fix(noema): validate stable OIDC exchange envelope - #834
Conversation
📝 WalkthroughWalkthroughNoema OIDC 교환 응답에 fail-closed 검증을 추가했습니다. 워크플로는 저장소에 바인딩된 ChangesNoema OIDC 응답 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant NoemaOIDC
participant GitHubWorkflow
participant jq
NoemaOIDC->>GitHubWorkflow: OIDC 교환 응답 반환
GitHubWorkflow->>jq: 응답 envelope 및 저장소 메타데이터 검증
jq-->>GitHubWorkflow: 검증 결과와 data.token 반환
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the unchanged exact head |
|
|
|
@coderabbitai review Re-review only the unchanged exact head |
|
I will limit the review to the four-file Noema OIDC response-envelope repair. I will not use evidence from superseded PR
|
|
@coderabbitai review Re-review only unchanged exact head |
|
I will limit the review to the four-file Noema OIDC success-envelope repair. I will not use evidence from superseded PR ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@coderabbitai review @cwl-noema-review @opencode-agent Review only exact current head |
|
I will verify the specified OIDC envelope validation, token handling, diagnostic safety, and unchanged fallback and permission boundaries. I will not modify, merge, retarget, or alter credentials.
|
|
@opencode-agent review Evaluate exact current head |
|
Exact-current-head review request for Review the bounded four-file Noema OIDC consumer repair: accept only Keep the exact head unchanged. Do not transfer #822 evidence, synthesize author approval, accept the old top-level token shape, expose response/token data, alter credential fallbacks or reviewer identity, update the branch, merge, release, or bypass protection. After protected integration, operational acceptance still requires a real OIDC exchange proving the validated envelope reaches extraction without disclosure. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== revision verification =='
git rev-parse HEAD
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
git merge-base --is-ancestor "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
echo
echo '== bounded diff =='
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo
echo '== workflow outline =='
ast-grep outline .github/workflows/noema-review.yml --items all || true
echo
echo '== test outline =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all || true
echo
echo '== workflow references relevant to credentials, outputs, diagnostics, and OIDC =='
rg -n -i -C 8 \
'(oidc|noema|token|github_output|github app|app[_ -]?token|pat|permissions|reviewer|nvidia|model|curl|jq)' \
.github/workflows/noema-review.yml
echo
echo '== contract test source =='
cat -n tests/test_noema_oidc_exchange_contract.pyLength of output: 35934 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='834'
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
echo '== response-contract references =='
rg -n -C 5 \
'(token_expires_at|workflow_ref|target_repository|response envelope|data\.token)' \
. \
-g '!docs/doctoring/noema-oidc-exchange-envelope.md' \
-g '!tests/test_noema_oidc_exchange_contract.py' \
-g '!CHANGELOG.md' \
-g '!**/.git/**' || true
echo
echo '== PR identity and exact-head state =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{number, state, draft, mergeable, merge_commit_sha, base_sha: .base.sha, head_sha: .head.sha, changed_files, review_comments, commits}'
echo
echo '== check runs attached to exact head =='
gh api --paginate "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url, head_sha}' || true
echo
echo '== statuses attached to exact head =='
gh api --paginate "repos/${repo}/commits/${head_sha}/status?per_page=100" \
--jq '.statuses[] | {context, state, target_url, updated_at}' || true
echo
echo '== unresolved PR review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body path line } } }
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}' || trueLength of output: 63301
I verified exact head The OIDC consumer now requires The workflow masks GitHub reports this exact head as mergeable with zero unresolved review threads. The inspected security and supply-chain checks are associated with this head and have successful conclusions where applicable. I did not treat skipped or neutral jobs as passing evidence. The expiry field has presence and string-type validation. A real post-integration exchange is still required to verify the provider envelope, extraction path, and token non-disclosure in the GitHub Actions environment. 🧠 Learnings usedYou are interacting with an AI system. |
Live sole-collaborator canary for the OIDC response-envelope repairEmbedRelay PR #3 at exact head The supported non-author review path therefore depends on the installed Noema/OpenCode reviewer App chain. This makes the After this PR reaches protected central |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='834'
echo '== revision and scope =='
printf 'checked-out HEAD: '; git rev-parse HEAD
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
git merge-base --is-ancestor "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo '== workflow relevant context =='
rg -n -i -C 12 \
'(oidc|noema|token_response|app_token|data\.token|github_output|github app|app[_ -]?token|pat|permissions|reviewer|nvidia|model|curl|jq)' \
.github/workflows/noema-review.yml
echo '== contract tests =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all
cat -n tests/test_noema_oidc_exchange_contract.py
echo '== reviewer edit boundary =='
if [ -f opencode.jsonc ]; then
rg -n -C 4 '"edit"\s*:\s*"(deny|allow)"' opencode.jsonc
else
echo 'opencode.jsonc is absent'
fi
echo '== exact-head PR state, check runs, and review threads =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{state, draft, mergeable, base_sha: .base.sha, head_sha: .head.sha, changed_files, review_comments}'
gh api --paginate "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, head_sha}' || true
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}'Length of output: 44773
I verified exact head The OIDC exchange accepts only The workflow applies The GitHub App and PAT fallback order is unchanged. The reviewer/model routing, NVIDIA behavior, workflow permissions, and reviewer GitHub reports this exact head as mergeable. The current-head review threads are resolved. The inspected terminal-success checks belong to this exact head. I did not count skipped or neutral checks as passing evidence. A real post-integration OIDC exchange remains necessary to prove the provider response, extraction path, and token non-disclosure in GitHub Actions. This request invoked 🧠 Learnings usedYou are interacting with an AI system. |
|
Fresh policy RCA is tracked in #948. Protected |
|
@opencode-agent review Re-evaluate exact current head |
Pull request was converted to draft
|
Current owner-boundary checkpoint (freshly revalidated 2026-08-30 KST): existing The causal producer/consumer defect is still present in protected central truth: Preserve the repairs already present on #834 while converging: consume only validated Noema-side acceptance after protected central integration remains one real OIDC exchange using the then-current audited central workflow SHA, proving the |
|
@coderabbitai review Review only exact current head |
|
Scheduled review-feedback autofix for this PR head.
|
|
Fresh Noema consumer canary / owner handoff (2026-09-03): protected This PR is currently Downstream acceptance remains: after protected integration, Noema must execute a real OIDC exchange canary bound to the then-current protected central workflow source and prove validated |
|
Fresh downstream Noema consumer revalidation against protected Current #834 authority is now |
Only CHANGELOG.md conflicted (both branches independently appended distinct Fixed bullets) -- kept both. noema-review.yml auto-merged cleanly with the data.token envelope fix intact and verified present in the merged file. Confirmed this fix is not superseded: main's current noema-review.yml still reads the nonexistent top-level `.token` from the OIDC exchange response (the bug this PR describes), so the repair remains genuinely needed. Verified post-merge: coverage run -m pytest tests -q (2778 passed, 1 skipped, 21 subtests), coverage report --fail-under=100 (100%), interrogate (100%). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Resolved the merge conflict against current `main` (previous CHANGES_REQUESTED was `mergeStateStatus: DIRTY` only). New head `50219fb2` merges cleanly — only `CHANGELOG.md` had a real content conflict (both branches independently appended distinct `### Fixed` bullets); kept both. `noema-review.yml` auto-merged cleanly and the `data.token` envelope fix is confirmed present and intact in the merged file. Confirmed this bug is not fixed some other way: main's current `noema-review.yml` still reads the nonexistent top-level `.token` from the OIDC exchange response, so this repair remains genuinely needed. Post-merge verification: `coverage run -m pytest tests -q` → 2778 passed, 1 skipped, 21 subtests; `coverage report --fail-under=100` → 100%; `interrogate` → 100%. 🤖 Generated with Claude Code |
…review runs
`active_review_run_refs` matched a workflow run's `name` exactly against the
review workflow aliases. But eight workflows in this repository define
`run-name:`, and that set contains every workflow whose runs this matcher looks
for -- `opencode-review.yml` ("Required OpenCode Review"),
`opencode-review-dispatch.yml` ("OpenCode Review Dispatch") and `strix.yml`
("Strix Security Scan"). For such a workflow GitHub reports the *rendered* run
name in `name` -- the same string as `display_title`, e.g.
OpenCode Review Dispatch #834e748ee6...
Sampled 2026-09-07: 100 of 100 opencode-review-dispatch runs carry that form
and none carries the bare workflow name. So the exact match dropped every
production dispatch run at this line, before the `event == "repository_dispatch"`
branch immediately below that exists to read them. Two consequences:
* `already_running` never suppressed a same-head repeat. .github#1529 took 27
dispatches on one unchanged head over 100.8 hours; each new run's creation
preceded the previous run's cancellation by about three seconds, so the
previous run was demonstrably still active when the check ran and did not
see it.
