test: prove pg-erd OCI least-privilege runtime - #19
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughpg-erd OCI 검증이 Changespg-erd OCI 수락 검증
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The OCI acceptance now verifies pg-erd health and Prometheus listener identity without changing production runtime behavior. No concrete merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
added
maintenance
type: maintenance
priority: high
labels
ChatGPT Codex Connector
|
@coderabbitai review Please review exact current range |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='e78f362b79a746b84c35dd68409b94d27070421d'
echo '== Exact range verification =='
git merge-base "$base" "$head"
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
echo '== Full exact diff =='
git diff --find-renames --find-copies --no-ext-diff "$base" "$head" --
echo '== Workflow outline and OCI-related context =='
ast-grep outline .github/workflows/ci.yml --items all || true
rg -n -i -C 12 \
'oci-runtime|pg-erd|cwl-pingora-pg-erd-migration|CWL_GATEWAY_BIN|livez|metrics|read-only|read_only|cap-drop|no-new-privileges|65532|docker run|podman run' \
.github/workflows/ci.yml
echo '== Packaging and pg-erd implementation references =='
rg -n -i -C 6 \
'CWL_GATEWAY_BIN|cwl-pingora-pg-erd-migration|pg-erd-migration|ENTRYPOINT|USER[[:space:]]+65532|65532' \
-g 'Dockerfile*' -g '*.yml' -g '*.yaml' -g '*.toml' -g '*.rs' .
echo '== Changed documentation with line numbers =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- $file ----"
cat -n "$file"
done
echo '== Potential overclaims in changed documentation =='
rg -n -i -C 3 \
'green|hosted|release|canary|cutover|parity|approved|production|complete|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery' \
CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md || trueLength of output: 142963 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='e78f362b79a746b84c35dd68409b94d27070421d'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Dockerfile =='
cat -n Dockerfile
echo '== pg-erd OCI fixture =='
cat -n examples/pg-erd-migration.yaml
echo '== Full OCI workflow job =='
sed -n '168,270p' .github/workflows/ci.yml
echo '== Metrics listener implementation and endpoint routing =='
rg -n -C 8 --type rust \
'metrics_listener|/metrics|metrics.*listener|listener.*metrics|serve_metrics|Metrics' \
src tests
echo '== Exact PR metadata and current check state =='
gh pr view 19 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeCommit,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeCommit,statusCheckRollup: [.statusCheckRollup[] | {name,conclusion,status,detailsUrl}]}'
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 30 \
--json databaseId,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt \
--jq '.[] | {databaseId,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt}'
echo '== Exact-head jobs and steps =='
for run in 34101515128 34101515141; do
echo "---- run $run ----"
gh run view "$run" --repo "$repo" --json status,conclusion,jobs \
--jq '{status,conclusion,jobs: [.jobs[] | {databaseId,name,status,conclusion,steps: [.steps[] | {name,status,conclusion,number}]}]}'
doneLength of output: 80331
I found no correctness issues in this range.
The exact-head CI and Supply Chain runs are still queued with no executed steps. They are incomplete evidence. Keep the PR Draft until the required exact-head checks reach terminal states and the required governance review completes.
