fix(security): fail closed on unavailable dependency review - #897
Conversation
|
Warning Review limit reached
Next review available in: 55 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughdependency-review 게이트가 exact base/head 비교의 HTTP 200 증거만 허용하도록 변경되었습니다. 오류, 빈 응답, 부분 전송, 비정상 상태 코드는 실패 처리합니다. PR head checkout, 회귀 계약 테스트, 운영 문서를 갱신했습니다. Changes공급망 검증 제어
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The dependency-review gate is changed to fail closed when comparison evidence is unavailable, and no actionable merge-blocking risk remains in the supplied evidence beyond normal checks and review. Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant security_scan
participant GitHubCompareAPI
participant dependency_review
PullRequest->>security_scan: PR head repository와 head SHA 전달
security_scan->>GitHubCompareAPI: 정확한 base...head 비교 요청
GitHubCompareAPI-->>security_scan: HTTP 상태와 전송 결과 반환
security_scan->>dependency_review: 전송 코드 0 및 HTTP 200일 때 실행
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/oc Refetch and abort unless exact head is still Fix test-first on this existing branch only. Add a permanent regression that models a fake/controlled curl which writes HTTP Strengthen |
|
Exact-head RCA and proof for
Hosted exact-head security and supply-chain results remain authoritative. |
|
@opencode-agent review Evaluate exact current head |
|
Follow-up at current head |
|
@opencode-agent review Review exact current head |
|
@coderabbitai review Review exact current head |
|
I will verify the dependency-review fail-closed boundary and the listed workflow invariants. I will keep exact-head check evidence separate from review judgment, approval, and merge authority. I will not modify code, merge, or change protections. I used the repository guidance that only successful checks for the exact current head are valid merge evidence. 🧠 Learnings used
|
|
Exact-current-head review request for Review the bounded six-file supply-chain evidence repair: dependency-review support accepts only HTTP 200; non-200, timeout, or unavailable comparison fails closed with exact identity and operator guidance; response bodies are discarded; checkout is bound to the explicit PR head repository/SHA; and read-only permissions plus immutable action pins remain. Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation are terminal-success on this exact head. No review thread exists. Keep the exact head unchanged. Do not update the branch, synthesize author approval, substitute another scanner for dependency-review evidence, add credentials, merge, release, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Re-evaluate exact current head |
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review Please provide an independent exact-head review of |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
Pull request was converted to draft
|
Returned to Draft because this branch overlaps the authoritative prerequisite #821 and no longer matches its own four-file bounded-scope claim. #821 already owns the fail-closed dependency-review boundary and exact-head focused quality gate. This branch contains a useful incremental refinement—capturing the After #821 reaches protected |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review After a qualifying exact-head OpenCode verdict, independently review |
|
@opencode-agent review exact head |
|
Inkspan downstream acceptance RED remains reproducible after the protected SAST exact-submitted-revision repair landed. Fresh consumer: Causal boundary remains the central required workflow owned here/#810, not Inkspan source. Smallest remedy remains the current fail-closed #897 path: accept only transport-successful HTTP 200 comparison evidence, bind/attest the exact PR head repository+SHA, and make inability to execute dependency review fail the required gate rather than green-by-skip. After this exact owner integrates under live |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
ec4e2af7d376e4689ab2a0f3421c2bfe383fa2be. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix workflow run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/33153996584)
- strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33154039624)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
|
Fresh downstream acceptance canary is still RED on the current Inkspan release head; this is product-consumer evidence for this exact owner lane, not a request for an Inkspan-local workaround. Affected consumer:
This reproduces the original fail-open contradiction: the aggregate required job is green while the hard dependency evidence step did not execute. Under the owner contract, that downstream result is non-passing and cannot be promoted to release/security evidence. Falsifiable RCA: protected central workflow consumed by Inkspan still implements the Smallest remedy remains this existing PR: preserve exact-head checkout/verification, require successful transport plus HTTP 200, and permit the pinned Dependency Review action to execute only after that proof; every unsupported/unavailable path must terminate nonzero rather than skip-success. GREEN acceptance after normal protected integration (no bypass, no predecessor evidence): rerun the then-current unchanged Inkspan consumer head and require (1) the Dependency Review action step to be 2026-08-29 exact-current consumer refreshA newly synchronized independent Inkspan lane reproduces the same defect after its canonical branch was non-destructively reconciled with the current protected tip, so stale-base or release-branch-specific behavior is now falsified as the explanation:
Inkspan repository CI for the same exact RED acceptance for #897 remains this exact |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3f90120a69dbe2efbf3e40638ba0a168f319f168. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33175303800/job/98863258847)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33175303800/job/98863258847)
- strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33175323133)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
