test(governance): exercise multiline CodeRabbit pending notice

[seonghobae]

Summary

• keep multiline CodeRabbit approval-pending notices on the waiting path
• cover the multiline fixture in the fake check-run response so the regression test exercises the intended branch

Verification

• bash scripts/ci/test_pr_governance_gate.sh
• git diff --check

Follow-up to #1443.

---

[coderabbitai]

Important

Approval pending

CodeRabbit has no unresolved comments, but it skipped the latest review.

Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review @github-code-quality

Exact current HEAD 874c098 contains the mixed approval-notice blocker fix and regression test. Focused governance self-test, Bash syntax, ShellCheck, and diff checks pass. Publish fresh exact-head review and security evidence; do not reuse predecessor results.

[seonghobae]

Dependency note: this follow-up currently contains the pre-remediation #1443 stack through 874c098548e6794217393e0338074ba2f292d080. Root #1443 is now at 1bd9782dccda46c4fe5fb3c964417f9e58df6046; keep the identity-boundary changes here, and restack this branch onto the merged root before normal review and merge. No force push or bypass is being used.

[github-actions]

PR governance metadata gate update for 874c098548e6794217393e0338074ba2f292d080: no current blocking failures remain.

PR governance metadata gate is ready; all current-head requirements passed.

[seonghobae]

@coderabbitai review\n\nPlease review only exact current head 874c098; do not reuse predecessor-head evidence. The current metadata gate is stale until this exact head receives a fresh review.

[coderabbitai]

@seonghobae I will review only exact HEAD 874c098548e6794217393e0338074ba2f292d080. I will not reuse predecessor-head evidence.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-head verification record

• Exact head: 874c098
• Exact base: 81c1056
• Scope: governance gate regression coverage for multiline CodeRabbit pending notices.
• Exact-head local verification: test_pr_governance_gate PASS, shell syntax check PASS, and git diff --check PASS.
• Current hosted Checks have no source failure; no qualifying independent approval is present.

Decision: WAIT_AND_REMEDIATE. Keep the protected normal path and obtain the required independent review before merge; no bypass, force push, direct protected-branch write, or fabricated status was used.

[seonghobae]

@opencode-agent @cwl-noema-review review only exact current head 874c098 of PR #1448 against base develop@81c105645ca6e680f5f8c15ba9c33b. Review the full governance test and fixture diff, current review metadata semantics, exact-head checks, and regression evidence. Publish structured exact-head verdicts; do not merge, update branch, dismiss reviews, bypass protection, or reuse predecessor evidence.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[devin-ai-integration]

🟡 Added multiline notice fixtures never run

The added stub branches coderabbit_multiline_approval_pending_comment and coderabbit_mixed_approval_pending_blocking_comment are referenced by no run_gate call; the multiline and mixed tests instead run the _json and _current_head variants (test_pr_governance_gate.sh, test_pr_governance_gate.sh). The genuinely multiline JSON headCommitId fixture the PR aims to cover is never exercised.

Prompt for agents

The two fake-gh scenarios added at scripts/ci/test_pr_governance_gate.sh:264 (coderabbit_multiline_approval_pending_comment) and :267 (coderabbit_mixed_approval_pending_blocking_comment) are dead: no run_gate call uses them. The tests assert_multiline_coderabbit_approval_pending_notice_does_not_block (line 804) and assert_mixed_coderabbit_approval_pending_notice_blocks (line 826) instead run the renamed coderabbit_multiline_json_approval_pending_comment and coderabbit_current_head_mixed_approval_pending_blocking_comment scenarios. Decide the intended coverage: either point these tests at the newly added genuinely-multiline fixtures (and add coderabbit_mixed_approval_pending_blocking_comment to the check-runs empty case at line 143 so the issue-comment path is reached), or add dedicated test functions that run the new scenarios and register them in the runner list at the bottom of the file. Remove whichever fixtures remain unreferenced so the fake gh has no dead branches.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

📝 Info: Repository identity guard is sound

The added guard ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ requires exactly one slash and rejects shell metacharacters, running before OWNER/REPO extraction so malformed values fail closed before any gh call. Behaves as intended.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Exact-head validation after normal stack restack: 068aefd on base fix/coderabbit-approval-pending-gate-develop@55a84f904f11203f49c356d95d7d88ba9f903030. The merge commit preserves the parent governance gate fix and child regression fixtures. Local checks passed: bash -n scripts/ci/pr_governance_gate.sh scripts/ci/test_pr_governance_gate.sh; bash scripts/ci/test_pr_governance_gate.sh; python -m pytest backend/tests/test_local_http.py backend/tests/test_url_validation.py -q (44 passed); git diff --check. Devin Review passed for this head. Central scheduler/OpenCode dispatch is queued; hosted required Checks and qualifying approval remain gates. No predecessor evidence is being reused.