|
|
@coderabbitai review Retry the exact |
|
|
|
@coderabbitai review Final exact-head review after the formatting-only EOF repair: |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='86087dc456496d6b083abf521220c2c14ebfbf69'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact range identity =='
printf 'merge-base: '
git merge-base "$base" "$head"
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact four-file patch =='
git diff --no-ext-diff --find-renames --find-copies "$base" "$head" -- \
.github/workflows/ci.yml \
CHANGELOG.md \
TEST_STRATEGY.md \
docs/product-technical-gap-baseline.md
echo '== Workflow structure =='
ast-grep outline .github/workflows/ci.yml --items all || true
echo '== OCI workflow and packaging references =='
rg -n -i -C 18 \
'oci-runtime|pg-erd|CWL_GATEWAY_BIN|cwl-pingora-pg-erd-migration|docker run|--user|65532|--read-only|cap-drop|no-new-privileges|pg-erd-migration.yaml|livez|metrics|publish|port' \
.github/workflows/ci.yml
echo '== Dockerfile and pg-erd fixture =='
fd -a '^Dockerfile.*$|^pg-erd-migration\.yaml$' . -t f -x sh -c '
for file do
echo "---- $file ----"
cat -n "$file"
done
' sh {} +
echo '== Documentation claims and final newline check =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- $file ----"
tail -c 1 "$file" | od -An -t x1
rg -n -i -C 3 \
'pg-erd|OCI|metrics|livez|GREEN|hosted|release|canary|cutover|approved|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery|complete' \
"$file" || true
done
echo '== PR and exact-head checks =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url,createdAt,updatedAt \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url,createdAt,updatedAt}'Length of output: 44019 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='86087dc456496d6b083abf521220c2c14ebfbf69'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact-head documentation final bytes =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
printf '%s: ' "$file"
git show "${head}:${file}" | tail -c 1 | od -An -t x1
done
echo '== Exact-head documentation content and restricted claims =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- ${file} ----"
git show "${head}:${file}" | rg -n -i -C 3 \
'pg-erd|OCI|metrics|livez|GREEN|hosted|release|canary|cutover|approved|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery|terminal|exact.head' || true
done
echo '== Exact line-ending / whitespace validation =='
git diff --check "$base" "$head"
git show "${head}:docs/product-technical-gap-baseline.md" | tail -n 16 | cat -n
echo '== PR and exact-head workflow state =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url,createdAt,updatedAt \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url,createdAt,updatedAt}'Length of output: 1853 🏁 Script executed: #!/bin/bash
set -u
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='86087dc456496d6b083abf521220c2c14ebfbf69'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Utility availability =='
command -v xxd || true
command -v hexdump || true
command -v git || true
command -v gh || true
echo '== Exact-head final-byte checks =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
printf '%s: ' "$file"
if command -v xxd >/dev/null 2>&1; then
git show "${head}:${file}" | tail -c 1 | xxd -p
elif command -v hexdump >/dev/null 2>&1; then
git show "${head}:${file}" | tail -c 1 | hexdump -v -e '1/1 "%02x\n"'
else
echo 'no byte-dump utility available'
fi
done
echo '== Git whitespace validation =='
git diff --check "$base" "$head" || true
echo '== Exact documentation tail =='
git show "${head}:docs/product-technical-gap-baseline.md" | tail -n 18 | cat -n
echo '== Exact-head PR checks =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || true
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url,createdAt,updatedAt \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url,createdAt,updatedAt}' || trueLength of output: 12788
I found one issue.
The OCI implementation preserves the requested boundary.
The exact-head CI and Supply Chain runs are queued. They remain incomplete evidence. You are interacting with an AI system. |
|
@coderabbitai review Please review the exact current range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='86087dc456496d6b083abf521220c2c14ebfbf69'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact range =='
printf 'merge-base: '
git merge-base "$base" "$head"
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact patch: workflow =='
git diff --no-ext-diff "$base" "$head" -- .github/workflows/ci.yml
echo '== Exact patch: documentation =='
git diff --no-ext-diff "$base" "$head" -- \
CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md
echo '== Changed workflow OCI context at exact head =='
git show "${head}:.github/workflows/ci.yml" |
rg -n -i -C 20 \
'oci-runtime|pg-erd|CWL_GATEWAY_BIN|cwl-pingora-pg-erd-migration|docker run|--user|65532|--read-only|cap-drop|no-new-privileges|pg-erd-migration.yaml|livez|metrics|publish|curl'
echo '== Supporting packaging and pg-erd fixture at exact head =='
for file in Dockerfile examples/pg-erd-migration.yaml; do
echo "---- ${file} ----"
git show "${head}:${file}" | cat -n
done
echo '== Documentation final byte and relevant claims at exact head =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- ${file}: final byte ----"
git show "${head}:${file}" | tail -c 1 | od -An -t x1
echo "---- ${file}: scope claims ----"
git show "${head}:${file}" |
rg -n -i -C 4 \
'pg-erd|OCI|metrics|livez|hosted|GREEN|release|canary|cutover|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery|traffic'
done
echo '== Exact-head PR and runs =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}'
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url}'Length of output: 43024 🏁 Script executed: #!/bin/bash
set -u
head='86087dc456496d6b083abf521220c2c14ebfbf69'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact-head documentation final bytes =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
printf '%s: ' "$file"
git show "${head}:${file}" | tail -c 1 | base64 || true
done
echo '== Exact-head documentation scope excerpts =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- ${file} ----"
git show "${head}:${file}" | \
rg -n -i -C 5 \
'pg-erd|OCI|metrics|livez|hosted|GREEN|release|canary|cutover|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery|exact.head|terminal' || true
done
echo '== Exact whitespace check =='
git diff --check \
d6e61e59bfdca47dd2e9542001938b5c33674314 \
"$head" || true
echo '== Pull request and exact-head workflow state =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || true
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url}' || trueLength of output: 49497
I found one issue.
