Repository navigation
ci(OMN-10475): wire zone-filter caller in omnimarket - #694
Conversation
📝 WalkthroughWalkthroughAdds a new ChangesDocumentation-only change detection and job gating
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
✅ Architectural Review — PASSEDErrors: 0 What this checks
No architectural violations found. Powered by node_pr_review_bot |
✅ PR Review Bot — CLEANFindings: 0
Verdict semantics
Powered by node_pr_review_bot — FSM pipeline with multi-model review fan-out |
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical/error findings | No |
blocked |
CRITICAL or ERROR findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 14: Replace the mutable branch ref in the reusable workflow invocation by
pinning the `uses:
OmniNode-ai/omnibase_core/.github/workflows/zone-filter.yml@main` entry to an
immutable commit SHA: locate the `uses:
OmniNode-ai/omnibase_core/.github/workflows/zone-filter.yml@main` line, fetch
the current commit SHA from omnibase_core's main branch, and update the `@main`
suffix to `@<commit-sha>` so the workflow is pinned to that exact commit.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
6e160d4 to
36b375f
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
11-17: ⚡ Quick winAdd explicit permissions block for defense-in-depth security.
The
zone-filterjob calls a reusable workflow without declaring explicit permissions. While the reusable workflow defines its own permissions, declaring minimal permissions at the caller level provides defense-in-depth and prevents privilege escalation if the reusable workflow is modified.🔒 Proposed fix to add minimal permissions
zone-filter: + permissions: + contents: read uses: OmniNode-ai/omnibase_core/.github/workflows/zone-filter.yml@7631ef3321e1a6561f4b2c70019ee57d24160620🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 11 - 17, The zone-filter job lacks an explicit permissions block; add a minimal permissions stanza under the zone-filter job (the job named "zone-filter") to declare least-privilege access for the reusable workflow call—e.g., restrict to only the scopes the job needs such as contents: read and actions: read (and any other strictly required scopes), placed directly beneath the zone-filter job declaration so the caller explicitly limits permissions even if the reusable workflow changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 11-17: The zone-filter job lacks an explicit permissions block;
add a minimal permissions stanza under the zone-filter job (the job named
"zone-filter") to declare least-privilege access for the reusable workflow
call—e.g., restrict to only the scopes the job needs such as contents: read and
actions: read (and any other strictly required scopes), placed directly beneath
the zone-filter job declaration so the caller explicitly limits permissions even
if the reusable workflow changes.
…declarative-evidence diffs Adds a `zone-filter` job at the head of ci.yml that calls the reusable workflow shipped in omnibase_core (OmniNode-ai/omnibase_core/.github/ workflows/zone-filter.yml@main). The four heaviest jobs gain `needs: zone-filter` plus `if: needs.zone-filter.outputs.docs_only != 'true'`: - typecheck (mypy --strict) - test (pytest) - e2e-workflow-runner (golden_chain_sweep E2E) - golden-chains (1000+ golden chain tests) `lint` (ruff + topic guards), `topic-naming-lint`, `runtime-sweep`, and `contract-compliance` continue to run on every PR. The `ci-summary` aggregator already accepts `skipped` (line ~340 in pre-existing logic), so docs-only PRs aggregate green even when the heavy jobs short-circuit. DOCS zone now covers `docs/`, `standards/`, plus the declarative-evidence trees `contracts/`, `drift/dod_receipts/`, `allowlists/`, and `.evidence/` (per OMN-10475 — see omnibase_core PR #1023).
36b375f to
c3839b5
Compare
|
1 participant
Summary
Verification
git diff --check origin/main...HEADgit push --force-with-lease origin jonah/omn-10475-zone-filter-callerLinear: OMN-10475
Summary by CodeRabbit
Evidence-Ticket: OMN-10475
Evidence-Source: OCC#1218
Deploy/runtime restart not performed.