chore(deps): update hash-locked aiohttp to 3.14.3 - #1244
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe Strix CI hash requirements file updates ChangesDependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This updates the CI aiohttp lock from 3.14.1 to 3.14.3 with its corresponding hashes. No actionable runtime or dependency-lock risk remains. 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review exact current head cdf4cea |
|
@cwl-noema-review review exact current head cdf4cea |
|
@opencode-agent @cwl-noema-review Please review exact current head |
|
@coderabbitai review Please review exact current head |
|
@cwl-noema-review Independently review exact head |
|
Review-only exact-head dispatch for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_sha="cdf4ceaaa9136629b098c675e749c116b2c7258a"
repo="ContextualWisdomLab/naruon"
pr_number="1244"
echo "== Checked-out HEAD =="
git rev-parse HEAD
echo
echo "== Pull request head metadata =="
gh pr view "$pr_number" --repo "$repo" --json number,headRefName,headRefOid,baseRefName,files \
--jq '{number, headRefName, headRefOid, baseRefName, files: [.files[] | {path, additions, deletions}]}'
echo
echo "== Commit metadata =="
git show --no-ext-diff --no-renames --format=fuller --no-patch "$expected_sha"
echo
echo "== Files changed by exact commit =="
git diff-tree --no-commit-id --name-status -r "$expected_sha"
echo
echo "== Complete exact-commit diff =="
git diff --no-ext-diff --no-renames "${expected_sha}^" "$expected_sha"
echo
echo "== aiohttp references in changed content =="
git show "${expected_sha}" | rg -n -C 8 --fixed-strings 'aiohttp'
echo
echo "== Parent and current hash-line comparison =="
git diff --no-ext-diff -U0 "${expected_sha}^" "$expected_sha" | \
rg -n '^[+-].*(aiohttp|--hash=sha256:)' || trueLength of output: 48418 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_sha="cdf4ceaaa9136629b098c675e749c116b2c7258a"
repo="ContextualWisdomLab/naruon"
lock_file="requirements-strix-ci-hashes.txt"
echo "== Pull request `#1238` head =="
old_pr_sha="$(gh pr view 1238 --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf '%s\n' "$old_pr_sha"
echo
echo "== Tree equivalence with `#1238` head =="
printf 'current tree: '
git rev-parse "${expected_sha}^{tree}"
printf '`#1238` tree: '
git rev-parse "${old_pr_sha}^{tree}"
if [ "$(git rev-parse "${expected_sha}^{tree}")" = "$(git rev-parse "${old_pr_sha}^{tree}")" ]; then
echo "RESULT: identical trees"
else
echo "RESULT: trees differ"
git diff --no-ext-diff --stat "$old_pr_sha" "$expected_sha"
fi
echo
echo "== aiohttp 3.14.3 lock and PyPI hash validation =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import hashlib
import json
import os
import re
import urllib.request
path = os.environ["LOCK_FILE"]
text = open(path, encoding="utf-8").read()
match = re.search(
r"(?ms)^aiohttp==(?P<version>[^\s]+)\s+\\\n"
r"(?P<body>.*?)(?=^# via\n(?:^#.*\n)*|^\S|\Z)",
text,
)
if not match:
raise SystemExit("ERROR: Could not locate a complete aiohttp lock block.")
version = match.group("version")
body = match.group("body")
hashes = re.findall(r"--hash=sha256:([0-9a-f]{64})", body)
invalid = re.findall(r"--hash=sha256:([^\s\\]+)", body)
duplicates = sorted({value for value in hashes if hashes.count(value) > 1})
print(f"locked_version={version}")
print(f"locked_hashes={len(hashes)}")
print(f"duplicate_hashes={len(duplicates)}")
print(f"invalid_sha256_tokens={len(invalid) - len(hashes)}")
print(f"has_via_gql_and_litellm={('# gql' in text[match.start():match.end()+80] and '# litellm' in text[match.start():match.end()+80])}")
with urllib.request.urlopen(
f"https://pypi.org/pypi/aiohttp/{version}/json", timeout=20
) as response:
metadata = json.load(response)
release_hashes = {
item["digests"]["sha256"]
for item in metadata["urls"]
if item.get("digests", {}).get("sha256")
}
local_hashes = set(hashes)
print(f"pypi_release_files={len(release_hashes)}")
print(f"missing_from_lock={len(release_hashes - local_hashes)}")
print(f"not_in_pypi_release={len(local_hashes - release_hashes)}")
if release_hashes - local_hashes:
print("MISSING:", *sorted(release_hashes - local_hashes), sep="\n")
if local_hashes - release_hashes:
print("UNEXPECTED:", *sorted(local_hashes - release_hashes), sep="\n")
if (
version == "3.14.3"
and not duplicates
and len(invalid) == len(hashes)
and local_hashes == release_hashes
):
print("RESULT: lock hash set exactly matches PyPI aiohttp 3.14.3 artifacts")
else:
raise SystemExit("ERROR: lock hash set does not exactly match release metadata.")
