fix(coverage): materialize trusted uv lock dependencies - #743
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthrough신뢰된 기준 커밋에서 Changes신뢰된 uv materialization
Strix NVIDIA NIM fallback
저장소 품질 및 workflow 회귀
의존성 및 release updates
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='2ef7a3661d26aa17636fc562f51531993c21313b'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual" "$expected"
git diff-tree --no-commit-id --name-status -r "$expected"
printf '\n--- IMPLEMENTATION OUTLINE ---\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
printf '\n--- TEST OUTLINES ---\n'
for f in \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_trusted_uv_download_contract.py \
tests/test_uv_export_isolation_contract.py
do
printf '\n### %s ###\n' "$f"
ast-grep outline "$f" --items all --view expanded
done
printf '\n--- IMPLEMENTATION ---\n'
cat -n scripts/ci/materialize_base_python_requirements.py
printf '\n--- FOCUSED TESTS ---\n'
for f in \
tests/test_materialize_base_python_requirements.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_trusted_uv_download_contract.py \
tests/test_uv_export_isolation_contract.py
do
printf '\n### %s ###\n' "$f"
cat -n "$f"
done
printf '\n--- DESIGN RECORD ---\n'
cat -n docs/doctoring/trusted-uv-lock-materialization.mdLength of output: 81216 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='2ef7a3661d26aa17636fc562f51531993c21313b'
printf '%s\n' '--- REF AND MERGE-BASE DISCOVERY ---'
git remote -v
git branch -a --contains "$head" || true
for ref in origin/main origin/master main master; do
if git rev-parse --verify --quiet "$ref" >/dev/null; then
base="$(git merge-base "$ref" "$head")"
printf 'REF=%s MERGE_BASE=%s\n' "$ref" "$base"
git diff --name-status "$base" "$head"
fi
done
printf '%s\n' '--- PULL REQUEST METADATA ---'
gh pr view 743 --repo ContextualWisdomLab/.github --json baseRefName,baseRefOid,headRefName,headRefOid,isDraft,state,mergeStateStatus,statusCheckRollup
printf '%s\n' '--- REDIRECT AND OUTPUT-VALIDATION CALL SITES ---'
rg -n -C 4 --glob '*.py' \
'geturl\(\)|urlparse\(|TRUSTED_UV_ARCHIVE_URL|_is_fully_hash_pinned_requirement|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE' \
scripts tests
printf '%s\n' '--- QUALITY CONFIGURATION CANDIDATES ---'
fd -H -t f '^(pyproject\.toml|pytest\.ini|setup\.cfg|tox\.ini|\.coveragerc|ruff\.toml)$' . \
-E .git -E node_modules -E dist -E build \
-x sh -c 'printf "\n### %s ###\n" "$1"; cat -n "$1"' sh {}
printf '%s\n' '--- DOCSTRING AND COVERAGE REFERENCES ---'
rg -n -C 3 --hidden \
'(branch\s*=\s*true|--cov-branch|fail_under|docstring|pydocstyle|D[0-9]{3}|materialize_base_python_requirements)' \
-g '!**/.git/**' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' .Length of output: 109425
I found two blockers.
The reviewed implementation otherwise matches the requested boundaries:
I did not execute repository tests because the review sandbox prohibits execution of repository code. Pull request ✅ Action performedReview finished.
|
|
Addressed both exact-head CodeRabbit blockers in
@coderabbitai review |
|
Review-only exact-current-head dispatch. Do not update branches or merge. Re-evaluate trusted-base uv materialization, Python 3.10/3.14 portability, 100% production statement/branch coverage and docstrings, secure Strix locks, Git configuration isolation, and absence of temporary write-capable workflows. |
|
@cwl-noema-review Independently review the exact current head. Confirm the uv lock parser and bootstrap are bound to the validated base SHA, offline export is fail-closed, Git configuration is hermetic, secure dependency floors remain intact, and no pull-request-controlled code can reach a write credential. |
|
@coderabbitai review Please perform a fresh exact-current-head review after all bounded repair commits. Treat predecessor-head approvals and cancelled or absent checks as stale. |
Rate Limit Exceeded
|
|
@coderabbitai review Please review exact current head @opencode-agent Review this same exact head after all current-head checks complete. @cwl-noema-review Independently review this same exact head; do not reuse predecessor-head evidence. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
printf '%s\n' '--- EXACT REVISION AND PR STATE ---'
printf 'checked_out=%s expected=%s\n' "$(git rev-parse HEAD)" "$head"
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution}' \
|| printf '%s\n' 'Branch-protection API unavailable to this token.'
