ci: bootstrap exact-head repair runner for Strix #952

[seonghobae]

Purpose

Install a one-shot, exact-head-locked pull_request_target runner so PR #1133 can apply and verify the base-executed Strix runtime fix that its own branch cannot trigger safely.

Security boundary

• runs only for ready_for_review on same-repository branch fix/strix-base-runtime-contract-952;
• requires exact immutable head e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04 and re-verifies the checkout SHA before executing any branch code;
• workflow-level token is read-only; only the narrowly gated job receives contents: write;
• runs focused Python regressions, the bounded required-workflow smoke, the full Strix shell regression suite, syntax checks, and git diff --check before committing;
• removes itself and all temporary bootstrap tooling from fix(strix): bootstrap complete runtime evidence for #952 #1133, so merging fix(strix): bootstrap complete runtime evidence for #952 #1133 deletes this workflow from main.

No Strix lock/version, pip-audit, scheduler, or review policy changes are included here. This is a temporary bootstrap prerequisite for #1133/#1121 and issue #952.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fb932b0c-57b0-48ae-b876-b950b3138529

📥 Commits

Reviewing files that changed from the base of the PR and between 64feb77 and 92d1382.

📒 Files selected for processing (1)

• .github/workflows/apply-strix-952-repair.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review the exact-head, one-shot pull_request_target trust boundary, especially same-repository/exact-SHA gating, job-scoped write permission, immutable checkout verification, and guaranteed self-deletion through #1133. Do not suggest broadening the trigger or running arbitrary PR-head code.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== PR metadata =='
gh pr view 1134 --repo ContextualWisdomLab/.github --json number,title,headRefName,headRefOid,baseRefName,files,url

echo '== Changed files =='
gh pr diff 1134 --repo ContextualWisdomLab/.github --name-only

echo '== Workflow and bootstrap-tool candidates =='
fd -t f . .github scripts tests 2>/dev/null \
  | rg '(^|/)(.*(strix|bootstrap|repair|dispatch).*\.(ya?ml|py|sh)|.*opencode.*\.ya?ml)$' \
  || true

echo '== Workflow outlines =='
fd -t f -e yml -e yaml .github 2>/dev/null \
  | xargs -r -n1 ast-grep outline --lang yaml --items all 2>/dev/null \
  | sed -n '1,500p'

echo '== PR patch =='
gh pr diff 1134 --repo ContextualWisdomLab/.github

Length of output: 6855

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="ContextualWisdomLab/.github"
sha="e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04"

echo '== PR `#1133` metadata =='
gh pr view 1133 --repo "$repo" \
  --json number,state,isDraft,headRefName,headRefOid,baseRefName,mergeStateStatus,mergeable,url,files

echo '== PR `#1133` changed files =='
gh pr diff 1133 --repo "$repo" --name-only

echo '== Exact commit metadata =='
gh api "repos/$repo/commits/$sha" \
  --jq '{sha:.sha,parents:[.parents[].sha],message:.commit.message,tree:.commit.tree.sha}'

echo '== Exact tree paths related to bootstrap and Strix repair =='
gh api "repos/$repo/git/trees/$sha?recursive=1" --paginate \
  --jq '.tree[]
    | select(.path | test("(^|/)(apply-strix-952-repair\\.yml|repair-strix-base-runtime-952\\.yml|apply_strix_952_repair(_v2)?\\.py|strix_report_semantics\\.py|validate_strix_runtime_compatibility\\.py|test_strix_952_runtime_contract\\.py)$"))
    | [.path,.type,.sha] | `@tsv`'

echo '== Exact repair script =='
gh api "repos/$repo/contents/scripts/ci/apply_strix_952_repair_v2.py?ref=$sha" \
  --jq '.content' | base64 --decode | cat -n

echo '== Exact target runtime test =='
gh api "repos/$repo/contents/tests/test_strix_952_runtime_contract.py?ref=$sha" \
  --jq '.content' | base64 --decode | cat -n

echo '== Target-branch protection and rulesets =='
gh api "repos/$repo/branches/fix/strix-base-runtime-contract-952/protection" 2>&1 || true
gh api "repos/$repo/rules/branches/fix/strix-base-runtime-contract-952" 2>&1 || true

