repair(ci): format consolidated supply-chain policy test - #1176
repair(ci): format consolidated supply-chain policy test#1176seonghobae wants to merge 7 commits into
Conversation
…ks with O(1) dictionary key deduplication in chart export
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough워크플로 권한 검증 assertion의 줄바꿈 형식을 단일 줄로 변경했습니다. 테스트 조건과 동작은 유지했습니다. ChangesSupply chain policy 테스트
Estimated code review effort: 1 (매우 낮음) | ~2분 Merge Risk: ⚪ Minimal · up to This change only reformats a supply-chain policy test assertion without changing its validation behavior, so it presents no current product or deployment risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Succession receipt: canonical #1076 is now repaired onto current protected |
Understood. Acknowledging that this work has been succeeded by a different PR and this PR will be closed unmerged. Stopping work on this task. |
seonghobae
changed the title
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected="a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd"
base="314ddeae7b775a4957594b599358c8255617eb2e"
printf '%s\n' '== Exact HEAD =='
git rev-parse HEAD
git cat-file -t "$head_expected"
git cat-file -t "$base"
printf '%s\n' '== HEAD matches requested commit =='
test "$(git rev-parse HEAD)" = "$head_expected" && echo yes || echo no
printf '%s\n' '== Base is an ancestor of requested head =='
git merge-base --is-ancestor "$base" "$head_expected" && echo yes || echo no
printf '%s\n' '== Name-status diff: protected develop -> requested head =='
git diff --name-status "$base" "$head_expected"
printf '%s\n' '== Summary diff =='
git diff --stat "$base" "$head_expected"
printf '%s\n' '== Byte identity checks =='
for path in .jules/bolt.md exports/chart.py; do
if git cat-file -e "${base}:${path}" 2>/dev/null && git cat-file -e "${head_expected}:${path}" 2>/dev/null; then
if git diff --quiet "$base" "$head_expected" -- "$path"; then
printf '%s: identical\n' "$path"
else
printf '%s: DIFFERENT\n' "$path"
fi
else
printf '%s: missing in base or head\n' "$path"
fi
done
printf '%s\n' '== Repository-control paths changed =='
git diff --name-status "$base" "$head_expected" -- \
'.github' '.github/**' '.jules' '.jules/**' \
'pyproject.toml' 'ruff.toml' '.ruff.toml' \
'package.json' 'package-lock.json' 'poetry.lock' 'uv.lock' \
'requirements*.txt' 'Pipfile' 'Pipfile.lock' \
'Dockerfile' 'docker-compose*.yml' 'Makefile' || true
printf '%s\n' '== Focused diff =='
git diff --no-ext-diff --unified=80 "$base" "$head_expected" -- \
services/analysis-engine/tests/test_supply_chain_policy.py
printf '%s\n' '== Test file outline =='
ast-grep outline services/analysis-engine/tests/test_supply_chain_policy.py --items allLength of output: 22007 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd"
base="314ddeae7b775a4957594b599358c8255617eb2e"
printf '%s\n' '== Patch whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== Word-level diff for the only modified test file =='
git diff --word-diff=porcelain --no-ext-diff "$base" "$head" -- \
services/analysis-engine/tests/test_supply_chain_policy.py
printf '%s\n' '== Tracked chart.py paths in base =='
git ls-tree -r --name-only "$base" | awk '(^|/)chart\.py$'
printf '%s\n' '== Tracked chart.py paths in requested head =='
git ls-tree -r --name-only "$head" | awk '(^|/)chart\.py$'
printf '%s\n' '== Diff for all tracked chart.py paths found in either tree =='
{
git ls-tree -r --name-only "$base"
git ls-tree -r --name-only "$head"
} | awk '(^|/)chart\.py$' | sort -u | while IFS= read -r path; do
printf '%s\n' "--- $path"
git diff --name-status "$base" "$head" -- "$path"
done
printf '%s\n' '== Changed paths outside the permitted test file =='
git diff --name-only "$base" "$head" | \
awk '$0 != "services/analysis-engine/tests/test_supply_chain_policy.py" { print }'Length of output: 2542 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd"
base="314ddeae7b775a4957594b599358c8255617eb2e"
base_paths="$(git ls-tree -r --name-only "$base" | grep -E '(^|/)chart\.py$' || true)"