PYLength of output: 5779
Independent validation of the 119 hashes against PyPI release metadata is inconclusive. The sandbox rejected PyPI TLS verification with Please retry the PyPI metadata validation from an environment that trusts the required certificate chain before approval. I found no unrelated file changes.
|
|
@opencode-agent @cwl-noema-review Please review exact current head |
|
@opencode-agent @cwl-noema-review @coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1244"
expected_sha="cdf4ceaaa9136629b098c675e749c116b2c7258a"
lock_file="requirements-strix-ci-hashes.txt"
echo "== Exact HEAD and PR metadata =="
printf 'checked_out_head='
git rev-parse HEAD
gh pr view "$pr" --repo "$repo" \
--json number,state,headRefOid,baseRefName,mergeStateStatus,reviewDecision,isDraft,files \
--jq '{number,state,headRefOid,baseRefName,mergeStateStatus,reviewDecision,isDraft,files:[.files[]|{path,additions,deletions}]}'
echo "== Base resolution and diff scope =="
base_sha="$(git rev-parse "origin/develop" 2>/dev/null || git rev-parse "develop")"
printf 'develop_sha=%s\n' "$base_sha"
git diff --no-ext-diff --no-renames --name-status "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames --check "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames -U0 "$base_sha" "$expected_sha"
echo "== aiohttp lock block structure =="
EXPECTED_SHA="$expected_sha" LOCK_FILE="$lock_file" python3 - <<'PY'
import os, re, hashlib
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
m = re.search(r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)', text)
if not m:
raise SystemExit("ERROR: no complete aiohttp block")
hashes = re.findall(r'--hash=sha256:([0-9a-f]{64})(?:\s*\\)?', m.group("body"))
all_hash_tokens = re.findall(r'--hash=sha256:([^\s\\]+)', m.group("body"))
print("version=" + m.group("version"))
print("valid_hash_count=" + str(len(hashes)))
print("unique_hash_count=" + str(len(set(hashes))))
print("hash_token_count=" + str(len(all_hash_tokens)))
print("all_hashes_are_lowercase_sha256=" + str(len(hashes) == len(all_hash_tokens)))
print("has_gql_provenance=" + str("# gql" in text[m.start():m.end()+120]))
print("has_litellm_provenance=" + str("# litellm" in text[m.start():m.end()+120]))
print("contains_aiohttp_3_14_1=" + str("aiohttp==3.14.1" in text))
print("contains_aiohttp_3_14_3=" + str("aiohttp==3.14.3" in text))
PY
echo "== PyPI metadata comparison =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import json, re, ssl, urllib.request, os
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
m = re.search(r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)', text)
version = m.group("version")
local = set(re.findall(r'--hash=sha256:([0-9a-f]{64})', m.group("body")))
try:
with urllib.request.urlopen(f"https://pypi.org/pypi/aiohttp/{version}/json", timeout=20) as response:
remote = {
row["digests"]["sha256"] for row in json.load(response)["urls"]
if row.get("digests", {}).get("sha256")
}
print(f"pypi_hash_count={len(remote)}")
print(f"missing_from_lock={len(remote-local)}")
print(f"unexpected_in_lock={len(local-remote)}")
except Exception as exc:
print(f"PYPI_VALIDATION_ERROR={type(exc).__name__}: {exc}")
PY
echo "== Exact-head checks and reviews =="
gh pr checks "$pr" --repo "$repo" --required
gh api "repos/$repo/pulls/$pr/reviews" --paginate \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api "repos/$repo/pulls/$pr/comments" --paginate --jq 'length'
echo "== Dependabot alerts for aiohttp =="
gh api "repos/$repo/dependabot/alerts?state=open&per_page=100" --paginate \
--jq '.[] | select(.dependency.package.name == "aiohttp") | {number,state,dependency:.dependency.package.name,manifest_path:.dependency.manifest_path,security_advisory:{ghsa_id:.security_advisory.ghsa_id,cve_id:.security_advisory.cve_id,severity:.security_advisory.severity},security_vulnerability:{vulnerable_version_range:.security_vulnerability.vulnerable_version_range,first_patched_version:.security_vulnerability.first_patched_version.identifier}}' || true
