ci: satisfy foundation workflow coalescing contract - #60
Merged
seonghobae merged 37 commits intoSep 5, 2026
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughCI 및 공급망 워크플로가 Changes워크플로 실행 정책
Estimated code review effort: 2 (Simple) | ~5 minutes Merge Risk: ⚪ Minimal · up to The CI and supply-chain workflows now coalesce pull-request runs by PR identity while preserving independent main-push runs and avoiding their cancellation. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
@coderabbitai review Please review the exact current range |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="7d14b9e22d9842355cc3cf59a986f31968e1b92a"
head="ee48595723ded58ebcdb4233bf8fffaf5e8a8462"
echo '== Commit availability and merge base =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=yes"
echo
echo '== Exact changed-file scope =='
git diff --name-status "$base" "$head"
echo
git diff --stat "$base" "$head"
echo
echo '== Exact workflow diff =='
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/ci.yml \
.github/workflows/supply-chain.yml
echo
echo '== Base contract: concurrency assertions =='
contract="$(fd -a '^workflow_concurrency_contract\.rs$' . | head -n1)"
if [ -z "$contract" ]; then
echo 'ERROR: tests/workflow_concurrency_contract.rs was not found'
exit 1
fi
echo "contract=$contract"
git diff --no-ext-diff --name-status "$base" "$head" -- "$contract"
git show "${base}:${contract}" | nl -ba | sed -n '1,320p'
echo
echo '== Workflow maps at head =='
for workflow in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $workflow ---"
ast-grep outline "$workflow" --items all || true
echo '--- top-level and condition-bearing lines ---'
nl -ba "$workflow" | rg -n -C2 '(^\s*[0-9]+\s+(name:|on:|push:|pull_request:|branches:|concurrency:|group:|cancel-in-progress:|permissions:|jobs:|if:|needs:|runs-on:|steps:|uses:|run:))'
done
echo
echo '== Semantic comparison excluding intended concurrency controls =='
python3 - "$base" "$head" <<'PY'
import subprocess, sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
for path in paths:
a = subprocess.check_output(["git", "show", f"{base}:{path}"], text=True).splitlines()
b = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True).splitlines()
# Remove the exact, indentation-aware intended fields and their value lines.
def filtered(lines):
result = []
skip_next_group_value = False
for line in lines:
stripped = line.strip()
if stripped == "concurrency:":
continue
if stripped.startswith("group:") or stripped.startswith("cancel-in-progress:"):
continue
if stripped == "push:":
result.append(line)
continue
if stripped.startswith("branches:") and "main" in stripped:
continue
result.append(line)
return result
if filtered(a) == filtered(b):
print(f"{path}: no differences remain after intended concurrency/push controls")
else:
print(f"{path}: unexpected differences remain after filtering")
PYLength of output: 11285 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="7d14b9e22d9842355cc3cf59a986f31968e1b92a"
head="ee48595723ded58ebcdb4233bf8fffaf5e8a8462"
echo '== Locate base-side workflow concurrency contract =='
git ls-tree -r --name-only "$base" | grep -E '(^|/)workflow_concurrency_contract\.rs$' || true
contract="$(git ls-tree -r --name-only "$base" | grep -E '(^|/)workflow_concurrency_contract\.rs$' | head -n 1)"
test -n "$contract"
echo "contract=$contract"
echo
echo '== Contract changed in requested range =='
git diff --no-ext-diff --name-status "$base" "$head" -- "$contract"
echo
echo '== Base contract source =='
git show "$base:$contract" | cat -n
echo
echo '== Contract source at head =='
git show "$head:$contract" | cat -n
echo
echo '== Exact workflow content outside intended controls =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
def show(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_intended(lines):
result = []
in_concurrency = False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith(" ") and not line.startswith(" "):
if line.lstrip().startswith(("group:", "cancel-in-progress:")):
continue
in_concurrency = False
if line == " push:\n":
result.append(line)
continue
if line.startswith(" branches:\n") or line.startswith(" - main\n"):
continue
result.append(line)
return result
for path in paths:
left = strip_intended(show(base, path))
right = strip_intended(show(head, path))
print(f"--- {path} ---")
diff = list(difflib.unified_diff(left, right, fromfile="base-filtered", tofile="head-filtered"))
if diff:
print("UNEXPECTED DIFFERENCES:")
print("".join(diff), end="")
else:
print("No differences outside push-branch admission and concurrency controls.")
echo
PY
echo '== Head workflow trigger/concurrency sections with line numbers =='
for workflow in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $workflow ---"
sed -n '1,28p' "$workflow" | cat -n
doneLength of output: 9323 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="7d14b9e22d9842355cc3cf59a986f31968e1b92a"
head="ee48595723ded58ebcdb4233bf8fffaf5e8a8462"
expected_group='group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}'
expected_cancel="cancel-in-progress: \${{ github.event_name == 'pull_request' }}"
expected_push=$'push:\n branches:\n - main'
echo '== Diff whitespace validation =='
git diff --check "$base" "$head"
echo
echo '== Changed workflow headers at head =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | sed -n '1,20p' | cat -n
done
echo
echo '== Base-contract source checks over all workflows at head =='
status=0
while IFS= read -r path; do
source="$(git show "$head:$path")"
if printf '%s' "$source" | grep -Fq 'pull_request:'; then
if printf '%s' "$source" | grep -Fqx "$expected_group" &&
printf '%s' "$source" | grep -Fqx "$expected_cancel"; then
echo "PASS PR concurrency: $path"
else
echo "FAIL PR concurrency: $path"
status=1
fi
fi
if printf '%s' "$source" | grep -Fq 'push:'; then
if printf '%s' "$source" | grep -Fq "$expected_push"; then
echo "PASS protected-main push: $path"
else
echo "FAIL protected-main push: $path"
status=1
fi
fi
done < <(git ls-tree -r --name-only "$head" .github/workflows | grep -E '\.ya?ml$')
exit "$status"Length of output: 3103 🤖 web_search executed:
Length of output: 10362 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="ee48595723ded58ebcdb4233bf8fffaf5e8a8462"
expected_group='group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}'
expected_cancel='cancel-in-progress: ${{ github.event_name == '\''pull_request'\'' }}'
expected_push=$'push:\n branches:\n - main'
echo '== Repository-wide base-contract checks at head =='
status=0
workflows="$(git ls-tree -r --name-only "$head" .github/workflows | grep -E '\.ya?ml$' || true)"
test -n "$workflows"
for path in $workflows; do
source="$(git show "$head:$path")"
if printf '%s\n' "$source" | grep -Fq 'pull_request:'; then
if printf '%s\n' "$source" | grep -Fqx "$expected_group" &&
printf '%s\n' "$source" | grep -Fqx "$expected_cancel"; then
echo "PASS PR concurrency: $path"
else
echo "FAIL PR concurrency: $path"
status=1
fi
fi
if printf '%s\n' "$source" | grep -Fq 'push:'; then
if printf '%s\n' "$source" | grep -Fq "$expected_push"; then
echo "PASS protected-main push: $path"
else
echo "FAIL protected-main push: $path"
status=1
fi
fi
done
exit "$status"Length of output: 1748 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="ee48595723ded58ebcdb4233bf8fffaf5e8a8462"
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
expected_group = (
"group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event.pull_request.number || github.run_id }}"
)
expected_cancel = "cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
expected_main_push = "push:\n branches:\n - main"
paths = subprocess.check_output(
["git", "ls-tree", "-r", "--name-only", head, ".github/workflows"],
text=True,
).splitlines()
failed = False
for path in (p for p in paths if p.endswith((".yml", ".yaml"))):
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
if "pull_request:" in source:
ok = expected_group in source and expected_cancel in source
print(f"{'PASS' if ok else 'FAIL'} PR concurrency: {path}")
failed |= not ok
if "push:" in source:
ok = expected_main_push in source
print(f"{'PASS' if ok else 'FAIL'} protected-main push: {path}")
failed |= not ok
raise SystemExit(1 if failed else 0)
PYLength of output: 1495
I verified these conditions:
GitHub Actions supports expressions in workflow-level This is a static review. It does not replace the required exact-head CI, Supply Chain, formatting, actionlint, and Rust-contract execution after ✅ Action performedReview finished.
