Repository navigation
feat(scripts): wire PR snapshot stall detector into cron-merge-sweep [OMN-9406] - #1378
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 42 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…[OMN-9406] After the merge-sweep skill runs, pipe HandlerPrSnapshot output through file-stall-tickets.sh to file Linear tickets tagged auto-stall-detected for any PR whose blocked shape is identical across two consecutive 5-minute snapshots. Fail-open throughout: missing LINEAR_API_KEY, import errors, and handler exceptions all log a warning and continue without aborting the tick. Also fixes .pre-commit-config.yaml: moves normalization-symmetry hook out of the ci: block (where bot PRs misplaced it) into the repos: local hooks list.
Fix two hostile-reviewer high-confidence findings:
- GraphQL injection: build issueCreate mutation body via Python json.dumps
with variables instead of interpolating title/description/blocking_reason
directly into the GraphQL string (double quotes in CI messages would break it)
- Python injection: pass pr_key via env var (PR_KEY=...) instead of
interpolating ${pr_key} directly into a python3 -c single-quoted string
Both callers now use PREFIX=value python3 -c pattern with os.environ.get()
so no user-supplied string ever touches shell quoting or GraphQL syntax.
f4678cb to
fddc450
Compare
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical/error findings | No |
blocked |
CRITICAL or ERROR findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)
…[OMN-9406] LINEAR_API_KEY="test-key" in test-stall-wiring.sh is a mock stub, not a real credential. Add pragma: allowlist secret annotation and regenerate baseline.
…1860) ## Summary Phase 3 of OMN-13502 (epic OMN-13498, golden-chain de-fake) for the omniclaude side of the flip. - OMN-13500 (#1849) burned omniclaude's `no-faked-boundary` detector self-scan down from 61 findings (55 `mock_assigned_to_boundary` + 6 `patch_httpx_egress`) to **zero**, verified live on this branch via `uv run python -m omnibase_core.validation.no_faked_boundary.runtime_no_faked_boundary src tests` → `No faked-boundary violations found.` - This PR drops `--report-only` from both surfaces that ran the detector: - `.github/workflows/no-faked-boundary.yml` (CI mirror) - `.pre-commit-config.yaml` `check-no-faked-boundary` hook (local mirror) - Job/hook name renamed from `"No Faked Boundary Gate (report-only)"` to the bare `"No Faked Boundary Gate"` so it can become a dev branch-protection required context **after** it lands and reports once on a dev commit — required-context addition is a separate follow-up step, not part of this PR, per the ordering constraint (a required context that has never reported wedges every PR). ## DoD evidence Ticket OMN-13502 carries dod_evidence from the parallel omnibase_core/omnimarket legs of this same phase-3 flip (PRs #1377, #1378, #1608, OCC receipts #3530, #3533, #3535, #3587). This PR is the omniclaude leg of the same de-fake flip. ## Test plan - [x] `uv run python -m omnibase_core.validation.no_faked_boundary.runtime_no_faked_boundary src tests` → 0 findings (confirms flip is safe) - [x] `pre-commit run --all-files` — `check-no-faked-boundary` passes; 3 pre-existing/unrelated failures confirmed present identically on `origin/dev` without this diff (Windows-path string in `architecture-handshakes/validator-requirements.yaml`, cross-repo `@main` ref in `call-occ-preflight.yml`, `hook-bits-drift` missing sibling `omnibase_core` checkout in this worktree) - [x] `uv run pytest tests/ -v -m "unit and not integration"` → 9103 passed, 26 skipped, 1 pre-existing failure (`test_checkout_occ_contracts_shell_suite`, missing `gtimeout`/`timeout` binary on this Mac — confirmed identical failure on `origin/dev` without this diff) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Strengthened boundary-checking by making the related validation gates enforce new findings (pre-commit and CI now fail builds instead of only reporting). * Improved CI reliability across varied runners with more consistent dependency setup, Linux-specific readiness handling, and a more controlled streaming-test service lifecycle. * Enhanced security scanning by adjusting runner selection logic and expanding secret-scan coverage for pull requests, plus safer handling of privileged filesystem setup. * Updated timeouts and checkout depth to make workflow execution more consistent. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Evidence-Source: OCC#3599 Evidence-Ticket: OMN-13502
Summary
scripts/lib/run-stall-detector.py— thin CLI driver that importsHandlerPrSnapshotfrom omnimarket, calls.handle(ModelPrSnapshotInput(repos=...)), and prints a JSON array of stall events to stdout. Fail-open: handler exceptions print[]and exit 0.scripts/lib/file-stall-tickets.sh— reads stall events JSON from stdin, files Linear tickets taggedauto-stall-detectedvia GraphQLissueCreate, with idempotency viaissueSearch. Fail-open: missingLINEAR_API_KEYdrains stdin and exits 0.cron-merge-sweep.shafter the merge-sweep skill invocation:uv run python run-stall-detector.py | bash file-stall-tickets.sh. Errors in either step log a warning and do not abort the tick.scripts/tests/test-stall-wiring.sh— 5 shell tests covering: zero events noop, no-API-key fail-open, ticket filed (mock curl), idempotency skip (mock curl), null JSON noop. All 9 assertions pass..pre-commit-config.yaml: movesnormalization-symmetryhook from insideci:block (where bot PRs chore(ci): propagate normalization-symmetry-hook to .pre-commit-config.yaml [bot] #1372–chore(ci): propagate normalization-symmetry-hook to .pre-commit-config.yaml [bot] #1374 misplaced it) into therepos:local hooks list. Fixes the YAML parse error that was breaking all pre-commit runs on this branch.Test plan
bash scripts/tests/test-stall-wiring.sh→ 9/9 PASSshellcheck scripts/lib/file-stall-tickets.sh scripts/tests/test-stall-wiring.sh scripts/cron-merge-sweep.sh→ cleanuv run pre-commit run --all-files→ all hooks pass