echo "== develop branch protection / rules =="
gh api "repos/$repo/branches/develop/protection" \
--jq '{required_status_checks,required_pull_request_reviews,enforce_admins,required_linear_history,allow_force_pushes,allow_deletions}' || true
gh api "repos/$repo/rules/branches/develop" --paginate \
--jq '.[] | {id,name,enforcement,status,rules:[.rules[].type]}' || trueLength of output: 28662
I found no code or lock-file finding.
I cannot submit formal approval yet. The PyPI release-metadata comparison is inconclusive. The sandbox rejected the PyPI TLS chain with The GitHub token also cannot read Dependabot alerts or Run the PyPI hash comparison from a trusted environment. Then confirm the open You are interacting with an AI system. |
|
Review-only exact-head dispatch for |
|
@cwl-noema-review Independently review exact head |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1244"
expected_sha="cdf4ceaaa9136629b098c675e749c116b2c7258a"
lock_file="requirements-strix-ci-hashes.txt"
echo "== exact head =="
printf 'checked_out_head='
git rev-parse HEAD
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files \
--jq '{number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files:[.files[]|{path,additions,deletions}]}'
echo "== exact commit and base diff scope =="
git cat-file -e "${expected_sha}^{commit}"
base_sha="$(git merge-base "origin/develop" "$expected_sha" 2>/dev/null || git merge-base develop "$expected_sha")"
printf 'merge_base=%s\n' "$base_sha"
git diff --no-ext-diff --no-renames --name-status "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames --check "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames -U0 "$base_sha" "$expected_sha"
echo "== lock block validation =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import os, re
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
block = re.search(
r"(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)",
text,
)
if not block:
raise SystemExit("ERROR: complete aiohttp block not found")
version = block.group("version")
body = block.group("body")
valid = re.findall(r"--hash=sha256:([0-9a-f]{64})(?:\s*\\)?", body)
tokens = re.findall(r"--hash=sha256:([^\s\\]+)", body)
print(f"version={version}")
print(f"hash_tokens={len(tokens)}")
print(f"valid_lowercase_sha256={len(valid)}")
print(f"unique_valid_sha256={len(set(valid))}")
print(f"malformed_hash_tokens={len(tokens)-len(valid)}")
print(f"contains_aiohttp_3_14_1={'aiohttp==3.14.1' in text}")
print(f"contains_aiohttp_3_14_3={'aiohttp==3.14.3' in text}")
following = text[block.start():block.end()+160]
print(f"has_gql_provenance={'# gql' in following}")
print(f"has_litellm_provenance={'# litellm' in following}")
PY
echo "== exact-head required checks and reviews =="
gh pr checks "$pr" --repo "$repo" --required
gh api "repos/$repo/pulls/$pr/reviews" --paginate \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}' || true
gh api "repos/$repo/pulls/$pr/comments" --paginate --jq 'length' || true
echo "== authenticated PyPI metadata hash comparison =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import json, os, re, urllib.request
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
block = re.search(r"(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)", text)
version = block.group("version")
local = set(re.findall(r"--hash=sha256:([0-9a-f]{64})", block.group("body")))
try:
with urllib.request.urlopen(f"https://pypi.org/pypi/aiohttp/{version}/json", timeout=20) as response:
remote = {u["digests"]["sha256"] for u in json.load(response)["urls"] if u.get("digests", {}).get("sha256")}
except Exception as error:
print(f"validation_error={type(error).__name__}: {error}")
else:
print(f"pypi_hashes={len(remote)}")
print(f"missing_from_lock={len(remote-local)}")
print(f"unexpected_in_lock={len(local-remote)}")
print(f"exact_match={remote == local}")
PYLength of output: 27198
I found no code or lock-file finding.
