Skip to content

feat(scripts): wire PR snapshot stall detector into cron-merge-sweep [OMN-9406] - #1378

Merged
jonahgabriel merged 3 commits into
mainfrom
jonah/omn-9406-snapshot-stall-wiring
Apr 21, 2026
Merged

jonahgabriel merged 3 commits into
mainfrom
jonah/omn-9406-snapshot-stall-wiring

Conversation

@jonahgabriel

Copy link
Copy Markdown
Contributor

Summary

  • Adds scripts/lib/run-stall-detector.py — thin CLI driver that imports HandlerPrSnapshot from omnimarket, calls .handle(ModelPrSnapshotInput(repos=...)), and prints a JSON array of stall events to stdout. Fail-open: handler exceptions print [] and exit 0.
  • Adds scripts/lib/file-stall-tickets.sh — reads stall events JSON from stdin, files Linear tickets tagged auto-stall-detected via GraphQL issueCreate, with idempotency via issueSearch. Fail-open: missing LINEAR_API_KEY drains stdin and exits 0.
  • Wires both into cron-merge-sweep.sh after the merge-sweep skill invocation: uv run python run-stall-detector.py | bash file-stall-tickets.sh. Errors in either step log a warning and do not abort the tick.
  • Adds scripts/tests/test-stall-wiring.sh — 5 shell tests covering: zero events noop, no-API-key fail-open, ticket filed (mock curl), idempotency skip (mock curl), null JSON noop. All 9 assertions pass.
  • Fixes .pre-commit-config.yaml: moves normalization-symmetry hook from inside ci: block (where bot PRs chore(ci): propagate normalization-symmetry-hook to .pre-commit-config.yaml [bot] #1372–chore(ci): propagate normalization-symmetry-hook to .pre-commit-config.yaml [bot] #1374 misplaced it) into the repos: local hooks list. Fixes the YAML parse error that was breaking all pre-commit runs on this branch.

Test plan

  • bash scripts/tests/test-stall-wiring.sh → 9/9 PASS
  • shellcheck scripts/lib/file-stall-tickets.sh scripts/tests/test-stall-wiring.sh scripts/cron-merge-sweep.sh → clean
  • uv run pre-commit run --all-files → all hooks pass
  • CI green on push

@coderabbitai

coderabbitai Bot commented Apr 21, 2026 •

Copy link
Copy Markdown

Warning

Rate limit exceeded

@jonahgabriel has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 5 minutes and 42 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 42 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: afaaa51f-2713-48c9-a4c8-e6d4485204d1

📥 Commits

Reviewing files that changed from the base of the PR and between 9e1d732 and 77cf7c8.

📒 Files selected for processing (6)
  • .pre-commit-config.yaml
  • .secrets.baseline
  • scripts/cron-merge-sweep.sh
  • scripts/lib/file-stall-tickets.sh
  • scripts/lib/run-stall-detector.py
  • scripts/tests/test-stall-wiring.sh
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch jonah/omn-9406-snapshot-stall-wiring

Comment @coderabbitai help to get the list of available commands and usage tips.

@jonahgabriel
jonahgabriel enabled auto-merge April 21, 2026 13:49
…[OMN-9406]

After the merge-sweep skill runs, pipe HandlerPrSnapshot output through
file-stall-tickets.sh to file Linear tickets tagged auto-stall-detected
for any PR whose blocked shape is identical across two consecutive 5-minute
snapshots. Fail-open throughout: missing LINEAR_API_KEY, import errors, and
handler exceptions all log a warning and continue without aborting the tick.

