fix(noema): replay OIDC envelope repair on current main - #834
Conversation
|
Warning Review limit reached
Next review available in: 48 minutes Limit details: You’ve used all 1 included review currently available under your plan. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughNoema OIDC 교환 응답에 fail-closed 검증을 추가했습니다. 워크플로는 저장소에 바인딩된 ChangesNoema OIDC 응답 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant NoemaOIDC
participant GitHubWorkflow
participant jq
NoemaOIDC->>GitHubWorkflow: OIDC 교환 응답 반환
GitHubWorkflow->>jq: 응답 envelope 및 저장소 메타데이터 검증
jq-->>GitHubWorkflow: 검증 결과와 data.token 반환
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the unchanged exact head |
|
|
|
@coderabbitai review Re-review only the unchanged exact head |
|
I will limit the review to the four-file Noema OIDC response-envelope repair. I will not use evidence from superseded PR
|
|
@coderabbitai review Re-review only unchanged exact head |
|
I will limit the review to the four-file Noema OIDC success-envelope repair. I will not use evidence from superseded PR ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_noema_oidc_exchange_contract.py`:
- Around line 41-44: Update the assertions in the exchange contract test to
verify that the `echo "::add-mask::$app_token"` command appears before `echo
"token=$app_token" >>"$GITHUB_OUTPUT"` within `exchange`, while preserving the
existing presence checks.
- Line 24: Update the assertion in the noema OIDC exchange contract test so it
rejects the `.token // empty` jq pattern regardless of whether the filter uses
single or double quotes; prefer checking the quote-independent pattern itself.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8cc60992-3a83-462d-b8da-6169c065e230
📒 Files selected for processing (4)
.github/workflows/noema-review.ymlCHANGELOG.mddocs/doctoring/noema-oidc-exchange-envelope.mdtests/test_noema_oidc_exchange_contract.py
|
@coderabbitai review @cwl-noema-review @opencode-agent Review only exact current head |
|
I will verify the specified OIDC envelope validation, token handling, diagnostic safety, and unchanged fallback and permission boundaries. I will not modify, merge, retarget, or alter credentials.
|
|
@opencode-agent review Evaluate exact current head |
|
Exact-current-head review request for Review the bounded four-file Noema OIDC consumer repair: accept only Keep the exact head unchanged. Do not transfer #822 evidence, synthesize author approval, accept the old top-level token shape, expose response/token data, alter credential fallbacks or reviewer identity, update the branch, merge, release, or bypass protection. After protected integration, operational acceptance still requires a real OIDC exchange proving the validated envelope reaches extraction without disclosure. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== revision verification =='
git rev-parse HEAD
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
git merge-base --is-ancestor "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
echo
echo '== bounded diff =='
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo
echo '== workflow outline =='
ast-grep outline .github/workflows/noema-review.yml --items all || true
echo
echo '== test outline =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all || true
echo
echo '== workflow references relevant to credentials, outputs, diagnostics, and OIDC =='
rg -n -i -C 8 \
'(oidc|noema|token|github_output|github app|app[_ -]?token|pat|permissions|reviewer|nvidia|model|curl|jq)' \
.github/workflows/noema-review.yml
echo
echo '== contract test source =='
cat -n tests/test_noema_oidc_exchange_contract.pyLength of output: 35934 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='834'
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
echo '== response-contract references =='
rg -n -C 5 \
'(token_expires_at|workflow_ref|target_repository|response envelope|data\.token)' \
. \
-g '!docs/doctoring/noema-oidc-exchange-envelope.md' \
-g '!tests/test_noema_oidc_exchange_contract.py' \
-g '!CHANGELOG.md' \
-g '!**/.git/**' || true
echo
echo '== PR identity and exact-head state =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{number, state, draft, mergeable, merge_commit_sha, base_sha: .base.sha, head_sha: .head.sha, changed_files, review_comments, commits}'
echo
echo '== check runs attached to exact head =='
gh api --paginate "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url, head_sha}' || true