* `stale` never populated, so older-head central runs were never cancelled.
A first count of the live queue said "20 duplicates of 45 active runs" and was
wrong: it grouped by repository and PR without the workflow, so runs of
different dispatch workflows on one PR were counted as duplicates of each other.
Regrouped by (workflow, repository, PR):
active repository_dispatch runs, queued + in_progress 33
codeql-scan-dispatch.yml 25 runs / 12 keys / 13 same-head duplicates
opencode-review-dispatch.yml 5 runs / 5 keys / 0 duplicates
pr-review-autofix.yml 3 runs / 3 keys / 0 duplicates
So the workflows this matcher governs show no live duplication at this instant.
The harm this fix addresses is the historical chain on .github#1529 and a
suppression that has never once fired, not a backlog visible right now. The 13
duplicates all belong to CodeQL Scan Dispatch, which this matcher does not
govern; that workflow also defines `run-name:`, which makes it a separate lead
rather than evidence for this change. Reviving stale cancellation is separately
safe: of 163 non-terminal central runs, 49 are review or dispatch
kind and 4 become cancellable, all of them subjects that no longer exist (3
closed or merged PRs, 1 moved head).
The fix is confined to the run comparison. `OPENCODE_WORKFLOW_NAMES` is
unchanged, because its other consumer compares a *workflow* object's name,
which is genuinely bare. `active_review_run_refs` has exactly two call sites,
OpenCode's and Strix's, so both are fixed here; the Strix side is pinned by its
own test so a later narrowing to the OpenCode aliases cannot silently reopen
half of it.
Note the new behaviour this enables: while a same-head central run is active,
a repeat is now suppressed. A run that never terminates would therefore hold
the PR, where before the check simply never fired.
The existing fixture sets a bare `name` beside a rendered `display_title`, a
payload GitHub never emits for a `run-name:` workflow, which is why 100 percent
line coverage of that branch never revealed that production could not reach it.
Developer experience: the scheduler's same-head suppression and stale-run
cancellation work against real payloads instead of a shape only the tests
produce.
User experience: a pull request stops accumulating duplicate concurrent review
runs that cancel each other, so a review that starts can finish.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…review runs
`active_review_run_refs` matched a workflow run's `name` exactly against the
review workflow aliases. But eight workflows in this repository define
`run-name:`, and that set contains every workflow whose runs this matcher looks
for -- `opencode-review.yml` ("Required OpenCode Review"),
`opencode-review-dispatch.yml` ("OpenCode Review Dispatch") and `strix.yml`
("Strix Security Scan"). For such a workflow GitHub reports the *rendered* run
name in `name` -- the same string as `display_title`, e.g.
OpenCode Review Dispatch #834e748ee6...
Sampled 2026-09-07: 100 of 100 opencode-review-dispatch runs carry that form
and none carries the bare workflow name. So the exact match dropped every
production dispatch run at this line, before the `event == "repository_dispatch"`
branch immediately below that exists to read them. Two consequences:
* `already_running` never suppressed a same-head repeat. .github#1529 took 27
dispatches on one unchanged head over 100.8 hours; each new run's creation
preceded the previous run's cancellation by about three seconds, so the
previous run was demonstrably still active when the check ran and did not
see it.
* `stale` never populated, so older-head central runs were never cancelled.
A first count of the live queue said "20 duplicates of 45 active runs" and was
wrong: it grouped by repository and PR without the workflow, so runs of
different dispatch workflows on one PR were counted as duplicates of each other.
Regrouped by (workflow, repository, PR):
active repository_dispatch runs, queued + in_progress 33
codeql-scan-dispatch.yml 25 runs / 12 keys / 13 same-head duplicates
opencode-review-dispatch.yml 5 runs / 5 keys / 0 duplicates
pr-review-autofix.yml 3 runs / 3 keys / 0 duplicates
So the workflows this matcher governs show no live duplication at this instant.
