fix(review): base 선언 의존성 coverage 실패를 안전하게 분류 - #590
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR updates the org-wide OpenCode coverage workflow to safely “defer” (instead of hard-fail) Python coverage runs when pytest collection fails only due to a missing dependency that is already declared on the protected base branch, addressing false-negative coverage blockers caused by the central sandbox’s intentionally networkless dependency model.
Changes:
- Add
scripts/ci/python_coverage_dependency_guard.pyto classify pytest exit-4 collection failures asDEFERREDonly when the missing modules are base-declared (fail-closed otherwise). - Wire the classifier into
.github/workflows/opencode-review.ymlvia a dedicatedrun_and_capture_python_coverage()wrapper to emitDEFERREDresults without weakening other failure modes. - Add focused regression tests for the classifier and update existing workflow contract tests / Strix quick gate assertions.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
tests/test_python_coverage_dependency_guard.py |
Adds regression tests for the new base-declared dependency deferral classifier (collection-only, fail-closed cases, log/path safety). |
tests/test_opencode_agent_contract.py |
Updates workflow contract assertions to cover the new classifier integration and the additional sandbox env-null hardening occurrences. |
scripts/ci/test_strix_quick_gate.sh |
Extends Strix quick-gate assertions to ensure the workflow includes the new deferral classifier and its intended constraints. |
scripts/ci/python_coverage_dependency_guard.py |
Implements the new classifier that reads only protected-base manifests (via git show) and defers only narrow, explicitly-detected missing-dependency collection failures. |
.github/workflows/opencode-review.yml |
Integrates the classifier into Python coverage execution and summarizes DEFERRED outcomes while keeping repository-native required checks authoritative for merge. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
current-head 5686854 기준 hosted coverage, 보안, CodeQL, Strix는 통과했습니다. opencode-review failure는 이 PR 코드가 아니라 중앙 모델 풀 소진입니다. run 29734027190에서 DeepSeek V3/R1 timeout, Luna quota, GPT-5 계열 context-window, o3 권한 오류가 발생했고, GPT-4.1은 리뷰를 생성했으나 adversarial evidence 형식 한 항목으로 재시도 없이 거부되었습니다. 중앙 복구 PR #579가 시간 상한과 형식 재시도를 구현하고 있으므로 본 PR은 코드 결함으로 분류하지 않고 #579 병합 후 exact current HEAD 리뷰를 다시 요청하겠습니다. 근거: https://github.com/ContextualWisdomLab/.github/actions/runs/29734027190 / #579 |
5686854 to
e97973a
Compare
| for raw_line in text.splitlines(): | ||
| line = raw_line.strip() | ||
| if not line or line.startswith(("#", "-")): | ||
| continue | ||
| match = REQUIREMENT_NAME_RE.match(line) | ||
| if match: | ||
| names.add(normalize_distribution(match.group(1))) |
| assert module.requirement_names("\n# comment\n-r base.txt\nFoo_Bar==1\n") == { | ||
| "foo-bar" | ||
| } |
e97973a to
227abf9
Compare
| # Preserve the final path component so classify() can reject a symlink | ||
| # rather than silently following it to an attacker-selected file. | ||
| args.log_file = Path(os.path.abspath(args.log_file)) | ||
| return args |
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
227abf9 to
a122a9e
Compare
| env={ | ||
| "PATH": os.environ.get("PATH", "/usr/local/bin:/usr/bin:/bin"), | ||
| "HOME": tempfile.gettempdir(), | ||
| "GIT_CONFIG_NOSYSTEM": "1", | ||
| "GIT_CONFIG_GLOBAL": "/dev/null", | ||
| }, |
|
Superseded by the current fail-closed coverage architecture on The protected-base dependency gap is now handled by the #657/#661 lineage: This PR instead converts base-declared |
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
문제
중앙 OpenCode coverage 샌드박스는 PR이 선택한 Python 의존성 manifest를 설치하지 않습니다. 그 결과 보호된 base branch가 이미 선언한 의존성이 중앙 도구 이미지에 없으면, 실제 저장소 CI가 성공해도 pytest collection이
ModuleNotFoundError로 끝나고 OpenCode가 변경 요청을 남길 수 있습니다.실제 재현 근거는
ContextualWisdomLab/naruon#1080@960d23ad의pytest exit 4/No module named fastapi이며,fastapi는 base manifest에 선언되어 있고 동일 헤드의 저장소-native backend CI는 성공했습니다.변경
requirements.txt,requirements-hashes.txt,pyproject.toml만git show로 읽습니다.ModuleNotFoundError, 모든 누락 배포 패키지가 base에 선언된 경우에만 중앙 coverage를DEFERRED로 분류합니다.5686854).검증
codegraph syncpython3 -m pytest --cov --cov-report=term-missing -q— 645 passedgit diff --check통과test_strix_quick_gate.sh는 이번 coverage diff와 무관하고origin/main대비 변경되지 않은 Strix 구현/워크플로 시나리오 불일치를 별도로 노출했습니다.