echo
echo '== statuses attached to exact head =='
gh api --paginate "repos/${repo}/commits/${head_sha}/status?per_page=100" \
--jq '.statuses[] | {context, state, target_url, updated_at}' || true
echo
echo '== unresolved PR review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body path line } } }
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}' || trueLength of output: 63301
I verified exact head The OIDC consumer now requires The workflow masks GitHub reports this exact head as mergeable with zero unresolved review threads. The inspected security and supply-chain checks are associated with this head and have successful conclusions where applicable. I did not treat skipped or neutral jobs as passing evidence. The expiry field has presence and string-type validation. A real post-integration exchange is still required to verify the provider envelope, extraction path, and token non-disclosure in the GitHub Actions environment. 🧠 Learnings usedYou are interacting with an AI system. |
Live sole-collaborator canary for the OIDC response-envelope repairEmbedRelay PR #3 at exact head The supported non-author review path therefore depends on the installed Noema/OpenCode reviewer App chain. This makes the After this PR reaches protected central |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='834'
echo '== revision and scope =='
printf 'checked-out HEAD: '; git rev-parse HEAD
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
git merge-base --is-ancestor "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo '== workflow relevant context =='
rg -n -i -C 12 \
'(oidc|noema|token_response|app_token|data\.token|github_output|github app|app[_ -]?token|pat|permissions|reviewer|nvidia|model|curl|jq)' \
.github/workflows/noema-review.yml
echo '== contract tests =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all
cat -n tests/test_noema_oidc_exchange_contract.py
echo '== reviewer edit boundary =='
if [ -f opencode.jsonc ]; then
rg -n -C 4 '"edit"\s*:\s*"(deny|allow)"' opencode.jsonc
else
echo 'opencode.jsonc is absent'
fi
echo '== exact-head PR state, check runs, and review threads =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{state, draft, mergeable, base_sha: .base.sha, head_sha: .head.sha, changed_files, review_comments}'
gh api --paginate "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, head_sha}' || true
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}'Length of output: 44773
I verified exact head The OIDC exchange accepts only The workflow applies The GitHub App and PAT fallback order is unchanged. The reviewer/model routing, NVIDIA behavior, workflow permissions, and reviewer GitHub reports this exact head as mergeable. The current-head review threads are resolved. The inspected terminal-success checks belong to this exact head. I did not count skipped or neutral checks as passing evidence. A real post-integration OIDC exchange remains necessary to prove the provider response, extraction path, and token non-disclosure in GitHub Actions. This request invoked 🧠 Learnings usedYou are interacting with an AI system. |
|
Fresh policy RCA is tracked in #948. Protected |
|
@opencode-agent review Re-evaluate exact current head |
Pull request was converted to draft
|
Returned to Draft because the exact current diff no longer satisfies the stated bounded replacement contract. The body promises only four OIDC files, but head Reconcile or rebuild from protected main so the effective diff contains only the four declared OIDC surfaces. Preserve the unrelated materializer work in its authoritative PR. Then rerun exact-head checks and obtain fresh independent review. Do not merge this contaminated tree or reuse predecessor evidence. |
|
@coderabbitai review Review only exact current head |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review @coderabbitai review Re-review the unchanged exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
HEAD_SHA='526e7c284c4cb60979516935f3fb930319aed5de'
BASE_SHA='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
REPO='ContextualWisdomLab/.github'
PR='834'
echo '== exact revisions and effective scope =='
printf 'checked-out HEAD: '; git rev-parse HEAD
git cat-file -e "${HEAD_SHA}^{commit}"
git cat-file -e "${BASE_SHA}^{commit}"
git merge-base --is-ancestor "$BASE_SHA" "$HEAD_SHA"
git diff --name-status "$BASE_SHA" "$HEAD_SHA"
echo '-- commit count --'
