Repository navigation
fix(coverage): prefetch locked Rust dependencies for offline evidence - #1391
seonghobae wants to merge 11 commits into
Conversation
|
Warning Review limit reachedNext included review available in 35 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Recompute REVIEW_DISPATCH_BLOB_SHA to the merged tree's actual blob hash for .github/workflows/opencode-review-dispatch.yml, since this branch's own Cargo-prefetch step is added inside that same workflow file, so neither side's pre-merge pinned value is correct post-merge. Verified: pytest tests/test_pr_review_autofix_nvidia_nim_contract.py (23 passed).
| def test_rust_coverage_prefetches_locked_crates_before_networkless_sandbox() -> None: | ||
| """Materialize only trusted Cargo caches before PR code loses network access.""" | ||
|
|
||
| dispatch = _dispatch_text() | ||
| source_tree_start = dispatch.index( | ||
| " - name: Materialize pull request merge tree for coverage measurement\n" | ||
| ) | ||
| source_tree_end = dispatch.index( | ||
| " - name: Upload materialized pull request merge tree\n", | ||
| source_tree_start, | ||
| ) | ||
| source_tree = dispatch[source_tree_start:source_tree_end] | ||
|
|
||
| assert "prefetch_manifests=\"$(git -C \"$COVERAGE_SOURCE_WORKDIR\" ls-files 'Cargo.toml' '*/Cargo.toml')\"" in source_tree | ||
| assert "cargo fetch --locked" in source_tree | ||
| assert "--manifest-path \"$COVERAGE_SOURCE_WORKDIR/$prefetch_manifest\"" in source_tree | ||
| assert 'cd "$prefetch_home"' in source_tree | ||
| assert 'HOME="$prefetch_home"' in source_tree | ||
| assert 'CARGO_HOME="$prefetch_home/.cargo"' in source_tree | ||
| assert 'CARGO_REGISTRIES_CRATES_IO_PROTOCOL=git' in source_tree | ||
| assert 'GIT_TERMINAL_PROMPT=0' in source_tree | ||
| assert "env -u GH_TOKEN -u GITHUB_TOKEN" in source_tree | ||
| assert ".opencode-sandbox-home" in source_tree | ||
| assert "refusing to mix it with trusted Cargo caches" in source_tree | ||
| assert 'for prefetch_cache_dir in registry git; do' in source_tree | ||
| assert 'CARGO_NET_OFFLINE=true' in dispatch | ||
| assert "docker run --rm --init --network=none" in dispatch | ||
|
|
||
|
|
||
| def test_reserved_sandbox_path_is_rejected_without_cargo() -> None: | ||
| """Reject PR-controlled sandbox state even when the runner lacks Cargo.""" | ||
|
|
||
| dispatch = _dispatch_text() | ||
| source_tree_start = dispatch.index( | ||
| " - name: Materialize pull request merge tree for coverage measurement\n" | ||
| ) | ||
| source_tree_end = dispatch.index( | ||
| " - name: Upload materialized pull request merge tree\n", | ||
| source_tree_start, | ||
| ) | ||
| source_tree = dispatch[source_tree_start:source_tree_end] | ||
|
|
||
| reserved_path_guard = ( | ||
| 'if [ -e "$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home" ] ||' | ||
| ) | ||
| cargo_gate = ( | ||
| 'if [ -n "$prefetch_manifests" ] && command -v cargo >/dev/null 2>&1; then' | ||
| ) | ||
| assert source_tree.index(reserved_path_guard) < source_tree.index(cargo_gate) |
There was a problem hiding this comment.
🔍 Cache transfer lacks executable coverage
The new tests only match workflow text. They cannot catch failures spanning Cargo fetch, cache copying, archive validation, and offline resolution.
Was this helpful? React with 👍 or 👎 to provide feedback.
- Clean-merge subtotal said 5 but named 6 PRs; corrected to 6, and added the omitted #1391 to the trivial-conflicts list so 6+7+2=15 reconciles with the stated total. - Compact cross-repo references to the owner/repo#num binding convention: ContextualWisdomLab/contextual-orchestrator#857 and ContextualWisdomLab/LineageWeave#667. Co-Authored-By: Claude <noreply@anthropic.com>
* docs(gaps): restore section dropped by #1423's merge, correct stale claim PR #1423 merged (ebd1b8b) using a merge-conflict resolution that kept only its own branch's dated section and silently dropped main's already-published '2026-08-30 sidecar pin staleness recurrence' section (the #1422 fix's own record) from the file entirely. That merge also left #1423's own section claiming #1413/#1422 'have not merged' even though both are its own git ancestors. Restore the dropped section verbatim, annotate the stale section as superseded, and append an accurate dated entry recording this cycle's backlog-refresh work: 15 PRs merged/retriggered against the new main, 8 left untouched for real conflicts, one independent sidecar/review- dispatch defect newly observed on #1420, and a Gap ID collision (G-15) renumbered to G-16 on #1348. Verified: git diff against origin/main shows this change is purely additive (no main content removed); pytest tests/test_product_technical_gap_baseline.py tests/test_pr_governance_audit_contract.py (8 passed). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Gs7KmNvH75nxz1sL8mKjw * docs(gaps): fix Devin-flagged count/reference errors in #1424 - Clean-merge subtotal said 5 but named 6 PRs; corrected to 6, and added the omitted #1391 to the trivial-conflicts list so 6+7+2=15 reconciles with the stated total. - Compact cross-repo references to the owner/repo#num binding convention: ContextualWisdomLab/contextual-orchestrator#857 and ContextualWisdomLab/LineageWeave#667. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
…line-rust-coverage-20260828 # Conflicts: # CHANGELOG.md
…rust-coverage-20260828 # Conflicts: # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
|
Resolved the stale merge conflict against current Conflicts (2 files):
No independent fix on Test evidence (post-merge, in an isolated worktree):