head_paths="$(git ls-tree -r --name-only "$head" | grep -E '(^|/)chart\.py$' || true)"
printf '%s\n' '== Tracked chart.py paths in base =='
printf '%s\n' "${base_paths:-<none>}"
printf '%s\n' '== Tracked chart.py paths in requested head =='
printf '%s\n' "${head_paths:-<none>}"
printf '%s\n' '== Diff for all tracked chart.py paths =='
printf '%s\n%s\n' "$base_paths" "$head_paths" | sed '/^$/d' | sort -u | while IFS= read -r path; do
printf '%s' "$path: "
if git diff --quiet "$base" "$head" -- "$path"; then
echo identical
else
echo DIFFERENT
git diff --name-status "$base" "$head" -- "$path"
fi
done
printf '%s\n' '== Exact requested exports/chart.py object status =='
for revision in "$base" "$head"; do
if git cat-file -e "${revision}:exports/chart.py" 2>/dev/null; then
echo "${revision}: present"
else
echo "${revision}: absent"
fi
doneLength of output: 1719
I verified exact head
This review uses current-head evidence only.
|
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head="340b0a343ecfc05f630c7da729b8af40c7da4a2c"
predecessor="a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd"
base="314ddeae7b775a4957594b599358c8255617eb2e"
test_path="services/analysis-engine/tests/test_supply_chain_policy.py"
printf '%s\n' '== Requested commit identity =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested head object: '; git cat-file -t "$head"
printf 'predecessor object: '; git cat-file -t "$predecessor"
printf 'base object: '; git cat-file -t "$base"
printf 'HEAD matches requested: '
test "$(git rev-parse HEAD)" = "$head" && echo yes || echo no
printf '%s\n' '== Empty retry commit verification =='
printf 'head tree: '; git rev-parse "${head}^{tree}"
printf 'predecessor tree: '; git rev-parse "${predecessor}^{tree}"
printf 'trees identical: '
test "$(git rev-parse "${head}^{tree}")" = "$(git rev-parse "${predecessor}^{tree}")" && echo yes || echo no
printf '%s\n' 'commit-level patch predecessor -> head:'
git diff-tree --no-commit-id --name-status -r "$predecessor" "$head"
printf '%s\n' '== Ancestry =='
printf 'base ancestor of head: '
git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf 'predecessor ancestor of head: '
git merge-base --is-ancestor "$predecessor" "$head" && echo yes || echo no
printf '%s\n' '== Changed paths base -> head =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Paths outside permitted test file =='
git diff --name-only "$base" "$head" | awk -v permitted="$test_path" '$0 != permitted {print}' || true
printf '%s\n' '== Focused semantic diff =='
git diff --no-ext-diff --unified=30 "$base" "$head" -- "$test_path"
printf '%s\n' '== Word diff =='
git diff --no-ext-diff --word-diff=porcelain "$base" "$head" -- "$test_path"
printf '%s\n' '== Whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== Prohibited path identity =='
for path in \
.jules/bolt.md \
exports/chart.py \
services/analysis-engine/src/bandscope_analysis/exports/chart.py; do
printf '%s: ' "$path"
if git cat-file -e "${base}:${path}" 2>/dev/null && git cat-file -e "${head}:${path}" 2>/dev/null; then
git diff --quiet "$base" "$head" -- "$path" && echo identical || echo DIFFERENT
else
echo missing-in-base-or-head
fi
done
printf '%s\n' '== Repository-control changes =='
git diff --name-status "$base" "$head" -- \
'.github' '.github/**' '.jules' '.jules/**' \
'pyproject.toml' 'ruff.toml' '.ruff.toml' \
'package.json' 'package-lock.json' 'poetry.lock' 'uv.lock' \
'requirements*.txt' 'Pipfile' 'Pipfile.lock' \
'Dockerfile' 'docker-compose*.yml' 'Makefile' || true
printf '%s\n' '== Test file structure =='
ast-grep outline "$test_path" --items allLength of output: 20282
I reviewed exact head
This review uses current-head evidence only. You are interacting with an AI system. |
seonghobae
added
bug
ChatGPT Codex Connector
|
@coderabbitai review exact |
|
@opencode-agent please perform an independent last-push review of exact |
|
Descendant inventory handoff: Dependabot #1191 now adopts this exact canonical Ruff prerequisite through ordinary merge descendant |