The requested OCI boundary is preserved.
The exact-head CI and Supply Chain runs are queued. They are incomplete evidence. Keep the PR Draft until the required exact-head checks and governance review reach terminal states. You are interacting with an AI system. |
|
@coderabbitai review Please review exact current range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='e0ab23d43d3ef4ae77aaf8475154084d72ff4a95'
red='b0183680d6a9e3ff9531db0b833e80ad2742fcc3'
green='651793716e6f96735fca3f9ea313b3561fcc642e'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact range identity and changed paths =='
printf 'merge-base: '; git merge-base "$base" "$head"
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
echo '== Exact patch =='
git diff --no-ext-diff --find-renames --find-copies "$base" "$head" --
echo '== TDD commit identity and patches =='
for commit in "$red" "$green"; do
echo "---- $commit ----"
git show -s --format='%H%n%P%n%s' "$commit"
git show --format=fuller --no-ext-diff --find-renames --find-copies "$commit" -- \
tests/pg_erd_oci_metrics_workflow_contract.rs .github/workflows/ci.yml
done
echo '== Exact-head workflow contract test =='
if git cat-file -e "${head}:tests/pg_erd_oci_metrics_workflow_contract.rs" 2>/dev/null; then
git show "${head}:tests/pg_erd_oci_metrics_workflow_contract.rs" | cat -n
fi
echo '== Exact-head OCI workflow context =='
git show "${head}:.github/workflows/ci.yml" | nl -ba | \
rg -n -i -C 18 \
'oci-runtime|pg-erd|CWL_GATEWAY_BIN|cwl-pingora-pg-erd-migration|docker run|--user|65532|--read-only|cap-drop|no-new-privileges|pg-erd-migration\.yaml|livez|metrics|content-type|text/plain|curl|publish'
echo '== Supporting exact-head packaging and configuration =='
for file in Dockerfile examples/pg-erd-migration.yaml; do
echo "---- $file ----"
git show "${head}:${file}" | cat -n
done
echo '== Exact-head documentation claims =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- $file ----"
git show "${head}:${file}" | nl -ba | \
rg -n -i -C 4 \
'pg-erd|OCI|metrics|livez|text/plain|metric.family|metric family|routing|auth|business|hosted|GREEN|release|canary|cutover|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery|traffic' || true
done
echo '== Exact-head pull request and workflow state =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || true
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url}' || trueLength of output: 40158 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='d6e61e59bfdca47dd2e9542001938b5c33674314'
head='e0ab23d43d3ef4ae77aaf8475154084d72ff4a95'
repo='ContextualWisdomLab/pingora-gateway'
echo '== OCI workflow step at exact head =='
git show "${head}:.github/workflows/ci.yml" | \
sed -n '/Exercise pg-erd read-only least-privilege runtime:/,/^[[:space:]]*-[[:space:]]name:/p'
echo '== Workflow occurrences that can satisfy the contract literal =='
git show "${head}:.github/workflows/ci.yml" | \
grep -nE -C 2 'content-type|content_type|text/plain|6288|6289|--user|--read-only|cap-drop|no-new-privileges|pg-erd-migration\.yaml|CWL_GATEWAY_BIN' || true
echo '== Test target registration and execution =='
for file in Cargo.toml .github/workflows/ci.yml; do
echo "---- $file ----"
git show "${head}:${file}" | \
grep -nE -C 3 'pg_erd_oci_metrics_workflow_contract|cargo test|test --|tests/' || true
done
echo '== Exact test assertion versus extracted workflow literals =='
test_file="$(git show "${head}:tests/pg_erd_oci_metrics_workflow_contract.rs")"
workflow="$(git show "${head}:.github/workflows/ci.yml")"
printf 'test uses script.contains("content-type"): '
printf '%s\n' "$test_file" | grep -Fq 'script.contains("content-type")' && echo yes || echo no
printf 'workflow contains literal content-type: '
printf '%s\n' "$workflow" | grep -Fq 'content-type' && echo yes || echo no
printf 'workflow contains literal content_type: '
printf '%s\n' "$workflow" | grep -Fq 'content_type' && echo yes || echo no
printf 'workflow contains literal text/plain: '
printf '%s\n' "$workflow" | grep -Fq 'text/plain' && echo yes || echo no
echo '== Documentation restricted-claim excerpts =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- $file ----"
git show "${head}:${file}" | \
grep -nEi -C 3 'pg-erd|metrics|text/plain|metric family|hosted|GREEN|release|canary|cutover|routing|auth|business|authority' || true
done
echo '== Exact-head pull request and runs =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || true
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url}' || trueLength of output: 54269
I found one issue.
