From f0ec67f35277449baadd5d0570c0f04703b7e9ed Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 21 Jul 2026 23:15:12 +0000 Subject: [PATCH 1/7] fix(review): coverage evidence tooling for numpy and Rust repos pytest ran with no target dependencies installed and cargo llvm-cov had no llvm-tools or crate cache, so coverage evidence always failed for scientific-Python and Rust repositories (every fast-mlsirm PR has been stuck at REQUEST_CHANGES since 2026-07-14). Fixes, keeping the fail-closed offline sandbox design intact: 1. Add numpy==2.5.1 to the trusted hash-pinned coverage toolchain (hashes regenerated with uv pip compile --generate-hashes --no-header --no-annotate --python-version 3.12 --python-platform x86_64-manylinux_2_28). Verified against fast-mlsirm main: suite passes with numpy alone (156 passed, 72 skipped; Rust-parity tests skip cleanly). 2. Provision a pinned rustup toolchain (1.94.1 + llvm-tools-preview) via the sha256-pinned rustup-init 1.28.2 binary, symlinked into /usr/local/bin so it shadows the distribution rustc (1.75), which cannot parse version-4 Cargo.lock files. 3. Pre-fetch the locked crate graph in the online coverage-source-tree job into the tree-local CARGO_HOME the sandbox already uses (cargo fetch --locked executes no build scripts), and export CARGO_NET_OFFLINE=true in the sandbox so cargo resolves strictly from that cache. Local gates: 634 contract tests pass, scripts/ci coverage 100%, interrogate 100%, workflow YAML parses. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01ERVynrYEjd2TwYvusVpA9f --- .github/workflows/opencode-review.yml | 34 ++++ requirements-opencode-review-ci-hashes.txt | 171 ++++++++++++++++++++- requirements-opencode-review-ci.txt | 1 + 3 files changed, 202 insertions(+), 4 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index 7010b262..ef0c9a4a 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -293,6 +293,19 @@ jobs: mkdir -p "$(dirname "$COVERAGE_SOURCE_WORKDIR")" mv "$fetch_dir" "$COVERAGE_SOURCE_WORKDIR" git -C "$COVERAGE_SOURCE_WORKDIR" status --short + if [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.toml" ] && [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.lock" ] \ + && command -v cargo >/dev/null 2>&1; then + # Pre-fetch the locked crate graph into the tree-local CARGO_HOME that the + # network-isolated coverage sandbox already uses, so `cargo llvm-cov` can + # compile Rust coverage offline. `cargo fetch` downloads content-addressed + # crates without executing any build scripts, and a failed prefetch keeps + # the same fail-closed sandbox behavior: the offline build surfaces the + # missing dependencies for this head. + if ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ + cargo fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/Cargo.toml"; then + echo "::warning::Locked cargo prefetch failed; offline Rust coverage will surface the missing dependencies for this head." + fi + fi tar -cf "$COVERAGE_SOURCE_ARCHIVE" -C "$COVERAGE_SOURCE_WORKDIR" . - name: Upload materialized pull request merge tree @@ -592,6 +605,22 @@ jobs: && tar -xzf /tmp/cargo-llvm-cov.tar.gz -C /usr/local/bin cargo-llvm-cov \ && chmod 0755 /usr/local/bin/cargo-llvm-cov \ && rm -f /tmp/cargo-llvm-cov.tar.gz + # Pinned rustup toolchain with llvm-tools-preview: the distribution + # rustc/cargo cannot parse modern version-4 Cargo.lock files and ships + # no llvm-cov/llvm-profdata, so `cargo llvm-cov` coverage evidence for + # Rust repositories needs this toolchain. The rustup-init binary is + # sha256-pinned and the toolchain channel is version-pinned. + ENV RUSTUP_HOME=/usr/local/rustup \ + CARGO_HOME=/usr/local/cargo + RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/rustup-init \ + https://static.rust-lang.org/rustup/archive/1.28.2/x86_64-unknown-linux-gnu/rustup-init \ + && echo '20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c /tmp/rustup-init' | sha256sum -c - \ + && chmod 0755 /tmp/rustup-init \ + && /tmp/rustup-init -y --no-modify-path --profile minimal \ + --default-toolchain 1.94.1 --component llvm-tools-preview \ + && ln -sf /usr/local/cargo/bin/* /usr/local/bin/ \ + && chmod -R a+rX /usr/local/rustup /usr/local/cargo \ + && rm -f /tmp/rustup-init COPY requirements-opencode-review-ci-hashes.txt /tmp/requirements-opencode-review-ci-hashes.txt RUN python3 -m pip install \ --break-system-packages \ @@ -1333,6 +1362,11 @@ jobs: failures=$((failures + 1)) return 1 fi + # The sandbox has no network access; make cargo resolve strictly from + # the crate cache the online coverage-source-tree job pre-fetched into + # the tree-local CARGO_HOME so missing dependencies fail fast with a + # clear offline error instead of a network timeout. + export CARGO_NET_OFFLINE=true ensure_rust_gpu_adapter ensure_rust_desktop_deps } diff --git a/requirements-opencode-review-ci-hashes.txt b/requirements-opencode-review-ci-hashes.txt index 2846355f..9b169635 100644 --- a/requirements-opencode-review-ci-hashes.txt +++ b/requirements-opencode-review-ci-hashes.txt @@ -1,30 +1,193 @@ attrs==26.1.0 \ - --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 + --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \ + --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32 click==8.4.2 \ + --hash=sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6 \ --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76 colorama==0.4.6 \ + --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \ --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6 coverage==7.14.3 \ + --hash=sha256:0096fd7559178f0cc9cf088f2dbd2a02ef85bacaa69732c633517286b4494610 \ + --hash=sha256:02c41de2a88011b893050fc9830267d927a50a215f7ad5ec17349db7090ccf26 \ + --hash=sha256:0423d64c013057a06e70f070f073cec4b0cbc7d2b27f3c7007292f2ff1d52965 \ + --hash=sha256:0ee68f5c34812780f3a7063382c0a9fcbb99985b7ddcdcaa626e4f3fb2e0783a \ + --hash=sha256:11a7ec9f97ab950f4c5af62229befc7faf208fdbc0116d3902d7e306cf2c5abd \ + --hash=sha256:1551b4caac3e3ec9f2bfcec6bf3776e01c0edbdd2e240431a50ca1a1aac72c27 \ + --hash=sha256:16b206e521feb8b7133a45754643dead0538489cf8b783b90cf5f4e3299625fd \ + --hash=sha256:1a7563a443f3d53fdeb040ec8c9f7466aed7ca3dc5891aa09d3ca3625fa4387f \ + --hash=sha256:1bb93c2aa61d2a5b38f1526546d95cf4132cb681e541a337bf8dfd092be816e5 \ + --hash=sha256:1e3b91f9c4740aeb571ecf82e5e8d8e4ab62d34fcb5a5d4e5baa38c6f7d2857c \ + --hash=sha256:2415902f385a23dcc4ccd26e0ba803249a169af6a930c003a4c715eeb9a5444e \ + --hash=sha256:27d07a46500ba23515b838dbcf52512026af04090755cf6cc64166d88c9b9a1a \ + --hash=sha256:2bfc4dd0a912329eccc7484a7d0b2a38032b38c40663b1e1ac595f10c457954b \ + --hash=sha256:2e41fd3aab806770008279a93879b0924b16247e09ab537c043d08bbca53b4ab \ + --hash=sha256:338b19131ab1a6b767b462bfcbaa692e7ae22f24463e39d49b02a83410ff6b37 \ + --hash=sha256:360bec1f58e7243e3405d3bdf7a1a8115aa9b448d54dc7cd6f7b7e0e9406b62e \ + --hash=sha256:39e1dbbb6ff2c338e0196a482558a792a1de3aa64261196f5cdb3da016ad9cda \ + --hash=sha256:3c68df8e61f1e09633fefc7538297145623957a048534368c9d212782aa5e845 \ + --hash=sha256:3d74ff26299c4879ce3a4d826f9d3d4d556fd285fde7bbce3c0ef5a8ab1cec24 \ + --hash=sha256:3e5b550a128419373c2f6cec28a244207013ef15f5cbcff6a5ca09d1dfaaf027 \ + --hash=sha256:41de778bd41780586e2b04912079c73089ab5d839624e28db3bdb26de638da92 \ + --hash=sha256:47968988b367990ae4ab17523790c38cd125e02c6bfd379b6022be2d40bdc38c \ + --hash=sha256:4b60ca6d8af70473491a15a343cbabab2e8f9ea66a4376e81c7aa24876a6f977 \ + --hash=sha256:4d310baf69a4fbe8a098ce727e4808a34866ac718a6f759ae659cbd3221358bc \ + --hash=sha256:526ce9721116af23b1065089f0b75046fe521e7772ab94b641cd66b7a0421889 \ + --hash=sha256:583d50d59142f8549470bd6390471d0fe8b8c8d69d6a0f28ac71e05380cef640 \ + --hash=sha256:5952f8c1bda2a5347154450379316e6dfa4d934d62ca35f6784451e6f55074fb \ + --hash=sha256:5d788e5fd55347eef06ca0732c77d04a264de67e8ff24631270cdff3767a60cf \ + --hash=sha256:605ab2b566a22bd94834529d66d295c364aba84afd3e5498285c7a524017b1fc \ + --hash=sha256:611e62cb9386096d81b63e0a05330750268617231e7bd598e1fe77482a2c58a5 \ + --hash=sha256:6197e5a00183c11a8ce7c6abd18be1a9189fd8399084ffc95196f4f0db4f2137 \ --hash=sha256:621e13c6108234d7960aaf5762ab5c3c00f33c30c15af06dcbff0c73bf112727 \ - --hash=sha256:92c22e19ce64ca3f2ad751f16f14df1468b4c231bd6af97185063a9c292a0cb3 + --hash=sha256:62c7f79db2851c95ef020e5d28b97afde3daf9f7febcd35b53e05638f729063f \ + --hash=sha256:64b2055bb6e0dc945af35cdeceb3633e6ed9273475ef3af85592410fd6803803 \ + --hash=sha256:68520c90babfa2d560eca6d497921ed3a4f469623bd709733124491b2aa8ef3f \ + --hash=sha256:69918344541ed9c8368566c2adc03c0e33d4550d7faa87d1b35e49b6a3286ea9 \ + --hash=sha256:6a3693b4153394d265f44fb855fdc80e72403024d4d6f91c4871b334d028e4e0 \ + --hash=sha256:74fdd718d88fe144f4579b8747873a07ec3f04cb837d5faec5a25d9e22fa31a8 \ + --hash=sha256:7b27c822a8161afbe48e99f1adfb098d270ae7e0f7d7b0555ce110529bdb69cc \ + --hash=sha256:7dfe427045520d6abca33687dfef767b4f635015893a1816c5decb12eb72ce18 \ + --hash=sha256:7ea52fc08f007bcc494d4bb3df3851e95843d881860ba38fe2c64dc100db5e7d \ + --hash=sha256:830c1fca669c572dec37ce9c838224ee45aac5be0f6961edf871e82e49d6537c \ + --hash=sha256:8427f370ca67db4c975d2a26acfc0e5783ca0b52444dbc50278ace0f35445949 \ + --hash=sha256:878832eaac515b62decfa76965aed558775f86bf1fc8cca76993c0c84ae31aed \ + --hash=sha256:8ac012839ff7e396030f1e94e10553a431d14e4de2ab65cb3acb72bbd5628ca2 \ + --hash=sha256:8cec0ad652ec57790970d817490105bd917d783c2f7b38d6b58a0ca312e1a336 \ + --hash=sha256:8cf0f2509acb4619e2471a1951089054dd58ebea7a912066d2ea56dd4c24ca4a \ + --hash=sha256:90f7608aeb5d9b60b523b9fb2a4ee1973867cc4865a3f26fe6c7577073b70205 \ + --hash=sha256:92c22e19ce64ca3f2ad751f16f14df1468b4c231bd6af97185063a9c292a0cb3 \ + --hash=sha256:96150a9cf3468ea20f0bc5d0e21b3df8972c31480ef90fa7614b773cc6429665 \ + --hash=sha256:98a0859b0e98e43e1178a9402e19c8127766b14f7109a374d976e5a62c0e5c73 \ + --hash=sha256:9973ef2463f8e6cfb61a6324126bb3e17d67a85f22f58d856e583ea2e3ca6501 \ + --hash=sha256:9a3f142070eb7b82fc4085a55d887396f9c4e21250bccebe2ba22502c45b9647 \ + --hash=sha256:9be4e7d4c5ca0427889f8f9d614bd630c2be741b1de7699bca3b2b6c0e41003e \ + --hash=sha256:a090cbf9521e78ffdb2fcf448b72902afe9f5923ff6a12d5c0d0120200348af9 \ + --hash=sha256:a2335ea5fed26af2e831094964fa3f8fae60b45f7e37fcc2d3b615b2add3ad87 \ + --hash=sha256:a3c2134809e80fac091bfed18a6991b5a5eb5df5ae32b17ac4f4f99864b73dd7 \ + --hash=sha256:a571bd889cd36c5922ce8e42e059f9d37d02301531d11374afa4c87a578625d5 \ + --hash=sha256:a574912f3bde4b0619f6e97d01aa590b70998859244793769eb3a6df78ee56d3 \ + --hash=sha256:a64caee2193563601dbaaa55fe2dcf597debef04a2f8f1fa8a07aa4bb7ac7a1e \ + --hash=sha256:ac082660de8f429ba0ea363595abb838998570b9a7546777c60f413ab902bbde \ + --hash=sha256:b3d77f7f196abdef7e01415de1bce09f216189e83e58159cfeef2b92d0464994 \ + --hash=sha256:b3ff255799f5a1676c71c1c32ec01fd043aa09d57b3d95764b24992757184784 \ + --hash=sha256:b488bd4b23397db62e7a9459129d01ff06a846582a732efd24834b24a6ada498 \ + --hash=sha256:b75ee850fc2d7c831e883220c445b035f2224de2ba6103f1e56dbd237ab913f7 \ + --hash=sha256:b7f300ac92cd4b570724c8ffbbd0c130fee298d2447f41d5a3abf58976fae1de \ + --hash=sha256:beaab199b9e5ceaf5a225e16a9d4df136f2a1eae0a5c20de1e277c8a5225f388 \ + --hash=sha256:c02efd507227bde9969cab0db8f48890eb3b5dcad6afac57a4792df4133543ce \ + --hash=sha256:c66f9f9d4f1e9712eb9b1de5310f881d4e2188cfcba5065e1a8490f38687f2c4 \ + --hash=sha256:c90a7cdd5e380e1ce02f19792e2ac2fbfbf177e35a27e69fd3e873b30d895c0c \ + --hash=sha256:c946099774a7699de03cbd0ff0a64e21aed4525eed9d959adde4afe6d15758ef \ + --hash=sha256:cc96aa922e21d4bc5d5ed3c915cef27dfcbc13686f47d5e378d647fbfba655a2 \ + --hash=sha256:d20a15c622194234161535459affa8f7905830391c9ccfa060d495dbfe3a1c7f \ + --hash=sha256:d48400185564042287dc487c1f016a3397f18ab4f4c5d5ec36edc218f7ffa35b \ + --hash=sha256:d8e88f335544a47e22ae2e45b344772925ec65166555c958720d5ed971880891 \ + --hash=sha256:dc9b4e35e7c3920e925ba7f14886fd5fbe481232754624e832ddba66c7535635 \ + --hash=sha256:de76caefc8deabb0dd1678b6a980be97d14c8d87e213ac194dbf8b09e96d63fb \ + --hash=sha256:e0bb8a6bc7015efdf8a928753b25da1b9ca2d6f24ef04d2ee0688e486f32aae7 \ + --hash=sha256:e343fb086c9cd780b38622fea7c369acd64c1a0724312149b5d769c387a2b1f5 \ + --hash=sha256:e4ed44705ca4bead6fc977a8b741f2145608289b33c8a9b42a95d0f15aedbf4d \ + --hash=sha256:e574801e1d643561594aa021206c46d80b257e9853087090ba97bed8b0a509d3 \ + --hash=sha256:e6230e688c7c3e65cedd41a774eb4ec221adc6bfee13768231015b702d5e4150 \ + --hash=sha256:ea3169c7116eb6cdf7608c6c7da9ecfcb3da40688e3a510fac2d1d2bafd6dc35 \ + --hash=sha256:eadea7aba74e40adee867a8c0eec17b820b061d308a4b014f7a0e118c2b0aa61 \ + --hash=sha256:ed68faa5e85de2f3e400bc3f122e5c82735a58c8bb24b9f63a2215954ba17b2d \ + --hash=sha256:f0a47095963cfe054e0df178daca95aec21e680d6076da807c3add28dfe920f7 \ + --hash=sha256:f502e948e03e866538048bba081c075caaa62e5bda6ea5b7432e45f587eb462a \ + --hash=sha256:f82b6bb7d75a2613e85d07cefa3a8c973d0544a8993337f6e2728e4a1e94c305 \ + --hash=sha256:fa9e5c6857a7e80fa22ace5cf3550ae392bbfc322f1d8dd2d2d5a8be38cec027 \ + --hash=sha256:fb7e18afb6e903c1a92401a2f0501ac277dca527bb9ca6fe1f691a8a0026a0e8 \ + --hash=sha256:fbb8c3a98e779013786ae01d229662aeacbc77100efbd3f2f245219ace5af700 iniconfig==2.3.0 \ + --hash=sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730 \ --hash=sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12 interrogate==1.7.0 \ + --hash=sha256:a320d6ec644dfd887cc58247a345054fc4d9f981100c45184470068f4b3719b0 \ --hash=sha256:b13ff4dd8403369670e2efe684066de9fcb868ad9d7f2b4095d8112142dc9d12 +numpy==2.5.1 \ + --hash=sha256:08d60c810432eb83360958dea0999ac4cfb94531ea8efcbf0b7f277c2068aeb2 \ + --hash=sha256:09e9bfd8d2cf479c7d174804fb3811c53a8e9f20a37444008606b57d6b7a826d \ + --hash=sha256:0bfebd8695f9863592fe744be833a258120b14a9f39da255e8aa8fade2c0ddd1 \ + --hash=sha256:17a25e09640602e10bc8de0e6fa2b3fd68eedd84ba6d7842dc8f32f9ab87bd0b \ + --hash=sha256:1c6759f538fb912fc46de0a6b1758ccf7b57bc7c7ebebc23974fdac3de8db0cd \ + --hash=sha256:224ca51130ef7da85bea2191625181cb4f337f9cb64b471f10c1a12aa8b60077 \ + --hash=sha256:24d0eb82c0541d3415a33425db64ae439dffccd7b4dbcb30e7c35120205c506a \ + --hash=sha256:2ae0ca40bcb22d6ba59c1dfd5446f49940b0f2d821fde133f10dda11f816b84e \ + --hash=sha256:2c889b56fe48b1018f764b0eec8df59ab654e9148aa91faa12596043500de277 \ + --hash=sha256:30b44a6b53a7ae63c54c089a8726e5563ed302716c5b7ccc85afade40b0e7ff6 \ + --hash=sha256:32985c896d897419ef8da6917872d80b78ad0ea26d85b23245c7366ffde76d75 \ + --hash=sha256:3935f3b419b244a02732676fa5317a9193cc596a4c0646db07e5b421229ac9f7 \ + --hash=sha256:4939237038ada79308dda3204ac6462df056b5672b2e25db1149cf873668b3e1 \ + --hash=sha256:4b4ff1608417eb7a59da7b967bbb798cacfe071d2caf526a24281cd562072ed9 \ + --hash=sha256:54ad769f17bc2d833b620851989f62054fb9ab93c969d9e1dc3c8e3d56beea21 \ + --hash=sha256:59fda5e192b570217ec2580c96f00e9a7e12ef6866a900eb089b62c1a32545ca \ + --hash=sha256:5a4c988b38d261deeeaad9954e3deb091ad905c94e8bb6708654ef1d97f286b0 \ + --hash=sha256:5a6db61f9aaa57e369905c67d852045d3c4f7126405b29d09b19dec118e9c9cb \ + --hash=sha256:6165343f81b56ef8f514f396989e529b61d9dc709b99421b07e9f3e698e2287d \ + --hash=sha256:61ac47e772e6b8ea489e1d2f441a34c5c3ac17327e7ce294cbdf535795ad4e75 \ + --hash=sha256:6c3fe51bc6a16453d452997053454f309e8e0ed7b42d6b361ce4ac8c32913d74 \ + --hash=sha256:6eab239876581b2b3c5a242281b6007bbdbcd1c7085d7709bb57c5929b11e6bf \ + --hash=sha256:78798bd5b9ad744056af8efa90e3b9ddaa53272a0848a483084a1cc0a13b2dc0 \ + --hash=sha256:7c786fe9a5bbe360022e584c5a34cf6b54265c71bd7ec8ac3d8fec38968071f8 \ + --hash=sha256:83ce9c80d5b521b0d77ddcbe5447c218d247929b6cc056ca5351342accfff0af \ + --hash=sha256:9726558e8db4a5bf7929a70ae50f63abda4daf0efe810e3bfbab95976f75fc1a \ + --hash=sha256:99d5095fa265a0c4152e7bb12759e14381ef5496152f1ce58f44bdf55c44beb4 \ + --hash=sha256:a33276be12fa045805f477f22482088b66bb758ffbe89a9d21457de863a32e22 \ + --hash=sha256:a48a113e6afea91f5608793bafa7ef2ad481fefbda87ec5069f483de61cb9fa3 \ + --hash=sha256:ab451b59c5643c570974c43aef780703ef1d3b4965d2be07afd530615a9358d1 \ + --hash=sha256:ab84dc6b074fa881cae55bea94cc4f68e285181ba7f32497bf7dee6b1496165b \ + --hash=sha256:ab87a91b3cc3382b8956095bd8f95e00cf679bb81554339be1a2ba404a1473c1 \ + --hash=sha256:c12afb53450fa976d4c681c50a7423729a4c51c0465ed9f32b8a9cabbc472373 \ + --hash=sha256:caf3e317d33d60c37986b452613f4ab51246d0691350c03d0cb4a898627f4a95 \ + --hash=sha256:dc932a65ded7ce9013d120845a2514dcccb1a67bfc8deb8d37633762951904a6 \ + --hash=sha256:e68d8dd1e7eba712948f2053a29ec86917bc70ba1358df869d9f06649ef9cf09 \ + --hash=sha256:e824c2acf8862052246be5a44c15da1777940c60d010dd2aab897824d9c430f9 \ + --hash=sha256:e8c11c405efc5ff6816d5983c96cdfa215bab3428961243af3ff59b228490438 \ + --hash=sha256:efd736408cc97c79b9e6917338dfc8f06013b2274f992e96b1d9a81a71e2a2c2 \ + --hash=sha256:f089d7b00756190aacf1f5d34bdf38c3c430ac82b4f868f8cede73380460fce7 \ + --hash=sha256:f2479a47f8d5932d1718168a681ad6e536a9df484c83cfcf9de365e164537ace \ + --hash=sha256:f7119ebff1a9829e9f431a4f9d28e703023bb6b9fe7c8f724467dbfc27c94ab3 \ + --hash=sha256:f7d60026c0bdb1380e83bfa7a0419c4577ee4b9a08880afcb6dadeb74c649fa2 \ + --hash=sha256:f7feb014281029e628ba2d5a007407443b06e418b6fe451d1e2adcbc8eba0107 packaging==26.2 \ - --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e + --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \ + --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661 pluggy==1.6.0 \ + --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \ --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746 py==1.11.0 \ + --hash=sha256:51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719 \ --hash=sha256:607c53218732647dff4acdfcd50cb62615cedf612e72d1724fb1a0cc6405b378 pygments==2.20.0 \ + --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \ --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176 pytest==9.1.1 \ + --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \ --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c pytest-cov==7.1.0 \ + --hash=sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2 \ --hash=sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678 tabulate==0.10.0 \ + --hash=sha256:e2cfde8f79420f6deeffdeda9aaec3b6bc5abce947655d17ac662b126e48a60d \ --hash=sha256:f0b0622e567335c8fabaaa659f1b33bcb6ddfe2e496071b743aa113f8774f2d3 uv==0.11.25 \ + --hash=sha256:2c1cfe97dce56c997dfa3214bdb8955b7b34cceea7505520185e22ad99c0eb6b \ + --hash=sha256:3febca65ec5bc336ddaf7e4f724704f2c894c16839723df14865ee00b4acf38d \ + --hash=sha256:41b37e724f41eb4c3794bbdd82ddeebb4b5850d4ada8cccb2906ef9e5aa0f83b \ + --hash=sha256:458e731778e7b5cc870710397859c23e766703e7bc0695f23b3eb15080745ba6 \ + --hash=sha256:560b0fbaa6356af533923a349658c21d4f410d16e835787d8a05da451d4ee859 \ + --hash=sha256:57fbd47e924242fd347d0c209d95711d8ea61db8d8780962d0f30ccde2c854a3 \ + --hash=sha256:610650cbaa0a9b18015da39d2c28d736d287a5a124e49296d8fdef5e4022e980 \ + --hash=sha256:61ef11d9967a38109e6e8e3d20d1f743fa08033c32bce274d6ccd9a9abb5d305 \ + --hash=sha256:69d14ffd0a4b050f8a70f64aacb09b8dfdfb1cb30a6351fb17b48f273f95c58c \ + --hash=sha256:79f166cd1b84f855e9d2768221d59b403869648289fd884d58ad4299edfb4d9e \ + --hash=sha256:850ba0018ff170c3a9baaf9b5fe8b23393b6b77ee4ea6b2e2315fdb8d7c388f7 \ + --hash=sha256:86d4759fec9b46f61944d6e9ef1f5eaa2c5fbe2db5ddb59492d9174b08fcf39c \ + --hash=sha256:b180b12237b4e04692491fc6796584a9a8bdf4c7332bd2a769caf096b97885d0 \ --hash=sha256:d2bc05e17ae3e1f232abf93e7dcfb3b68702dfcde34a00c29cbce7e07d1ecbfb \ - --hash=sha256:560b0fbaa6356af533923a349658c21d4f410d16e835787d8a05da451d4ee859 + --hash=sha256:d6f965a79fc7539a12139ce981caa0cbf7d9d3bd4ea3daadaf174ab4d7fb6e42 \ + --hash=sha256:e3480640983e0b8e509eeb67882837e620bdd820f8776948a5f13ebbb4481d04 \ + --hash=sha256:f42de9e7d63a28a4fe76a522077813656de38b5acda20b4db63857d260c1ff13 \ + --hash=sha256:f7a78fc8d0c5e764e9fa39c99066db47a0bc465b023feed90812e3c0a6b5eb0d \ + --hash=sha256:fbff70ae9fa4da9fb6823ae4fdaf77a65c9520e13b6d1d0241ba56e4b121b7aa diff --git a/requirements-opencode-review-ci.txt b/requirements-opencode-review-ci.txt index b73fe983..cdcbe58a 100644 --- a/requirements-opencode-review-ci.txt +++ b/requirements-opencode-review-ci.txt @@ -1,5 +1,6 @@ coverage==7.14.3 interrogate==1.7.0 +numpy==2.5.1 pytest==9.1.1 pytest-cov==7.1.0 uv==0.11.25 From 2b328f6a8b277c618b6bf288cda04d613e8f1611 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 21 Jul 2026 23:20:17 +0000 Subject: [PATCH 2/7] fix(security): bump pyasn1 to 0.6.4 for CVE-2026-59886 pip-audit fails on main: pyasn1 0.6.3 in requirements-strix-ci-hashes.txt carries CVE-2026-59886 (univ.Real big-exponent DoS), fixed in 0.6.4. Add the floor to requirements-strix-ci.txt and regenerate the lockfile with the exact header command; only pyasn1 changes. --- requirements-strix-ci-hashes.txt | 10 ++++++---- requirements-strix-ci.txt | 2 ++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/requirements-strix-ci-hashes.txt b/requirements-strix-ci-hashes.txt index 4cf45203..85c6bf60 100644 --- a/requirements-strix-ci-hashes.txt +++ b/requirements-strix-ci-hashes.txt @@ -1501,10 +1501,12 @@ protobuf==6.33.6 \ # grpc-google-iam-v1 # grpcio-status # proto-plus -pyasn1==0.6.3 \ - --hash=sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf \ - --hash=sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde - # via pyasn1-modules +pyasn1==0.6.4 \ + --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ + --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b + # via + # -r requirements-strix-ci.txt + # pyasn1-modules pyasn1-modules==0.4.2 \ --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \ --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6 diff --git a/requirements-strix-ci.txt b/requirements-strix-ci.txt index