feat(automation): run Scopeweave hourly NVIDIA NIM review repair - #1078
feat(automation): run Scopeweave hourly NVIDIA NIM review repair#1078seonghobae wants to merge 5 commits into
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Warning Review limit reached
Next review available in: 40 seconds Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
c7bbc85 to
614bc9e
Compare
|
Rebased onto current |
614bc9e to
ec0f6e3
Compare
ec0f6e3 to
424e2c9
Compare
|
Rebased onto current origin/main c47bee5 and preserved the existing hourly caller path set plus the Scopeweave documentation/changelog entry. Current HEAD: 424e2c9 Validation on this HEAD:
@OpenCode review this exact HEAD after the rebase. |
424e2c9 to
d078d62
Compare
|
@opencode-agent review the exact current head $head_oid against protected base 2cce96f. Rebased this hourly caller onto current main; contract tests, changed-workflow actionlint, and diff --check were run on the exact rebased source. The caller keeps explicit target identity, bounded dispatch/retry, OIDC/approved secret scope, and no COPILOT token forwarding. Treat predecessor reviews/checks as historical and do not approve from queued or status-only evidence. |
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Add a thin minute-31 caller for ContextualWisdomLab/scopeweave on protected develop. The caller maps only established scheduler credentials, grants job-scoped OIDC, and leaves NVIDIA_NIM_API_KEY on the reusable worker.
590268d to
6e66bcd
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - **Product hourly callers** stay thin. Do not hard-code OriginWeave, naruon, or Keyverse | ||
| - **Product hourly callers** stay thin. Do not hard-code Scopeweave, naruon, or Keyverse |
There was a problem hiding this comment.
🟡 Guidance document left with a duplicated, incomplete instruction line
A near-duplicate bullet was inserted (CLAUDE.md:121) instead of updating the existing one, leaving the original line above it dangling without its sentence ending, so the guidance now reads as two overlapping, half-broken instructions.
Impact: Readers see a confusing, malformed instruction where one bullet trails off mid-sentence and a second nearly identical bullet repeats it.
Botched find-and-replace in the conventions list
Before the change the list had a single bullet: "Product hourly callers stay thin. Do not hard-code OriginWeave, naruon, or Keyverse into pr-review-fix-scheduler.yml. ...". The PR added a new line CLAUDE.md:121 ("...Do not hard-code Scopeweave, naruon, or Keyverse") but did not remove/merge the original line CLAUDE.md:120. The continuation at CLAUDE.md:122 ("into pr-review-fix-scheduler.yml...") now attaches only to the new line, so line 120 ends abruptly at "Keyverse" with no predicate, and the list contains two redundant "Product hourly callers stay thin" bullets. The same duplicated pair is mirrored in AGENTS.md's embedded copy. Intended fix was likely to append Scopeweave to the existing single bullet rather than duplicate it.
| - **Product hourly callers** stay thin. Do not hard-code OriginWeave, naruon, or Keyverse | |
| - **Product hourly callers** stay thin. Do not hard-code Scopeweave, naruon, or Keyverse | |
| - **Product hourly callers** stay thin. Do not hard-code Scopeweave, OriginWeave, naruon, or Keyverse |
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Current-head validation for b20edee: fixed the shared Strix gate so only CRITICAL/HIGH/MEDIUM severity is blocking, while workflow-only No Assessable Application Code Found in Scope and provider infrastructure output without medium-or-higher evidence are neutral. Added a focused regression contract. Passed: 7 Scopeweave contract tests, actionlint for Strix/Scopeweave/hourly caller workflows, bash -n for the Strix harness, and git diff --check. Please review this exact head; merge remains gated on an independent non-author approval and terminal protected checks. |
|
@opencode-agent Please review the current PR head b20edee on the exact branch. Re-check the Strix threshold/scope gate, changed-file scope, current mergeability, and required checks. Do not approve a stale head. |
| # Only medium-or-higher findings are blocking evidence. Low and INFO | ||
| # reports are retained as artifacts but do not block merge progress; | ||
| # the configured Strix threshold is MEDIUM. Keep the severity branch | ||
| # anchored away from identifiers such as STRIX_FAIL_ON_MIN_SEVERITY. | ||
| reported_vulnerability_signal='(^|[^A-Za-z0-9_])severity[[:space:]]*:[[:space:]]*(critical|high|medium)([^A-Za-z0-9_]|$)' |
There was a problem hiding this comment.