The OCI workflow itself preserves the requested runtime boundary. It builds the pg-erd image with The acceptance loop requires both
The exact-head CI and Supply Chain runs are queued. They remain incomplete evidence. You are interacting with an AI system. |
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='9749d01ae0e9aae027d7fce1a2c15e6a8358acd9'
head='ef4acdffb08709eb47677cf3dd5b53b6902e1262'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact range identity =='
printf 'merge-base: '
git merge-base "$base" "$head"
echo 'Changed paths:'
git diff --name-status "$base" "$head"
echo 'Whitespace errors:'
git diff --check "$base" "$head"
echo 'Diff stat:'
git diff --stat "$base" "$head"
echo '== Exact patch =='
git diff --no-ext-diff --find-renames --find-copies "$base" "$head" --
echo '== Contract-test and OCI workflow structure =='
if git cat-file -e "${head}:tests/pg_erd_oci_metrics_workflow_contract.rs" 2>/dev/null; then
ast-grep outline tests/pg_erd_oci_metrics_workflow_contract.rs --items all
echo '---- tests/pg_erd_oci_metrics_workflow_contract.rs ----'
git show "${head}:tests/pg_erd_oci_metrics_workflow_contract.rs" | nl -ba
fi
echo '---- .github/workflows/ci.yml OCI context ----'
git show "${head}:.github/workflows/ci.yml" | nl -ba | rg -n -i -C 22 \
'oci-runtime|pg-erd|CWL_GATEWAY_BIN|cwl-pingora-pg-erd-migration|docker run|--user|65532|--read-only|cap-drop|no-new-privileges|pg-erd-migration\.yaml|livez|metrics|content_type|text/plain|curl|publish'
echo '== Supporting exact-head packaging and listener configuration =='
for file in Dockerfile examples/pg-erd-migration.yaml Cargo.toml; do
if git cat-file -e "${head}:${file}" 2>/dev/null; then
echo "---- ${file} ----"
git show "${head}:${file}" | nl -ba | rg -n -C 8 \
'CWL_GATEWAY_BIN|cwl-pingora-gateway|cwl-pingora-pg-erd-migration|ENTRYPOINT|USER|traffic|metrics|6188|6189|pg_erd_oci_metrics_workflow_contract|test' \
|| true
fi
done
echo '== Documentation claims in changed files =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
if git cat-file -e "${head}:${file}" 2>/dev/null; then
echo "---- ${file} ----"
git show "${head}:${file}" | nl -ba | rg -n -i -C 5 \
'pg-erd|OCI|metrics|livez|text/plain|metric.family|metric family|hosted|GREEN|release|canary|cutover|routing|auth|business|authority|Keyverse|Wardnet|EgressWeave|TLS|service discovery|traffic' \
|| true
fi
done
echo '== Pull request and exact-head checks =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' \
|| true
gh run list --repo "$repo" --commit "$head" --limit 30 \
--json databaseId,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt \
--jq '.[] | {databaseId,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt}' \
|| trueLength of output: 29244 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ef4acdffb08709eb47677cf3dd5b53b6902e1262'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Full pg-erd OCI workflow step =='
git show "${head}:.github/workflows/ci.yml" |
sed -n '/Exercise pg-erd read-only least-privilege runtime:/,/^[[:space:]]*-[[:space:]]name:/p'
echo '== Generic OCI workflow step =='
git show "${head}:.github/workflows/ci.yml" |
sed -n '/Exercise generic gateway read-only least-privilege runtime:/,/^[[:space:]]*-[[:space:]]name:/p' || true
echo '== Exact-head Dockerfile =='
git show "${head}:Dockerfile" | cat -n
echo '== Exact-head pg-erd OCI fixture =='
git show "${head}:examples/pg-erd-migration.yaml" | cat -n
echo '== Contract-test registration =='
git show "${head}:Cargo.toml" |
