fix(oidc): roll forward current central workflow source - #450
Conversation
|
Warning Review limit reached
Next review available in: 9 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| ALLOWED_WORKFLOW_REPOSITORY = "ContextualWisdomLab/.github" | ||
| ALLOWED_WORKFLOW_REF_PREFIX = "ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main" | ||
| ALLOWED_WORKFLOW_SHA = "322004186dd34736bc073e69406c41d2f435f8e4" | ||
| ALLOWED_WORKFLOW_SHA = "daf5ad43b48c826a3a119f385a2f80bef893ae49" |
There was a problem hiding this comment.
🔍 Diff rolls config forward despite RED intent
The description says this draft keeps wrangler.toml stale at the old SHA as a TDD RED step, but wrangler.toml is already updated to daf5ad43... matching the test, so the gate is GREEN. Either the config change is premature or the description is stale. The new SHA itself cannot be verified against the central repo here.
Was this helpful? React with 👍 or 👎 to provide feedback.
Reapply PR #425's content onto current main after an unrelated git history rewrite orphaned the branch's original base commit (a779375, pre-#450) from main's history (root ab3ebde, from #450 onward). README.md was byte-identical between the old base and current main, so the PR's own README.md diff applies verbatim. - Rewrite README.md as a customer/operator surface: product purpose, standalone run/deploy, /health /ready /exchange, orchestrator gateway contract, naruon/gyeot hub table, GitHub App permissions, operator vars, and links to onboarding/runbook/API spec/threat-model/deployment guide/SLA/OpenAPI. - Add docs/internal/README.md so maintainers still find the hourly-loop, acquisition, saleable-program, and KPI collect internals that moved out of the customer README. - Update the CHANGELOG.md Unreleased entry to the PR's refined wording, replacing the earlier draft of the same bullet already present on main. test/readme-customer-facing.test.ts continues to pass.
…e) into current main origin/main's history was rewritten (new root ab3ebde at PR #450); this PR's original base commit a779375 (#423-era) and its one commit 7d95ca2 predate that rewrite and share no ancestor with current main, so a normal merge is refused ("refusing to merge unrelated histories"). This records the old branch tip as merged history (satisfying "merge base into head", not a rebase, and not a force-push) while keeping the tree from the preceding commit, which already carries the old branch's content reapplied onto current main by hand (README.md patch applied verbatim since it was byte-identical at the old base; docs/internal/README.md copied from the old head; CHANGELOG.md bullet updated to the old head's wording).
1 participant
Summary
Central read-only
.githubprotected main advanced todaf5ad43b48c826a3a119f385a2f80bef893ae49while protected Noemamainstill trusts322004186dd34736bc073e69406c41d2f435f8e4inALLOWED_WORKFLOW_SHA.The audited
noema-review.ymlblob remains unchanged (59b25e343444d0b97fc1c7ba33cb15543dd70102), but GitHub OIDCjob_workflow_shabinds the immutable source commit. This Draft begins with a TDD RED:test/trusted-workflow-source-rollforward.test.tsnow requires the current central source commit while production configuration is intentionally still stale.Next step on this same canonical lane is to change only Noema
wrangler.tomlto the audited central commit, then require fresh exact-head application CI, reviewer-ci, and eligible central Security Scan before Ready/merge.Central
.githubremains read-only.Merge boundary
Draft. Do not merge until RED→GREEN is complete, live central source is refetched unchanged, all applicable exact-head gates are terminal-success, and review/thread state plus protected base are freshly clean.