security: remove tracked Packrat build artifacts - #160
Open
seonghobae wants to merge 3 commits into
Open
Conversation
This was referenced Jul 21, 2026
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
804ea97cd83144f94c5020a9d42f2573cc8cb442. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
Changed-File Evidence Map
flowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
|
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
804ea97cd83144f94c5020a9d42f2573cc8cb442. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/29796717850/job/88529427601)
Changed-File Evidence Map
flowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
Collaborator
Author
|
@strix review Fresh exact-head security revalidation request for |
Collaborator
Author
|
@opencode-agent address Continue the existing PR branch. Refetch its exact current head/base and resolve every live review/check finding directly; do not open a competing PR, create temporary branch writers, synthesize approval, or bypass protection. After central Use NVIDIA NIM rather than |
|
Important Review skippedToo many files! This PR contains 1823 files, which is 1723 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (34)
📒 Files selected for processing (1823)
You can disable this status message by setting the |
Collaborator
Author
|
@opencode-agent @coderabbitai review exact current head The exact-head R CMD check, Code Quality, Security Audit, Security Scan, and SAST Semgrep workflows are successful. This change removes generated installed Packrat libraries while retaining the lock file, bootstrap, and tracked source cache; it also replaces unpinned runtime installer commands with full-SHA-pinned lint actions. Please submit a formal current-head verdict or actionable findings only. The earlier Strix quick-run failure must be re-evaluated on the current central scanner; do not waive checks or merge. |
seonghobae
marked this pull request as draft
August 14, 2026 13:06
seonghobae
marked this pull request as ready for review
August 14, 2026 13:07
seonghobae
enabled auto-merge (squash)
August 14, 2026 13:07
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='804ea97cd83144f94c5020a9d42f2573cc8cb442'
expected_base='35e44988487de8f5b8b7e57d9d76e18911b99841'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit objects =='
git cat-file -t "$expected_head"
git cat-file -t "$expected_base"
printf '%s\n' '== Merge-base and commit relation =='
git merge-base "$expected_base" "$expected_head"
git merge-base --is-ancestor "$expected_base" "$expected_head" && echo 'base_is_ancestor=yes'
printf '%s\n' '== Changed paths with status =='
git diff --name-status "$expected_base" "$expected_head"
printf '%s\n' '== Diff stat =='
git diff --stat "$expected_base" "$expected_head"
printf '%s\n' '== Relevant tracked configuration and workflow paths =='
git diff --name-only "$expected_base" "$expected_head" -- \
'.gitignore' \
'packrat/init.R' \
'packrat/packrat.lock' \
'packrat/src' \
'.github/workflows' \
'README.md' \
'ARCHITECTURE.md' \
'CONTRIBUTING.md'
printf '%s\n' '== PR metadata, checks, and review threads =='
gh pr view 160 --repo ContextualWisdomLab/aFIPC \
--json number,url,headRefOid,baseRefOid,state,isDraft,reviewDecision,statusCheckRollup,reviews \
--jq '{number,url,headRefOid,baseRefOid,state,isDraft,reviewDecision,checks:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}],reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid,submittedAt}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='aFIPC' -F number=160 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 10) {
nodes { author { login } body url }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] |
select(.isResolved == false) |
{isOutdated,path,line,comments:[.comments.nodes[]|{author:.author.login,body,url}]}'Length of output: 171183 🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='804ea97cd83144f94c5020a9d42f2573cc8cb442'
live_head='678b6f77dc06c345301468c43f3d9cd9dc07da90'
base='35e44988487de8f5b8b7e57d9d76e18911b99841'
printf '%s\n' '== Local identity and clean state =='
printf 'HEAD='; git rev-parse HEAD
git status --porcelain=v1
printf 'requested subject='; git show -s --format='%h %s' "$requested_head"
printf 'live subject='; git show -s --format='%h %s' "$live_head"
