fix(codeql): recover reruns after missing dispatch verdict - #1902
fix(codeql): recover reruns after missing dispatch verdict#1902seonghobae wants to merge 55 commits into
Conversation
|
Warning Review limit reachedNext included review available in 1 minute. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughCodeQL 재실행은 ChangesCodeQL 재실행 복구
SARIF 게시 경계
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to A stale same-head CodeQL verdict could be reused after the PR base changes, potentially completing the required workflow without a verdict for the current scan context. Resolve the status provenance gap before merge. Sequence Diagram(s)sequenceDiagram
participant AnalyzeHead
participant GitHubPRAPI
participant GitHubStatusesAPI
participant CodeQLScanDispatch
participant SARIFArtifactStore
AnalyzeHead->>GitHubPRAPI: live PR base와 head 조회
AnalyzeHead->>GitHubStatusesAPI: 전체 commit statuses 조회
GitHubStatusesAPI-->>AnalyzeHead: terminal verdict 또는 없음
AnalyzeHead->>CodeQLScanDispatch: verdict가 없으면 CodeQL 샤드 디스패치
CodeQLScanDispatch->>SARIFArtifactStore: SARIF evidence 업로드
SARIFArtifactStore-->>CodeQLScanDispatch: sarif_upload outcome 반환
CodeQLScanDispatch->>GitHubStatusesAPI: 성공한 경우에만 terminal 상태 게시
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Exact-head verification sweep for Accordingly the executable test-first regression and minimal source repair remain a development candidate, not hosted GREEN or merge-ready evidence. ADR 0025 is still Proposed and its attempt-one/attempt-two prose must be reconciled before this Draft can advance; do not mark it Accepted merely because the recovery defect is understood. |
|
Non-force restack completed on protected Keep Draft: ADR 0025 still describes the older "attempt one dispatch / attempt two verdict read" sequence and must be made code-current before merge, and this restacked exact head still needs its own full test/coverage/docstring/workflow/security/review evidence. After ordinary protected integration, acceptance remains rerunning unchanged accounting-platform #49 and observing authenticated terminal |
|
Fresh owner-head adoption: protected Keep Draft. This restack does not address the still-stale ADR 0025 and predecessor checks/reviews do not transfer. Require all evidence on |
|
Additional unchanged-head consumer evidence for this owner defect, 2026-09-05:
Owner RED: a consumer can obtain runner assignment and successfully request the exact-head CodeQL scan, yet the compatibility workflow never receives an authenticated terminal GREEN acceptance remains central: after #1902's recovery semantics land on protected |
|
Fresh protected-main sweep found This comment supersedes the PR body's older current-head/base sentence. Exact development head is now |
|
Fresh canonical-owner verification from AIP consumer lane:
The corresponding trusted |
|
/opencode Current owner-path head is Read and adopt the intervening protected-main delta as a normal descendant; do not force-push or destructively rebase. The intervening merged #1943 changes Preserve the evidence-driven recovery contract: After the non-force adoption, run the focused rerun-recovery contracts plus complete central workflow tests/security/coverage/docstring gates on the new exact head, then update the PR body to the new protected-main parent and exact evidence. Keep Draft until those gates and independent review are terminal. |
|
Non-force protected-main adoption completed. New exact head: No force update or destructive rebase was used. Exact-head SAST |
|
Fresh LineageWeave downstream canary for the rerun-recovery contract: |
