Repository navigation
evidence(OMN-10855): bind omninode_infra merge queue PRs - #4604
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe change adds contracts for OMN-10855 and OMN-14929, extends evidence for OMN-14153 and OMN-14642, and records PASS command receipts for related pull request, diff-scope, CI, and companion evidence checks. ChangesTicket evidence contracts
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-14153.yaml`:
- Around line 123-130: Update the command check in contracts/OMN-14153.yaml
lines 123-130 to sort the PR diff file list and require an exact match
containing only .github/workflows/build-and-push-omnidash.yml and
docker/omnidash/Dockerfile. Apply the same fail-closed sorted exact comparison
in contracts/OMN-14642.yaml lines 84-92, allowing only
k8s/onex-dev/omnidash/deployment.yaml; both checks must fail when any unexpected
file is present.
- Around line 116-122: Update the PR metadata checks so they assert the recorded
commit head, not only query PR details: in contracts/OMN-14153.yaml lines
116-122, require headRefOid to equal 1fd3f5ea576d37f0205859b9cd14c5d987b488d5;
in contracts/OMN-14642.yaml lines 74-83, require headRefOid to equal
c3dac92ea747c82a171d73b9418b7a2d9ce328d6. Preserve the existing PR and
repository checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3d36be3d-8233-494f-b331-0046eaa26cd2
📒 Files selected for processing (21)
contracts/OMN-10855.yamlcontracts/OMN-14153.yamlcontracts/OMN-14642.yamlcontracts/OMN-14929.yamldrift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-ci/command.yamldrift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-head/command.yamldrift/dod_receipts/OMN-10855/dod-omninode_infra-pr-616-product-diff-scope/command.yamldrift/dod_receipts/OMN-10855/occ-self-bind-pr-4604-omn10855/command.yamldrift/dod_receipts/OMN-14153/dod-OmniNode-ai-omninode_infra-pr-617-ci/command.yamldrift/dod_receipts/OMN-14153/dod-OmniNode-ai-omninode_infra-pr-617/command.yamldrift/dod_receipts/OMN-14153/occ-self-bind-pr-4294-supersede-0001/command.yamldrift/dod_receipts/OMN-14153/occ-self-bind-pr-4295-supersede-0001/command.yamldrift/dod_receipts/OMN-14153/occ-self-bind-pr-4307-supersede-0001/command.yamldrift/dod_receipts/OMN-14153/occ-self-bind-pr-4604-omn14153/command.yamldrift/dod_receipts/OMN-14642/dod-omninode_infra-pr-614-head/command.yamldrift/dod_receipts/OMN-14642/dod-omninode_infra-pr-614-product-diff-scope/command.yamldrift/dod_receipts/OMN-14642/occ-self-bind-pr-4604-omn14642/command.yamldrift/dod_receipts/OMN-14929/dod-omninode_infra-pr-615-head/command.yamldrift/dod_receipts/OMN-14929/dod-omninode_infra-pr-615-kustomize-ci/command.yamldrift/dod_receipts/OMN-14929/dod-omninode_infra-pr-615-product-diff-scope/command.yamldrift/dod_receipts/OMN-14929/occ-self-bind-pr-4604-omn14929/command.yaml
| - id: "dod-OmniNode-ai-omninode_infra-pr-617" | ||
| description: "PR #617 on OmniNode-ai/omninode_infra — OMN-14153 main OIDC build input promotion binding." | ||
| source: "manual" | ||
| status: "verified" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr view 617 --repo OmniNode-ai/omninode_infra --json number,state,headRefOid,headRefName" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Pin the product PR checks to their recorded heads.
Both commands only query PR metadata; they do not compare headRefOid with the SHA captured by the corresponding receipt/description. A later PR push can therefore leave stale evidence passing.
contracts/OMN-14153.yaml#L116-L122: assertheadRefOid == 1fd3f5ea576d37f0205859b9cd14c5d987b488d5.contracts/OMN-14642.yaml#L74-L83: assertheadRefOid == c3dac92ea747c82a171d73b9418b7a2d9ce328d6.
📍 Affects 2 files
contracts/OMN-14153.yaml#L116-L122(this comment)contracts/OMN-14642.yaml#L74-L83
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-14153.yaml` around lines 116 - 122, Update the PR metadata
checks so they assert the recorded commit head, not only query PR details: in
contracts/OMN-14153.yaml lines 116-122, require headRefOid to equal
1fd3f5ea576d37f0205859b9cd14c5d987b488d5; in contracts/OMN-14642.yaml lines
74-83, require headRefOid to equal c3dac92ea747c82a171d73b9418b7a2d9ce328d6.
Preserve the existing PR and repository checks.
| - id: "dod-OmniNode-ai-omninode_infra-pr-617-ci" | ||
| description: "PR #617 on OmniNode-ai/omninode_infra — product diff scope is limited to omnidash build | ||
| workflow and Dockerfile inputs." | ||
| source: "manual" | ||
| status: "verified" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr diff 617 --repo OmniNode-ai/omninode_infra --name-only" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Make the diff-scope checks fail closed.
Both commands return success for any non-error diff, including diffs with unexpected files.
contracts/OMN-14153.yaml#L123-L130: compare the sorted output with exactly.github/workflows/build-and-push-omnidash.ymlanddocker/omnidash/Dockerfile.contracts/OMN-14642.yaml#L84-L92: compare the sorted output with exactlyk8s/onex-dev/omnidash/deployment.yaml.
📍 Affects 2 files
contracts/OMN-14153.yaml#L123-L130(this comment)contracts/OMN-14642.yaml#L84-L92
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-14153.yaml` around lines 123 - 130, Update the command check in
contracts/OMN-14153.yaml lines 123-130 to sort the PR diff file list and require
an exact match containing only .github/workflows/build-and-push-omnidash.yml and
docker/omnidash/Dockerfile. Apply the same fail-closed sorted exact comparison
in contracts/OMN-14642.yaml lines 84-92, allowing only
k8s/onex-dev/omnidash/deployment.yaml; both checks must fail when any unexpected
file is present.
1 participant
Refs OMN-10855
Refs OMN-14153
Refs OMN-14642
Refs OMN-14929
Evidence-Ticket: OMN-10855
Evidence-Ticket: OMN-14153
Evidence-Ticket: OMN-14642
Evidence-Ticket: OMN-14929
Adds central OCC receipts for omninode_infra#614, #615, #616, and #617 so their Receipt Gate checks can bind current product PR heads.
Local validation:
No runtime deploy, restart, production promotion, or .201 mutation performed.
Summary by CodeRabbit
New Features
Bug Fixes
Tests