|
Contributor
Author
|
@coderabbitai review Please review the current exact child range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='bbb74256a35d566e7d9c902086da5944dd62821d'
head='562a699e902388798b9f7015dcabd1e5f8040998'
echo '== Exact range and changed-file scope =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo
echo '== Exact diff =='
git diff --no-ext-diff --unified=100 "$base" "$head" -- \
.github/workflows/ci.yml \
.github/workflows/supply-chain.yml \
tests/workflow_concurrency_contract.rs
echo
echo '== Locate and compare workflow concurrency contract =='
contract="$(git ls-tree -r --name-only "$base" | grep -E '(^|/)workflow_concurrency_contract\.rs$' | head -n 1 || true)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
git diff --no-ext-diff --name-status "$base" "$head" -- "$contract"
echo '--- base contract ---'
git show "$base:$contract" | cat -n
echo '--- head contract ---'
git show "$head:$contract" | cat -n
echo
echo '== All workflow event and concurrency declarations at head =='
while IFS= read -r workflow; do
echo "--- $workflow ---"
git show "$head:$workflow" | cat -n | rg -C3 \
'^[[:space:]]*[0-9]+[[:space:]]+(name:|on:|push:|pull_request:|release:|create:|workflow_dispatch:|schedule:|branches:|branches-ignore:|tags:|tags-ignore:|concurrency:|group:|cancel-in-progress:)'
done < <(git ls-tree -r --name-only "$head" .github/workflows | grep -E '\.ya?ml$' | sort)
echo
echo '== Full head content for the two modified workflows =='
for workflow in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $workflow ---"
git show "$head:$workflow" | cat -n
doneLength of output: 29932 🤖 web_search executed:
Length of output: 17423 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='bbb74256a35d566e7d9c902086da5944dd62821d'
head='562a699e902388798b9f7015dcabd1e5f8040998'
echo '== All workflow event and concurrency declarations at head =='
git ls-tree -r --name-only "$head" .github/workflows \
| grep -E '\.ya?ml$' \
| sort \
| while IFS= read -r workflow; do
echo "--- $workflow ---"
git show "$head:$workflow" | cat -n | rg -C3 \
'^[[:space:]]*[0-9]+[[:space:]]+(name:|on:|push:|pull_request:|release:|create:|workflow_dispatch:|schedule:|branches:|branches-ignore:|tags:|tags-ignore:|concurrency:|group:|cancel-in-progress:)' || true
done
echo
echo '== Static evaluation of the unchanged Rust workflow concurrency contract =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
paths = subprocess.check_output(
["git", "ls-tree", "-r", "--name-only", head, ".github/workflows"],
text=True,
).splitlines()
paths = sorted(p for p in paths if p.endswith((".yml", ".yaml")))
def indent(line):
return len(line) - len(line.lstrip(" "))
def event_block(source, event):
target = f" {event}:"
in_on = False
in_event = False
block = []
for line in source.splitlines():
trimmed = line.strip()
ignorable = not trimmed or trimmed.startswith("#")
if not in_on:
if line == "on:":
in_on = True
continue
if not in_event:
if not ignorable and indent(line) == 0:
return None
if line == target:
in_event = True
continue
if not ignorable and indent(line) <= 2:
break
block.append(line)
return block if in_event else None
def concurrency_block(source):
in_block = False
block = []
for line in source.splitlines():
trimmed = line.strip()
ignorable = not trimmed or trimmed.startswith("#")
if not in_block:
if line == "concurrency:":
in_block = True
continue
if not ignorable and indent(line) == 0:
break
block.append(line)
return block if in_block else None
def push_branches(source):
block = event_block(source, "push")
if block is None:
return None
in_branches = False
branches = []
for line in block:
trimmed = line.strip()
ignorable = not trimmed or trimmed.startswith("#")
if not in_branches:
if line == " branches:":
in_branches = True
continue
if not ignorable and indent(line) <= 4:
break
if indent(line) == 6 and trimmed.startswith("- "):
branches.append(trimmed[2:].strip().strip("'\""))
return branches if in_branches else None
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
top_level_on = [
line for line in source.splitlines()
if indent(line) == 0 and line.lstrip().startswith("on:")
]
syntax_ok = top_level_on == ["on:"]
print(f"{'PASS' if syntax_ok else 'FAIL'} block-style on: {path}")
failed |= not syntax_ok
has_pr = event_block(source, "pull_request") is not None
has_push = event_block(source, "push") is not None
if has_pr:
concurrency = concurrency_block(source) or []
pr_ok = concurrency.count(expected_group) == 1 and concurrency.count(expected_cancel) == 1
print(f"{'PASS' if pr_ok else 'FAIL'} PR identity and PR-only cancellation: {path}")
failed |= not pr_ok
if has_pr and has_push:
branches = push_branches(source)
push_ok = branches == ["main"]
print(f"{'PASS' if push_ok else 'FAIL'} protected-main-only duplicate push: {path} ({branches!r})")
failed |= not push_ok
if has_push and not has_pr:
print(f"INFO push-only workflow outside PR contract: {path}")
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Exact range check for push-only workflow changes =='
git diff --name-status "$base" "$head" -- .github/workflows \
| grep -v -E '^M[[:space:]]+\.github/workflows/(ci|supply-chain)\.yml$' \
&& exit 1 || true
echo 'PASS: no push-only workflow changed in the exact range.'Length of output: 7660
I reviewed this range independently. I did not transfer the predecessor review.
GitHub Actions supports expression-based concurrency groups, fallback identities, and conditional This is a static review. Exact-head CI, Supply Chain, formatting, actionlint, and Rust-contract execution remain required after You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Re-review the current exact child range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3e45d88d46420c949ce0d98072229df3b8cfc33f'
head='b177f42f25d1481fc3db8b1a4d063ad18e99e63b'
echo '== Exact range =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo
echo '== Changed-file scope and whitespace =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo
echo '== Exact workflow and contract diffs =='
git diff --no-ext-diff --unified=100 "$base" "$head" -- \
.github/workflows/ci.yml \
.github/workflows/supply-chain.yml \
tests/workflow_concurrency_contract.rs
echo
echo '== Locate and compare the contract =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n 1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
git diff --name-status "$base" "$head" -- "$contract"
echo '--- contract at base ---'
git show "$base:$contract" | cat -n
echo '--- contract at head ---'
git show "$head:$contract" | cat -n
echo
echo '== Current modified workflow headers =='
for workflow in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $workflow ---"
git show "$head:$workflow" | sed -n '1,35p' | cat -n
done
echo
echo '== Static strengthened-contract validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
paths = subprocess.check_output(
["git", "ls-tree", "-r", "--name-only", head, ".github/workflows"],
text=True,
).splitlines()
paths = sorted(p for p in paths if p.endswith((".yml", ".yaml")))
def indent(line):
return len(line) - len(line.lstrip(" "))
def event_block(source, event):
active = False
result = []
for line in source.splitlines():
if not active:
if line == f" {event}:":
active = True
continue
if line.strip() and not line.lstrip().startswith("#") and indent(line) <= 2:
break
result.append(line)
return result if active else None
def push_branches(source):
block = event_block(source, "push")
if block is None:
return None
branches, active = [], False
for line in block:
if line == " branches:":
active = True
continue
if active and line.strip() and not line.lstrip().startswith("#") and indent(line) <= 4:
break
if active and indent(line) == 6 and line.strip().startswith("- "):
branches.append(line.strip()[2:].strip("'\""))
return branches if active else None
def concurrency_block(source):
active = False
result = []
for line in source.splitlines():
if not active:
if line == "concurrency:":
active = True
continue
if line.strip() and not line.lstrip().startswith("#") and indent(line) == 0:
break
result.append(line)
return result if active else []
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
has_pr = event_block(source, "pull_request") is not None
has_push = event_block(source, "push") is not None
if has_pr:
block = concurrency_block(source)
ok = block.count(expected_group) == 1 and block.count(expected_cancel) == 1
print(f"{'PASS' if ok else 'FAIL'} PR identity and PR-only cancellation: {path}")
failed |= not ok
if has_pr and has_push:
branches = push_branches(source)
ok = branches == ["main"]
print(f"{'PASS' if ok else 'FAIL'} main-only duplicate push: {path} ({branches!r})")
failed |= not ok
if has_push and not has_pr:
print(f"INFO unchanged push-only workflow outside PR concurrency contract: {path}")
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Push-only workflow protection =='
unexpected="$(
git diff --name-status "$base" "$head" -- .github/workflows \
| rg -v '^M[[:space:]]+\.github/workflows/(ci|supply-chain)\.yml$' || true
)"
test -z "$unexpected"
echo 'PASS: no push-only release or tag workflow changed in this range.'Length of output: 37958
I reviewed this range independently. I did not transfer the predecessor-range review.