🟨 Strix security gate no longer blocks on reported vulnerability counts during backend outages
The Strix gate's reported_vulnerability_signal (.github/workflows/strix.yml:874) was narrowed to match only severity: critical/high/medium lines and no longer matches a reported vulnerability count. Because the neutral-skip branches at .github/workflows/strix.yml:881-885 and 891-895 treat a run as a pass when a backend-unavailable signal is present and no reported_vulnerability_signal matches, a run whose output reports vulnerabilities only via a count (e.g. Vulnerabilities 1) or via a differently-formatted severity marker (e.g. JSON "severity": "high", where the quote after the colon defeats the new [[:space:]]*(critical|high|medium) anchor) will be downgraded to a neutral skip, allowing real findings to bypass the required check.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Current-head failure triage for central run 32405368323: the failing Hourly cadence, immutable source, NIM credential, and conflict scope / exact-head-path-policy wrapper is executing the shared Strix fallback contract tests, not the PR's product files. The concrete failures are stale assertions in tests/test_strix_nvidia_nim_not_found_fallback.py that do not accept the current vulnerability-count signal. The root-cause repair is central PR #1177 at exact head a6ab307, which narrows the retry classifier and updates those assertions. No unrelated source patch is warranted on this PR; regenerate this PR's exact-head checks after #1177 is normally merged. |
|
Current-head repair is pushed at . The shared Strix vulnerability contract now keeps Critical/High/Medium evidence fail-closed and treats only non-assessable/info-only provider output as neutral. Focused regression tests and shell syntax checks passed. @opencode-agent review this exact HEAD; do not transfer predecessor approval or merge. |
|
Current-head repair is pushed at SHA 820e2ab. The shared Strix vulnerability contract keeps Critical/High/Medium evidence fail-closed and treats only non-assessable/info-only provider output as neutral. Focused regression tests and shell syntax checks passed. @opencode-agent review this exact HEAD; do not transfer predecessor approval or merge. |
|
Current-head merge repair pushed normally at |
|
Exact-head lock repair pushed as 26b684b from b48509e. Updated the hashed pip audit runtime from pip 26.1.2 to pip 26.2.1 with exact hashes, without changing the hourly caller implementation. The same lock has already passed local pip-audit in this maintenance loop; hosted checks and exact-head approval must be re-evaluated. No bypass or force push was used. |
| name: Scopeweave Hourly Review Repair | ||
|
|
||
| on: | ||
| schedule: | ||
| # Minute 31 avoids Clearfolio (23), DiskSage (37), fast-mlsirm (49), | ||
| # BandScope (53), naruon (11), Inkspan (47), orchestrator (17), | ||
| # Wardnet (7), codec-carver (5), pg-erd-cloud (13), Keyverse (29), | ||
| # and noema (19). | ||
| - cron: "31 * * * *" | ||
|
|
||
| concurrency: | ||
| group: scopeweave-hourly-review-repair | ||
| # A later heartbeat must not cancel an in-flight WBS or ITSM RCA. | ||
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| dispatch-review-repair: | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| uses: ./.github/workflows/pr-review-fix-scheduler.yml | ||
| with: | ||
| target_repository: ContextualWisdomLab/scopeweave | ||
| base_branch: develop | ||
| max_prs: "50" | ||
| max_dispatches: "1" | ||
| retry_hours: "2" | ||
| secrets: | ||
| PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }} | ||
| OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }} |
There was a problem hiding this comment.
📝 Info: New Scopeweave caller matches sibling caller contract
The new scopeweave-hourly-review-repair.yml mirrors the established sibling callers (e.g. originweave-hourly-review-repair.yml) exactly: read-only workflow permissions, job-scoped id-token: write, non-cancelling single-flight concurrency, one dispatch, two-hour retry floor, and only PR_REVIEW_MERGE_TOKEN/OPENCODE_APPROVE_TOKEN mapped (no NVIDIA_NIM_API_KEY, no secrets: inherit). Minute 31 is consistent with the cross-caller slot map (OriginWeave's comment already reserves "Scopeweave (31)"), and the base_branch: develop matches the doctoring. No functional issue found here.
Was this helpful? React with 👍 or 👎 to provide feedback.