…scape a line-leading #1939 The 22:20Z paragraph of signature 3 still counted #1902's green job as a noema-review success; it was a draft skip with a 1 s verdict step, as the stage-level tally further down already says. Wrap the line-leading #1939 reference in inline code (MD018). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BV96rXhqoR3tYZ9AeAVur4
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='e72ae30e3e989396b8cfdd1d850f7db1f45c6a7e'
base='efb8926923de45245338159a489a1b227e81945f'
echo '== HEAD and parents =='
git rev-parse HEAD
git show -s --format='%H%nparents: %P%nsubject: %s' "$head_expected"
echo '== Parent ancestry =='
git merge-base --is-ancestor "$base" "$head_expected" && echo "base-is-ancestor=true"
git diff-tree --no-commit-id --name-status -r "$head_expected"
echo '== Changed paths relative to protected main =='
git diff --name-status "$base" "$head_expected"
echo '== Intervening main changes preserved by merge result =='
git diff --name-status "${head_expected}^1" "$base"
echo '== Four target path blob IDs: base vs head =='
for path in \
'.github/workflows/codeql-pr.yml' \
'docs/adr/0025-codeql-pr-rerun-recovery.md' \
'docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.md' \
'tests/test_codeql_pr_rerun_recovery_contract.py'
do
printf '%s\n' "$path"
git rev-parse "$base:$path" 2>&1 || true
git rev-parse "$head_expected:$path" 2>&1 || true
done
echo '== Candidate files =='
fd -a 'codeql-pr.yml|0025.*codeql|codeql-rerun-pre-runner|test_codeql_pr_rerun_recovery_contract.py' . \
-E .git -E node_modules -E dist -E build
echo '== Workflow outline / security-sensitive snippets =='
rg -n -C 6 \
'run_attempt|codeql-dispatch|repository_dispatch|id-token|ACTIONS_ID_TOKEN_REQUEST|create-github-app-token|concurrency|verdict|creator|statuses|sha|head_sha|language|pending|fail.closed|dispatch' \
.github/workflows/codeql-pr.yml
echo '== Focused regression and doctoring/ADR =='
cat -n tests/test_codeql_pr_rerun_recovery_contract.py
printf '\n== ADR ==\n'
cat -n docs/adr/0025-codeql-pr-rerun-recovery.md
printf '\n== Doctoring ==\n'
cat -n docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.mdLength of output: 24265 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='e72ae30e3e989396b8cfdd1d850f7db1f45c6a7e'
prior='2d4624a3998baf79944d2a76b2a3367946b0d923'
base='efb8926923de45245338159a489a1b227e81945f'
echo '== Exact owned diff against protected main =='
git diff --find-renames --find-copies --stat "$base" "$head"
git diff --find-renames --find-copies -- .github/workflows/codeql-pr.yml "$base" "$head"
echo '== PR-owned changes relative to prior PR parent =='
git diff --name-status "$prior" "$head"
git diff -- .github/workflows/codeql-pr.yml \
docs/adr/0025-codeql-required-workflow-dispatch-architecture.md \
docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.md \
tests/test_codeql_pr_rerun_recovery_contract.py \
"$prior" "$head"
echo '== Merge tree agreement with protected main outside owned paths =='
python3 - <<'PY'
import subprocess
head = 'e72ae30e3e989396b8cfdd1d850f7db1f45c6a7e'
base = 'efb8926923de45245338159a489a1b227e81945f'
owned = {
'.github/workflows/codeql-pr.yml',
'docs/adr/0025-codeql-required-workflow-dispatch-architecture.md',
'docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.md',
'tests/test_codeql_pr_rerun_recovery_contract.py',
}
def entries(rev):
raw = subprocess.check_output(['git', 'ls-tree', '-r', '-z', rev])
return {
item.split(b'\t', 1)[1].decode(): item.split(b'\t', 1)[0].decode().split()[2]
for item in raw.split(b'\0') if item
}
h, b = entries(head), entries(base)
unexpected = sorted(
p for p in set(h) | set(b)
if p not in owned and h.get(p) != b.get(p)
)
print('unexpected-path-count=' + str(len(unexpected)))
print('\n'.join(unexpected))
PY