This is a static review. Exact-head CI, Supply Chain, formatting, actionlint, and Rust-contract execution remain required after You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Review the current exact child range |
Rate Limit Exceeded
|
Contributor
Author
|
@coderabbitai review Review the current exact child range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='7109015c5c01bc855286075353b3a600f0ac98fb'
head='94432aae96359e429ef6e7d9933d96176195cdba'
expected_group=' group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}'
expected_cancel=" cancel-in-progress: \${{ github.event_name == 'pull_request' }}"
echo '== Exact range and ancestry =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo
echo '== Changed-file scope and whitespace =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo
echo '== Complete exact diff =='
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Locate and compare strengthened Rust contract =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n 1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
git diff --name-status "$base" "$head" -- "$contract"
echo '--- contract at base ---'
git show "$base:$contract" | cat -n
echo '--- contract at head ---'
git show "$head:$contract" | cat -n
echo
echo '== Changed workflow headers and concurrency declarations at head =='
for workflow in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $workflow ---"
git show "$head:$workflow" | sed -n '1,45p' | cat -n
done
echo
echo '== Structured workflow contract validation =='
python3 - "$head" "$expected_group" "$expected_cancel" <<'PY'
import subprocess
import sys
head, expected_group, expected_cancel = sys.argv[1:]
changed = {".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"}
paths = subprocess.check_output(
["git", "ls-tree", "-r", "--name-only", head, ".github/workflows"],
text=True,
).splitlines()
paths = sorted(p for p in paths if p.endswith((".yml", ".yaml")))
def indent(line):
return len(line) - len(line.lstrip(" "))
def block(source, heading, heading_indent):
lines = source.splitlines()
start = next((i for i, line in enumerate(lines) if line == heading), None)
if start is None:
return None
result = []
for line in lines[start + 1:]:
stripped = line.strip()
if stripped and not stripped.startswith("#") and indent(line) <= heading_indent:
break
result.append(line)
return result
def event_block(source, event):
return block(source, f" {event}:", 2)
def push_branches(source):
lines = event_block(source, "push")
if lines is None:
return None
branches = block("\n".join(lines), " branches:", 4)
if branches is None:
return None
return [
line.strip()[2:].strip("'\"")
for line in branches
if indent(line) == 6 and line.strip().startswith("- ")
]
def concurrency(source):
return block(source, "concurrency:", 0) or []
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
has_pr = event_block(source, "pull_request") is not None
has_push = event_block(source, "push") is not None
if path in changed:
c = concurrency(source)
group_ok = c.count(expected_group) == 1
cancel_ok = c.count(expected_cancel) == 1
push_ok = has_push and push_branches(source) == ["main"]
print(f"{'PASS' if group_ok else 'FAIL'} group identity: {path}")
print(f"{'PASS' if cancel_ok else 'FAIL'} PR-only cancellation: {path}")
print(f"{'PASS' if push_ok else 'FAIL'} main-only push: {path} ({push_branches(source)!r})")
failed |= not (group_ok and cancel_ok and push_ok)
elif has_push and not has_pr:
print(f"INFO unchanged push-only workflow: {path}")
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Semantic comparison excluding approved trigger/concurrency fields =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def remove_approved(lines):
output = []
in_concurrency = False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency:
if line.startswith(" group:") or line.startswith(" cancel-in-progress:"):
continue
in_concurrency = False
if line == " branches:\n" or line == " - main\n":
continue
output.append(line)
return output
failed = False
for path in paths:
diff = list(difflib.unified_diff(
remove_approved(read(base, path)),
remove_approved(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
if diff:
failed = True
print(f"FAIL unexpected changes: {path}")
print("".join(diff), end="")
else:
print(f"PASS no changes outside approved trigger/concurrency fields: {path}")
raise SystemExit(1 if failed else 0)
PYLength of output: 43429
I reviewed this range independently.
This is a static review. Exact-head CI, Supply Chain, formatting, actionlint, and Rust-contract execution remain required. You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Review current exact child range |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='9e6afedb179b0d0c29b7752082020728bafb97f8'
head='8590d7b05d10edcc19e0629f3173e384476a8d1e'
readonly base head
echo '== Exact range and ancestry =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
echo
echo '== Changed-file scope and whitespace =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
echo
echo '== Complete exact diff =='
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Rust concurrency contract at range endpoints =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n 1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
git diff --name-status "$base" "$head" -- "$contract"
echo '--- base contract ---'
git show "$base:$contract" | cat -n
echo '--- head contract ---'
git show "$head:$contract" | cat -n
echo
echo '== Modified workflow headers at head =='
for workflow in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $workflow ---"
git show "$head:$workflow" | sed -n '1,48p' | cat -n
done
echo
echo '== Static workflow concurrency and event-syntax validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
changed = {".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"}
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
paths = subprocess.check_output(
["git", "ls-tree", "-r", "--name-only", head, ".github/workflows"],
text=True,
).splitlines()
paths = sorted(path for path in paths if path.endswith((".yml", ".yaml")))
def indent(line):
return len(line) - len(line.lstrip(" "))
def block(lines, heading, heading_indent):
start = next((index for index, line in enumerate(lines) if line == heading), None)
if start is None:
return None
output = []
for line in lines[start + 1:]:
stripped = line.strip()
if stripped and not stripped.startswith("#") and indent(line) <= heading_indent:
break
output.append(line)
return output
def event_block(lines, event):
return block(lines, f" {event}:", 2)
def push_branches(lines):
push = event_block(lines, "push")
if push is None:
return None
branch_lines = block(push, " branches:", 4)
if branch_lines is None:
return None
return [
line.strip()[2:].strip("'\"")
for line in branch_lines
if indent(line) == 6 and line.strip().startswith("- ")
]
def concurrency_block(lines):
return block(lines, "concurrency:", 0) or []
failed = False
for path in paths:
lines = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True).splitlines()
has_pr = event_block(lines, "pull_request") is not None
has_push = event_block(lines, "push") is not None
if path in changed:
event_syntax_ok = lines.count("on:") == 1
group_ok = concurrency_block(lines).count(expected_group) == 1
cancel_ok = concurrency_block(lines).count(expected_cancel) == 1
push_ok = has_push and push_branches(lines) == ["main"]
print(f"{'PASS' if event_syntax_ok else 'FAIL'} block-style event syntax: {path}")
print(f"{'PASS' if group_ok else 'FAIL'} workflow/repository/PR/run identity: {path}")
print(f"{'PASS' if cancel_ok else 'FAIL'} PR-only cancellation: {path}")
print(f"{'PASS' if push_ok else 'FAIL'} exact main-only push: {path} ({push_branches(lines)!r})")
failed |= not (event_syntax_ok and group_ok and cancel_ok and push_ok)
elif has_push and not has_pr:
print(f"INFO unchanged push-only workflow: {path}")
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Semantic comparison outside approved trigger and concurrency fields =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def filtered(lines):
result = []
in_concurrency = False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency:
if line.startswith((" group:", " cancel-in-progress:")):
continue
in_concurrency = False
if line in (" branches:\n", " - main\n"):
continue
result.append(line)
return result
failed = False
for path in paths:
diff = list(difflib.unified_diff(
filtered(read(base, path)),
filtered(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
if diff:
failed = True
print(f"FAIL unexpected workflow changes: {path}")
print("".join(diff), end="")
else:
print(f"PASS no changes outside approved trigger/concurrency fields: {path}")
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Push-only workflow protection =='
unexpected="$(
git diff --name-status "$base" "$head" -- .github/workflows \
| rg -v '^M[[:space:]]+\.github/workflows/(ci|supply-chain)\.yml$' || true
)"
test -z "$unexpected"
echo 'PASS: no push-only release or tag workflow changed in this range.'Length of output: 45574
I reviewed this range independently.
This is a static review. Exact-head CI, Supply Chain, formatting, actionlint, and Rust-contract execution remain required.
|
Contributor
Author
|
@coderabbitai review Please review the current exact child range |
Contributor
Author
|
@coderabbitai review Please review the current exact range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='802d9a30030759fc6410f86fda7128a1569956c8'
head='b587d043bef8d11a5d08de9ea7e5f690e289250f'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range, ancestry, scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: exact range changes only the two workflow files.'
