fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base by seonghobae · Pull Request #736 · ContextualWisdomLab/.github

seonghobae · 2026-08-04T08:59:43Z

What

.github/workflows/sbom-generation.yml:

add push: branches: [main, master, develop] so default-branch commits get a dependency snapshot;
change the concurrency group's final fallback from github.ref to github.sha;
add a dedicated static contract test that pins the push trigger, commit-SHA concurrency key, dependency snapshot submission, write permission, and closed-PR job conditions.

Why

dependency-review compares the base and head dependency graphs. SBOM Generation only ran on pull_request and release, so main never received a dependency snapshot and every PR's comparison reports:

The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match

With no base snapshot the action treats the entire dependency set as newly added, so it re-flags every pre-existing vulnerability on every PR instead of only the ones the PR introduces. This was observed on #733 and #734.

This does not weaken the gate: genuinely added vulnerable dependencies still fail, while whole-repository scanners (trivy-fs, pip-audit) continue to catch pre-existing findings. It restores the intended diff-scoped semantics of dependency-review.

Why the concurrency fallback changes

For pull requests the group is keyed by PR number and for releases by tag. Push events need a commit-specific final key. Using github.ref would make every push to main share one concurrency group; with cancel-in-progress: true, a later commit could cancel the earlier commit's dependency submission and recreate the missing-base snapshot defect. github.sha preserves one snapshot attempt per commit while still deduplicating reruns of the same commit.

Verification contracts

tests/test_sbom_generation_push_contract.py proves:

main, master, and develop pushes are included;
pull-request and release triggers remain present;
SPDX generation still submits dependency-snapshot: true;
push concurrency falls back to github.sha, never github.ref;
closed PRs only run the cancellation sentinel;
push and release events run generate-sbom with job-scoped contents: write.

Current-head GitHub Actions remain authoritative before merge. The first successful push run after this lands populates the default-branch snapshot used by subsequent PR comparisons.

dependency-review compares the base and head dependency graphs. SBOM Generation only ran on pull_request and release, so main never received a dependency snapshot and every PR's comparison reported: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match With no base snapshot the action treats the entire dependency set as newly added, so it re-flags every pre-existing vulnerability on every PR instead of only the ones the PR actually introduces. That is why an untouched lock file can block an unrelated PR. Adds a push trigger on the default branches so those commits get a real snapshot. The existing job conditions already handle it: cancel-closed-pr-runs is pull_request-gated and generate-sbom runs for any non-pull_request event. anchore/sbom-action only uploads release assets on release events, so upload-release-assets is a no-op here. Also switches the concurrency group's final fallback from github.ref to github.sha. That fallback was previously unreachable (pull_request and release both matched earlier terms); reached by push it would make two commits landing close together cancel each other, and a cancelled push run leaves that commit without a snapshot -- reopening the same base-side gap. Co-Authored-By: Claude <noreply@anthropic.com>

coderabbitai · 2026-08-04T08:59:53Z

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in:24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 85ceaf4a-9c3b-4125-9912-207a303dca0f

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 1b5dbeb.

📒 Files selected for processing (2)

.github/workflows/sbom-generation.yml
tests/test_sbom_generation_push_contract.py

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-04T09:44:08Z

Current-head diagnosis: the new SBOM push contract is not the failing component. CodeQL, Semgrep, Secret Scan, Scorecard, OSV and SBOM all pass; Python Security and Security Scan fail only on the protected main Strix lock (aiohttp==3.14.1, cryptography==49.0.0). Atomic baseline PR #731 carries the exact fixes plus the explicit aiohttp>=3.14.3 floor. Keep this PR ready and auto-merge queued; after #731 lands, update/retest this same branch so the first default-branch push can populate the missing dependency snapshot.