echo '== Corrected ADR and doctoring note =='
cat -n docs/adr/0025-codeql-required-workflow-dispatch-architecture.md
cat -n docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.md
echo '== CodeQL handler candidates =='
fd -a -i 'codeql*' .github tests -E .git -E node_modules -E dist -E build
echo '== Handler workflow references =='
rg -n -C 5 'codeql-scan|codeql-dispatch|required_run_id|required_job_id|required_language|repository_dispatch|concurrency|createCommitStatus|statuses' \
.github/workflows testsLength of output: 202709 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='e72ae30e3e989396b8cfdd1d850f7db1f45c6a7e'
prior='2d4624a3998baf79944d2a76b2a3367946b0d923'
base='efb8926923de45245338159a489a1b227e81945f'
echo '== Compact merge and scope verification =='
git show -s --format='head=%H%nparents=%P' "$head"
printf 'merge-base='; git merge-base "$prior" "$base"
printf 'base..head paths:\n'; git diff --name-status "$base" "$head"
python3 - <<'PY'
import subprocess
head='e72ae30e3e989396b8cfdd1d850f7db1f45c6a7e'
base='efb8926923de45245338159a489a1b227e81945f'
owned=frozenset((
'.github/workflows/codeql-pr.yml',
'docs/adr/0025-codeql-required-workflow-dispatch-architecture.md',
'docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.md',
'tests/test_codeql_pr_rerun_recovery_contract.py',
))
def tree(ref):
return {line.split('\t',1)[1]:line.split()[2]
for line in subprocess.check_output(['git','ls-tree','-r',ref],text=True).splitlines()}
left,right=tree(head),tree(base)
print('non-owned tree differences:', [p for p in sorted(set(left)|set(right)) if p not in owned and left.get(p)!=right.get(p)])
PY
echo '== Exact workflow delta =='
git diff --unified=30 "$prior" "$head" -- .github/workflows/codeql-pr.yml
echo '== ADR delta =='
git diff --unified=12 "$prior" "$head" -- docs/adr/0025-codeql-required-workflow-dispatch-architecture.md
echo '== CodeQL handler structure =='
cat -n .github/workflows/codeql-scan-dispatch.yml | sed -n '1,460p'
echo '== CodeQL-specific test inventory =='
fd -a -i '*codeql*' tests .github/workflows -E .git | sort
echo '== CodeQL-specific assertions =='
rg -n -C 3 'codeql-scan|codeql-dispatch|required_run_id|required_job_id|required_language|RUN_ATTEMPT|OIDC|concurrency|rerun-failed-jobs|statuses' \
tests/test_code_scanning_required_workflow_contract.py \
tests/test_codeql_pr_rerun_recovery_contract.py \
tests/test_required_workflow_queue_contract.py \
tests/test_scheduler_and_codeql_dispatch_runner_image_contract.pyLength of output: 28847 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='e72ae30e3e989396b8cfdd1d850f7db1f45c6a7e'
base='efb8926923de45245338159a489a1b227e81945f'
echo '== Workflow diff from protected main =='
git diff --unified=25 "$base" "$head" -- .github/workflows/codeql-pr.yml
echo '== ADR diff from protected main =='
git diff --unified=20 "$base" "$head" -- docs/adr/0025-codeql-required-workflow-dispatch-architecture.md
echo '== Recovery test and doctoring additions =='
git diff --unified=8 "$base" "$head" -- \
tests/test_codeql_pr_rerun_recovery_contract.py \
docs/doctoring/codeql-rerun-pre-runner-cancellation-recovery.md
echo '== Handler status publication and exact rerun tail =='
cat -n .github/workflows/codeql-scan-dispatch.yml | sed -n '407,620p'
echo '== CodeQL tests and targeted contract references =='
fd -a -i '.*codeql.*' tests .github/workflows -E .git | sort
rg -n -C 4 'codeql-scan|codeql-dispatch|required_run_id|required_job_id|required_language|rerun-failed-jobs|RUN_ATTEMPT' \
tests/test_code_scanning_required_workflow_contract.py \
tests/test_codeql_pr_rerun_recovery_contract.py \
tests/test_required_workflow_queue_contract.py \
tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py \