printf '%s\n' '--- DIFF AND TEMPORARY-WRITER INVENTORY ---'
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
rg -n -C 2 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|git push|gh pr|pull_request_target)' \
.github/workflows || true
printf '%s\n' '--- TRUSTED UV IMPLEMENTATION AND CONTRACT TEST MAP ---'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
rg -n -C 10 \
'^def (_list_regular_files|_read_base|_download_trusted_uv_archive|_install_trusted_uv|_run_uv_export|_export_uv_lock)|TRUSTED_UV_|ProxyHandler|HTTPRedirectHandler|urlparse\(|parsed\.port|urlopen\(|tarfile|member\.isreg|platform\.system|platform\.machine|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|tool\.uv\.workspace' \
scripts/ci/materialize_base_python_requirements.py
for path in \
tests/test_trusted_uv_portability_and_streaming.py \
tests/test_uv_workspace_fail_closed.py \
tests/test_uv_export_isolation_contract.py \
tests/test_materialize_uv_export_hash_contract.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_redirect_and_coverage_contract.py
do
printf '\n### %s ###\n' "$path"
rg -n -C 4 '(sha256|redirect|port|stream|chunk|platform|workspace|nested|orphan|tracked|frozen|offline|no-cache|exact|hash)' "$path"
done
printf '%s\n' '--- GIT ISOLATION, QUALITY, AND STRIX CONTRACTS ---'
sed -n '850,1020p' .github/workflows/opencode-review-dispatch.yml
sed -n '1,180p' tests/test_repository_branch_coverage_pr743_cleanup.py
rg -n -C 8 \
'branch = true|fail_under = 100|python-version: "3\.10"|python-version: "3\.14"|--cov-branch|docstring|py_compile|head\.sha|persist-credentials' \
pyproject.toml .github/workflows/trusted-uv-materializer-quality-ci.yml \
tests/test_trusted_uv_materializer_quality_workflow_contract.py
rg -n -C 10 \
'STRIX_MODEL_REQUESTED|STRIX_GITHUB_MODELS_TOKEN|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|nemotron|is_nvidia_nim_not_found_error|NotFoundError|catalog|same.model|vulnerab' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
printf '%s\n' '--- DOCSTRINGS, LOCK FLOORS, AND DOCTORING ---'
python3 - <<'PY'
import ast
from pathlib import Path
missing = []
for path in Path("scripts/ci").rglob("*.py"):
tree = ast.parse(path.read_text(encoding="utf-8"))
for node in ast.walk(tree):
if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
if not node.name.startswith("_") and not ast.get_docstring(node):
missing.append((str(path), node.name, node.lineno))
print("missing_public_docstrings=", missing)
PY
rg -n -C 2 '^(aiohttp|cryptography)==' requirements-strix-ci.txt requirements-strix-ci-hashes.txt
rg -n -C 3 \
'(APA|References|uv\.lock|workspace|nested|coverage|branch|100%|Astral|NVIDIA|404|fallback)' \
docs/doctoring/trusted-uv-lock-materialization.md \
docs/doctoring/strix-nvidia-nim-not-found-fallback.md
printf '%s\n' '--- CHANGED WORKFLOW ACTION PINS ---'
git diff --name-only "$base" "$head" -- .github/workflows | while IFS= read -r path; do
printf '### %s ###\n' "$path"
rg -n '^\s*uses:\s+' "$path" || true
doneLength of output: 178298 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
log='/tmp/coderabbit-shell-logs/shell-output-4G9BCe'
printf '%s\n' '--- EXACT-HEAD STATUS ---'
printf 'checked_out=%s expected=%s\n' "$(git rev-parse HEAD)" "$head"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,isDraft,state,mergeStateStatus \
--jq '{headRefOid,baseRefOid,isDraft,state,mergeStateStatus}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | {name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution}' \
|| printf '%s\n' 'Branch-protection API unavailable to this token.'