I cannot establish fresh approval yet. The authoritative PyPI comparison remains inconclusive because TLS validation failed with You are interacting with an AI system. |
|
@coderabbitai review Please review exact current head |
|
@opencode-agent Please independently review exact current head |
|
@cwl-noema-review Please perform a second independent exact-head review of |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1244"
expected_sha="cdf4ceaaa9136629b098c675e749c116b2c7258a"
lock_file="requirements-strix-ci-hashes.txt"
echo "== Exact head =="
printf 'checked_out_head='; git rev-parse HEAD
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files \
--jq '{number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files:[.files[]|{path,additions,deletions}]}'
git cat-file -e "${expected_sha}^{commit}"
echo "== Merge-base diff scope =="
base_sha="$(git merge-base "origin/develop" "$expected_sha" 2>/dev/null || git merge-base develop "$expected_sha")"
printf 'merge_base=%s\n' "$base_sha"
git diff --no-ext-diff --no-renames --name-status "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames --check "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames -U0 "$base_sha" "$expected_sha"
echo "== aiohttp block and dependency-lock integrity =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import os, re
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
block = re.search(r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)', text)
if not block:
raise SystemExit("ERROR: aiohttp lock block was not found")
body = block.group("body")
tokens = re.findall(r'--hash=sha256:([^\s\\]+)', body)
valid = re.findall(r'--hash=sha256:([0-9a-f]{64})(?:\s*\\)?', body)
following = text[block.start():block.end()+160]
print(f"version={block.group('version')}")
print(f"hash_tokens={len(tokens)}")
print(f"valid_sha256_hashes={len(valid)}")
print(f"unique_sha256_hashes={len(set(valid))}")
print(f"malformed_hashes={len(tokens)-len(valid)}")
print(f"has_gql_provenance={'# gql' in following}")
print(f"has_litellm_provenance={'# litellm' in following}")
print(f"has_old_version={'aiohttp==3.14.1' in text}")
print(f"has_new_version={'aiohttp==3.14.3' in text}")
PY
echo "== Compare local hashes with PyPI metadata using system trust =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import json, os, re, urllib.request
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
block = re.search(r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)', text)
local = set(re.findall(r'--hash=sha256:([0-9a-f]{64})', block.group("body")))
try:
with urllib.request.urlopen(f"https://pypi.org/pypi/aiohttp/{block.group('version')}/json", timeout=20) as r:
remote = {u["digests"]["sha256"] for u in json.load(r)["urls"] if u.get("digests", {}).get("sha256")}
except Exception as exc:
print(f"pypi_validation_error={type(exc).__name__}: {exc}")
else:
print(f"pypi_hashes={len(remote)}")
print(f"missing_from_lock={len(remote-local)}")
print(f"unexpected_in_lock={len(local-remote)}")
print(f"exact_match={remote == local}")
PY
echo "== Exact-head required checks and review state =="
gh pr checks "$pr" --repo "$repo" --required
gh api "repos/$repo/pulls/$pr/reviews" --paginate \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api "repos/$repo/pulls/$pr/comments" --paginate --jq 'length'Length of output: 27142
I found no code or lock-file finding.