git rev-list --count "${BASE_SHA}..${HEAD_SHA}"
echo
echo '== bounded OIDC diff =='
git diff --no-ext-diff --unified=100 "$BASE_SHA" "$HEAD_SHA" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo
echo '== workflow outline and security-relevant context =='
ast-grep outline .github/workflows/noema-review.yml --items all || true
rg -n -i -C 16 \
'(permissions:|id-token:|contents:|pull-requests:|oidc|noema|token_response|app_token|data\.token|github_output|add-mask|github app|app[_ -]?token|pat|reviewer|nvidia|model|curl|jq|echo|printf)' \
.github/workflows/noema-review.yml
echo
echo '== contract-test outline and source =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all || true
cat -n tests/test_noema_oidc_exchange_contract.py
echo
echo '== changed unrelated-file contents and references =='
for path in AGENTS.md ARCHITECTURE.md CLAUDE.md scripts/ci/materialize_base_python_requirements.py tests/test_materialize_base_python_requirements.py; do
if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- "$path"; then
continue
fi
echo "-- $path --"
git diff --no-ext-diff --unified=30 "$BASE_SHA" "$HEAD_SHA" -- "$path"
done
echo
echo '== PR identity, head, base, and review state =='
gh api "repos/${REPO}/pulls/${PR}" \
--jq '{number,state,draft,mergeable,base_sha:.base.sha,head_sha:.head.sha,changed_files,commits,review_comments}'
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$PR" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}'Length of output: 69396
I reviewed The OIDC consumer correctly requires Two issues prevent a clean verdict:
I did not approve the pull request. You are interacting with an AI system. |
The PR had no merge-base with main. Re-apply only the Noema OIDC audience/subject contract, workflow check, tests, and doctoring without replaying a stale materializer tree.
526e7c2 to
c94bd8a
Compare
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
1 participant
RCA
The Noema OIDC exchange can successfully return its stable success envelope while the central consumer still fails because protected
mainreads the nonexistent top-level.token. The actual token is repository-bound underdata.token; treating the resulting empty lookup as a missing credential misdiagnoses a producer/consumer schema mismatch.Historical PR #822 contains the bounded repair but is no longer mergeable and is based on protected-main
1131b1bbafb24e455fc8619cdf316813e8721861. Protectedmainadvanced to6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. Checks, reviews, approvals, comments, and synthetic merge evidence from #822 do not transfer here.Feasibility decision
A destructive rebase/force-push is unnecessary. The old base → current main delta touches only the Strix quality workflow, its doctoring/test, and one independent
CHANGELOG.mdentry; it does not modifynoema-review.yml. This replacement is therefore rebuilt directly from exact current protected main and carries only the same four-file bounded OIDC contract, while preserving the intervening Strix changelog entry.Bounded repair
ok: trueand object-valueddata;data.token, exact target repository identity, and non-empty workflow-source/expiry metadata;.data.tokenafter the full envelope validates;Exact replacement boundary
This branch is exactly four commits ahead and zero behind protected main at creation. The effective diff is limited to:
.github/workflows/noema-review.ymltests/test_noema_oidc_exchange_contract.pydocs/doctoring/noema-oidc-exchange-envelope.mdCHANGELOG.mdNo predecessor evidence transfers. Keep Draft until implementation/tests/docs/changelog are complete and every currently executable exact-head deterministic/security/supply-chain gate is green with zero current source-backed findings. At that point Ready status is permitted solely to obtain current-head automated and independent review; Ready is not merge evidence. Merge remains prohibited until current automated review is complete, zero valid unresolved findings remain, a qualifying non-author counted approval exists, and branch protection/repository policy allow the exact unchanged head.
Operational acceptance
After protected integration, execute a real Noema OIDC exchange and prove the stable response envelope reaches token extraction successfully without exposing the token. PR checks alone are not operational closure.
Supersedes #822 only after this replacement proves its own exact-head gates.
Summary by CodeRabbit
버그 수정
문서
테스트