printf '%s\n' '--- TRUSTED UV CORE ---'
nl -ba scripts/ci/materialize_base_python_requirements.py | sed -n '1,330p'
nl -ba scripts/ci/materialize_base_python_requirements.py | sed -n '340,560p'
printf '%s\n' '--- EXACT CHECKS, TEMPORARY-WRITER INVENTORY, AND DIFF ERRORS ---'
rg -n -A120 -B2 -- '--- EXACT REVISION AND PR STATE ---' "$log" | sed -n '1,180p'
printf 'temporary-artifacts:\n'
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
printf 'diff-check:\n'
git diff --check "$base" "$head"Length of output: 2949 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3f65dbee6672b78802e7d71d49c390f3817bb03b'
head='91f0e3616897f47a40029ae5ca5846f0b84a75e9'
printf '%s\n' '--- TRUSTED UV SOURCE: CONSTANTS, DOWNLOAD, AND INSTALL ---'
sed -n '1,330p' scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- TRUSTED UV SOURCE: BASE TREE, EXPORT, AND ENTRY POINT ---'
sed -n '340,560p' scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- SOURCE-LEVEL SECURITY MARKERS ---'
grep -nE \
'TRUSTED_UV_ARCHIVE_(URL|SHA256)|ProxyHandler|HTTPRedirectHandler|urlparse|parsed\.port|platform\.(system|machine)|member\.isreg|sha256|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|stat\.S_ISREG|tool\.uv\.workspace' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- TEMPORARY-WRITER INVENTORY AND DIFF CHECK ---'
matches="$(fd -H -t f . .github scripts tests docs 2>/dev/null | grep -Ei '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true)"
if [ -n "$matches" ]; then
printf '%s\n' "$matches"
else
printf '%s\n' 'none'
fi
git diff --check "$base" "$head"Length of output: 22830
I found no current source-level actionable issue. I verified the requested controls:
GitHub reports that PR You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Re-evaluate the exact current head only. Preserve trusted-base lock materialization, secure Strix NVIDIA NIM fallback, 100% statement/branch/docstring gates, isolated Git configuration, and all protected review credentials. Do not bypass branch protection or reuse predecessor-head evidence. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='743'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf '%s\n' '--- EXACT CURRENT REVISION AND PR STATE ---'
printf 'checked_out=%s\nhead=%s\nbase=%s\n' "$(git rev-parse HEAD)" "$head" "$base"
test "$(git rev-parse HEAD)" = "$head"
git cat-file -e "${base}^{commit}"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergedAt,mergeStateStatus,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergedAt,mergeStateStatus,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName}]}'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '[.check_runs[]|{name,status,conclusion,details_url}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'
printf '%s\n' '--- BRANCH PROTECTION ---'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_conversation_resolution,required_signatures,required_linear_history}' \
|| printf '%s\n' 'Branch-protection API unavailable to this review token.'
printf '%s\n' '--- CURRENT DIFF AND WRITE-CAPABLE AUTOMATION ---'
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
fd -H -t f . .github scripts tests docs 2>/dev/null \
| rg -i '(one-shot.*743|743.*one-shot|repair.*743|743.*repair|repair_pr_743|repair-pr-743)' || true
rg -n -C 2 --glob '*.yml' --glob '*.yaml' \
'(contents:\s*write|pull-requests:\s*write|issues:\s*write|git push|gh pr|pull_request_target)' \
.github/workflows || true
printf '%s\n' '--- TRUSTED UV SOURCE BOUNDARIES ---'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all --view expanded
rg -n -C 10 \
'^def (_list_regular_files|_read_base|_download_trusted_uv_archive|_install_trusted_uv|_run_uv_export|_export_uv_lock)|TRUSTED_UV_|ProxyHandler|HTTPRedirectHandler|urlparse\(|parsed\.port|urlopen\(|tarfile|member\.isreg|platform\.(system|machine)|--frozen|--offline|--no-cache|UV_NO_ENV_FILE|UV_PYTHON_DOWNLOADS|UV_EXACT_REQUIREMENT_RE|UV_SHA256_HASH_RE|tool\.uv\.workspace|stat\.S_ISREG' \
scripts/ci/materialize_base_python_requirements.py
printf '%s\n' '--- GIT ISOLATION, QUALITY, AND STRIX BOUNDARIES ---'
sed -n '850,1020p' .github/workflows/opencode-review-dispatch.yml
sed -n '1,180p' tests/test_repository_branch_coverage_pr743_cleanup.py
rg -n -C 7 \