Acknowledged. I confirm this PR (#1176) is maintained as the single-writer canonical prerequisite, and that the dependent Dependabot PR (#1191) successfully inherited the formatting repair via standard merge ancestry without duplicating the work. |
|
@coderabbitai review Please review only the unchanged exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head="8fe6b6d99c009527ef0bcba419e6f6debdb23c23"
base="314ddeae7b775a4957594b599358c8255617eb2e"
test_path="services/analysis-engine/tests/test_supply_chain_policy.py"
printf '%s\n' '== Commit identity and ancestry =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested object type: '; git cat-file -t "$head"
printf 'HEAD matches requested: '
test "$(git rev-parse HEAD)" = "$head" && echo yes || echo no
printf 'base is an ancestor of requested head: '
git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf '%s\n' '== Effective changed paths: base -> head =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Paths outside permitted test file =='
git diff --name-only "$base" "$head" | awk -v permitted="$test_path" '$0 != permitted { print }'
printf '%s\n' '== Focused diff =='
git diff --no-ext-diff --unified=80 "$base" "$head" -- "$test_path"
printf '%s\n' '== Focused word diff =='
git diff --no-ext-diff --word-diff=porcelain "$base" "$head" -- "$test_path"
printf '%s\n' '== Whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== Protected path identity =='
for path in \
.jules/bolt.md \
exports/chart.py \
services/analysis-engine/src/bandscope_analysis/exports/chart.py; do
printf '%s: ' "$path"
if git cat-file -e "${base}:${path}" 2>/dev/null && git cat-file -e "${head}:${path}" 2>/dev/null; then
git diff --quiet "$base" "$head" -- "$path" && echo identical || echo DIFFERENT
else
echo missing-in-base-or-head
fi
done
printf '%s\n' '== Workflow, policy, and dependency changes =='
git diff --name-status "$base" "$head" -- \
'.github' '.github/**' '.jules' '.jules/**' \
'pyproject.toml' 'ruff.toml' '.ruff.toml' \
'package.json' 'package-lock.json' 'poetry.lock' 'uv.lock' \
'requirements*.txt' 'Pipfile' 'Pipfile.lock' \
'Dockerfile' 'docker-compose*.yml' 'Makefile' || true
printf '%s\n' '== Test file structure =='
ast-grep outline "$test_path" --items allLength of output: 23095
I found no source-level supply-chain or product regression. I did not treat the CodeQL control-plane failure as a BandScope source finding. You are interacting with an AI system. |
|
@coderabbitai approve Please approve only if the unchanged exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head="8fe6b6d99c009527ef0bcba419e6f6debdb23c23"
base="314ddeae7b775a4957594b599358c8255617eb2e"
test_path="services/analysis-engine/tests/test_supply_chain_policy.py"
printf '%s\n' '== Exact head =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested object: '; git cat-file -t "$head"
printf 'HEAD matches requested: '
test "$(git rev-parse HEAD)" = "$head" && echo yes || echo no
printf 'base ancestor of head: '
git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf '%s\n' '== Effective changed paths =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Paths outside allowed file =='
git diff --name-only "$base" "$head" | awk -v path="$test_path" '$0 != path { print }'
printf '%s\n' '== Exact test diff =='
git diff --no-ext-diff --unified=40 "$base" "$head" -- "$test_path"
printf '%s\n' '== Word diff =='
git diff --no-ext-diff --word-diff=porcelain "$base" "$head" -- "$test_path"
printf '%s\n' '== Whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== Protected path identity =='
for path in \
.jules/bolt.md \
exports/chart.py \
services/analysis-engine/src/bandscope_analysis/exports/chart.py; do
printf '%s: ' "$path"
if git cat-file -e "${base}:${path}" 2>/dev/null && git cat-file -e "${head}:${path}" 2>/dev/null; then
git diff --quiet "$base" "$head" -- "$path" && echo identical || echo DIFFERENT
else
echo absent-in-base-or-head
fi
done
printf '%s\n' '== Control, workflow, policy, and dependency changes =='
git diff --name-status "$base" "$head" -- \
