fix(scheduler): scope Actions credentials by run host - #2002
Conversation
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough스케줄러가 워크플로 실행을 호스팅하는 저장소에 따라 Actions 자격 증명을 선택합니다. 중앙 저장소의 실행 조회와 취소에는 dispatch 자격 증명을 사용하고, 대상 저장소에는 기존 Actions 자격 증명을 사용합니다. 테스트와 결정 기록을 추가했습니다. ChangesActions 자격 증명 라우팅
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The scheduler now scopes Actions credentials to the run-hosting repository, with central and target operations covered by updated tests. No actionable merge-blocking risk remains. Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant run_github_actions_for_repository
participant GitHub_API
Scheduler->>run_github_actions_for_repository: 워크플로 실행 조회 또는 취소 요청
run_github_actions_for_repository->>GitHub_API: 중앙 저장소면 SCHEDULER_DISPATCH_TOKEN 사용
run_github_actions_for_repository->>GitHub_API: 대상 저장소면 SCHEDULER_ACTIONS_TOKEN 사용
GitHub_API-->>Scheduler: 실행 결과 반환
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 2 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
added
bug
ChatGPT Codex Connector
Baseline reproduction narrows #2005 failure ownershipIndependent clean-detached reproduction was completed against parent stack head Command: .venv/bin/python -m pytest tests/test_pr_review_merge_scheduler.py -q -k 'cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs or force_cancel_failure_logs_reason_and_does_not_raise or force_cancel_multiple_runs_reports_only_failures or workflow_starting_credentials_allow_head_mutations' --tb=shortResult: 4 failed, 330 deselected / 13.60s / terminal 1. The same four failures already exist before #2005's target-Actions-inventory omission delta:
Therefore these four are parent-stack regressions, not caused by #2005's child-only inventory-suppression delta. This does not prove that the remaining 11 failures from #2005 hosted run Canonical repair request for #2002/#2003 owner lane:
No force push, source change, close, or safety-gate weakening is requested. |
|
Exact-head repair receipt —
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head source review for b18b7ca77ba6a8cb733a4661c00d1035408c5eec: no new substantive finding in the five-file delta.
The production change is bounded to one repository-aware Actions command boundary. It selects the central runner token only when the run-host repository case-insensitively matches the configured SCHEDULER_REQUIRED_WORKFLOW_REPOSITORY, which the protected caller sets to ContextualWisdomLab/.github; every other repository retains the explicit cross-repository Actions token. Both inventory and force-cancellation pass through the same selector, including stdin, and missing/invalid authority still fails in the existing command boundary.
The three parent-baseline failures caused by one-argument cancellation doubles are repaired by accepting the production callable's existing stdin=None keyword. The tests do not bypass the new host routing or weaken the production credential checks.
This is an independent source review, not approval or hosted GREEN. Current exact-head Runtime Quality, CodeQL, security, model review, and stack admission evidence remains required. Preserve the downstream non-force #2003→#2007 stack and do not transfer predecessor evidence if this head changes.
|
Fresh exact-head verification for |
|
Current-main non-force restack receipt
PR remains Draft/Proposed. Previous-head evidence is not transferred; no force update, rebase, bypass, lifecycle toggle, or auto-merge was used. |
|
Exact-head hosted CodeQL RCA for Both current-head shards reproduce the same protected-main control-plane failure:
The dispatch itself succeeded; this is not a source/SARIF or #2002 scheduler regression. It is another exact consumer showing the canonical CodeQL receipt/wake convergence defect tracked in #1902. #2002 remains Draft and no old-head evidence is transferred. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-head review at 1528aa50c82eb46367b084faa310845c3d644cf6: no new substantive finding after the non-force protected-main restack. The PR-only five-file delta routes central hosted run inventory/cancellation through the central dispatch credential and preserves the explicit Actions credential for target repositories; repository identity is case-insensitive and stdin forwarding remains intact. Independent exact-tree scheduler suite under GITHUB_ACTIONS=true -W error: 334 passed; git diff --check clean. Hosted exact-head Runtime Quality, CodeQL, Security, SAST, and Python Security are terminal success. This COMMENT is admission evidence, not approval; a qualifying current-head approval remains a merge gate.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
1528aa50c82eb46367b084faa310845c3d644cf6. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34234420967/job/102093048010)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34234420967/job/102093048010)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34234421326/job/102088746757)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34234421326/job/102088746757)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: CHANGELOG.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: host-scoped-actions-inventory-credentials.md (2 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: host-scoped-actions-inventory-credentials.md (2 files)"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: pr_review_merge_scheduler_core.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: pr_review_merge_scheduler_core.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_pr_review_merge_scheduler.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_pr_review_merge_scheduler.py"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
|
|
Ready admission remains source-correct, but ordinary auto-merge is blocked by the fresh same-head replacement CodeQL run |
1 participant
Root cause
Central required-workflow inventory and force-cancellation were routed through the same cross-repository Actions credential used for target repositories. If the mutation App installation exhausted its independent API quota, the scheduler could not discover or cancel central current-head review runs even though the receiving workflow runner token had the required same-repository authority.
Historical owner PR #1231 contains this valid repair mixed with unrelated linter, SBOM, GPU, and mutation-credential changes on a branch 36 commits behind protected
main. This successor extracts only the independently verifiable host-scoped Actions credential boundary; #1231 remains open for complete delta reconciliation.RED → GREEN
8cc62ce8837e456dfac4f592bcbd0786a77e4b817bf3451a47768dbda903115a393b1da1d98e1dbadocs/product-technical-gap-baseline.mdAuthority and safety
main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db1528aa50c82eb46367b084faa310845c3d644cf6(parents prior fix(scheduler): scope Actions credentials by run host #2002b18b7ca77ba6a8cb733a4661c00d1035408c5eec+ protected main7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db)9ddc06460bbf4e665aec1056479d782f94e67928; GitHub compare is 5 ahead / 0 behind with only the intended five scheduler/documentation/test pathspython -W error: 375 passed across scheduler and inherited CodeQL contracts; hosted evidence is still authoritativeSummary by CodeRabbit
개선 사항
문서
테스트