'branch = true|fail_under = 100|python-version: "3\.10"|python-version: "3\.14"|--cov-branch|docstring|py_compile|head\.sha|persist-credentials' \
pyproject.toml .github/workflows/trusted-uv-materializer-quality-ci.yml \
tests/test_trusted_uv_materializer_quality_workflow_contract.py
rg -n -C 10 \
'STRIX_MODEL_REQUESTED|STRIX_GITHUB_MODELS_TOKEN|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|nemotron|is_nvidia_nim_not_found_error|NotFoundError|catalog|same.model|vulnerab' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py
printf '%s\n' '--- DOCSTRINGS AND DEPENDENCY FLOORS ---'
python3 - <<'PY'
import ast
from pathlib import Path
missing = []
for path in Path("scripts/ci").rglob("*.py"):
tree = ast.parse(path.read_text(encoding="utf-8"))
for node in ast.walk(tree):
if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
if not node.name.startswith("_") and not ast.get_docstring(node):
missing.append((str(path), node.name, node.lineno))
print("missing_public_docstrings=", missing)
PY
rg -n -C 2 '^(aiohttp|cryptography)==' requirements-strix-ci.txt requirements-strix-ci-hashes.txtLength of output: 237562
I found no current source-level actionable issue in the requested scope.
Pull request I could not independently verify protected-branch rules. The branch-protection API returned HTTP 403 for the review token. You are interacting with an AI system. |
2 participants
Purpose
Provide exact-base, offline, fully hash-pinned Python dependency materialization for repositories that use
uv.lock, and integrate the bounded Strix NVIDIA hosted-model availability repair required for protected downstream merges.Trusted uv boundary
uv.lockand siblingpyproject.tomlonly from the validated 40-character base SHA;[tool.uv.workspace]projects while preserving independently operable nested modules;uv exportunder isolated environment directories;==pins followed exclusively by complete SHA-256 hashes;Quality and security evidence
The read-only quality workflow proves Python 3.10 conditional
tomlicompatibility, Python 3.14 full tests, production statement and branch coverage at 100%, production docstrings at 100%, compilation, immutable action pins, exact contributor-head checkout, and hermetic runtime Git configuration for all three OpenCode sandbox invocations.Permanent tests cover execution sandboxes, JavaScript and Noema repository classification, reporting edges, review-scheduler branches, short reads, bounded downloads, cache cleanup, supported runner architecture, fail-closed workspace handling, exact adjacent Git-isolation blocks, and absence of PR-specific write-capable repair automation. The readiness timeout regression repeats its terminal monotonic timestamp indefinitely, the Git-isolation regression proves the
trusted_git()boundary marker and the completesafe.directory=/workblock, and the Noema regression proves the complete line-free review-thread rendering.Integrated Strix hosted-model repair
nvidia/nemotron-3-super-120b-a12b;nvidia/llama-3.3-nemotron-super-49b-v1.5before GitHub Models;COPILOT_GITHUB_TOKENand change no independent reviewer credential or scope.Protected-base repairs
scheduled-security-scan.ymlto immutable v4.37.5;aiohttp==3.14.3,cryptography==50.0.0, compatible pyOpenSSL, and regenerated hashes;Exact-head gate
Current exact head:
91f0e3616897f47a40029ae5ca5846f0b84a75e9.The following exact-head workflows succeeded:
All inline review threads are resolved, the PR is mergeable, and the final diff contains no temporary repair workflow. Every predecessor-head review is stale after the complete safe-directory isolation-value regression. Current-head OpenCode, Noema, CodeRabbit/qualifying independent approval and branch protection remain mandatory. Auto-merge may act only after every same-head rule succeeds.
After merge, #757 and downstream repositories must reconcile with the resulting protected central baseline and rerun their exact-head gates.
Standards traceability
Doctoring records cite official Astral uv, GitHub Actions, Git, RFC 3986, RFC 9110, NVIDIA primary documentation, and approved SLSA 1.2 materials in APA 7th form. No unsupported formal-conformance claim is made.
Summary by CodeRabbit
새로운 기능
uv.lock에서 해시가 고정된 Python 요구사항을 안전하게 생성합니다.버그 수정
문서