2>/dev/null || trueLength of output: 47536
Finding
The rest of the requested controls remain present after inspection:
I did not execute repository tests in this inspection environment. You are interacting with an AI system. |
|
Ready-for-review restored at exact event Fresh state before transition: protected base |
|
Draft transition at |
|
Canonical successor integration complete at exact head Review of Draft #2039 identified two valid test-only semantics not yet explicit in the canonical writer: (1) explicit empty producer jobs/artifacts must not acquire fixture defaults, and (2) App identity never substitutes for exact producer-run metadata. Both are now integrated. RED reproduced empty-evidence defaulting; the event/path/head/repository/actor/triggering-actor substitution matrix is fail-closed on the production path. Other #2039 deltas are already carried by equal or stronger canonical failure-state, malformed-evidence, pagination, and receipt-identity cases. Exact-tree GREEN: focused two-workflow contracts Protected-base comparison is |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e07e8fd503
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Current-head RCA checkpoint —
The PR remains Draft; neither thread was resolved. I did not overlap the active writer with a partial source change. |
|
Fresh live canary from fast-mlsirm should be folded into this canonical CodeQL rerun-recovery lane, not repaired in the leaf. Protected central authority is still
No leaf source/no-op commits were used. This evidence strengthens the existing single-settlement design requirement: convergence needs to be intrinsic to the workflow, not depend on manually choosing one failed matrix job. The #1902 RED/GREEN set should cover a post-dispatch rerun attempt where GitHub re-materializes sibling matrix jobs but not the coordinator, and prove the attempt cannot leave any required language shard permanently failed merely because a sibling settles before the requested rerun acquires a runner. This appears compatible with your current P1 findings rather than a competing lane: authenticate predecessor-handler receipts across mixed-matrix settlement, and bind one attempt to one base SHA. Please preserve exact repo/PR/live-base/head/language/required-run/source/SARIF/artifact binding and fail closed. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head integration review for 855f0173aae53620f68322e3b218c022fe1c4eed.
The non-force merge preserves RED 48baf18c11e4d942748b33cf7c94e15fe7fde7bb and the 723d1c368b459ce5646d5ebc91ce9546bbe5fc70 repair. Shard and coordinator admission now validate the live repository/ref/head and bind newly issued context/title/payload evidence to the fresh live base SHA; the old event-base receipt cannot match. Both status consumers also validate every candidate and normalize by (run_id,state), accepting a verdict only when exactly one evidence-complete producer remains. The earlier base-advance and first-complete-status-order findings are therefore resolved on this exact head.
This does not open merge admission. Two separate current-source P1 threads remain unresolved: run-wide settlement cannot yet authenticate a terminal predecessor-handler receipt for an already-complete language, and independently admitted matrix shards can bind different live base SHAs within one required attempt. The PR should remain Draft until both receive executable RED→GREEN repair.
Hosted evidence for this exact SHA is non-terminal: CodeQL 34201420308 is pending; Runtime Quality 34201420253, SAST 34201420286, Security Scan 34201420237, and Python Security 34201420195 are queued. No predecessor result is promoted.