printf '%s\n' '== Commits after requested head =='
git log --oneline --decorate "$requested_head..$live_head"
printf '%s\n' '== Paths changed after requested head =='
git diff --name-status "$requested_head" "$live_head"
printf '%s\n' '== Non-generated diff after requested head =='
git diff --find-renames --find-copies -- \
"$requested_head" "$live_head" -- \
':(exclude)packrat/lib/**'
printf '%s\n' '== Requested-head non-generated diff =='
git diff --find-renames --find-copies \
"$base" "$requested_head" -- \
'.github/workflows/code-quality.yml' '.gitignore' 'ARCHITECTURE.md' 'README.md' 'AGENTS.md' 'CLAUDE.md'
printf '%s\n' '== Live workflow files and action references =='
fd -e yml -e yaml .github/workflows -x sh -c '
echo "--- $1"
grep -nE "^( *uses:|.*(pip|npm)[[:space:]]+install)" "$1" || true
' sh {}
printf '%s\n' '== Failed check details =='
gh run view 31784690425 --repo ContextualWisdomLab/aFIPC --log-failed || true
printf '%s\n' '== Unresolved review-thread summary =='
gh api graphql -F owner='ContextualWisdomLab' -F name='aFIPC' -F number=160 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved isOutdated path line
comments(first: 10) { nodes { author { login } body url } }
}
}
}
}
}' --jq '[
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,path,line,comments:[.comments.nodes[] | {author:.author.login,body,url}]}
] | {count:length,threads:.}'Length of output: 10439 🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='804ea97cd83144f94c5020a9d42f2573cc8cb442'
live_head='678b6f77dc06c345301468c43f3d9cd9dc07da90'
printf '%s\n' '== Current-head incremental diff =='
git diff --find-renames --find-copies "$requested_head" "$live_head" -- .github/workflows/code-quality.yml
printf '%s\n' '== Current workflow with line numbers =='
nl -ba .github/workflows/code-quality.yml
printf '%s\n' '== Action references and installer commands in all workflows =='
fd . .github/workflows -t f -e yml -e yaml -x sh -c '
echo "--- $1"
grep -nE "^[[:space:]]*uses:|(^|[[:space:]])(python(3)?[[:space:]]+-m[[:space:]]+pip|pip|npm)[[:space:]]+install([[:space:]]|$)" "$1" || true
' sh {}
printf '%s\n' '== Non-SHA action references, if any =='
python3 - <<'PY'
from pathlib import Path
import re
bad = []
for path in Path(".github/workflows").rglob("*"):
if path.suffix not in {".yml", ".yaml"}:
continue
for n, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
m = re.match(r"^\s*uses:\s*([^#\s]+)", line)
if m and "@" in m.group(1):
ref = m.group(1).rsplit("@", 1)[1]
if not re.fullmatch(r"[0-9a-f]{40}", ref):
bad.append(f"{path}:{n}: {m.group(1)}")
print("\n".join(bad) if bad else "none")
PY
printf '%s\n' '== Failed check details =='
gh run view 31784690425 --repo ContextualWisdomLab/aFIPC --log-failed || true
printf '%s\n' '== Unresolved review-thread summary =='
gh api graphql -F owner='ContextualWisdomLab' -F name='aFIPC' -F number=160 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved isOutdated path line
comments(first: 10) { nodes { author { login } body url } }
}
}
}
}
}' --jq '[
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,path,line,comments:[.comments.nodes[] | {author:.author.login,body,url}]}
] | {count:length,threads:.}'Length of output: 3646 🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '== Current workflow =='
sed -n '1,220p' .github/workflows/code-quality.yml
printf '%s\n' '== Workflow action and installer inventory =='
find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -print0 |
while IFS= read -r -d '' file; do
echo "--- $file"
grep -nE "^[[:space:]]*uses:|(^|[[:space:]])(python(3)?[[:space:]]+-m[[:space:]]+pip|pip|npm)[[:space:]]+install([[:space:]]|$)" "$file" || true
done
printf '%s\n' '== Non-SHA action references =='
python3 - <<'PY'
from pathlib import Path
import re
bad = []
for path in Path(".github/workflows").rglob("*"):
if path.suffix not in {".yml", ".yaml"}:
continue
for n, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
m = re.match(r"^\s*uses:\s*([^#\s]+)", line)
if m and "@" in m.group(1):
ref = m.group(1).rsplit("@", 1)[1]
if not re.fullmatch(r"[0-9a-f]{40}", ref):
bad.append(f"{path}:{n}: {m.group(1)}")
print("\n".join(bad) if bad else "none")
PY
printf '%s\n' '== Current generated-tree tracked files =='
