fix(ci): execute Server Tests on exact PR heads - #523
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughServer Tests, CodeQL Required, OSV 스캔이 exact-head 검증을 사용합니다. 서버·브라우저 커버리지와 API 경계 테스트가 확장되었습니다. E2E 테스트와 모달·토스트 UI 검증도 추가되었습니다. ChangesCI 무결성 및 커버리지
애플리케이션 계약
브라우저와 UI
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to This PR improves exact-head CI execution and bounds browser-install time, but the supplied evidence still identifies unresolved validation risks, including a failing API timing test, potentially incomplete coverage enforcement, and flaky or overly permissive automated checks. Fix or explicitly accept these bounded risks before merging. Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant ServerTests
participant CodeQLRequired
participant OSVScanner
participant GitCheckout
participant CoverageCollector
PullRequest->>ServerTests: contributor head SHA 전달
ServerTests->>GitCheckout: exact-head checkout
GitCheckout-->>ServerTests: actual HEAD 반환
ServerTests->>CoverageCollector: 서버·브라우저 테스트 실행
CoverageCollector-->>ServerTests: Istanbul 보고서와 진단 결과 반환
PullRequest->>CodeQLRequired: head SHA 전달
CodeQLRequired->>GitCheckout: exact-head checkout 및 SHA 검증
PullRequest->>OSVScanner: protected base와 contributor head 전달
OSVScanner->>GitCheckout: base·head 순차 checkout
OSVScanner-->>PullRequest: 비교 SARIF 업로드
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
@coderabbitai review |
|
|
@opencode-agent review Please submit a review-only formal verdict for exact current head |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent review Review only the exact current contributor head |
|
@opencode-agent review Please submit a review-only formal verdict for exact current contributor head |
|
@opencode-agent review Current-head re-dispatch request for |
|
@opencode-agent review Exact-head review-only request for Please submit a formal current-head |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent review Review only the exact current contributor head |
1 participant
Buyer/control outcome
Refs #522.
This PR is ScopeWeave's repository-owned exact-head CI/evidence foundation. It binds repository tests and security checks to immutable contributor revisions, keeps base-sensitive work tied to the live protected base, fails owned browser/server coverage closed at exact 100%, and records the evidence boundary needed by dependent security/product repairs such as #588. It is not merge authority by itself.
Exact current identity
develop@2c328875e00e86537df3e965170be80532571cad;e28b5caba7a6f16071ead232b33d0c5d64d78b7a;5d4b4a6a55e627180e69f40c99190b7e99417a33;0056ef11020aa04c789516c2d7ff58194e7975f0;fix/server-tests-exact-head-522;ahead_by=317,behind_by=0, with the current base as merge base;APPROVEDreview exists.Any contributor-head or protected-base movement invalidates head/base-sensitive evidence until exact revisions, actual checkout attestations, reviews, checks, and live-base identity are freshly revalidated.
Current exact-head repository evidence
On unchanged head
e28b5caba7a6f16071ead232b33d0c5d64d78b7a, all seven repository-owned pull-request workflows are terminal GitHub-success:33247472708;33247472679;33247472689;33247472663;33247472656;33247472709; and33247472787.Commit statuses
CodeRabbitandDevin Revieware also success. The latest inline-review-thread sweep has no unresolved thread. Historical OpenCodeREQUEST_CHANGESevidence is anchored to predecessor heads, including3ce9a8bbc483036bddc2fa1681f84e25f8493772, and is not transferred to this head.The latest commit is
fix(ci): keep OSV read-only under CodeQL-only scanning; repository OSV now preserves its exact-head SARIF artifact without publishing a competing GitHub code-scanning result, leaving code-scanning publication to CodeQL.Live organization/repository rule boundary
Fresh effective ruleset reads supersede older body text:
18156473(CWL Central required workflows), updated2026-09-02 19:15 +09, is active on the default branch, currently requires one approving review, resolved review threads, deletion/non-fast-forward protection, merge/squash only, and ten organization-required workflow paths fromContextualWisdomLab/.github;17214767(Lock default branch) independently requires one approving review and approval from someone other than the latest pusher, plus resolved review threads and deletion/non-fast-forward protection.The current review set contains no qualifying
APPROVEDreview. Do not self-approve, synthesize independence, use the organization-admin bypass, or weaken either ruleset to make this PR pass.There is also a current required-workflow rollout gap on this unchanged head. Exact-head check-run queries return zero runs named
Required OpenCode Reviewand zero namedRequired Strix, while the current organization ruleset now requires the corresponding central workflow paths. The current central OpenCode/Strix entrypoints admit PR lifecycle events such as open/synchronize/reopen/ready (plus their own bounded variants); changing a ruleset after an already-open unchanged PR does not itself create a new contributor-head synchronization event. No no-op source commit or draft-state churn should be used merely to shake required CI.The canonical control-plane owner path is
ContextualWisdomLab/.github#1340; fresh ScopeWeave #523 evidence was added there with acceptance requiring a satisfiable solo-maintainer approval contract and fail-closed materialization of newly-enrolled required workflows for already-open unchanged heads..githubhas an active dedicated writer, so ScopeWeave must consume the repaired released/authoritative gate rather than duplicating it locally.Review-driven repairs
Earlier realistic RED findings on this PR have been repaired test-first, including exact-head checkout/runtime identity, OSV/CodeQL ownership separation, live-base resolver singular-result validation, deterministic browser/API coverage, coverage-diagnostic boundaries, dependency/coverage workflow evidence gaps, browser persistence/interaction edge cases, and exact-head workflow contract tests. The current resolved-thread state is evidence only; any new valid current-head finding reopens the repair loop.
docs/doctoring/server-tests-exact-head.mdremains the detailed repository evidence-integrity record.CHANGELOG.mdrecords Unreleased work rather than protected-shipped truth.Merge boundary
Do not merge or enable auto-merge until the unchanged exact contributor head remains freshly reconciled to protected
develop, every currently required repository and organization workflow has authoritative current-head terminal evidence, valid unresolved findings are zero, and the effective review/ruleset contract is actually satisfiable and satisfied without bypass.Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic-only, status-only, author-only, model-only, rate-limited, or infrastructure-only evidence is non-passing.