index("  coverage-evidence:\n")
coverage_end = workflow.index("\n  opencode-review-target:", coverage_start)
coverage_job = workflow[coverage_start:coverage_end]

docker_start_marker = """cat >"$coverage_build_dir/Dockerfile" <<'DOCKERFILE"""
docker_end_marker = "\n          DOCKERFILE"
docker_start = coverage_job.index(docker_start_marker)
docker_end = coverage_job.index(docker_end_marker, docker_start)
dockerfile = coverage_job[docker_start:docker_end]

needles = [
    "              llvm-19 " + chr(92),
    "ENV LLVM_COV=/usr/bin/llvm-cov-19",
    "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19",
    'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"',
]
for label, text in [
    ("workflow", workflow),
    ("coverage_job", coverage_job),
    ("dockerfile", dockerfile),
]:
    print(label)
    for needle in needles:
        print(" ", repr(needle), "count=", text.count(needle))

check_index = dockerfile.index('RUN test -x "$LLVM_COV"')
install_index = dockerfile.index("cargo-llvm-cov.tar.gz")
print("dockerfile_bounds_valid:", docker_start < docker_end)
print("check_before_cargo_llvm_cov_archive:", check_index < install_index)
print("dockerfile_start_line:",
      coverage_start + coverage_job[:docker_start].count("\n") + 1)
print("dockerfile_end_line:",
      coverage_start + coverage_job[:docker_end].count("\n") + 1)
PY

Repository: ContextualWisdomLab/.github

Length of output: 947

coverage-evidence의 Dockerfile 범위를 검증하세요.

전체 workflow 대신 coverage-evidence job에서 생성한 Dockerfile만 검사하세요. RUN test -x "$LLVM_COV"가 cargo-llvm-cov.tar.gz 설치보다 먼저 실행되는지도 assertion으로 고정하세요. 전체 테스트 스위트를 실행하세요.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_opencode_agent_contract.py` around lines 2734 - 2743, Update
test_opencode_coverage_image_provisions_compatible_llvm_tools to extract and
inspect only the Dockerfile generated by the coverage-evidence job rather than
the entire workflow. Keep the LLVM tool assertions scoped to that Dockerfile,
and add an ordering assertion that the executable checks for LLVM_COV and
LLVM_PROFDATA occur before cargo-llvm-cov.tar.gz installation. Run the complete
test suite.

Source: Coding guidelines

Loading