Uh oh!
There was an error while loading. Please reload this page.
Bound Strix required workflow self-test - #83
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a bounded smoke test to validate the Strix required-workflow contract, and updates the required workflow path to run this fast contract check instead of the full long-form Strix gate harness, while keeping the full harness available for non-required/manual use.
Changes:
- Add
scripts/ci/strix_required_workflow_smoke.shto validate key invariants of.github/workflows/strix.ymland the central Strix gate script. - Update the Strix workflow to export and run the new bounded smoke script with a shorter timeout.
- Update the existing Strix quick-gate harness assertions to require the smoke script and to ensure the full harness is not executed on the required path.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/ci/test_strix_quick_gate.sh | Updates workflow-contract assertions to expect the bounded smoke script and forbid executing the full harness on the required path. |
| scripts/ci/strix_required_workflow_smoke.sh | Adds a new bounded contract smoke test for the required workflow path. |
| .github/workflows/strix.yml | Switches the required-path self-test step to run the bounded smoke script (short timeout) and exports its path. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryInspected changed files and verified no critical issues. Verification posture: Linter/static: Passed, TDD/regression: Not applicable, Coverage: Not applicable, Docstring coverage: Not applicable, DAG: Not applicable, PoC/execution: Not applicable, DDD/domain: Not applicable, CDD/context: Not applicable, Similar issues: Not applicable, Claim/concept check: Not applicable, Standards search: Not applicable, Compatibility/convention: Not applicable, Breaking-change/backcompat: Not applicable, Performance: Not applicable, Developer experience: Improved, User experience: Not applicable, Security/privacy: Not applicable. Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/strix.yml, scripts/ci/strix_required_workflow_smoke.sh, scripts/ci/test_strix_quick_gate.sh.
Change Flow DAGflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script (2 files)"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script (2 files)"]
R2 --> V2["bash -n plus Strix self-test"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head evidence but found unresolved human review threads before approval.
Findings
1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved human review thread blocks automated approval
- Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human review thread evidence on the current pull request.
- Root cause: Human review feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
- Fix: Address or resolve the listed human review thread(s), then re-run OpenCode on the current head.
- Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE.
Review thread evidence
Latest unresolved human review thread evidence
scripts/ci/strix_required_workflow_smoke.sh line 52
Latest human comment: @copilot-pull-request-reviewer at 2026-06-26T10:48:49Z
Comment URL: #83 (comment)
Comment excerpt: With
set -e, thecheckout_count="$(grep -Fc ...)"assignment will cause the script to exit immediately when the pattern is missing (grep exits 1), bypassingrecord_failureand skipping the remaining assertions. If the goal is to aggregate failures and emit a clear message, the grep exit status should be neutralized for the no-matches case.Result: REQUEST_CHANGES
Reason: unresolved human review thread(s) were present before approval.
Head SHA:
0ac8efa4d09eaae245723c10239ddc9806b585a5Workflow run: 28233382082
Workflow attempt: 1
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Inspected changed files and verified no critical issues. Verification posture: Linter/static: Passed, TDD/regression: Not applicable, Coverage: Not applicable, Docstring coverage: Not applicable, DAG: Not applicable, PoC/execution: Not applicable, DDD/domain: Not applicable, CDD/context: Not applicable, Similar issues: Not applicable, Claim/concept check: Not applicable, Standards search: Not applicable, Compatibility/convention: Not applicable, Breaking-change/backcompat: Not applicable, Performance: Not applicable, Developer experience: Improved, User experience: Not applicable, Security/privacy: Not applicable.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/strix.yml, scripts/ci/strix_required_workflow_smoke.sh, scripts/ci/test_strix_quick_gate.sh.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence proves 100% test coverage.
Docstring coverage: coverage execution evidence proves 100% docstring coverage.
DAG: Change Flow DAG maps .github/workflows/strix.yml through bounded evidence, review risk, and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, and current-head workflow evidence were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions and compatibility surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: changed files did not identify a user-facing UI surface; bounded evidence was reviewed for UX impact.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: No blockers found
- Head SHA:
98b3c594ad1bbb96da1523e1db14a082977bf8cb - Workflow run: 28233818564
- Workflow attempt: 1
Uh oh!
There was an error while loading. Please reload this page.
…ral mirror to end 429 flakes (#346) * perf(strix): skip scans on doc/image-only diffs and cap job at 60m Runner-queue starvation across the org: every doc-only, image-only, or empty re-trigger PR/push spawned a fresh ~120-min Strix scan, blocking all PR merges behind runner contention. Two security-preserving throughput fixes: 1. paths-ignore on push and pull_request_target for changes whose ENTIRE diff is non-executable documentation/image assets (*.md, *.rst, *.markdown, raster images, LICENSE, .github/ISSUE_TEMPLATE). A code security scanner has nothing to analyze in such a diff. Conservative: no source, no *.txt, no *.svg (can embed script), no CODEOWNERS, no build/workflow files. GitHub requires EVERY changed file to match, so any code/config/build/workflow change still scans. The weekly full-tree schedule (no path filter) backstops protected branches, and the merge scheduler still forces same-head evidence via workflow_dispatch (which paths-ignore does not affect) before merging managed PRs. 2. Cap the strix job at 60m (was 120m). The scan step is already hard-bounded to 30 min (timeout-minutes: 30 + STRIX_TOTAL_TIMEOUT=1800) and all other steps are quick/self-bounded; 120 only ever bit hung runs. 60m clears the realistic worst case with margin and is fail-closed. The head.sha concurrency / cancel-in-progress security design (which deliberately does NOT cancel in-progress scans on new commits) is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RjGVapDZ3k7V7zKYk16P4C * fix(security): route osv-scanner Maven resolution through Google Central mirror to end 429 flakes The required `osv-scan / osv-scan` gate intermittently failed APPROVED Maven PRs (clearfolio #76/#82/#83) with "No issues found" while osv-scanner resolved transitive parent POMs (spring-boot-starter-parent:3.5.0). It was a reliability failure, not a real vulnerability: repo.maven.apache.org returns HTTP 429 during transitive parent-POM resolution. osv-scanner resolves parent POMs over its own HTTP client (osv-scalibr pomxmlnet -> MavenRegistryAPIClient.defaultRegistry.URL), NOT via the `mvn` CLI or ~/.m2. It never reads ~/.m2/repository and parses settings.xml only for <servers> auth, not <mirrors> -- so caching ~/.m2 or a settings.xml mirror would be inert. The only effective lever is the `--maven-registry` flag, which sets that default registry URL. Fix: pass `--maven-registry=https://maven-central.storage-download.googleapis.com/maven2` (Google's byte-identical Maven Central mirror) via `scan-args`, keeping `-r ./` so recursion and transitive scanning stay fully enabled. No `--no-resolve`, no coverage reduction. Applied to both osv-scan callers (security-scan.yml HARD gate and osv-scanner-pr.yml analysis upload). Verified locally with osv-scanner 2.4.0 against a spring-boot-starter-parent:3.5.0 pom.xml: the default-central run reproduced the exact 429 on parent-POM resolution, the mirror run had zero 429s, and both resolved an identical set of 8 transitive packages (byte-identical POMs) -- confirming root cause and zero coverage loss. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RjGVapDZ3k7V7zKYk16P4C --------- Co-authored-by: Seongho Bae <seonghobae@me.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
Summary
Verification