Also fixes .pre-commit-config.yaml: moves normalization-symmetry hook out of
the ci: block (where bot PRs misplaced it) into the repos: local hooks list.
Fix two hostile-reviewer high-confidence findings:
- GraphQL injection: build issueCreate mutation body via Python json.dumps
  with variables instead of interpolating title/description/blocking_reason
  directly into the GraphQL string (double quotes in CI messages would break it)
- Python injection: pass pr_key via env var (PR_KEY=...) instead of
  interpolating ${pr_key} directly into a python3 -c single-quoted string

Both callers now use PREFIX=value python3 -c pattern with os.environ.get()
so no user-supplied string ever touches shell quoting or GraphQL syntax.
@jonahgabriel
jonahgabriel force-pushed the jonah/omn-9406-snapshot-stall-wiring branch from f4678cb to fddc450 Compare April 21, 2026 13:52
@github-actions

github-actions Bot commented Apr 21, 2026 •

Copy link
Copy Markdown
Contributor

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8524) and do not block merge. Error: cli_review exited non-zero (all models failed or binary error)


Gate semantics (pilot phase)

Verdict Meaning Blocks merge?
passed No critical/error findings No
blocked CRITICAL or ERROR findings found Yes
degraded All models unavailable (infra) No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)

…[OMN-9406]

LINEAR_API_KEY="test-key" in test-stall-wiring.sh is a mock stub, not a real
credential. Add pragma: allowlist secret annotation and regenerate baseline.
@jonahgabriel
jonahgabriel added this pull request to the merge queue Apr 21, 2026
Merged via the queue into main with commit 64e3da6 Apr 21, 2026
72 checks passed
@jonahgabriel
jonahgabriel deleted the jonah/omn-9406-snapshot-stall-wiring branch April 21, 2026 14:25
jonahgabriel added a commit that referenced this pull request Jul 9, 2026
…1860)

## Summary

Phase 3 of OMN-13502 (epic OMN-13498, golden-chain de-fake) for the
omniclaude side of the flip.

- OMN-13500 (#1849) burned omniclaude's `no-faked-boundary` detector
self-scan down from 61 findings (55 `mock_assigned_to_boundary` + 6
`patch_httpx_egress`) to **zero**, verified live on this branch via `uv
run python -m
omnibase_core.validation.no_faked_boundary.runtime_no_faked_boundary src
tests` → `No faked-boundary violations found.`
- This PR drops `--report-only` from both surfaces that ran the
detector:
  - `.github/workflows/no-faked-boundary.yml` (CI mirror)
- `.pre-commit-config.yaml` `check-no-faked-boundary` hook (local
mirror)
- Job/hook name renamed from `"No Faked Boundary Gate (report-only)"` to
the bare `"No Faked Boundary Gate"` so it can become a dev
branch-protection required context **after** it lands and reports once
on a dev commit — required-context addition is a separate follow-up
step, not part of this PR, per the ordering constraint (a required
context that has never reported wedges every PR).

## DoD evidence

Ticket OMN-13502 carries dod_evidence from the parallel
omnibase_core/omnimarket legs of this same phase-3 flip (PRs #1377,
#1378, #1608, OCC receipts #3530, #3533, #3535, #3587). This PR is the
omniclaude leg of the same de-fake flip.

## Test plan

- [x] `uv run python -m
omnibase_core.validation.no_faked_boundary.runtime_no_faked_boundary src
tests` → 0 findings (confirms flip is safe)
- [x] `pre-commit run --all-files` — `check-no-faked-boundary` passes; 3
pre-existing/unrelated failures confirmed present identically on
`origin/dev` without this diff (Windows-path string in
`architecture-handshakes/validator-requirements.yaml`, cross-repo
`@main` ref in `call-occ-preflight.yml`, `hook-bits-drift` missing
sibling `omnibase_core` checkout in this worktree)
- [x] `uv run pytest tests/ -v -m "unit and not integration"` → 9103
passed, 26 skipped, 1 pre-existing failure
(`test_checkout_occ_contracts_shell_suite`, missing `gtimeout`/`timeout`
binary on this Mac — confirmed identical failure on `origin/dev` without
this diff)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Strengthened boundary-checking by making the related validation gates
enforce new findings (pre-commit and CI now fail builds instead of only
reporting).
* Improved CI reliability across varied runners with more consistent
dependency setup, Linux-specific readiness handling, and a more
controlled streaming-test service lifecycle.
* Enhanced security scanning by adjusting runner selection logic and
expanding secret-scan coverage for pull requests, plus safer handling of
privileged filesystem setup.
* Updated timeouts and checkout depth to make workflow execution more
consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Evidence-Source: OCC#3599
Evidence-Ticket: OMN-13502
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant