fix(ci): coalesce Bandit pull request scans

[seonghobae]

Current authority — 2026-09-08

• protected base: develop@042b0c70531b229af3acbd0421a2f23098d848b3
• exact head: c1286c1631365862e2b576fb045388796d3bd246
• lifecycle: Draft / provenance-only / zero effective delta / canonical successor verification pending
• effective compare against protected develop: 0 files, +0/-0, behind 0

Finding and owner repair

The original acb374e9b68faf1911a4298155aead3e4144b22e change created a second Bandit concurrency owner and grouped every pull-request run by repository + PR number while cancelling all PR runs. That conflicts with the existing Bandit concurrency lineage #1554 and its successor #1562, which preserve a separate generation for intentional manual reruns so a later PR event cannot cancel a user-requested rerun of an older head.

This was treated as an ownership/contract repair, not as disposable race output. Ordinary child 55d601cdc494921cb2e98e04612709e43e4f6a69 restores the protected product/workflow tree while retaining the generated commit in ancestry. Fresh comparison then showed that the branch ancestry itself was stale/diverged from protected develop, so two-parent ordinary merge c1286c1631365862e2b576fb045388796d3bd246 adopts exact protected develop as the second parent without force-push or destructive rebase. The resulting compare has the protected head as merge base, is ahead-only, and has no effective files.

Succession boundary

The useful intent — coalescing superseded Bandit PR scans without cancelling manual reruns — remains owned by #1554/#1562. This PR stays open/Draft as provenance until the canonical owner/successor normally integrates into protected develop and a post-merge comparison proves the intended Bandit concurrency/test contract is present there. Only then is zero-delta closure justified as complete succession.

Do not merge this zero-delta PR as an alternate Bandit owner. No force-push, destructive rebase, self-approval, dummy/no-op requeue, review fabrication/dismissal, synthetic status, central-workflow copy, or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

현재 head acb374e9b68faf1911a4298155aead3e4144b22e에서 Application CI, Security, Docker image validation, CodeQL 및 중앙 review 관련 검사가 실제로 접수됐습니다. 확인 시 실행 job은 queued, publish/deploy는 pull_request 조건상 skipped입니다. queued를 성공으로 세지 않으며, exact-head terminal checks와 독립 리뷰를 기다립니다. 38개 로컬 회귀검사와 diff check는 별도 분모입니다.

[seonghobae]

재확인: 현재 exact head acb374e9b68faf1911a4298155aead3e4144b22e의 12개 Actions run이 모두 queued이며 완료된 실행은 없습니다. Bandit run 34194670652도 queued입니다. 동시성 그룹 API는 bandit-ContextualWisdomLab/naruon-1606 그룹을 인식하고 total_count=1을 반환했지만, 이 API 응답의 entries는 비어 있어 실행 중 runner로 해석하지 않았습니다. 이는 접수와 실제 실행을 구분해야 한다는 증거입니다. 수동 취소·재실행·timeout 확대는 하지 않았습니다.

[seonghobae]

최신 exact head acb374e9의 hosted 상태가 변했습니다. Bandit SUCCESS, Security SUCCESS, CodeQL 분석 일부와 CodeQL 중립 결과가 확인됐고 backend/frontend/image 및 중앙 review 관련 job은 아직 IN_PROGRESS 또는 QUEUED입니다. 이는 부분 성공이며 전체 required gate 통과나 병합 증거가 아닙니다. 이전 queued 상태에서 실제 runner 실행으로 진행된 변화만 기록합니다.

[seonghobae]

현재 head 재검증: backend, security, CodeQL, Bandit 및 정적 분석은 SUCCESS로 완료됐습니다. Docker image validation·frontend는 IN_PROGRESS이고 중앙 OpenCode/Strix/Noema 및 admission 단계는 QUEUED입니다. 따라서 부분 성공만 기록하며 전체 required checks 통과나 merge readiness로 해석하지 않습니다.

[seonghobae]

재확인: backend/frontend 및 정적 보안 검사는 계속 완료됐고, Docker 이미지 검증은 IN_PROGRESS입니다. admission·required workflow bootstrap·변경 범위 검사는 QUEUED입니다. 현재 head는 변경되지 않았으므로 기존 SUCCESS를 정확히 이 head의 부분 결과로만 사용합니다.

[seonghobae]

Exact-head audit: head c1286c1631365862e2b576fb045388796d3bd246, base develop@042b0c70531b229af3acbd0421a2f23098d848b3. The three CodeQL compatibility failures reference run 34196063063, whose logs now return GitHub API HTTP 404. This is stale/non-reproducible evidence, not a source finding; no blind rerun, verdict transfer, or unrelated source change was made. Fresh exact-head evidence is required after a reproducible repair or authorized head change.

[seonghobae]

현재 head c1286c163에서 CodeQL compatibility(actions/javascript-typescript/python)가 모두 중앙 authenticated terminal verdict 미발행으로 실패했습니다. 실패 job 로그는 dispatch 후 CodeQL scan dispatched. The dispatch workflow will rerun this exact failed CodeQL job after publishing its terminal verdict.를 남기고 종료합니다.

이 결함은 Naruon에서 복제·우회하지 않고 canonical owner 선행 PR ContextualWisdomLab/.github#2043 및 exact successor #2044에서 수리 중입니다. 두 PR의 보호 Checks와 인증된 terminal verdict가 완료되기 전에는 이 PR을 Ready/승인/병합하지 않습니다.