Length of output: 15956

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="ContextualWisdomLab/.github"
sha="e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04"

get_file() {
  local path="$1"
  echo "== $path =="
  gh api "repos/$repo/contents/$path?ref=$sha" --jq '.content' \
    | base64 --decode | cat -n
}

get_file "scripts/ci/apply_strix_952_repair.py"
get_file ".github/workflows/apply-strix-952-repair.yml"
get_file ".github/workflows/repair-strix-base-runtime-952.yml"

echo '== Patcher file-write and subprocess-related source lines =='
gh api "repos/$repo/contents/scripts/ci/apply_strix_952_repair.py?ref=$sha" --jq '.content' \
  | base64 --decode \
  | rg -n -C3 '(write_text|replace_once|Path\(|subprocess|os\.|shutil|git |\.github|scripts/ci|tests/)'

echo '== Base-parent versions of temporary files =='
parent="8075c983d7dbc3057bfc96d4367bf578158720a4"
for path in \
  ".github/workflows/apply-strix-952-repair.yml" \
  ".github/workflows/repair-strix-base-runtime-952.yml" \
  "scripts/ci/apply_strix_952_repair.py" \
  "scripts/ci/apply_strix_952_repair_v2.py"
do
  status="$(gh api -i "repos/$repo/contents/$path?ref=$parent" 2>/dev/null | sed -n '1p' || true)"
  printf '%s\t%s\n' "$path" "$status"
done

Length of output: 57044

---

🤖 web_search executed:

site:docs.github.com/actions "pull_request" workflow pull request branch workflow file permissions contents write same repository

Length of output: 17777

---

🤖 web_search executed:

site:docs.github.com/actions "push" event workflow file branch "GITHUB_TOKEN" permissions contents write

Length of output: 20781

---

@seonghobae Blocking issue found.

The new pull_request_target runner has the requested controls:

• It requires the same repository, the fixed branch, and the exact SHA.
• It grants contents: write only to jobs.apply.
• It verifies the checked-out SHA before it runs repository scripts.
• Its final commit removes both temporary workflows and both patchers.

However, the exact #1133 head still contains two independent write-capable workflows:

• .github/workflows/apply-strix-952-repair.yml runs on pull_request ready_for_review and workflow_dispatch.
• .github/workflows/repair-strix-base-runtime-952.yml runs on pushes to fix/strix-base-runtime-contract-952.

Both workflows check out mutable branch content and execute it with contents: write. Neither workflow verifies the fixed SHA. The pull_request workflow can run when #1133 changes from draft to ready. The push workflow can run for pushes to that branch. The safe runner deletes them only after its own execution completes.

Therefore, #1134 does not yet guarantee that #1133 has no arbitrary PR-head write-capable execution path. Remove or disable both #1133 workflows before #1133 is marked ready. Keep only the exact-head pull_request_target runner from this PR.

GitHub documents that pull_request workflows run against the PR merge result and that push workflows run for pushed branch commits. It also documents that job-level permissions apply to all commands in that job. GitHub Actions events documentation and workflow syntax documentation support this assessment.

I could not verify target-branch protection. The branch-protection API returned HTTP 403.

---

🧠 Learnings used

Learnt from: seonghobae
Repo: ContextualWisdomLab/.github PR: 1052
File: .github/workflows/opencode-review-dispatch.yml:636-638
Timestamp: 2026-08-18T06:13:24.803Z
Learning: In ContextualWisdomLab/.github, `scripts/ci/materialize_base_rust_toolchain.py` currently reads `Cargo.toml`, `Cargo.lock`, and `rust-toolchain*` from the live PR merge tree instead of from `$PR_BASE_SHA` Git blobs. This can allow PR-head Rust dependency or toolchain inputs into trusted Rust coverage image preparation. The required follow-up is tracked in ContextualWisdomLab/.github#1118 and requires a base-revision Git-blob read implementation plus Git-commit-based fixtures in `tests/test_materialize_base_rust_toolchain.py`.

_{You are interacting with an AI system.}

[seonghobae]

@opencode-agent Review this exact-head bootstrap PR only. Verify the pull_request_target same-repository + exact-SHA trust gate, job-scoped write permission, immutable checkout check, and the cleanup path that removes the runner when #1133 lands. Do not modify or merge #1133/#1121 from this review and do not broaden the trigger.

[seonghobae]

The runner no longer needs to land on main. Its branch is now an isolated temporary PR base for #1133, with the same-repository exact-head gate preserved. Closing this bootstrap PR prevents the temporary workflow from entering protected main; #1133 will be retargeted back to main after the one-shot verified branch repair.