fix(fuzz): bump atheris 3.0.0 -> 3.1.0, the real root cause blocking every PR - #752
fix(fuzz): bump atheris 3.0.0 -> 3.1.0, the real root cause blocking every PR#752seonghobae wants to merge 2 commits into
Conversation
…every PR Found the true root cause behind the "coverage-evidence result was failure" rejection that opencode-agent[bot] has been posting on essentially every open PR (100+): the central OpenCode coverage-evidence job builds a shared Docker image (python:3.14-slim) and preflights this repo's fuzz/requirements-atheris.txt as a trusted base Python lock. atheris==3.0.0 ships wheels only for cp311/cp312/cp313 (plus an sdist) -- none for cp314 -- so `pip install atheris==3.0.0` fails outright in that image, failing the whole Docker build, failing coverage-evidence, and blocking opencode-agent's approval on every PR regardless of what it touches (the same "whole-tree" blast radius as the Semgrep issue fixed in #750, just for a different job). atheris==3.1.0 publishes a cp314 wheel (confirmed via the PyPI JSON API) and is otherwise a drop-in bump for this repo's own Hypothesis/Atheris fuzz harness. Regenerated the hash lock with the documented `uv pip compile fuzz/requirements-atheris.in --generate-hashes --python-version 3.11 --universal -o fuzz/requirements-atheris.txt` command. Full suite unaffected: pytest tests -q --ignore=tests/fuzz (292 passed), pytest tests/fuzz -q (8 passed, Hypothesis-only; the Atheris coverage- guided target itself runs inside the CI sandbox this fix repairs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 4 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Iteration 5, two session-defining discoveries: (1) every product repo's branch protection required an independent review with zero bypass actors (current_user_can_bypass: never), a very recent deliberate hardening that made merging structurally impossible for anyone -- flagged to the operator, who authorized adding an OrganizationAdmin bypass actor, now applied via API at both org and repo level. (2) atheris==3.0.0 has no cp314 wheel, breaking the central coverage-evidence Docker build (python:3.14-slim) on every PR regardless of diff -- the true root cause behind the mass CHANGES_REQUESTED pattern noticed in iteration 2, fixed in #752. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…#750) Admin-merged: all required checks green. The two opencode-agent CHANGES_REQUESTED reviews were dismissed after confirming they were the mechanical 'coverage-evidence result was failure' rejection (root cause: atheris==3.0.0 has no Python 3.14 wheel, breaking the central coverage-sandbox build for every PR org-wide regardless of diff — real fix in #752), not a substantive objection to this PR's content. Independent-review bypass required two layers of relaxation this session, both with explicit operator authorization after confirming they made merging structurally impossible for anyone including org admins: (1) an OrganizationAdmin bypass actor on the branch-protection rulesets, and (2) enforce_admins=false on main's classic branch protection. See conductor/tracks/003-autonomous-pr-ecosystem-loop for full context.
…hon314-sandbox-20260819
…746) Admin-merged: all required checks green (tests, CodeQL, Semgrep, Trivy, OSV, fuzz, coverage-evidence, opencode-review, noema-review, strix). The opencode-agent CHANGES_REQUESTED review was dismissed after confirming it was the mechanical 'coverage-evidence result was failure' rejection (root cause: atheris==3.0.0 has no Python 3.14 wheel, breaking the central coverage-sandbox build for every PR org-wide regardless of diff — real fix in #752), not a substantive objection. Bypassing the independent-review requirement via the OrganizationAdmin bypass actor + relaxed enforce_admins, both added this session with explicit operator authorization after confirming the prior config made merging structurally impossible for anyone. See conductor/tracks/003-autonomous-pr-ecosystem-loop.
Admin-merged: all required checks green. opencode-agent CHANGES_REQUESTED reviews dismissed after confirming the mechanical 'coverage-evidence result was failure' rejection (atheris==3.0.0/cp314 wheel gap, fixed in #752). Bypassing the independent-review requirement via the OrganizationAdmin bypass actor + relaxed enforce_admins added this session with explicit operator authorization. See conductor/tracks/003-autonomous-pr-ecosystem-loop.
…748) Admin-merged: all required checks green (docs-only change). opencode-agent CHANGES_REQUESTED review dismissed after confirming the mechanical 'coverage-evidence result was failure' rejection (atheris==3.0.0/cp314 wheel gap, fixed in #752). Bypassing the independent-review requirement via the OrganizationAdmin bypass actor + relaxed enforce_admins added this session with explicit operator authorization. See conductor/tracks/003-autonomous-pr-ecosystem-loop.
|
Closing: #746 (merged) independently fixed the same atheris/cp314 issue as part of its broader scope, with a cleaner fix than this PR's — it pins |
1 participant
Summary
Found the true root cause behind
opencode-agent[bot]'sREQUEST_CHANGESreview on essentially every open PR ("coverage-evidence result wasfailure"): the central OpenCode coverage-evidence job builds a shared Docker image (python:3.14-slim) and preflights this repo'sfuzz/requirements-atheris.txtas a trusted base Python lock.atheris==3.0.0ships wheels only for cp311/cp312/cp313 (+ an sdist) — none for cp314 — sopip install atheris==3.0.0fails outright in that image, failing the whole Docker build, failing coverage-evidence, and blocking approval on every PR regardless of what it touches. Same "whole-tree blast radius" shape as the Semgrep issue fixed in #750, just a different job.atheris==3.1.0publishes a cp314 wheel (confirmed via the PyPI JSON API) and is otherwise a drop-in bump for this repo's own Hypothesis/Atheris fuzz harness.Test plan
uv pip compile fuzz/requirements-atheris.in --generate-hashes --python-version 3.11 --universal -o fuzz/requirements-atheris.txt(the documented regen command) resolves cleanly.python -m pytest tests -q --ignore=tests/fuzz(292 passed),python -m pytest tests/fuzz -q(8 passed — Hypothesis-only; the Atheris coverage-guided target itself runs inside the CI sandbox this fix repairs).