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=100 "$base" "$head" -- \
.github/workflows/ci.yml .github/workflows/supply-chain.yml
echo
echo '== Strengthened Rust oracle identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
echo 'PASS: Rust oracle is byte-identical at both endpoints.'
echo
echo '== Workflow headers and direct job guards at head =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | sed -n '1,180p' | cat -n
done
echo
echo '== Static concurrency, admission, and direct-job-guard validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
expected_types = " types: [opened, synchronize, reopened, ready_for_review]"
expected_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def lines_at(path):
return subprocess.check_output(["git", "show", f"{head}:{path}"], text=True).splitlines()
def indent(line):
return len(line) - len(line.lstrip(" "))
def block(lines, heading, depth):
try:
start = lines.index(heading)
except ValueError:
return None
result = []
for line in lines[start + 1:]:
text = line.strip()
if text and not text.startswith("#") and indent(line) <= depth:
break
result.append(line)
return result
def direct_job_guards(lines):
jobs = block(lines, "jobs:", 0)
if jobs is None:
return []
starts = [i for i, line in enumerate(jobs)
if indent(line) == 2 and line.rstrip().endswith(":")]
guarded = []
for pos, start in enumerate(starts):
end = starts[pos + 1] if pos + 1 < len(starts) else len(jobs)
name = jobs[start].strip()[:-1]
guarded.append((name, expected_guard in jobs[start + 1:end]))
return guarded
failed = False
for path in paths:
lines = lines_at(path)
push = block(lines, " push:", 2) or []
concurrency = block(lines, "concurrency:", 0) or []
guards = direct_job_guards(lines)
checks = {
"block_on": lines.count("on:") == 1,
"pr_types": expected_types in (block(lines, " pull_request:", 2) or []),
"main_push": " branches:" in push and " - main" in push,
"rerun_isolation_group": concurrency.count(expected_group) == 1,
"pr_only_cancellation": concurrency.count(expected_cancel) == 1,
"all_direct_jobs_draft_guarded": bool(guards) and all(ok for _, ok in guards),
}
print(f"{path}: {checks}; direct_jobs={guards}")
failed |= not all(checks.values())
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Compare execution controls at range endpoints =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def filtered(lines):
out, in_concurrency = [], False
admission_lines = {
" branches:\n", " - main\n",
" types: [opened, synchronize, reopened, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in admission_lines:
continue
out.append(line)
return out
bad = False
for path in paths:
diff = list(difflib.unified_diff(
filtered(read(base, path)), filtered(read(head, path)),
fromfile=f"{path}:base-filtered", tofile=f"{path}:head-filtered",
))
if diff:
print(f"FAIL unexpected changes: {path}")
print("".join(diff), end="")
bad = True
else:
print(f"PASS approved-policy-only changes: {path}")
raise SystemExit(bad)
PY
echo
echo '== Hosted runs: exact head and PR `#61` =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
echo '-- Exact requested head --'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.head_sha,.html_url] | `@tsv`'
echo '-- Pull request `#61` metadata --'
gh api "repos/$repo/pulls/61" \
--jq '[.number,.state,.draft,.head.sha,.base.ref,.updated_at,.html_url] | `@tsv`'
pr61_head="$(gh api "repos/$repo/pulls/61" --jq '.head.sha')"
echo '-- Pull request `#61` source-head runs --'
gh api "repos/$repo/actions/runs?head_sha=$pr61_head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`'Length of output: 34611 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='802d9a30030759fc6410f86fda7128a1569956c8'
head='b587d043bef8d11a5d08de9ea7e5f690e289250f'
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
echo '== Corrected static policy validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
expected_types = ["opened", "synchronize", "reopened", "converted_to_draft", "ready_for_review"]
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
expected_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def read(path):
return subprocess.check_output(["git", "show", f"{head}:{path}"], text=True).splitlines()
def indent(line):
return len(line) - len(line.lstrip(" "))
def block(lines, header, depth):
try:
start = lines.index(header)
except ValueError:
return None
result = []
for line in lines[start + 1:]:
if line.strip() and not line.lstrip().startswith("#") and indent(line) <= depth:
break
result.append(line)
return result
def list_values(lines, header, depth):
section = block(lines, header, depth)
if section is None:
return None
return [line.strip()[2:].strip("'\"") for line in section
if indent(line) == depth + 2 and line.strip().startswith("- ")]
def direct_job_guards(lines):
jobs = block(lines, "jobs:", 0) or []
starts = [i for i, line in enumerate(jobs)
if indent(line) == 2 and line.rstrip().endswith(":")]
result = []
for pos, start in enumerate(starts):
end = starts[pos + 1] if pos + 1 < len(starts) else len(jobs)
result.append((jobs[start].strip()[:-1], expected_guard in jobs[start + 1:end]))
return result
failed = False
for path in paths:
lines = read(path)
push = list_values(lines, " push:", 2)
pr_types = list_values(lines, " pull_request:", 2)
concurrency = block(lines, "concurrency:", 0) or []
guards = direct_job_guards(lines)
result = {
"block_style_on": lines.count("on:") == 1,
"main_only_push": push == ["main"],
"pr_admission_types": pr_types == expected_types,
"first_pr_attempt_uses_pr_group": concurrency.count(expected_group) == 1,
"rerun_and_non_pr_use_run_id": concurrency.count(expected_group) == 1,
"pr_only_cancellation": concurrency.count(expected_cancel) == 1,
"draft_jobs_skip": bool(guards) and all(guarded for _, guarded in guards),
}
print(f"{path}: {result}; direct_jobs={guards}")
failed |= not all(result.values())
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Changes outside admission and concurrency policy =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
approved = {
" branches:\n", " - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def filter_policy(lines):
result, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in approved:
continue
result.append(line)
return result
bad = False
for path in paths:
diff = list(difflib.unified_diff(filter_policy(read(base, path)), filter_policy(read(head, path))))
print(f"{path}: {'FAIL unexpected changes' if diff else 'PASS policy-only changes'}")
if diff:
print("".join(diff), end="")
bad = True
raise SystemExit(bad)
PY
echo
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`'
echo
echo '== PR `#61` metadata and timeline transition events =='
gh api "repos/$repo/pulls/61" \
--jq '[.number,.state,.draft,.head.sha,.base.ref,.updated_at,.html_url] | `@tsv`'
gh api -H 'Accept: application/vnd.github+json' "repos/$repo/issues/61/timeline?per_page=100" \
--jq '.[] | select(.event == "converted_to_draft" or .event == "ready_for_review") | [.event,.created_at,.actor.login] | `@tsv`'
pr61_head="$(gh api "repos/$repo/pulls/61" --jq '.head.sha')"
echo
echo '== PR `#61` source-head workflow runs =='
runs="$(gh api "repos/$repo/actions/runs?head_sha=$pr61_head&per_page=100" \
--jq '.workflow_runs[] | select(.name == "CI" or .name == "Supply Chain") | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`')"
printf '%s\n' "$runs"
echo
echo '== PR `#61` CI and Supply Chain job conclusions =='
while IFS=$'\t' read -r run_id name rest; do
[ -n "${run_id:-}" ] || continue
printf '%s\t%s\n' "$run_id" "$name"
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | [.name,.status,(.conclusion // "null"),.started_at,.completed_at] | `@tsv`'
done <<< "$runs"Length of output: 6766 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='802d9a30030759fc6410f86fda7128a1569956c8'
head='b587d043bef8d11a5d08de9ea7e5f690e289250f'
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
echo '== Source-accurate workflow policy checks =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
required = [
"on:\n push:\n branches:\n - main\n pull_request:\n types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]",
" group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}",
" cancel-in-progress: ${{ github.event_name == 'pull_request' }}",
]
guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_job_blocks(source):
lines = source.splitlines()
start = lines.index("jobs:")
jobs = lines[start + 1:]
positions = [i for i, line in enumerate(jobs)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")]
output = []
for index, begin in enumerate(positions):
end = positions[index + 1] if index + 1 < len(positions) else len(jobs)
output.append((jobs[begin].strip()[:-1], guard in jobs[begin + 1:end]))
return output
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_job_blocks(source)
checks = {
"event_admission": required[0] in source,
"rerun_isolation_identity": source.count(required[1]) == 1,
"pr_only_cancellation": source.count(required[2]) == 1,
"all_direct_jobs_draft_guarded": bool(jobs) and all(ok for _, ok in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(1 if failed else 0)
PY
echo
echo '== Full semantic diff after removing policy fields =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_fragments = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def filter_policy(lines):
out, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_fragments:
continue
out.append(line)
return out
failed = False
for path in paths:
diff = list(difflib.unified_diff(filter_policy(read(base, path)), filter_policy(read(head, path)),
fromfile=f"{path}:base", tofile=f"{path}:head"))
print(f"{path}: {'FAIL unexpected changes' if diff else 'PASS policy-only changes'}")
if diff:
print("".join(diff), end="")
failed = True
raise SystemExit(failed)
PY
echo
echo '== Exact-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`'
echo
echo '== PR `#61` transition history =='