rg -n -C 3 'pg_erd_oci_metrics_workflow_contract|test\s*=|name\s*=' || true
git show "${head}:.github/workflows/ci.yml" |
rg -n -C 3 'cargo test|all-targets|locked' || true
echo '== Exact-head documentation scope excerpts =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- ${file} ----"
git show "${head}:${file}" |
rg -n -i -C 4 \
'pg-erd|OCI|metrics|livez|text/plain|metric family|hosted|GREEN|release|canary|cutover|auth|business|routing|Keyverse|Wardnet|EgressWeave|authority' \
|| true
done
echo '== Exact-head PR metadata and checks =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,baseRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' \
|| true
echo '== Exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 30 \
--json databaseId,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt \
--jq '.[] | {databaseId,workflowName,status,conclusion,event,headSha,url,createdAt,updatedAt}' \
|| trueLength of output: 49301
I found no correctness issues. The exact merge base is the stated parent. I did not use predecessor review or hosted evidence. The effective delta has five paths: the four workflow/documentation paths and the added The one-binary-per-image boundary remains intact.
The pg-erd OCI acceptance preserves the required runtime boundary.
The changed documentation describes the source acceptance accurately. It does not claim The exact-head CI and Supply Chain runs are still queued or in progress. They are not terminal evidence. Keep the PR as Draft until exact-head checks and required governance review complete.
|
|
@coderabbitai review Please review the current exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='9749d01ae0e9aae027d7fce1a2c15e6a8358acd9'
head='86a6eb1b8fd5777b578cdbce49f40d52e916cc9b'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Exact range identity =='
printf 'merge-base: '
git merge-base "$base" "$head"
echo 'head parents:'
git show -s --format='%H%n%P%n%s' "$head"
echo 'changed paths:'
git diff --name-status "$base" "$head"
echo 'whitespace:'
git diff --check "$base" "$head"
echo 'stat:'
git diff --stat "$base" "$head"
echo '== Exact patch for reviewed paths =='
git diff --no-ext-diff --find-renames --find-copies "$base" "$head" -- \
.github/workflows/ci.yml \
tests/pg_erd_oci_metrics_workflow_contract.rs \
docs/doctoring/TRACEABILITY.md \
CHANGELOG.md \
TEST_STRATEGY.md \
docs/product-technical-gap-baseline.md
echo '== Exact-head OCI workflow step and adjacent test invocation =='
git show "${head}:.github/workflows/ci.yml" | nl -ba | \
rg -n -i -C 28 \
'Exercise pg-erd|CWL_GATEWAY_BIN|pg-erd-migration|docker run|--user|65532|--read-only|cap-drop|no-new-privileges|pg-erd-migration\.yaml|6288|6289|livez|metrics|content.type|content_type|text/plain|cargo test|all-targets'
echo '== Exact-head regression test =='
git show "${head}:tests/pg_erd_oci_metrics_workflow_contract.rs" | nl -ba
echo '== Exact-head packaging and fixture contract =='
for file in Dockerfile examples/pg-erd-migration.yaml; do
echo "---- $file ----"
git show "${head}:${file}" | nl -ba
done
echo '== Exact-head traceability entries =='
git show "${head}:docs/doctoring/TRACEABILITY.md" | nl -ba | \
rg -n -i -C 10 \
'Pingora|pingora-prometheus|prometheus|TextEncoder|format_type|TEXT_FORMAT|09696b51|e07efb4f|text/plain|pg-erd|metrics'
echo '== Documentation scope claims =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- $file ----"
git show "${head}:${file}" | nl -ba | \
rg -n -i -C 3 \
'pg-erd|OCI|metrics|text/plain|metric.family|metric family|hosted|GREEN|release|canary|cutover|auth|business|routing|authority' || true
done
echo '== Exact-head PR and check state =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || true
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url}' || trueLength of output: 34294 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='86a6eb1b8fd5777b578cdbce49f40d52e916cc9b'
repo='ContextualWisdomLab/pingora-gateway'
echo '== Full pg-erd OCI runtime step =='
git show "${head}:.github/workflows/ci.yml" |
sed -n '/Exercise pg-erd read-only least-privilege runtime:/,/^[[:space:]]*-[[:space:]]name:/p'
echo '== Workflow test execution and image-build context =='
git show "${head}:.github/workflows/ci.yml" |
rg -n -i -C 10 \
'cargo test|all-targets|locked|CWL_GATEWAY_BIN|cwl-pingora-pg-erd-migration|docker build|docker run|--user|--read-only|cap-drop|no-new-privileges|pg-erd-migration\.yaml|6288|6289'
echo '== Dockerfile build and final-stage boundary =='
git show "${head}:Dockerfile" | cat -n
echo '== Exact pg-erd fixture =='
git show "${head}:examples/pg-erd-migration.yaml" | cat -n
echo '== Regression-test registration =='
git show "${head}:Cargo.toml" | rg -n -C 4 \
'pg_erd_oci_metrics_workflow_contract|test[[:space:]]*=|name[[:space:]]*=' || true
git show "${head}:.github/workflows/ci.yml" | rg -n -C 4 \
'cargo test[[:space:]]+--all-targets[[:space:]]+--locked' || true
echo '== Traceability record and references =='
git show "${head}:docs/doctoring/TRACEABILITY.md" |
rg -n -i -C 8 \
'Pingora.s Prometheus|pingora-prometheus|rust-prometheus|TextEncoder|format_type|TEXT_FORMAT|09696b51|e07efb4f|text/plain'
echo '== Documentation scope excerpts =='
for file in CHANGELOG.md TEST_STRATEGY.md docs/product-technical-gap-baseline.md; do
echo "---- ${file} ----"
git show "${head}:${file}" | rg -n -i -C 3 \
'pg-erd|OCI|metrics|text/plain|metric family|hosted|GREEN|release|canary|cutover|auth|business|routing|authority' || true
done
echo '== Exact-head PR and workflow state =='
gh pr view 19 --repo "$repo" \
--json state,isDraft,headRefOid,statusCheckRollup \
--jq '{state,isDraft,headRefOid,checks:[.statusCheckRollup[] | {name,status,conclusion,detailsUrl}]}' || true
gh run list --repo "$repo" --commit "$head" --limit 20 \
--json databaseId,workflowName,status,conclusion,headSha,url \
--jq '.[] | {databaseId,workflowName,status,conclusion,headSha,url}' || trueLength of output: 65940 🤖 web_search executed:
Length of output: 3320 🤖 web_search executed:
Length of output: 2830
I found no correctness issues.
The media-type gate is correct.
[[ "${metrics_content_type%%;*}" == "text/plain" ]]The test also rejects the previous
I did not use predecessor review or hosted execution evidence. PR ✅ Action performedReview finished.
|
1 participant
Valid remaining deployment-evidence gap
The historical #19 branch proved a valid requirement—pg-erd must be exercised as an actual least-privilege OCI process and its separate metrics listener must be operational—but its original package-both-binaries implementation is obsolete. Current parent ancestry already has the stronger
CWL_GATEWAY_BINboundary: one admitted process identity per image. This Draft preserves that packaging and owns only the still-valid deployment evidence.Product auth/business logic, Keyverse identity, Wardnet/EgressWeave authority, routing authority, TLS issuance, service discovery, retries and consumer traffic state remain outside this slice.