I cannot submit approval from this environment. The authoritative PyPI comparison remains inconclusive. The request to the PyPI Validate that the 119 local hashes exactly match the PyPI
|
|
@opencode-agent review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1244"
expected_sha="cdf4ceaaa9136629b098c675e749c116b2c7258a"
lock_file="requirements-strix-ci-hashes.txt"
echo "== Exact pull request head =="
printf 'checked_out_head='; git rev-parse HEAD
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files \
--jq '{number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files:[.files[]|{path,additions,deletions}]}'
git cat-file -e "${expected_sha}^{commit}"
echo "== Merge-base scope and whitespace =="
base_sha="$(git merge-base origin/develop "$expected_sha" 2>/dev/null || git merge-base develop "$expected_sha")"
printf 'merge_base=%s\n' "$base_sha"
git diff --no-ext-diff --no-renames --name-status "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames --check "$base_sha" "$expected_sha"
git diff --no-ext-diff --no-renames -U0 "$base_sha" "$expected_sha"
echo "== Lock block format and hash tokens =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import os
import re
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
m = re.search(r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)', text)
if m is None:
raise SystemExit("ERROR: aiohttp lock block was not found")
body = m.group("body")
tokens = re.findall(r'--hash=sha256:([^\s\\]+)', body)
valid = re.findall(r'--hash=sha256:([0-9a-f]{64})(?:\s*\\)?', body)
following = text[m.start():m.end()+160]
print(f"version={m.group('version')}")
print(f"hash_tokens={len(tokens)}")
print(f"valid_lowercase_sha256={len(valid)}")
print(f"unique_valid_lowercase_sha256={len(set(valid))}")
print(f"malformed_hash_tokens={len(tokens)-len(valid)}")
print(f"has_gql_provenance={'# gql' in following}")
print(f"has_litellm_provenance={'# litellm' in following}")
print(f"old_version_present={'aiohttp==3.14.1' in text}")
print(f"new_version_present={'aiohttp==3.14.3' in text}")
PY
echo "== PyPI artifact hash comparison =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import json
import os
import re
import urllib.request
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
m = re.search(r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)', text)
if m is None:
raise SystemExit("ERROR: aiohttp lock block was not found")
local = set(re.findall(r'--hash=sha256:([0-9a-f]{64})', m.group("body")))
try:
with urllib.request.urlopen(f"https://pypi.org/pypi/aiohttp/{m.group('version')}/json", timeout=20) as response:
remote = {
item["digests"]["sha256"]
for item in json.load(response)["urls"]
if item.get("digests", {}).get("sha256")
}
except Exception as exc:
print(f"pypi_validation_error={type(exc).__name__}: {exc}")
else:
print(f"pypi_artifact_hashes={len(remote)}")
print(f"missing_from_lock={len(remote-local)}")
print(f"unexpected_in_lock={len(local-remote)}")
print(f"exact_match={remote == local}")
PY
echo "== Exact-head required checks and review threads =="
gh pr checks "$pr" --repo "$repo" --required
gh api "repos/$repo/pulls/$pr/reviews" --paginate \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api "repos/$repo/pulls/$pr/comments" --paginate --jq 'length'
echo "== Branch protection and rulesets, if token permits =="
gh api "repos/$repo/branches/develop/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,enforce_admins}' \
|| true
gh api "repos/$repo/rules/branches/develop" --paginate \
--jq '.[] | {id,name,enforcement,status,rules:[.rules[].type]}' \
|| trueLength of output: 27975
I found no code or lock-file finding.
I cannot submit a formal The PyPI artifact-hash comparison is inconclusive. The sandbox rejected the PyPI TLS chain with Validate the 119 lock hashes against PyPI
|
|
Review-only exact-head dispatch for |
|
@cwl-noema-review Independently review exact head |
|
@coderabbitai review |
|
|
Review-only exact-head dispatch for |
|
@cwl-noema-review Independently review exact head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headb8985fb08fd07293eb43411effe349bc4891db58. -
Head SHA:
b8985fb08fd07293eb43411effe349bc4891db58 -
Workflow run: 31134058262
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: requirements-strix-ci-hashes.txt"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: requirements-strix-ci-hashes.txt"]