gh api "repos/$repo/pulls/61" \
--jq '[.number,.state,.draft,.head.sha,.base.ref,.updated_at,.html_url] | `@tsv`'
gh api -H 'Accept: application/vnd.github+json' "repos/$repo/issues/61/timeline?per_page=100" \
--jq '.[] | select(.event == "converted_to_draft" or .event == "ready_for_review") | [.event,.created_at,.actor.login] | `@tsv`'
pr61_head="$(gh api "repos/$repo/pulls/61" --jq '.head.sha')"
echo
echo '== PR `#61` CI and Supply Chain runs on its unchanged source head =='
runs="$(gh api "repos/$repo/actions/runs?head_sha=$pr61_head&per_page=100" \
--jq '.workflow_runs[] | select(.name == "CI" or .name == "Supply Chain") | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`')"
printf '%s\n' "$runs"
echo
echo '== PR `#61` CI and Supply Chain job conclusions =='
while IFS=$'\t' read -r run_id name _; do
[ -n "${run_id:-}" ] || continue
printf '%s\t%s\n' "$run_id" "$name"
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | [.name,.status,(.conclusion // "null"),.started_at,.completed_at] | `@tsv`'
done <<< "$runs"Length of output: 7015 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b587d043bef8d11a5d08de9ea7e5f690e289250f'
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
echo '== Exact requested-head workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`' \
|| true
echo
echo '== PR `#61` state and draft-transition timeline =='
gh api "repos/$repo/pulls/61" \
--jq '[.number,.state,.draft,.head.sha,.base.ref,.updated_at,.html_url] | `@tsv`'
gh api --paginate -H 'Accept: application/vnd.github+json' "repos/$repo/issues/61/timeline?per_page=100" \
--jq '.[] | select(.event == "converted_to_draft" or .event == "ready_for_review") | [.event,.created_at,.actor.login] | `@tsv`'
pr61_head="$(gh api "repos/$repo/pulls/61" --jq '.head.sha')"
echo
echo '== PR `#61` CI and Supply Chain runs on current source head =='
runs_file="$(mktemp)"
gh api "repos/$repo/actions/runs?head_sha=$pr61_head&per_page=100" \
--jq '.workflow_runs[]
| select(.name == "CI" or .name == "Supply Chain")
| [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url]
| `@tsv`' | tee "$runs_file"
echo
echo '== Job conclusions for each PR `#61` workflow run =='
while IFS=$'\t' read -r run_id name _; do
[ -n "${run_id:-}" ] || continue
printf -- '-- run=%s workflow=%s --\n' "$run_id" "$name"
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | [.name,.status,(.conclusion // "null"),.started_at,.completed_at] | `@tsv`'
done < "$runs_file"
rm -f "$runs_file"Length of output: 2955 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
pr61_head="$(gh api "repos/$repo/pulls/61" --jq '.head.sha')"
runs_file="$(mktemp)"
echo '== PR `#61` workflow runs on current source head =='
gh api "repos/$repo/actions/runs?head_sha=$pr61_head&per_page=100" \
--jq '.workflow_runs[]
| select(.name == "CI" or .name == "Supply Chain")
| [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url]
| `@tsv`' > "$runs_file"
cat "$runs_file"
echo
echo '== Job conclusions for each PR `#61` workflow run =='
while IFS=$'\t' read -r run_id name _; do
[ -n "${run_id:-}" ] || continue
printf -- '-- run=%s workflow=%s --\n' "$run_id" "$name"
gh api "repos/$repo/actions/runs/$run_id/jobs?per_page=100" \
--jq '.jobs[] | [.name,.status,(.conclusion // "null"),.started_at,.completed_at] | `@tsv`'
done < "$runs_file"
echo
echo '== Pull request `#61` public issue-event history =='
gh api --paginate "repos/$repo/issues/61/events?per_page=100" \
--jq '.[] | select(.event == "converted_to_draft" or .event == "ready_for_review") | [.event,.created_at,.actor.login] | `@tsv`'
rm -f "$runs_file"Length of output: 2328
Both workflows use the required event admission: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]Both workflows use this concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}This gives the required isolation.
Both workflows use PR-only cancellation: cancel-in-progress: ${{ github.event_name == 'pull_request' }}All direct jobs have this draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseTherefore, a The CI cleanup change preserves the OCI cleanup commands. It changes the Hosted transition verification is still inconclusive.
The static policy is correct. The hosted You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Fresh exact-range review requested for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3e452c850a6585ffca94468d841a8b8b3d817040'
head='0e70ea9916146bcf82a305a349778ea4ec33e10a'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range, ancestry, scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: exact range changes only the two intended workflow files.'
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Current parent Rust oracle identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
echo 'PASS: Rust oracle is byte-identical at both endpoints.'
echo
echo '== Head workflow declarations and direct job guards =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Static admission, coalescing, rerun, and Draft policy validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
expected_admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
expected_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_job_guards(source):
lines = source.splitlines()
try:
start = lines.index("jobs:")
except ValueError:
return []
jobs = lines[start + 1:]
starts = [
index for index, line in enumerate(jobs)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")
]
result = []
for position, begin in enumerate(starts):
end = starts[position + 1] if position + 1 < len(starts) else len(jobs)
result.append((jobs[begin].strip()[:-1], expected_guard in jobs[begin + 1:end]))
return result
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_job_guards(source)
checks = {
"block_style_event_admission": source.count("on:") == 1 and expected_admission in source,
"first_pr_attempt_pr_identity": source.count(expected_group) == 1,
"rerun_and_non_pr_run_id_fallback": source.count(expected_group) == 1,
"pr_only_cancellation": source.count(expected_cancel) == 1,
"all_direct_jobs_draft_guarded": bool(jobs) and all(guarded for _, guarded in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Semantic comparison outside allowed policy fields =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_policy(lines):
output, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
output.append(line)
return output
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
print(f"{path}: {'FAIL unexpected changes' if diff else 'PASS policy-only changes'}")
if diff:
print("".join(diff), end="")
failed = True
raise SystemExit(failed)
PY
echo
echo '== Hosted status at the requested exact head =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`'Length of output: 36179 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3e452c850a6585ffca94468d841a8b8b3d817040'
head='0e70ea9916146bcf82a305a349778ea4ec33e10a'
echo '== Corrected exact workflow-policy validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
expected_admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
expected_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_job_guards(source):
lines = source.splitlines()
start = lines.index("jobs:")
jobs = lines[start + 1:]
starts = [
i for i, line in enumerate(jobs)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")
]
return [
(
jobs[start].strip()[:-1],
expected_guard in jobs[start + 1:(starts[position + 1] if position + 1 < len(starts) else len(jobs))]
)
for position, start in enumerate(starts)
]
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_job_guards(source)
checks = {
"top_level_block_style_on": source.splitlines().count("on:") == 1,
"event_admission": expected_admission in source,
"first_pr_attempt_uses_pr_identity": source.count(expected_group) == 1,
"rerun_and_non_pr_use_run_id": source.count(expected_group) == 1,
"pr_only_cancellation": source.count(expected_cancel) == 1,
"direct_jobs_skip_drafts": bool(jobs) and all(guarded for _, guarded in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Compare all changes outside policy controls =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_policy(lines):
result, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
result.append(line)
return result
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
print(f"--- {path} ---")
if diff:
print("Changes outside admission/concurrency/Draft-guard policy:")
print("".join(diff), end="")
else:
print("No changes outside the policy controls.")
PY
echo
echo '== Exact-head hosted workflow runs and checks =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.display_title,.event,.run_attempt,.status,(.conclusion // "null"),.created_at,.updated_at,.html_url] | `@tsv`'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`'Length of output: 7412
Both workflows have the required admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]Both workflows use the required concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}This policy has the expected behavior:
Both workflows set: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Only PR runs can cancel in-progress runs. All direct jobs have a non-Draft guard. Therefore, a The CI workflow has two additional changes outside the policy fields:
These changes do not weaken runner selection, permissions, security checks, gates, thresholds, or success conditions. Exact-head hosted verification remains pending:
The exact-head jobs must complete successfully before the hosted GREEN state is established. You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Current exact review target moved to |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='2d84080562d5c1d39067d89eb542147e40e217cc'
head='275aa356b59968337c60a964c6759fb3eb4378ca'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range and scope =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head"
echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: only intended workflow files changed.'