Parent-first ordinary succession
Exact parent #18 is
9749d01ae0e9aae027d7fce1a2c15e6a8358acd9, with CI34177466780and Supply Chain34177466712terminal GREEN plus an exact owner technical sweep with no actionable finding. That sweep is not independent human approval.Historical #19 exact
e861f3d69330c2fa8e32fc9262c76293840f8917remained 94 commits behind #18. Ordinary two-parent commitef4acdffb08709eb47677cf3dd5b53b6902e1262retainse861f3d...as first parent and adopts exact #18 as second parent without force-push or destructive rebase. Fresh compare from #18 to the current head remains behind=0 with merge base exactly9749d01..., and six effective child paths only:.github/workflows/ci.yml,CHANGELOG.md,TEST_STRATEGY.md,docs/doctoring/TRACEABILITY.md,docs/product-technical-gap-baseline.md, andtests/pg_erd_oci_metrics_workflow_contract.rs.The restack deliberately used the current #18 resolution tree and semantically reapplied only the valid child delta; stale workflow/docs blobs and the historical package-both-binaries approach were not overlaid.
Preserved deployment contract
The pg-erd image remains one admitted process identity, uid/gid 65532, read-only root, cap-drop ALL,
no-new-privileges, with only versioned config mounted read-only. OCI acceptance requires/livezon the traffic listener and the separately published/metricslistener to identify the Prometheus service as exacttext/plainafter stripping only optional semicolon media-type parameters. No pre-traffic metric-family assertion is invented.Review findings → minimal repairs
A fresh exact owner review of
ef4acd...found one real false-positive edge in the shell predicate:[[ "${metrics_content_type}" == text/plain* ]]would also accept invalid types such astext/plainfoo. Commit3f8c22497fe1ad018ba1e76b807fbea537a076f6strips only the optional semicolon-parameter suffix via${metrics_content_type%%;*}before requiring exacttext/plainand strengthens the workflow regression. No production Rust, runtime topology, route, port, privilege boundary, dependency or product/security authority changed.A second source/documentation sweep found that
docs/product-technical-gap-baseline.mdstill described the repaired contract astext/plain*. Documentation-only5e906a0652fbfc0da44d5929ca55212b0cccbde2aligns that canonical gap authority with the exact predicate.The same sweep found the new media-type contract lacked primary-source doctoring. Pinned Pingora
pingora-prometheus/src/lib.rs@09696b51...setsContent-Typefromprometheus::TextEncoder::format_type(), and exactprometheus0.14.0 source at TiKVrust-prometheus@e07efb4f372f1245bf7410b71e822c69877bcb32definesTEXT_FORMATastext/plain; version=0.0.4. Documentation-onlybe78ab964b497f78d51ec04baaafecff1a5d8f3arecords both primary sources and APA-style references indocs/doctoring/TRACEABILITY.md.The final test-oracle sweep found the regression still proved the repaired shell semantics only as disconnected substrings. Test-only
86a6eb1b8fd5777b578cdbce49f40d52e916cc9bnow requires the actual equality predicate[[ "${metrics_content_type%%;*}" == "text/plain" ]]and explicitly rejects the old== text/plain*wildcard form. This changes no workflow or production behavior; it makes the test fail closed against a future reintroduction of the false-positive predicate.A fresh exact owner technical sweep of the current six effective child paths found no further actionable source/documentation defect or review thread. No formal submitted review currently exists on this PR, so this is technical evidence only, not self-approval or independent human
APPROVEDreview.Exact-head hosted closure
Current exact head is
86a6eb1b8fd5777b578cdbce49f40d52e916cc9band has independently reacquired terminal hosted GREEN without predecessor transfer.34180261244:test 101917791952,load-contract 101917792069, andoci-runtime 101917792102all completed success. The test job passed exact checkout, Rust 1.98.0 formatting, compile/test, strict lint, warning-denied public rustdoc, complete owned-production coverage enforcement, and resolved dependency-lock verification. OCI built both admitted profiles and exercised both under declared non-root/read-only least-privilege constraints.34180261252completed success on the same exact SHA.#19 is therefore stable enough to serve as the exact parent for ordinary/non-force #20 succession. It remains Draft because supplier #54/#62 and #56 independent approval are earlier promotion gates. No protected merge, immutable release, shadow/canary, cutover, rollback or legacy-removal credit is claimed.