R1 --> V1["required checks"]
|
@coderabbitai review Please review the exact live head only. Verify the maintainer-owned branch is the intended one-file aiohttp 3.14.3 hash-lock update, the complete artifact hash set is synchronized, no application/workflow/API/database/reviewer-credential change exists, and current Application CI, Dependency Review, Bandit, Semgrep, Security Scan, container build, central reviews, and zero unresolved threads are satisfied. Review only; do not update the branch, merge, release, or alter protections. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/naruon"
pr="1244"
lock_file="requirements-strix-ci-hashes.txt"
echo "== Live PR identity =="
printf 'checked_out_head='
git rev-parse HEAD
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,mergeStateStatus,reviewDecision,files:[.files[]|{path,additions,deletions}]}'
head_sha="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
base_ref="$(gh pr view "$pr" --repo "$repo" --json baseRefName --jq '.baseRefName')"
printf 'queried_head=%s\nqueried_base=%s\n' "$head_sha" "$base_ref"
git cat-file -e "${head_sha}^{commit}"
echo "== Current merge-base scope and whitespace =="
base_sha="$(git merge-base "origin/${base_ref}" "$head_sha" 2>/dev/null || git merge-base "$base_ref" "$head_sha")"
printf 'merge_base=%s\n' "$base_sha"
git diff --no-ext-diff --no-renames --name-status "$base_sha" "$head_sha"
git diff --no-ext-diff --no-renames --check "$base_sha" "$head_sha"
git diff --no-ext-diff --no-renames -U0 "$base_sha" "$head_sha"
echo "== aiohttp lock block and PyPI artifact hash set =="
LOCK_FILE="$lock_file" python3 - <<'PY'
import json
import os
import re
import subprocess
import sys
from pathlib import Path
text = Path(os.environ["LOCK_FILE"]).read_text(encoding="utf-8")
match = re.search(
r'(?ms)^aiohttp==(?P<version>\S+)\s+\\\n(?P<body>.*?)(?=^# via\n|^\S|\Z)',
text,
)
if match is None:
raise SystemExit("ERROR: aiohttp lock block not found")
body = match.group("body")
tokens = re.findall(r'--hash=sha256:([^\s\\]+)', body)
valid = re.findall(r'--hash=sha256:([0-9a-f]{64})(?:\s*\\)?', body)
local = set(valid)
following = text[match.start():match.end() + 200]
print(f"version={match.group('version')}")
print(f"hash_tokens={len(tokens)}")
print(f"valid_sha256_hashes={len(valid)}")
print(f"unique_sha256_hashes={len(local)}")
print(f"malformed_hash_tokens={len(tokens) - len(valid)}")
print(f"old_version_present={'aiohttp==3.14.1' in text}")
print(f"gql_provenance_present={'# gql' in following}")
print(f"litellm_provenance_present={'# litellm' in following}")
url = f"https://pypi.org/pypi/aiohttp/{match.group('version')}/json"
try:
response = subprocess.run(
["curl", "--fail", "--silent", "--show-error", "--location", "--proto", "=https", url],
check=True, capture_output=True, text=True, timeout=30,
)
release = json.loads(response.stdout)
except Exception as exc:
print(f"pypi_validation_error={type(exc).__name__}: {exc}")
sys.exit(0)
remote = {
item["digests"]["sha256"]
for item in release["urls"]
if item.get("digests", {}).get("sha256")
}
print(f"pypi_artifact_hashes={len(remote)}")
print(f"missing_from_lock={len(remote - local)}")
print(f"unexpected_in_lock={len(local - remote)}")
print(f"exact_pypi_hash_match={local == remote}")
PY
echo "== Exact-head required checks =="
gh pr checks "$pr" --repo "$repo" --required
echo "== Reviews and unresolved review threads =="
gh api "repos/$repo/pulls/$pr/reviews" --paginate \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api graphql -F owner="${repo%%/*}" -F name="${repo#*/}" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
}
}
}
}
}' --jq '
.data.repository.pullRequest.reviewThreads.nodes
| {
total:length,
unresolved:[.[] | select(.isResolved | not)],
unresolved_count:([.[] | select(.isResolved | not)] | length)
}'
echo "== Protected-branch requirements, if authorized =="
gh api "repos/$repo/branches/$base_ref/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,enforce_admins}' \
|| true
gh api "repos/$repo/rules/branches/$base_ref" --paginate \
--jq '.[] | {id,name,enforcement,status,rules:[.rules[].type]}' \
|| trueLength of output: 28803
I found no actionable code or dependency-lock finding.
I cannot submit formal approval.