The harm this fix addresses is the historical chain on .github#1529 and a
suppression that has never once fired, not a backlog visible right now. The 13
duplicates all belong to CodeQL Scan Dispatch, which this matcher does not
govern; that workflow also defines `run-name:`, which makes it a separate lead
rather than evidence for this change. Reviving stale cancellation is separately
safe: of 163 non-terminal central runs, 49 are review or dispatch
kind and 4 become cancellable, all of them subjects that no longer exist (3
closed or merged PRs, 1 moved head).
The fix is confined to the run comparison. `OPENCODE_WORKFLOW_NAMES` is
unchanged, because its other consumer compares a *workflow* object's name,
which is genuinely bare. `active_review_run_refs` has exactly two call sites,
OpenCode's and Strix's, so both are fixed here; the Strix side is pinned by its
own test so a later narrowing to the OpenCode aliases cannot silently reopen
half of it.
This is one instance of a class, and the file already contains the stable form.
`run.name` is compared as an identifier at four places -- `:1250`, `:3198`,
`:3254` (this one) and `:3783` -- while `:3060` keys on
`run.get("workflow_id") or run.get("path") or run.get("name")`, which cannot be
rewritten by a `run-name:`. `:1250` in particular feeds the REST fallback's
workflow-level policy boundary and would see a rendered title where it expects a
workflow name. Fixing the whole class means moving the callers from display
names to paths, which also touches how `dispatch_title_prefixes` is built, so it
is deliberately left out of this change; .github#1941 is the same root seen from
the `display_title` side. Recorded here so the next reader does not rediscover
it as a fifth instance.
Note the new behaviour this enables: while a same-head central run is active,
a repeat is now suppressed. A run that never terminates would therefore hold
the PR, where before the check simply never fired.
The existing fixture sets a bare `name` beside a rendered `display_title`, a
payload GitHub never emits for a `run-name:` workflow, which is why 100 percent
line coverage of that branch never revealed that production could not reach it.
Developer experience: the scheduler's same-head suppression and stale-run
cancellation work against real payloads instead of a shape only the tests
produce.
User experience: a pull request stops accumulating duplicate concurrent review
runs that cancel each other, so a review that starts can finish.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…review runs (#1983) `active_review_run_refs` matched a workflow run's `name` exactly against the review workflow aliases. But eight workflows in this repository define `run-name:`, and that set contains every workflow whose runs this matcher looks for -- `opencode-review.yml` ("Required OpenCode Review"), `opencode-review-dispatch.yml` ("OpenCode Review Dispatch") and `strix.yml` ("Strix Security Scan"). For such a workflow GitHub reports the *rendered* run name in `name` -- the same string as `display_title`, e.g. OpenCode Review Dispatch #834e748ee6... Sampled 2026-09-07: 100 of 100 opencode-review-dispatch runs carry that form and none carries the bare workflow name. So the exact match dropped every production dispatch run at this line, before the `event == "repository_dispatch"` branch immediately below that exists to read them. Two consequences: * `already_running` never suppressed a same-head repeat. .github#1529 took 27 dispatches on one unchanged head over 100.8 hours; each new run's creation preceded the previous run's cancellation by about three seconds, so the previous run was demonstrably still active when the check ran and did not see it. * `stale` never populated, so older-head central runs were never cancelled. A first count of the live queue said "20 duplicates of 45 active runs" and was wrong: it grouped by repository and PR without the workflow, so runs of different dispatch workflows on one PR were counted as duplicates of each other. Regrouped by (workflow, repository, PR): active repository_dispatch runs, queued + in_progress 33 codeql-scan-dispatch.yml 25 runs / 12 keys / 13 same-head duplicates opencode-review-dispatch.yml 5 runs / 5 keys / 0 duplicates pr-review-autofix.yml 3 runs / 3 keys / 0 duplicates So the workflows this matcher governs show no live duplication at this instant. The harm this fix addresses is the historical chain on .github#1529 and a suppression that has never once fired, not a backlog visible right now. The 13 duplicates all belong to CodeQL Scan Dispatch, which this matcher does not govern; that workflow also defines `run-name:`, which makes it a separate lead rather than evidence for this change. Reviving stale cancellation is separately safe: of 163 non-terminal central runs, 49 are review or dispatch kind and 4 become cancellable, all of them subjects that no longer exist (3 closed or merged PRs, 1 moved head). The fix is confined to the run comparison. `OPENCODE_WORKFLOW_NAMES` is unchanged, because its other consumer compares a *workflow* object's name, which is genuinely bare. `active_review_run_refs` has exactly two call sites, OpenCode's and Strix's, so both are fixed here; the Strix side is pinned by its own test so a later narrowing to the OpenCode aliases cannot silently reopen half of it. This is one instance of a class, and the file already contains the stable form. `run.name` is compared as an identifier at