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Parent semantic job-admission contract identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
echo 'PASS: semantic contract is byte-identical at range endpoints.'
git show "$head:$contract" | cat -n
echo
echo '== Workflow sources at head =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Static admission, coalescing, rerun, and Draft-job policy =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
expected_admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
expected_group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
expected_cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
expected_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_job_guards(source):
lines = source.splitlines()
try:
start = lines.index("jobs:")
except ValueError:
return []
jobs = lines[start + 1:]
starts = [
i for i, line in enumerate(jobs)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")
]
result = []
for n, begin in enumerate(starts):
end = starts[n + 1] if n + 1 < len(starts) else len(jobs)
result.append((jobs[begin].strip()[:-1], expected_guard in jobs[begin + 1:end]))
return result
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
guards = direct_job_guards(source)
checks = {
"block_style_on": source.splitlines().count("on:") == 1,
"event_admission": expected_admission in source,
"first_pr_attempt_uses_pr_identity": source.count(expected_group) == 1,
"rerun_and_non_pr_use_run_id": source.count(expected_group) == 1,
"pr_only_cancellation": source.count(expected_cancel) == 1,
"all_direct_jobs_skip_drafts": bool(guards) and all(guarded for _, guarded in guards),
}
print(f"{path}: {checks}; direct_jobs={guards}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Difference check outside workflow policy controls =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_policy(lines):
output, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
output.append(line)
return output
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
print(f"--- {path} ---")
if diff:
print("FAIL: changes outside policy controls")
print("".join(diff), end="")
failed = True
else:
print("PASS: no changes outside policy controls.")
raise SystemExit(failed)
PYLength of output: 55255 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='2d84080562d5c1d39067d89eb542147e40e217cc'
head='275aa356b59968337c60a964c6759fb3eb4378ca'
echo '== Focused cleanup change =='
git diff --no-ext-diff --unified=20 "$base" "$head" -- .github/workflows/ci.yml | sed -n '/gateway_pid=\$!/,/for _ in/p;/cid="\$(docker run/,/test "\$(docker inspect/p'
echo
echo '== Standalone Bash EXIT-trap status probes =='
set +e
bash -c 'trap '\''true'\'' EXIT; false'
printf 'trap_true_after_false=%s\n' "$?"
bash -c 'trap '\''false'\'' EXIT; false'
printf 'trap_false_after_false=%s\n' "$?"
bash -c 'trap '\''echo cleanup >/dev/null || true; true'\'' EXIT; false'
printf 'direct_cleanup_after_false=%s\n' "$?"
set -e
echo
echo '== actionlint workflow validation =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is not installed in this sandbox'
fiLength of output: 2758
Both workflows use the required admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]Both workflows use the required concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}This gives the required behavior:
Both workflows set: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Only pull request runs can cancel in-progress runs. Every direct job has the required draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseTherefore, The CI workflow also updates the OCI This is an independent static review. Exact-head hosted checks still need to complete successfully. You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Fresh exact range: |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range, ancestry, scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: only the intended workflow files changed.'
git diff --stat "$base" "$head"
echo '== Complete exact diff =='
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Parent oracle identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
echo 'PASS: Rust oracle is byte-identical at range endpoints.'
echo
echo '== Head workflow sources =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Static workflow policy validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
draft_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_jobs(source):
lines = source.splitlines()
try:
start = lines.index("jobs:")
except ValueError:
return []
section = lines[start + 1:]
starts = [
i for i, line in enumerate(section)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")
]
return [
(
section[begin].strip()[:-1],
draft_guard in section[begin + 1:(starts[index + 1] if index + 1 < len(starts) else len(section))]
)
for index, begin in enumerate(starts)
]
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_jobs(source)
checks = {
"block_style_on": source.splitlines().count("on:") == 1,
"event_admission": admission in source,
"rerun_isolation_group": source.count(group) == 1,
"pr_only_cancellation": source.count(cancel) == 1,
"all_direct_jobs_draft_guarded": bool(jobs) and all(ok for _, ok in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Differences outside allowed workflow policy controls =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_policy(lines):
out, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
out.append(line)
return out
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
print(f"--- {path} ---")
if diff:
print("CHANGES OUTSIDE POLICY CONTROLS:")
print("".join(diff), end="")
failed = True
else:
print("PASS: no changes outside policy controls.")
raise SystemExit(failed)
PY
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fi
echo
echo '== Exact-head hosted workflow runs and checks =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.html_url] | `@tsv`' || true
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' || trueLength of output: 37428 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
echo '== Focused CI cleanup diff =='
git diff --no-ext-diff --unified=24 "$base" "$head" -- .github/workflows/ci.yml
echo
echo '== Cleanup command comparison =='
python3 - "$base" "$head" <<'PY'
import subprocess
import sys
base, head = sys.argv[1:]
path = ".github/workflows/ci.yml"
def text(rev):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True)
before, after = text(base), text(head)
required = [
'docker logs "${cid}" || true',
'docker rm --force "${cid}" >/dev/null 2>&1 || true',
]
for command in required:
print(f"{command}: base={command in before}, head={command in after}")
if command not in before or command not in after:
raise SystemExit(1)
PY
echo
echo '== Standalone Bash EXIT-trap exit-status probes =='
set +e
bash -c 'trap '\''docker_logs(){ :; }; docker_rm(){ :; }; docker_logs || true; docker_rm || true'\'' EXIT; false'
printf 'direct_trap_after_failure=%s\n' "$?"
bash -c 'cleanup(){ docker_logs(){ :; }; docker_rm(){ :; }; docker_logs || true; docker_rm || true; }; trap cleanup EXIT; false'
printf 'function_trap_after_failure=%s\n' "$?"
set -e
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fi
echo
echo '== Exact-head hosted workflow runs and checks =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.html_url] | `@tsv`'
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`'Length of output: 12398
Both workflows use this admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]Both workflows use this concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}This configuration has the required behavior:
Both workflows set: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Only pull request runs can cancel in-progress runs. Every direct job has the non-Draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseTherefore, a The CI workflow also adds an SC2329 suppression and replaces the OCI cleanup function with a direct Exact-head hosted verification is pending:
The hosted jobs must complete successfully before the exact-head GREEN state is established. You are interacting with an AI system. |
seonghobae
marked this pull request as draft
September 5, 2026 06:56
Contributor
Author
|
@coderabbitai review Please review the exact current child range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range, ancestry, scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head"
echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: exact range changes only the intended workflow files.'
git diff --stat "$base" "$head"
echo '== Complete exact diff =='
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Parent concurrency contract identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
printf 'base_object=%s\n' "$(git rev-parse "$base:$contract")"
printf 'head_object=%s\n' "$(git rev-parse "$head:$contract")"
test "$(git rev-parse "$base:$contract")" = "$(git rev-parse "$head:$contract")"
echo 'PASS: contract is byte-identical at range endpoints.'
echo
echo '== Workflow policy and direct job guards at head =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Static admission, concurrency, rerun, and Draft-guard validation =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_job_guards(source):
lines = source.splitlines()
try:
start = lines.index("jobs:")
except ValueError:
return []
jobs = lines[start + 1:]
starts = [i for i, line in enumerate(jobs)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")]
result = []
for index, begin in enumerate(starts):
end = starts[index + 1] if index + 1 < len(starts) else len(jobs)
result.append((jobs[begin].strip()[:-1], guard in jobs[begin + 1:end]))
return result
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_job_guards(source)
checks = {
"block_style_on": source.splitlines().count("on:") == 1,
"exact_admission": admission in source,
"rerun_isolation_group": source.count(group) == 1,
"pr_only_cancellation": source.count(cancel) == 1,
"all_direct_jobs_draft_guarded": bool(jobs) and all(ok for _, ok in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Changes outside admitted policy fields =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_policy(lines):
result, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
result.append(line)
return result
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
if diff:
print(f"CHANGES OUTSIDE POLICY: {path}")
print("".join(diff), end="")
failed = True
else:
print(f"PASS policy-only changes: {path}")
raise SystemExit(failed)
PY
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fiLength of output: 36932 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
echo '== Focused non-policy CI changes =='
git diff --no-ext-diff --unified=24 "$base" "$head" -- .github/workflows/ci.yml
echo
echo '== OCI cleanup command presence at both endpoints =='
python3 - "$base" "$head" <<'PY'
import subprocess
import sys
base, head = sys.argv[1:]
path = ".github/workflows/ci.yml"
commands = [
'docker logs "${cid}" || true',
'docker rm --force "${cid}" >/dev/null 2>&1 || true',
]
for command in commands:
values = []
for rev in (base, head):
source = subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True)
values.append(command in source)
print(f"{command}: base={values[0]}, head={values[1]}")
if not all(values):
raise SystemExit(1)
PY
echo
echo '== EXIT trap status preservation probes =='
set +e
bash -c 'cleanup(){ :; }; trap cleanup EXIT; false'
printf 'function_trap_after_failure=%s\n' "$?"
bash -c "trap 'true' EXIT; false"
printf 'direct_trap_after_failure=%s\n' "$?"
bash -c "trap 'docker_logs(){ :; }; docker_rm(){ :; }; docker_logs || true; docker_rm || true' EXIT; false"
printf 'direct_cleanup_after_failure=%s\n' "$?"
set -e
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fiLength of output: 11114
Both workflows use this event admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]This restricts push admission to Both workflows use this concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}
Both workflows use PR-only cancellation: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Every direct job has this Draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseTherefore, The CI workflow also adds an SC2329 annotation and changes the OCI cleanup from a function trap to a direct This is an independent static review. Exact-head hosted checks must still complete successfully. You are interacting with an AI system. |
seonghobae
marked this pull request as ready for review
September 5, 2026 07:22
Contributor
Author
|
@coderabbitai review Fresh exact-range review requested for |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range, ancestry, path scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: the exact range changes only the two workflow files.'