'.github' '.github/**' '.jules' '.jules/**' \
'pyproject.toml' 'ruff.toml' '.ruff.toml' \
'package.json' 'package-lock.json' 'poetry.lock' 'uv.lock' \
'requirements*.txt' 'Pipfile' 'Pipfile.lock' \
'Dockerfile' 'docker-compose*.yml' 'Makefile' || true
printf '%s\n' '== Test file structure =='
ast-grep outline "$test_path" --items allLength of output: 20007
I independently verified this exact head against
No actionable finding remains. This approval is based on the exact current head, not on predecessor approval. ✅ Action performedComments resolved. Approval is disabled; enable |
|
Fresh central-prerequisite correction for this BandScope lane: Therefore #1176 stays Draft. Its one-file Ruff delta is not the cause, and BandScope must not add local CodeQL/status bypasses or weaken required checks. Resume merge evaluation only after the central owner publishes terminal exact-head CodeQL evidence consumable by the protected required workflow. |
Acknowledged. I understand this PR will remain in Draft state, and the CodeQL issue is being handled centrally in |
|
@opencode-agent Fresh independent review request for exact head Read-only review only: do not commit, push, restack, create a successor PR, weaken gates, or manufacture a new event/head. Verify that the sole live delta in If clean, submit a formal GitHub review with |
|
New downstream RED acceptance evidence (2026-09-12): zero-diff #1212 at exact This is independent confirmation that #1176 remains the canonical one-file causal owner. #1212 has no live diff and will not copy the formatter change. Existing #1176 exact-head checks/reviews are not promoted or refreshed by this evidence; normal current-head merge gates remain in force. |
Acknowledged. I confirm this PR (#1176) continues to be the canonical owner of the |
|
@opencode-agent review 현재 Ready exact head |
|
@opencode-agent review Review only exact head |
|
@coderabbitai approve Please evaluate the unchanged exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head="8fe6b6d99c009527ef0bcba419e6f6debdb23c23"
base="314ddeae7b775a4957594b599358c8255617eb2e"
test_path="services/analysis-engine/tests/test_supply_chain_policy.py"
printf '%s\n' '== Commit identity and ancestry =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested object: '; git cat-file -t "$head"
printf 'HEAD matches requested: '
test "$(git rev-parse HEAD)" = "$head" && echo yes || echo no
printf 'base is ancestor of requested head: '
git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf '%s\n' '== Effective changed paths =='
git diff --name-status "$base" "$head"
printf '%s\n' '== Paths outside permitted test path =='
git diff --name-only "$base" "$head" | awk -v permitted="$test_path" '$0 != permitted { print }'
printf '%s\n' '== Focused diff =='
git diff --no-ext-diff --unified=60 "$base" "$head" -- "$test_path"
printf '%s\n' '== Word diff =='
git diff --no-ext-diff --word-diff=porcelain "$base" "$head" -- "$test_path"
printf '%s\n' '== Whitespace validation =='
git diff --check "$base" "$head"
printf '%s\n' '== Protected path identity =='
for path in \
.jules/bolt.md \
exports/chart.py \
services/analysis-engine/src/bandscope_analysis/exports/chart.py; do
printf '%s: ' "$path"
if git cat-file -e "${base}:${path}" 2>/dev/null && git cat-file -e "${head}:${path}" 2>/dev/null; then
git diff --quiet "$base" "$head" -- "$path" && echo identical || echo DIFFERENT
else
echo absent-in-base-or-head
fi
done
printf '%s\n' '== Workflow, policy, and dependency changes =='
git diff --name-status "$base" "$head" -- \
'.github' '.github/**' '.jules' '.jules/**' \
'pyproject.toml' 'ruff.toml' '.ruff.toml' \
'package.json' 'package-lock.json' 'poetry.lock' 'uv.lock' \
'requirements*.txt' 'Pipfile' 'Pipfile.lock' \
'Dockerfile' 'docker-compose*.yml' 'Makefile' || true
printf '%s\n' '== Relevant test structure =='
ast-grep outline "$test_path" --items allLength of output: 21438
I verified the exact current head against