No security gate, network-isolation boundary, or credential-handling logic was touched or weakened. Generated by Claude Code |
# Conflicts: # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
Stale base resolved — merged current
|
Two conflicts: - CHANGELOG.md — kept both sides, this branch's entry above main's, matching the file's newest-first convention. - REVIEW_DISPATCH_BLOB_SHA — this pin is `git hash-object` over `.github/workflows/opencode-review-dispatch.yml`, so both sides' values are correct only for their own tree (branch 77401c6…, main ade10b3…) and both are wrong for the merge. Recomputed against the merged file: bcf7446. Verified after resolution: 2892 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
#1932 changed `.github/workflows/opencode-review-dispatch.yml`, which REVIEW_DISPATCH_BLOB_SHA pins by whole-file `git hash-object`. The workflow auto-merged cleanly; only the pin line conflicted, and neither side's value is right for the merge: this branch bcf7446… (its own tree) main 26e8555… (after #1932) merged f1a9eb0… (recomputed) Verified: 2893 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
seonghobae
added
bug
ChatGPT Codex Connector
|
Fresh unchanged-consumer reproduction confirms that this PR still owns a live protected-main defect and also shows exactly why a current-main adoption is needed. OriginWeave consumer: Central OpenCode dispatch
That is the exact defect #1391 is designed to repair: current protected However, live PR state is now |
|
One additional repair finding remains before this owner PR should be revived against current main: review thread The new OriginWeave #229 log makes this especially material because the production failure occurs exactly at that cross-boundary behavior, not at the presence/absence of those strings. A current-main successor should therefore preserve the existing static contract and add an executable hermetic fixture for the helper/boundary: create a tiny locked Rust graph against a test-owned local registry/cache source, run the same bounded prefetch with neutral HOME/CARGO_HOME and credential stripping, pass only the allowed Cargo This is not a request to weaken |
|
Exact-head admission audit: 현재 blocker:
유효 commit·diff·review evidence를 보존한 채 Draft/Proposed로 교정합니다. Base 이동이나 queue 대기만으로 Close하지 않으며 Force Push·synthetic status/approval·manual rerun·bypass를 사용하지 않습니다. Blocker 수리 후 새 exact head에서 Checks와 review admission을 다시 받아야 합니다. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head P1 acceptance-evidence finding for 36ac3aa71b2580685f84d416a81e42c39dee927c (COMMENT because GitHub does not permit an author's self REQUEST_CHANGES).
The production change spans a multi-component boundary—trusted cargo fetch, selective registry/git cache copy, archive validation/materialization, and an offline coverage container—but the current regression evidence only inspects workflow text. That cannot detect incompatible Cargo cache formats, omitted cache members, copy/permission mistakes, archive rejection, or a runtime that still reaches dependency resolution without consuming the transferred cache. The cited OriginWeave run proves the pre-fix failure, not an exact-head end-to-end GREEN.
Repair this at the canonical owner with an executable fixture that uses a minimal locked Rust workspace and isolated runner-owned HOME/CARGO_HOME: prefetch while network is available, pass only the admitted registry/ and git/ cache through the same archive validator/materializer, then resolve/build with CARGO_NET_OFFLINE=true and no network. Include RED cases for a missing required cache member, a rejected non-regular/archive member, and PR-controlled reserved-home collision; assert no credentials or PR Cargo config enter the trusted prefetch. Keep the existing fail-closed custom-registry boundary and protocol pin.
The PR body currently says the current-head review-thread query returns zero unresolved threads, but live review state contains the unresolved executable-coverage thread at tests/test_opencode_rust_coverage_toolchain_contract.py:152; update that ledger only after the executable acceptance evidence exists.
GitHub REST reads are temporarily rate-limited (403), so I am not promoting any hosted Check or predecessor result. Keep Draft/Proposed; no merge, auto-merge, bypass, or rerun is authorized.
This branch has not been deployed
2 participants
Summary
registry/andgit/caches into the reserved sandbox home, rejects PR-controlled collisions, and keeps offline coverage fail-closed;Root-cause evidence
ContextualWisdomLab/OriginWeave#210 at exact head
0341079331f9cea669eb9a5cc21842fd6027431ereproduced the central OpenCode coverage failure in dispatched run33179004673, coverage-evidence job98875118407: the networkless container attempted to resolveunicode-normalizationfromindex.crates.iobecause no Cargo registry/git cache was materialized. The local OriginWeave Rust coverage proof was green; this PR repairs the central evidence boundary rather than weakening the gate.Verification
135106c903da0bbf040d809dcf1147379b984020: focused central contracts/shell checks33 passed, 1 skipped;stat -csidecar tests:1691 passed, 1 skipped, 17 subtests passed;git diff --check: passed; local Strix quick gate and full actionlint remain explicitly unclaimed because of the documented macOS fixture failure and timeout;36ac3aa71b2580685f84d416a81e42c39dee927c, which disables Git credential prompts during locked-manifest prefetch; current exact PR head is36ac3aa71b2580685f84d416a81e42c39dee927c;36ac3aa71b2580685f84d416a81e42c39dee927c;No branch protection, review, coverage, security, or merge gate is bypassed.