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de.
Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de
Workflow run: 30897835687
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: sbom-generation.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_sbom_generation_push_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_sbom_generation_push_contract.py"]
R2 --> V2["targeted test run"]

opencode-agent · 2026-08-04T10:20:51Z

OpenCode Review Overview

Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de
Workflow run: 30899990370
Workflow attempt: 1
Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de.
Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de
Workflow run: 30899990370
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: sbom-generation.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_sbom_generation_push_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_sbom_generation_push_contract.py"]
R2 --> V2["targeted test run"]

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de.
Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de
Workflow run: 30899990370
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: sbom-generation.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_sbom_generation_push_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_sbom_generation_push_contract.py"]
R2 --> V2["targeted test run"]

seonghobae · 2026-08-04T11:01:35Z

@opencode-agent Please re-review exact head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de after central baseline PR #731 lands and current-head coverage evidence reruns. Verify the default-branch dependency snapshot trigger, commit-SHA concurrency key, least-privilege write scope, and closed-PR conditions. Submit APPROVE only if exact-head checks pass and no blocking finding remains.

seonghobae · 2026-08-04T11:01:49Z

@cwl-noema-review Please independently review exact head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de after #731 repairs the central baseline and current-head checks complete. Confirm the dependency-snapshot workflow remains fail-closed and submit APPROVE only if no blocker remains.

seonghobae · 2026-08-04T11:06:10Z

Superseded by #731 exact head 0b6a188ab1a6e96b8450c47c7d5313c4c708fd39, which now contains this two-file default-branch SBOM dependency-snapshot repair together with the inseparable central CodeQL, Strix-lock, and coverage-deadlock baseline. Keeping a second open PR would duplicate checks and create an ambiguous merge order.

seonghobae mentioned this pull request Aug 4, 2026
fix(deps): bump cryptography to 50.0.0 and constrain aiohttp >=3.14.3 in strix CI lock #735
Closed

test(ci): pin default-branch SBOM snapshot contract
1b5dbeb

seonghobae enabled auto-merge (squash) August 4, 2026 09:10

opencode-agentBot requested changes Aug 4, 2026
View reviewed changes

opencode-agentBot disabled auto-merge August 4, 2026 10:21

opencode-agentBot requested changes Aug 4, 2026
View reviewed changes

seonghobae enabled auto-merge (squash) August 4, 2026 10:43

opencode-agentBot disabled auto-merge August 4, 2026 10:48

seonghobae enabled auto-merge (squash) August 4, 2026 11:01

seonghobae changed the base branch from main to fix/strix-python-security-cvesAugust 4, 2026 11:02

seonghobae merged commit 0b6a188 into fix/strix-python-security-cvesAug 4, 2026
57 of 61 checks passed

seonghobae deleted the fix/sbom-push-trigger-main-snapshot branch August 4, 2026 11:02

This was referenced Aug 4, 2026
docs(agents): record code-owner gate hold for solo maintenance #740
Closed
fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base #746
Closed
fix(ci): restore central review, security, snapshots, and hourly repair #731
Closed

This was referenced Aug 4, 2026
Replay focused central improvements after #731 restores the baseline #742
Open
security: make central dependency-review unavailability fail closed #810
Open

Navigation Menu

Uh oh!

fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base - #736

fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base#736
seonghobae merged 2 commits into
fix/strix-python-security-cvesfrom
fix/sbom-push-trigger-main-snapshot

seonghobae commented Aug 4, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Aug 4, 2026•
edited
Loading

Review limit reached

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

opencode-agentBot left a comment

Uh oh!

opencode-agentBot commented Aug 4, 2026•
edited
Loading

Uh oh!

opencode-agentBot left a comment

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

seonghobae commented Aug 4, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Why the concurrency fallback changes

Verification contracts

Related

Uh oh!

coderabbitaiBot commented Aug 4, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

opencode-agentBot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agentBot commented Aug 4, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OpenCode Review Overview

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agentBot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

Uh oh!

seonghobae commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 4, 2026•
edited
Loading

coderabbitaiBot commented Aug 4, 2026•
edited
Loading

opencode-agentBot commented Aug 4, 2026•
edited
Loading