| # Only medium-or-higher findings are blocking evidence. Low and INFO | ||
| # reports are retained as artifacts but do not block merge progress; | ||
| # the configured Strix threshold is MEDIUM. Keep the severity branch | ||
| # anchored away from identifiers such as STRIX_FAIL_ON_MIN_SEVERITY. | ||
| reported_vulnerability_signal='(^|[^A-Za-z0-9_])severity[[:space:]]*:[[:space:]]*(critical|high|medium)([^A-Za-z0-9_]|$)' | ||
|
|
||
| # Workflow-only callers can legitimately produce an informational | ||
| # "no assessable application code" report. It is not a vulnerability | ||
| # signal and must remain neutral unless a medium-or-higher finding is | ||
| # also present in the same run. | ||
| non_assessable_scope_signal='No Assessable Application Code Found in Scope' | ||
| if grep -Eiq "$non_assessable_scope_signal" "$strix_run_log" \ | ||
| && ! grep -Eiq "$reported_vulnerability_signal" "$strix_run_log"; then | ||
| echo "::warning title=Strix scope not assessable::Strix received workflow-only scope and produced no medium-or-higher vulnerability evidence; treating the informational scope result as neutral." | ||
| exit 0 | ||
| fi | ||
|
|
||
| # Neutral skip only when ALL hold: a backend-unavailability signal is | ||
| # present and no vulnerability was reported anywhere. This preserves | ||
| # real security gating while keeping uncontrollable provider outages | ||
| # from blocking current-head merge progress. | ||
| # present and no medium-or-higher vulnerability was reported. This | ||
| # preserves real security gating while keeping uncontrollable provider | ||
| # outages from blocking current-head merge progress. | ||
| if grep -Eiq "$backend_unavailable_signal" "$strix_run_log" \ | ||
| && ! grep -Eiq "$reported_vulnerability_signal" "$strix_run_log"; then | ||
| echo "::warning title=Strix backend unavailable::Strix could not complete because its LLM backend was unavailable (rate limit / token cap / connection or warm-up failure) before producing a vulnerability report. Treating as a neutral skip so an infrastructure outage does not block merges; genuine findings still fail the check. See the strix-reports artifact and the run log." |
There was a problem hiding this comment.
🔍 Strix gate change is undocumented in CHANGELOG and outside the PR's stated scope
This PR is described as adding the Scopeweave hourly caller, but it also materially changes the shared Strix security gate in strix.yml (medium-or-higher-only blocking plus a new non-assessable-scope neutral exit). This gate is shared across every sibling repo, so the behavioral change affects all repositories, not just Scopeweave. It is not recorded in CHANGELOG.md (only the Scopeweave caller entry was added at CHANGELOG.md). Reviewers should confirm the gate change is intended to ship in this PR and add a corresponding changelog entry.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
| # Minute 31 avoids Clearfolio (23), DiskSage (37), fast-mlsirm (49), | ||
| # BandScope (53), naruon (11), Inkspan (47), orchestrator (17), | ||
| # Wardnet (7), codec-carver (5), pg-erd-cloud (13), Keyverse (29), | ||
| # and noema (19). | ||
| - cron: "31 * * * *" |
There was a problem hiding this comment.
📝 Info: Cron minute 31 does not collide with existing hourly callers
The new caller uses cron: "31 * * * *" (scopeweave-hourly-review-repair.yml). I enumerated all cron schedules across .github/workflows/ and confirmed minute 31 is not used by any other hourly review-repair caller (existing minutes: 5,7,10,11,13,14,16,17,19,21,23,27,29,37,43,47,49,53). The staggering comment omits several existing callers (OriginWeave 10, nonnest2 16, quarantine 14, github 21, governance 43, accounting 27) but the chosen slot is genuinely free, so this is not a bug.
Was this helpful? React with 👍 or 👎 to provide feedback.
| uses: ./.github/workflows/pr-review-fix-scheduler.yml | ||
| with: | ||
| target_repository: ContextualWisdomLab/scopeweave | ||
| base_branch: develop | ||
| max_prs: "50" | ||
| max_dispatches: "1" | ||
| retry_hours: "2" | ||
| secrets: | ||
| PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }} | ||
| OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }} |
There was a problem hiding this comment.
📝 Info: Caller inputs match reusable scheduler contract
The caller passes target_repository, base_branch, max_prs, max_dispatches, retry_hours and maps PR_REVIEW_MERGE_TOKEN/OPENCODE_APPROVE_TOKEN. I verified against .github/workflows/pr-review-fix-scheduler.yml that all of these inputs and secrets exist with matching types. The pattern is identical to the existing accounting/bandscope/governance callers targeting develop, so the wiring is consistent and valid.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Buyer-perceivable gap
Hourly NVIDIA NIM review repair never scanned
ContextualWisdomLab/scopeweave. Live WBS/ITSM pull requests such as ContextualWisdomLab/scopeweave#545, ContextualWisdomLab/scopeweave#531, ContextualWisdomLab/scopeweave#529, and ContextualWisdomLab/scopeweave#523 target protecteddevelopand stalled while Clearfolio, DiskSage, and fast-mlsirm received heartbeats.Change
base_branch: develop, one dispatch, two-hour same-head retry.id-token: writeso the reusable scheduler can mint the OpenCode App fallback from GitHub OIDC.PR_REVIEW_MERGE_TOKENandOPENCODE_APPROVE_TOKEN. NeverNVIDIA_NIM_API_KEYon the caller. NeverCOPILOT_GITHUB_TOKEN.pull_request/push/compileallpath contracts.Do not self-approve. Merge remains subject to two-approval + last-pusher ruleset. GitHub review/Checks wait is not a blocker.
Refs ContextualWisdomLab/scopeweave#545, ContextualWisdomLab/scopeweave#531, ContextualWisdomLab/scopeweave#529, and ContextualWisdomLab/scopeweave#523.