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=100 "$base" "$head" -- \
.github/workflows/ci.yml .github/workflows/supply-chain.yml
echo
echo '== Parent contract identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
echo 'PASS: Rust workflow contract is byte-identical at both endpoints.'
git show "$head:$contract" | cat -n
echo
echo '== Complete head workflow sources =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Source-level policy assertions =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
draft_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_jobs(source):
lines = source.splitlines()
start = lines.index("jobs:")
jobs = lines[start + 1:]
starts = [i for i, line in enumerate(jobs)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")]
result = []
for n, begin in enumerate(starts):
end = starts[n + 1] if n + 1 < len(starts) else len(jobs)
result.append((jobs[begin].strip()[:-1], draft_guard in jobs[begin + 1:end]))
return result
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_jobs(source)
checks = {
"block_style_on": source.splitlines().count("on:") == 1,
"main_push_and_pr_event_admission": admission in source,
"first_attempt_pr_identity_and_rerun_fallback": source.count(group) == 1,
"pr_only_cancellation": source.count(cancel) == 1,
"all_direct_jobs_have_draft_guard": bool(jobs) and all(guarded for _, guarded in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Semantic comparison outside workflow-policy controls =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(rev, path):
return subprocess.check_output(["git", "show", f"{rev}:{path}"], text=True).splitlines(keepends=True)
def strip_policy(lines):
output, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
output.append(line)
return output
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
if diff:
print(f"CHANGES OUTSIDE POLICY CONTROLS: {path}")
print("".join(diff), end="")
failed = True
else:
print(f"PASS: no changes outside policy controls: {path}")
raise SystemExit(failed)
PY
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fi
echo
echo '== Exact-head hosted workflow runs and checks =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.html_url] | `@tsv`' || true
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' || trueLength of output: 55876 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
echo '== OCI cleanup commands at both endpoints =='
python3 - "$base" "$head" <<'PY'
import subprocess
import sys
base, head = sys.argv[1:]
path = ".github/workflows/ci.yml"
commands = (
'docker logs "${cid}" || true',
'docker rm --force "${cid}" >/dev/null 2>&1 || true',
)
for command in commands:
result = []
for revision in (base, head):
source = subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
)
result.append(command in source)
print(f"{command}: base={result[0]} head={result[1]}")
if not all(result):
raise SystemExit(1)
PY
echo
echo '== Bash EXIT-trap exit-status preservation =='
set +e
bash -c 'cleanup() { :; }; trap cleanup EXIT; false'
printf 'function_trap_after_failure=%s\n' "$?"
bash -c "trap 'true' EXIT; false"
printf 'direct_trap_after_failure=%s\n' "$?"
bash -c "trap 'docker_logs(){ :; }; docker_rm(){ :; }; docker_logs || true; docker_rm || true' EXIT; false"
printf 'direct_cleanup_after_failure=%s\n' "$?"
set -e
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fi
echo
echo '== Exact-head hosted workflow runs and check runs =='
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
printf 'repo=%s\n' "$repo"
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.html_url] | `@tsv`' || true
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`' || trueLength of output: 3018 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
repo="$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')"
echo '== Exact-head hosted workflow runs =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.event,.run_attempt,.status,(.conclusion // "null"),.html_url] | `@tsv`'
echo
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,(.conclusion // "null"),.details_url] | `@tsv`'Length of output: 3095
Both workflows use this admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]This policy limits duplicate push evidence to protected Both workflows use this concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}This group has the required behavior.
Both workflows use PR-only cancellation: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Every direct job has this Draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseTherefore, a The CI workflow also adds an Exact-head hosted verification is not complete. CI run You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Please review only the current exact GREEN range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Revisions, ancestry, scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: only the two intended workflow files changed.'
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=100 "$base" "$head" -- \
.github/workflows/ci.yml .github/workflows/supply-chain.yml
echo
echo '== Parent Rust workflow contract identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
git show "$head:$contract" | cat -n
echo
echo '== Head workflow sources =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Source-accurate policy assertions =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
draft_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_jobs(source):
lines = source.splitlines()
start = lines.index("jobs:")
section = lines[start + 1:]
starts = [
i for i, line in enumerate(section)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")
]
return [
(
section[begin].strip()[:-1],
draft_guard in section[begin + 1:(starts[n + 1] if n + 1 < len(starts) else len(section))]
)
for n, begin in enumerate(starts)
]
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_jobs(source)
checks = {
"block_style_on": source.splitlines().count("on:") == 1,
"main_only_push_and_draft_ready_events": admission in source,
"first_attempt_pr_group_and_rerun_run_id_fallback": source.count(group) == 1,
"pr_only_cancellation": source.count(cancel) == 1,
"every_direct_job_has_draft_guard": bool(jobs) and all(ok for _, ok in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Compare changes outside admission/concurrency/Draft-guard policy =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(revision, path):
return subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
).splitlines(keepends=True)
def strip_policy(lines):
result, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
result.append(line)
return result
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
if diff:
print(f"CHANGES OUTSIDE POLICY CONTROLS: {path}")
print("".join(diff), end="")
failed = True
else:
print(f"PASS: no changes outside policy controls: {path}")
raise SystemExit(failed)
PY
echo
echo '== Static YAML lint, if available =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fiLength of output: 55296 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='8893ab433a06bf25b63385689118d60861fe6a78'
head='f1b09eb0a669a6f9f439daf250b1c7d0d95b6c1a'
echo '== Focused CI cleanup diff =='
git diff --no-ext-diff --unified=24 "$base" "$head" -- .github/workflows/ci.yml
echo
echo '== Required OCI cleanup commands at both endpoints =='
python3 - "$base" "$head" <<'PY'
import subprocess
import sys
base, head = sys.argv[1:]
path = ".github/workflows/ci.yml"
commands = (
'docker logs "${cid}" || true',
'docker rm --force "${cid}" >/dev/null 2>&1 || true',
)
for command in commands:
present = []
for revision in (base, head):
source = subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
)
present.append(command in source)
print(f"{command}: base={present[0]} head={present[1]}")
if not all(present):
raise SystemExit(1)
PY
echo
echo '== Isolated Bash EXIT-trap status checks =='
set +e
bash -c 'cleanup() { :; }; trap cleanup EXIT; false'
printf 'function_trap_after_failure=%s\n' "$?"
bash -c "trap 'true' EXIT; false"
printf 'direct_trap_after_failure=%s\n' "$?"
bash -c "trap 'docker_logs(){ :; }; docker_rm(){ :; }; docker_logs || true; docker_rm || true' EXIT; false"
printf 'direct_cleanup_trap_after_failure=%s\n' "$?"
set -e
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fiLength of output: 11152
Both workflows use this admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]This policy admits duplicate push evidence only on Both workflows use this concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}
Both workflows set: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Only pull request runs can cancel in-progress runs. Every direct job has the required Draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseA The CI workflow also adds an This is an independent static review. Exact-head hosted checks must still complete successfully. You are interacting with an AI system. |
Contributor
Author
|
@coderabbitai review Review the current exact child range |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='cb458621b5cfdcec35820083bb82e19e9dc627cf'
head='e2309106eba4f41f45c770676885b27bf73aa69b'
expected_paths=$'.github/workflows/ci.yml\n.github/workflows/supply-chain.yml'
echo '== Exact range, ancestry, scope, and whitespace =='
git rev-parse "$base" "$head"
git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head"
echo 'base_is_ancestor=yes'
git diff --check "$base" "$head"
actual_paths="$(git diff --name-only "$base" "$head" | sort)"
printf '%s\n' "$actual_paths"
test "$actual_paths" = "$expected_paths"
echo 'PASS: only intended workflow files changed.'
git diff --stat "$base" "$head"
echo '== Complete exact diff =='
git diff --no-ext-diff --unified=100 "$base" "$head"
echo
echo '== Parent semantic-admission contract identity =='
contract="$(git ls-tree -r --name-only "$base" | rg '(^|/)workflow_concurrency_contract\.rs$' | head -n1)"
test -n "$contract"
printf 'contract=%s\n' "$contract"
base_contract="$(git rev-parse "$base:$contract")"
head_contract="$(git rev-parse "$head:$contract")"
printf 'base_object=%s\nhead_object=%s\n' "$base_contract" "$head_contract"
test "$base_contract" = "$head_contract"
echo 'PASS: semantic admission contract is byte-identical at range endpoints.'