No actionable current-head finding remains. This approval does not use predecessor-head evidence. ✅ Action performedComments resolved. Approval is disabled; enable |
1 participant
Repair finding
Protected
develop@314ddeae7b775a4957594b599358c8255617eb2econtains a Ruff-formatting defect introduced with the #1165 repository-workflow consolidation. The protected-base blobservices/analysis-engine/tests/test_supply_chain_policy.py@1d8224c5a5c8d45d4238b72fb4774275e41ab207is inherited by multiple downstream lanes, so duplicating the fix into product or documentation branches would violate single-writer ownership.Recovered valid delta
This PR had previously mixed chart-export work that is owned elsewhere. Ordinary descendants restored
.jules/bolt.mdandservices/analysis-engine/src/bandscope_analysis/exports/chart.pybyte-for-byte to protecteddevelop. The only live diff is the repository-pinned Ruff formatting change inservices/analysis-engine/tests/test_supply_chain_policy.py: one semantically equivalent assertion is collapsed to formatter output.Current exact head is unchanged
8fe6b6d99c009527ef0bcba419e6f6debdb23c23. No workflow, product behavior, dependency, audio/MIR, filesystem, model, release, gate, or assertion semantics change. Do not add a no-op descendant.Why this is now Ready
A fresh downstream #1116 quickcheck reproduced this protected-base defect after its own documentation RED was repaired: docs verification and Rust/Tauri checks passed, then
ruff format --checkstopped only on this exact file. Rather than copy the formatter delta, #1116 has now been explicitly stacked on this exact PR and retargeted to this branch; #968 ordinarily adopted #1116 afterward. That gives this one-file foundation repair an active downstream acceptance path.The unchanged head already has historical terminal-success
ci, build-baseline, SBOM, Security Scan, SAST and OpenCode evidence. Converting to Ready is not an approval or merge claim: it is intended to let the repository's current Ready-state review/security automation evaluate the unchanged exact head under the live protection contract without manufacturing a new commit.Security / CodeQL authority
The old
runner_id=0diagnosis is obsolete. Historical CodeQL compatibility jobs received hosted runners and failed later in exact-verdict settlement. GHAS Trivy/Scorecard PR-comparison neutrals are separately owned by #1209.Protected
developstill requires GitHub-managed dynamicAnalyze (javascript-typescript)/Analyze (python)contexts. The separate central compatibility producer/handler contract is owned byContextualWisdomLab/.github#2040; that lane has advanced ordinarily beyond the old3b2de64c...state and is still resolving staged protected-handler/run-wide settlement rollout. Do not synthesize statuses, restore a duplicate local CodeQL scanner, or create a no-op descendant merely to manufacture events.Ownership and stack
This PR is the bounded successor repair for #1165 formatting debt only. Current #1116 baseline is an explicit child stack on this head, not an independent formatter writer. Current #968 is stacked on #1116 and its fresh compare excludes this formatter file. #970 remains Project Persistence owner; #866 remains Resource Admission owner; #1055 remains temporal privacy owner. #1211 stays preservation and must not become a second formatter owner.
Product owners #970/#866/#1055 still consume this repair only after normal protected integration/reconciliation; the #1116/#968 documentation-governance stack is explicitly based on this prerequisite so its own CI can verify the corrected foundation without copying the delta.
Merge gate
This PR is Ready, not merged. Normal integration still requires every applicable live protected/central required gate on unchanged exact
8fe6b6d..., zero valid unresolved findings, and a qualifying independent non-author last-push approval. If any fresh Ready-state check fails, repair the causal owner rather than weakening the gate. No self-approval, bypass, force-push, destructive rebase, unrelated chart restoration, synthetic status, or no-op event gaming.