fix(ci): tighten central workflow gates#382
Open
seonghobae wants to merge 18 commits into
Open
Conversation
Scope central workflow tokens to read-only defaults with job-scoped writes, print Trivy SARIF findings in failing logs, and repair scheduler/Noema CI regressions caught by the full test suite.
This was referenced Jul 9, 2026
This was referenced Jul 9, 2026
Contributor
Author
|
Updated the active superseding central PR with the OpenCode outcome-gate cleanup from the closed #383 thread:
Verification on head
|
Contributor
Author
|
Follow-up on the timeout/model-order review note:
Rechecked on head |
Contributor
Author
|
Follow-up patch on the timeout/model-order note, now on head
Verification on head
Rechecked after push: no review threads, no PR-scoped code-scanning alerts, and the new current-head checks are queued behind the Actions backlog. |
Contributor
Author
|
Follow-up governance fix on head
Verification:
|
Contributor
Author
|
Central queue-control follow-up pushed in Why this was necessary:
What changed:
Verification:
This directly implements the current-head-only queue rule: new PR head events should cancel superseded OpenCode/Noema/Strix runs instead of letting stale heads accumulate. |
Contributor
Author
|
Queue hygiene update for #382: After pushing Some older |
Contributor
Author
|
Current-head validation for central #382 after the queue-concurrency update. Head tested: Scope checked:
Local validation from disposable worktree
GitHub Actions checks for this head remain queued; GitHub Status currently reports Actions degraded performance / delayed run starts. |
Contributor
Author
|
Added a central coverage-evidence fix on head Reason:
Change:
Verification:
Note: |
Contributor
Author
|
Central follow-up on head What changed now:
Why:
Verification:
Queue hygiene:
Timeout/model policy remains as previously updated in this PR: |
Contributor
Author
|
?? ??????. ?? head ??? ?? ??:
?? ??:
??:
?? ??:
?? GitHub ??:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
Author
|
Follow-up on the remaining Scorecard Added real fuzzing evidence on head
Verification before push:
After push, stale older-head OpenCode run |
…security-20260709 # Conflicts: # .github/workflows/opencode-review.yml # scripts/ci/run_opencode_review_model_pool.sh # scripts/ci/test_strix_quick_gate.sh # tests/test_opencode_agent_contract.py
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/central-workflow-security-20260709cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/central-workflow-security-20260709, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 382 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-workflow-security-20260709
# rebase path only: git push --force-with-lease origin HEAD:fix/central-workflow-security-20260709- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Workflow (9 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["actionlint plus required checks"]
Evidence --> S3["CI script (4 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (7 files)"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
cc66bb541ce92b121acd30af4d06be5e304cb4b6 - Workflow run: 29052503121
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Workflow (9 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["actionlint plus required checks"]
Evidence --> S3["CI script (4 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (7 files)"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 382 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-workflow-security-20260709
# rebase path only: git push --force-with-lease origin HEAD:fix/central-workflow-security-20260709
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Workflow (9 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["actionlint plus required checks"]
Evidence --> S3["CI script (4 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (7 files)"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (5 files)"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Workflow (9 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["actionlint plus required checks"]
Evidence --> S3["CI script (4 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (7 files)"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Merge Conflict Guidance
gh pr checkout 382 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-workflow-security-20260709
# rebase path only: git push --force-with-lease origin HEAD:fix/central-workflow-security-20260709 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
trivy-fsfailure logs so required-check failures show package/CVE/path/message reasons.Verification
python3 -m pytest-> 175 passed, 5 warningspython3 -m compileall -q scripts testsgit diff --cached --checkbash scripts/ci/test_strix_quick_gate.shremains nonzero on existing stale contract-string assertions unrelated to this diff; full pytest covers the updated contracts.Direct push
Direct push to
mainwas rejected by repository rules: required workflows are not satisfied and changes must be made through a pull request.