git show "$head:$contract" | cat -n
echo
echo '== Head workflow sources =='
for path in .github/workflows/ci.yml .github/workflows/supply-chain.yml; do
echo "--- $path ---"
git show "$head:$path" | cat -n
done
echo
echo '== Source-accurate admission, concurrency, rerun, and Draft-guard checks =='
python3 - "$head" <<'PY'
import subprocess
import sys
head = sys.argv[1]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
admission = (
"on:\n"
" push:\n"
" branches:\n"
" - main\n"
" pull_request:\n"
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]"
)
group = (
" group: ${{ github.workflow }}-${{ github.repository }}-"
"${{ github.event_name == 'pull_request' && github.run_attempt == 1 && "
"github.event.pull_request.number || github.run_id }}"
)
cancel = " cancel-in-progress: ${{ github.event_name == 'pull_request' }}"
draft_guard = " if: github.event_name != 'pull_request' || github.event.pull_request.draft == false"
def direct_jobs(source):
lines = source.splitlines()
start = lines.index("jobs:")
section = lines[start + 1:]
starts = [
index for index, line in enumerate(section)
if line.startswith(" ") and not line.startswith(" ") and line.endswith(":")
]
result = []
for index, begin in enumerate(starts):
end = starts[index + 1] if index + 1 < len(starts) else len(section)
result.append((
section[begin].strip()[:-1],
draft_guard in section[begin + 1:end],
))
return result
failed = False
for path in paths:
source = subprocess.check_output(["git", "show", f"{head}:{path}"], text=True)
jobs = direct_jobs(source)
checks = {
"single_block_style_on": source.splitlines().count("on:") == 1,
"main_push_and_pr_admission": admission in source,
"first_attempt_pr_identity_with_rerun_run_id_fallback": source.count(group) == 1,
"pr_only_cancellation": source.count(cancel) == 1,
"all_direct_jobs_draft_guarded": bool(jobs) and all(ok for _, ok in jobs),
}
print(f"{path}: {checks}; direct_jobs={jobs}")
failed |= not all(checks.values())
raise SystemExit(failed)
PY
echo
echo '== Differences outside admission, concurrency, and Draft-guard controls =='
python3 - "$base" "$head" <<'PY'
import difflib
import subprocess
import sys
base, head = sys.argv[1:]
paths = [".github/workflows/ci.yml", ".github/workflows/supply-chain.yml"]
policy_lines = {
" branches:\n",
" - main\n",
" types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]\n",
" if: github.event_name != 'pull_request' || github.event.pull_request.draft == false\n",
}
def read(revision, path):
return subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
).splitlines(keepends=True)
def strip_policy(lines):
result, in_concurrency = [], False
for line in lines:
if line == "concurrency:\n":
in_concurrency = True
continue
if in_concurrency and line.startswith((" group:", " cancel-in-progress:")):
continue
if in_concurrency:
in_concurrency = False
if line in policy_lines:
continue
result.append(line)
return result
failed = False
for path in paths:
diff = list(difflib.unified_diff(
strip_policy(read(base, path)),
strip_policy(read(head, path)),
fromfile=f"{path}:base-filtered",
tofile=f"{path}:head-filtered",
))
if diff:
print(f"FAIL: changes outside policy controls: {path}")
print("".join(diff), end="")
failed = True
else:
print(f"PASS: no changes outside policy controls: {path}")
raise SystemExit(failed)
PY
echo
echo '== OCI cleanup command preservation =='
python3 - "$base" "$head" <<'PY'
import subprocess
import sys
base, head = sys.argv[1:]
path = ".github/workflows/ci.yml"
commands = (
'docker logs "${cid}" || true',
'docker rm --force "${cid}" >/dev/null 2>&1 || true',
)
for command in commands:
present = [
command in subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
)
for revision in (base, head)
]
print(f"{command}: base={present[0]} head={present[1]}")
if not all(present):
raise SystemExit(1)
PY
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fiLength of output: 56161 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='cb458621b5cfdcec35820083bb82e19e9dc627cf'
head='e2309106eba4f41f45c770676885b27bf73aa69b'
path='.github/workflows/ci.yml'
echo '== Focused non-policy CI changes =='
git diff --no-ext-diff --unified=24 "$base" "$head" -- "$path"
echo
echo '== OCI cleanup command preservation =='
python3 - "$base" "$head" "$path" <<'PY'
import subprocess
import sys
base, head, path = sys.argv[1:]
commands = (
'docker logs "${cid}" || true',
'docker rm --force "${cid}" >/dev/null 2>&1 || true',
)
for command in commands:
present = []
for revision in (base, head):
source = subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
)
present.append(command in source)
print(f"{command}: base={present[0]} head={present[1]}")
if not all(present):
raise SystemExit(1)
PY
echo
echo '== EXIT trap status preservation probes =='
set +e
bash -c 'cleanup() { :; }; trap cleanup EXIT; false'
printf 'function_trap_after_failure=%s\n' "$?"
bash -c "trap 'true' EXIT; false"
printf 'direct_trap_after_failure=%s\n' "$?"
bash -c "trap 'docker_logs(){ :; }; docker_rm(){ :; }; docker_logs || true; docker_rm || true' EXIT; false"
printf 'direct_cleanup_trap_after_failure=%s\n' "$?"
set -e
echo
echo '== actionlint =='
if command -v actionlint >/dev/null 2>&1; then
actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml
echo 'PASS: actionlint'
else
echo 'SKIP: actionlint is unavailable in this sandbox'
fiLength of output: 11126
Both workflows have the required admission policy: push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened, converted_to_draft, ready_for_review]This policy admits duplicate push evidence only for Both workflows use this concurrency group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.run_attempt == 1 && github.event.pull_request.number || github.run_id }}
Both workflows use PR-only cancellation: cancel-in-progress: ${{ github.event_name == 'pull_request' }}Every direct job has the required Draft guard: if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseTherefore, The CI workflow also adds an This is an independent static review. You are interacting with an AI system. |
seonghobae
merged commit Sep 5, 2026
cf60f0b
into
test/actions-concurrency-foundation-red-v1
5 checks passed
This was referenced Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #58 and stacked on #59.
Landed GREEN workflow repair
Base at merge:
#59@cb458621b5cfdcec35820083bb82e19e9dc627cfExact head:
e2309106eba4f41f45c770676885b27bf73aa69bEffective child delta was exactly
.github/workflows/ci.ymland.github/workflows/supply-chain.yml(+17/-9). The parent carried the three Rust workflow oracles. The workflows restrict duplicate push evidence to protectedmain; coalesce first-attempt PR work by workflow/repository/PR identity; isolate reruns withgithub.run_id; cancel only pull-request runs; admitopened,synchronize,reopened,converted_to_draft, andready_for_review; and guard every direct PR job withgithub.event_name != 'pull_request' || github.event.pull_request.draft == false.Exact terminal GREEN
CI
33966008873completed success on exacte2309106...after realubuntu-24.04runner assignment and exact checkout:load-contract 101306149126: success after release build, checksum-pinned k6, concurrent loopback traffic and evidence upload;oci-runtime 101306149369: success after image build, declared non-root identity and read-only least-privilege runtime;test 101306149265: success through formatting,cargo test --all-targets --locked, strict Clippy, public rustdoc, pinned coverage tooling, owned-production coverage enforcement, resolved dependency-lock verification and lock evidence upload.Supply Chain
33966008876/candidate-evidence 101306148582also completed success on the same exact head after dependency-policy audit, exact candidate image build, SPDX SBOM generation, exact-image scan, exact-source binding and evidence upload.Exact k6 artifact
9970973185/ digestsha256:2f6e8b16813a58498a12df71bc38feae33e4a6193cc426b8351ad32185eba57drecords 400 requests, zero failed requests, 400/400 HTTP-200 checks, 400/400 upstream-body checks and loopbackhttp_req_duration p(95)=1.56505725 ms, satisfyingp(95)<20. This is loopback gateway-path evidence, not WAN/TLS/H2/H3 buyer-path performance.Parent #59 exact
cb458621...independently established current hosted semantic RED before this repair: load and OCI succeeded while the workflow-concurrency test binary failed exactly the intended two foundation invariants, 11 passed / 2 failed.Fresh exact-range CodeRabbit review of
cb458621...e2309106reported no static findings; it is technical review evidence, not a human approval.Normal merge / successor authority
After both current-head workflows reached terminal success and no review thread remained, this PR was normally merged into the #59 owner branch. Merge commit is
cf60f0bce57a8ac530e8fff52fa9ae00be232f07. No force update, destructive rebase, administrative bypass or self-approval was used.#59 is now Ready on
cf60f0bc...; its newly materialized exact CI33971798747and Supply Chain33971798802supersede this PR for combined-head promotion. Do not transfer this PR's terminal GREEN to the merge commit.No protected-main merge, release, canary, cutover or legacy-removal credit is claimed.