74eb5d1753cba1a48e47e9bc05940373181d7b23. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33184294749/job/98895708474)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33184294749/job/98895708474)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
Fresh consumer-owner revalidation from Inkspan exposes a new stale-base contradiction on this existing owner branch; no
Failure-contract classification: #897's dependency-review/Trivy repair may remain source-valid, but its previously reported GREEN runs are predecessor-base evidence now. The first causal action at this dedicated-writer boundary is a normal non-force sync/restack onto then-live protected main, preserving unique #897 changes and current shared workflow work, followed by regenerated exact-head/live-base Security/SAST/required-review evidence. Do not transfer RED acceptance: any candidate head whose merge base is not the independently refetched live protected main remains non-passing for integration even if its prior exact-head jobs are green. GREEN: successor #897 head contains live main as ancestor, Dependency Review and Trivy attest that successor exact head against the then-live base, all required checks are terminal/non-skipped, current review findings are resolved, and the authenticated review path supplies a genuine same-head verdict plus the separately required counted non-author approval. |
|
@opencode-agent review Review exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
ad07cb152e5d7b0eeb0e85f3956a76c0d84f6967. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885086/job/99090993260)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885237/job/99091043747)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885237/job/99091043747)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885086/job/99090993260)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
ad07cb152e5d7b0eeb0e85f3956a76c0d84f6967. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885086/job/99090993260)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885237/job/99091043747)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885237/job/99091043747)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33248885086/job/99090993260)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
d240ba4657300bb7e127fa0b539516a9a48cee4a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33250134550/job/99094320602)
- Strix Security Scan/strix workflow run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/33250134616)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33250134550/job/99094320602)
- strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33250300490)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
|
Post-#1408 protected-main revalidation requested for unchanged exact head Central protected Re-evaluate this exact head against the then-current live base using the newly protected sidecar catalog/policy behavior. Require actual @cwl-noema-review review |
1 participant
Purpose
Replace the stale, conflicted #799 integration path with a bounded current-main repair for #810. Preserve #799 as historical evidence only; do not import its divergent removal of later Strix work.
Root cause
The central required
Security Scancould conclude success when the exact dependency-review comparison returned HTTP 403 or 404. The support probe emittedsupported=false, exited zero, and skipped the pinned Dependency Review action. A hard supply-chain evidence boundary had therefore been modeled as an optional capability optimization.Remedy and TDD identity
6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;b06bb25c1af99b784730209dceb299cd493734f7reverses the stale fail-open queue contract;71947d24828cfb42806f5ef0a8abf83f9279d0afaccepts only HTTP 200, preserves curl transport status separately, bounds connect/total time, discards the response body, checks out the explicit PR-head repository/SHA, and emits exact-identity failure evidence;b527192d7b758fc2f8a95545f25545cec7747c99proves a partial transfer that prints200but exits non-zero cannot pass;59d702f30fa419a016e24c18e87e05c76fbee4a3; exact current head is recorded below;Scope correction
Unrelated scheduler-secret and Python-lock-materializer source/test changes that had accumulated on this branch were removed. Flattening an include-bearing requirements lock under a generated filename does not preserve relative include targets and requires a separately designed, test-first path-preservation contract.
The final scope changes only the Dependency Review control plane and its durable architecture, operator, release-note, and workflow-contract evidence. The existing executable mode of
scripts/ci/materialize_base_python_requirements.pyis preserved; the final mode-only correction introduces no source-content change.Fresh exact-head evidence (2026-08-29 KST)
74eb5d1753cba1a48e47e9bc05940373181d7b23;main@e1b03eebc6dc5c85aed393e5928927c96376cf46;33184295133checked out and attested the exact head in both Trivy job98893169360and Dependency Review job98893169268; Dependency Review recordedvisibility=public, exact base/head, HTTP200, and curl exit0before executing the pinned action;33184294749produced no vulnerability report: the protected-mainorchestrator/freesidecar passed the local request-envelope boundary but returned gateway HTTP500on all three bounded attempts, and the workflow emitted typed non-passingSTRIX_PROVIDER_UNAVAILABLErather than source findings or false success;CHANGES_REQUESTEDin review5052719430, bound to74eb5d1753cba1a48e47e9bc05940373181d7b23; qualifying independent approval: absent.This head is not merge-ready. Provider failure, neutral/skipped checks, and missing exact-head approval remain non-passing and do not invalidate the source-level exact-head Security repair.
Acceptance contract
Merge only after:
After merge, require a protected-main public-repository consumer run proving a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate before closing #810.
Summary by CodeRabbit
보안 강화
문서
테스트