Uh oh!
There was an error while loading. Please reload this page.
fix(coverage-evidence): install R covr/testthat as PPM binaries with cache (unblocks nonnest2/kaefa/aFIPC) - #378
Conversation
…cache The reusable coverage-evidence job installed covr/testthat from the CRAN source repo (https://cloud.r-project.org) inside `run_and_capture`'s `timeout 900` wrapper. Source-compiling the dependency tree (jsonlite was still building at 900s) never finished; SIGTERM from `timeout` kills the whole `bash -c`, so the `|| exit 0` fallback never fires and the step exits 124. R coverage-evidence therefore failed on install before any test ran, blocking the gate for every R repo (nonnest2, kaefa, aFIPC). Fix (no weakening of the gate): - Point install.packages at the Posit Public Package Manager binary repo for the runner's actual distro (VERSION_CODENAME from /etc/os-release, e.g. noble) and set HTTPUserAgent so precompiled Linux binaries are served instead of source. jsonlite/covr/testthat now download in seconds. - Cache the R library (actions/cache on ${{ runner.temp }}/R-library) so repeat runs skip install entirely. - Keep `timeout 900` as a safety net (not the fix) and make the fallback log name the repository used and the install error so failures are not opaque. Python/JS/Rust coverage paths are untouched; the cache step no-ops for non-R PRs because the library directory is not created. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryApproval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (2 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (2 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports test coverage as not applicable because no supported changed source files or package manifests were found.
Docstring coverage: coverage execution evidence reports docstring coverage as not applicable because no supported changed source files or package manifests were found.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: Workflow change uses trusted PPM binaries and cache for R coverage tools
- Head SHA:
0fca7bcd59cfe663be5aeadb80563c73294b2b06 - Workflow run: 29135833133
- Workflow attempt: 2
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/noema-review.yml, .github/workflows/opencode-review.yml, .github/workflows/pr-review-merge-scheduler.yml, .github/workflows/secret-scan.yml, scripts/ci/filter_gitleaks_sarif.py, and 4 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/noema-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: All tests pass with 100% coverage, R package improvements
- Head SHA:
3e64e57295713976d65037285b951c8e54a24212 - Workflow run: 29139576474
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (2 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (2 files)"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
Uh oh!
There was an error while loading. Please reload this page.
Problem (grounded in run 28916026742 / job 85783126635)
The reusable
coverage-evidencejob in.github/workflows/opencode-review.ymlwraps every measurement step inrun_and_capture, which runstimeout 900 "$@". Its R tooling step installscovr/testthatfrom the CRAN source repo (https://cloud.r-project.org):Because these are source builds, the whole dependency tree compiles from scratch. In the failing run,
jsonlitewas still compiling when the 900s cap hit. Thetimeoutsends SIGTERM to the entirebash -c, so the intended|| exit 0fallback never fires — the step exits 124. R coverage-evidence therefore fails on the install, before any test runs, and blocks the gate org-wide for every R repo (nonnest2, kaefa, aFIPC).Fix (does not weaken the gate)
/etc/os-release(ubuntu-latest→noble) and pointinstall.packagesathttps://packagemanager.posit.co/cran/__linux__/<codename>/latest, plus setHTTPUserAgentso PPM serves precompiled Linux binaries instead of source. Multi-minute compiles become second-scale downloads.actions/cachestep keys${{ runner.temp }}/R-libraryon the tool set so repeat runs skip install entirely. It no-ops for non-R PRs (directory is never created).timeout 900as a safety net, not the fix. The fallback message now names the repository used and the install error, so a failure is no longer opaque.Verification
noblerepo returns HTTP 200;covr 3.6.5present.jsonlite 2.0.0(the package compiling at 900s) resolves as a 1.09 MB precompiled binary at HTTP 200 from the noble__linux__path — a source compile becomes a ~1s download.Rscript -eexpression parses cleanly; on a host without/etc/os-releaseit falls back gracefully to the PPM source mirror.actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57verified to map to tagv4.2.0.This unblocks
coverage-evidencefor nonnest2, kaefa, and aFIPC.🤖 Generated with Claude Code