git ls-files 'packrat/lib/**' 'packrat/lib-R/**' 'packrat/lib-ext/**' | sed -n '1,80p'
printf '%s\n' '== Ignore-rule checks =='
git check-ignore -v \
packrat/lib/probe \
packrat/lib-R/probe \
packrat/lib-ext/probe || true
printf '%s\n' '== Failed check job metadata =='
gh api repos/ContextualWisdomLab/aFIPC/actions/jobs/94717880517 \
--jq '{name,conclusion,status,started_at,completed_at,html_url,steps:[.steps[]|{name,conclusion,number}]}'
printf '%s\n' '== Failed check job log =='
gh api -H 'Accept: application/vnd.github+json' \
repos/ContextualWisdomLab/aFIPC/actions/jobs/94717880517/logs > /tmp/pr160-check-logs.zip
python3 - <<'PY'
from pathlib import Path
import zipfile
p = Path("/tmp/pr160-check-logs.zip")
print(f"log_bytes={p.stat().st_size}")
with zipfile.ZipFile(p) as z:
for name in z.namelist():
print(f"--- {name}")
data = z.read(name).decode("utf-8", errors="replace")
print(data[-12000:])
PY
printf '%s\n' '== Unresolved review-thread summary =='
gh api graphql -F owner='ContextualWisdomLab' -F name='aFIPC' -F number=160 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved isOutdated path line
comments(first: 10) { nodes { author { login } body url } }
}
}
}
}
}' --jq '[
.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated,path,line,comments:[.comments.nodes[] | {author:.author.login,body,url}]}
] | {count:length,threads:.}'Length of output: 8026 🏁 Script executed: #!/bin/bash
set -u
run_id='31784690425'
printf '%s\n' '== Failed run identity =='
gh api "repos/ContextualWisdomLab/aFIPC/actions/runs/${run_id}" \
--jq '{id,head_sha,event,status,conclusion,created_at,updated_at,html_url,name,display_title}'
printf '%s\n' '== Failed dependency-setup lines =='
gh run view "$run_id" --repo ContextualWisdomLab/aFIPC \
--log-failed --allow-escape-sequences 2>&1 |
python3 -c '
import re, sys
text = sys.stdin.read()
text = re.sub(r"\x1b\[[0-?]*[ -/]*[`@-`~]", "", text)
print(text)
' | tail -n 500
printf '%s\n' '== R workflow dependency setup definition =='
sed -n '1,140p' .github/workflows/r.ymlLength of output: 3211
I cannot issue a passing current-head verdict.
The live head adds the Packrat source-only boundary check. The check confirms the required Packrat files exist and fails if Git tracks generated library trees. The live tree has no tracked files below The workflow inventory has no Blocking gate: The live-head You are interacting with an AI system. |
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
678b6f77dc06c345301468c43f3d9cd9dc07da90. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31784690425/job/94717880517)
- check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31784690425/job/94717880517)
Changed-File Evidence Map
flowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
678b6f77dc06c345301468c43f3d9cd9dc07da90. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31784690425/job/94717880517)
- check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31784690425/job/94717880517)
Changed-File Evidence Map
flowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Summary
packrat/libinstallation tree (1,851 tracked files, about 58 MB), including 11 Linux.so/.debbuild artifacts reported by Scorecard SARIF.packrat.lock,packrat/init.R, andpackrat/srcso the legacy opt-in environment remains reproducible; ignore restoredpackrat/lib,packrat/lib-R, andpackrat/lib-exttrees.pip install yamllintandnpm install -g markdownlint-cli2workflow commands with full-SHA-pinned actions, addressing ScorecardPinnedDependenciesIDalerts chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 #14 and chore(deps): bump step-security/harden-runner from 2.14.2 to 2.15.1 #15.Validation
R_PROFILE_USER=/dev/null Rscript -e 'testthat::test_local(reporter="summary")'R CMD buildsucceededR CMD check --no-manual --as-cran: 0 errors, 0 warnings, 3 pre-existing NOTEsyamllint,markdownlint-cli2, andactionlintsucceededvuln,secret,misconfig, Medium+) found no issues; OSV reported no supported package source for this legacy R lock formatpip/npm installworkflow command inventory is emptyRisk and Rollback
ee92fdd; the ignored installed tree can also be regenerated through the existing opt-in Packrat bootstrap.Behavioral Impact
R/aFIPC.RunchangedChecklist
README.md,ARCHITECTURE.md,CONTRIBUTING.md) as needed