four places -- `:1250`, `:3198`, `:3254` (this one) and `:3783` -- while `:3060` keys on `run.get("workflow_id") or run.get("path") or run.get("name")`, which cannot be rewritten by a `run-name:`. `:1250` in particular feeds the REST fallback's workflow-level policy boundary and would see a rendered title where it expects a workflow name. Fixing the whole class means moving the callers from display names to paths, which also touches how `dispatch_title_prefixes` is built, so it is deliberately left out of this change; .github#1941 is the same root seen from the `display_title` side. Recorded here so the next reader does not rediscover it as a fifth instance. Note the new behaviour this enables: while a same-head central run is active, a repeat is now suppressed. A run that never terminates would therefore hold the PR, where before the check simply never fired. The existing fixture sets a bare `name` beside a rendered `display_title`, a payload GitHub never emits for a `run-name:` workflow, which is why 100 percent line coverage of that branch never revealed that production could not reach it. Developer experience: the scheduler's same-head suppression and stale-run cancellation work against real payloads instead of a shape only the tests produce. User experience: a pull request stops accumulating duplicate concurrent review runs that cancel each other, so a review that starts can finish. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
efea864642374d54d3737ad4dff2fca3fcb7c58a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724544/job/101781778028)
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724544/job/101781776110)
- CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724544/job/101781778028)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724544/job/101781776110)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724617/job/101713962840)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724697/job/101713937677)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724697/job/101713937677)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34107724617/job/101713962840)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: noema-oidc-exchange-envelope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: noema-oidc-exchange-envelope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_noema_oidc_exchange_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_noema_oidc_exchange_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
8eddfc70d8f01201ebdc998fc7dbfb953441620b. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34182965777/job/101949109993)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34182965777/job/101949109993)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34182966017/job/101928079837)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34182966017/job/101928079837)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: noema-oidc-exchange-envelope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: noema-oidc-exchange-envelope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_noema_oidc_exchange_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_noema_oidc_exchange_contract.py"]
R4 --> V4["targeted test run"]
1 participant
RCA
Protected
mainreads Noema's stable OIDC exchange response from a nonexistenttop-level
.token. Noema publishes the credential underdata.tokentogetherwith repository, workflow, expiry, and trace evidence, so the consumer
misdiagnoses a producer/consumer schema mismatch as a missing credential.
Current-main repair
ok: true, object-valueddata, and a non-empty visible-ASCIIdata.tokenwithout trimming or normalization;GITHUB_WORKFLOW_REF;data.token_expires_atwith zero to threefractional-second digits and a non-empty
trace_id;routing, permissions, and merge authority.
The effective diff is limited to the workflow, its executable regression
contract, APA 7 doctoring, one changelog entry, and removal of one unused
test-only import. The regression executes the production shell body and proves
valid acceptance plus fail-closed rejection of the old top-level token, wrong
repository/workflow, expired, offset, calendar-invalid, malformed, or
over-precision timestamps, missing trace evidence, and CR/LF/space/non-ASCII
token bytes.
Governance
This replaces the stale #822 implementation but inherits none of its checks,
reviews, or approvals. Merge remains prohibited until every required check is
terminal on the unchanged exact head, all valid threads are resolved, and a
qualifying independent current-head approval satisfies protected-branch policy.
Local green evidence and mergeability are not approval.
After protected integration, execute one real Noema exchange and confirm the
bound response reaches masked token export without exposing the credential.
Current exact-head evidence
Head:
ff25d7a67c3b82c0389b8eaa2f913f990a2940edBase:
7b1a028e704a98ae8a807bb827f44aeaee0399afAncestry: regular merge history,
0 behind / 22 ahead, five-file effective diff.Secret Scan, Scorecard, SBOM, Strix changed-path quality, Required OpenCode,
Required Noema, scheduler, close-empty, and bootstrap paths. Cancelled and
skipped evidence is non-passing.
main@7b1a028e704a98ae8a807bb827f44aeaee0399afstill reads thenonexistent top-level
.token, so this consumer repair remains required.Merge is nevertheless prohibited until fresh exact-head review, security,
provenance, and quality evidence is terminal-clean on one unchanged head.