The GitHub token cannot read the Resolve, supersede, or withdraw the current-head You are interacting with an AI system. |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headf18b74f167b9405c7451b444f0068e6a42783ea1. -
Head SHA:
f18b74f167b9405c7451b444f0068e6a42783ea1 -
Workflow run: 31202927990
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: requirements-strix-ci-hashes.txt"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: requirements-strix-ci-hashes.txt"]
R1 --> V1["required checks"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heade89a25f82efda1cb4ec2f076d73c3a46a7122aea. -
Head SHA:
e89a25f82efda1cb4ec2f076d73c3a46a7122aea -
Workflow run: 31872877611
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: requirements-strix-ci-hashes.txt"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: requirements-strix-ci-hashes.txt"]
R1 --> V1["required checks"]
Dismissed as stale predecessor-head evidence. The review was submitted for e89a25f82efda1cb4ec2f076d73c3a46a7122aea solely because coverage evidence failed. The current unchanged candidate is 04dff4db09493b7ff8a4860c0d74c0f444f9ecc3; on this exact head, coverage-source-tree, coverage-evidence, opencode-review, Application CI, Python 3.14 backend, frontend, security, dependency review, SAST, and container validation are terminal-success, and the review-thread inventory is empty. This dismissal does not provide approval or bypass the independent current-head approval requirement.
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head2b5fe17f7a00d4ccd8cd36f56dd0c40bf15df131. -
Head SHA:
2b5fe17f7a00d4ccd8cd36f56dd0c40bf15df131 -
Workflow run: 31903619643
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: requirements-strix-ci-hashes.txt"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: requirements-strix-ci-hashes.txt"]
R1 --> V1["required checks"]
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head2fb03a60d89511cb643a27bcb576d63665881f7e. -
Head SHA:
2fb03a60d89511cb643a27bcb576d63665881f7e -
Workflow run: 32034520357
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: requirements-strix-ci-hashes.txt"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: requirements-strix-ci-hashes.txt"]
R1 --> V1["required checks"]
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Bumps the uv group with 1 update in the / directory: [aiohttp](https://github.com/aio-libs/aiohttp). Updates `aiohttp` from 3.14.1 to 3.14.3 - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.14.1...v3.14.3) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
8d06332 to
c1d4c7f
Compare
opencode-agent
Bot
added
area: api
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 similar comment
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Exact-head dependency gate diagnosis — 2026-09-05Scope: #1244 head
Next: allow the existing central dispatches to produce authenticated terminal evidence, repair the diagnostic owner, and regenerate the unchanged application head's review after the actual cause is addressed. No source edits, reruns, approvals, alert dismissals, ruleset changes or merges were performed in this diagnosis. Local dependency/source tests cannot substitute for these hosted gates. Diagnostic owner repair — 2026-09-05Central #1898 now contains pushed head Final owner tests: normal and CI-environment suites each 2940 passed, one reviewed-LLVM-19 test skipped, 21 subtests passed; Noema and four related policy modules measured 100% statement/branch coverage. The skip is unverified, and local tests are not protected delivery. Exact-head doctoring records RED/fix/GREEN, producer links, safe logging limits, and evidence boundaries. New owner quality run 33962985324 and Noema run 33962984599 are queued after the push. The three existing native CodeQL handles above were rechecked and remain queued at their same source revision; no duplicate dispatch or cancellation was issued. This Naruon head remains unchanged. Wait for actual owner delivery and terminal evidence; do not consume an unreleased owner branch or claim CO #1004/#1049 resolved the incident. |
1 participant
Summary
Replace Dependabot PR #1238 with a maintainer-owned current-base branch.
aiohttpfrom 3.14.1 to 3.14.3;Exact candidate
develop@042b0c70531b229af3acbd0421a2f23098d848b350351e8cacc65b4124ba2145e00d41aeceef0775requirements-strix-ci-hashes.txtVerification
uv pip install --python .venv/bin/python --require-hashes -r requirements-strix-ci-hashes.txtaiohttp.__version__ == "3.14.3"cryptography==50.0.0andpyasn1==0.6.4git diff --checkThis supersedes #1238 but does not reuse predecessor reviews or checks. Merge only after this unchanged exact head passes all live required checks, has no actionable threads, and receives qualifying independent approval.
Summary by CodeRabbit
aiohttpdependency to version 3.14.3.