|
Exact-head repair is now integrated at This resolves both current P1 findings in source:
The concurrent RED/test delta and product Gap entry are preserved. A contradictory per-shard live-base success expectation was converted to an explicit fail-closed regression under the stronger attempt-wide invariant. Exact-tree GREEN: focused Protected base comparison is |
|
Exact-head review finding for The two earlier P1 paths are materially addressed, and the exact blobs pass the two focused workflow suites (
A separate liveness condition also remains in the attempt-wide base repair. These are source findings, not hosted-check or approval evidence. Keep Draft until RED→GREEN and fresh exact-head review. |
|
Ready-for-review admission was restored at |
|
Current-head coordination for |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87228f918f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Exact-head gate-proof repair integrated at TDD evidence:
The independent whole-attempt base-advance recovery finding remains open, so this PR stays Draft. Fresh hosted runs |
|
Exact-head repair for the current post-capture base-advance finding is now published at The coordinator now proves the live base ref, adopts the fresh live base SHA, emits The concurrent predecessor-gate repair is preserved and strengthened: shard, coordinator, and handler receipt readers now require exactly one successful SARIF-preservation step and exactly one gate step whose conclusion matches RED reproduced 13 failures, followed by one separate coordinator gate-mismatch RED. Exact-tree GREEN: focused This resolves top-level finding #5581711833 and inline review comment #3955891530 at the source level. The PR remains Draft pending a fresh exact-head/base/review/thread admission check; Ready, if restored, is review admission only and does not authorize approval, auto-merge, bypass, empty push, or manual rerun. |
|
Ready-for-review admission was restored at Immediately before transition: 55 ahead / 0 behind, mergeable, 12 changed paths, unresolved review threads 0, and no newer substantive current-source finding after repair evidence #5582176132. The prior inline P1 thread is resolved against this head. Ready is independent-review admission only; it is not approval or merge evidence. The Ready event cancelled the prior push-triggered hosted runs and registered fresh same-head gates: Python Security No auto-merge, approval, protection bypass, empty push, manual rerun, force update, or stale-head evidence transfer was performed. |
1 participant
Root causes
The required
CodeQL PRworkflow treatedrun_attemptas proof that an earlier attempt dispatched. That is false after pre-runner cancellation. Terminal statuses and fallback receipts also lacked complete pagination, current target/base/run/source binding, unique evidence-complete producer selection, and preserved-SARIF proof. Later review exposed interacting liveness failures: independently scheduled matrix shards could adopt different live base SHAs; run-wide settlement could not combine an authenticated predecessor receipt with current direct evidence; and a protected-base advance after attempt capture had no automated recovery path.Current canonical scope
ebf054e67f7dbeb7c9b8d0f90e2bc1c151471a2b03a9ebd2ffc3504e52028499402b703394b5430emain@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db7ca416ee…Scheduler/Strix deltas formerly mixed into this history remain carried by successor #1999 and are not reintroduced. Cross-repository credential authority remains the separate #1929 boundary.
Exact-bound repair
rerun_mode=all, require the complete terminal matrix map, and request the exact required run's whole-run rerun endpoint. Unchanged-base recovery remains failed-job-only.A, producer sourceS, and handler runtimeTas separate identities. Admit onlyT == Sor immutable compare evidence thatSis the merge-base ancestor of newerT.github-actions[bot]fallback only through the same exact evidence boundary.actions: read; one non-matrix settlement job alone ownsactions: write.ADR-0025, doctoring, CHANGELOG, the product/technical Gap baseline, and executable shell contracts record the problem, constraints, rejected alternatives, evidence, failure scenes, effects, and follow-up.
Concurrent and successor delta preservation
The current tree preserves the concurrent
7ca416ee…predecessor gate-proof delta and extends its state-consistency contract to every receipt consumer. Draft PR #2039 remains open until hosted equivalence is observed; no predecessor evidence is transferred.Exact-tree verification
RED reproduced 13 base-recovery/rerun-mode/gate-proof failures; an additional coordinator gate-mismatch RED was then added and repaired.
129 passed in 107.53s3079 passed, 1 skipped, 21 subtests passed in 308.37s13194/13194; branch coverage:5330/5330; total100%100%python -m compileall -q scripts tests: PASSgit diff --check: cleanactionlint: unavailable; fresh hosted validation remains a merge gateAdmission and prohibitions
The current source finding about post-capture base advance is repaired on exact head
ebf054e67f7dbeb7c9b8d0f90e2bc1c151471a2b. If fresh head/base/review inspection shows no new substantive source finding, Ready may be restored solely to admit independent review. Pending hosted Checks and qualifying independent review remain later merge gates and are not approval or completion.No synthetic status, self-approval, auto-merge authorization, administrator bypass, force update, destructive rebase, mutable-branch consumption, predecessor evidence transfer, empty retrigger commit, manual rerun, or allowlist weakening is authorized.