d4889459..353a4c4d 100644 --- a/requirements-strix-ci.txt +++ b/requirements-strix-ci.txt @@ -3,3 +3,5 @@ google-cloud-aiplatform==1.133.0 protobuf<7.0.0 cryptography==49.0.0 python-multipart==0.0.31 +# CVE-2026-59886: univ.Real big-exponent DoS; fixed in 0.6.4 +pyasn1>=0.6.4 From 9828c2c15d2f86a034c1d7cfcf4cc3515e3292da Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 21 Jul 2026 23:23:31 +0000 Subject: [PATCH 3/7] fix(review): deterministic sandbox toolchain and prefetch diagnostics Address review feedback: export RUSTUP_TOOLCHAIN so a repository rust-toolchain.toml cannot make the offline sandbox attempt a toolchain download, and emit an explicit warning when the crate prefetch is skipped because cargo is unavailable on the runner. --- .github/workflows/opencode-review.yml | 31 +++++++++++++++++---------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index ef0c9a4a..c03c8b72 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -293,17 +293,20 @@ jobs: mkdir -p "$(dirname "$COVERAGE_SOURCE_WORKDIR")" mv "$fetch_dir" "$COVERAGE_SOURCE_WORKDIR" git -C "$COVERAGE_SOURCE_WORKDIR" status --short - if [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.toml" ] && [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.lock" ] \ - && command -v cargo >/dev/null 2>&1; then - # Pre-fetch the locked crate graph into the tree-local CARGO_HOME that the - # network-isolated coverage sandbox already uses, so `cargo llvm-cov` can - # compile Rust coverage offline. `cargo fetch` downloads content-addressed - # crates without executing any build scripts, and a failed prefetch keeps - # the same fail-closed sandbox behavior: the offline build surfaces the - # missing dependencies for this head. - if ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ - cargo fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/Cargo.toml"; then - echo "::warning::Locked cargo prefetch failed; offline Rust coverage will surface the missing dependencies for this head." + if [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.toml" ] && [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.lock" ]; then + if command -v cargo >/dev/null 2>&1; then + # Pre-fetch the locked crate graph into the tree-local CARGO_HOME that the + # network-isolated coverage sandbox already uses, so `cargo llvm-cov` can + # compile Rust coverage offline. `cargo fetch` downloads content-addressed + # crates without executing any build scripts, and a failed prefetch keeps + # the same fail-closed sandbox behavior: the offline build surfaces the + # missing dependencies for this head. + if ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ + cargo fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/Cargo.toml"; then + echo "::warning::Locked cargo prefetch failed; offline Rust coverage will surface the missing dependencies for this head." + fi + else + echo "::warning::cargo is unavailable on this runner, so the locked crate graph was not pre-fetched; offline Rust coverage for this head will fail with missing dependencies." fi fi tar -cf "$COVERAGE_SOURCE_ARCHIVE" -C "$COVERAGE_SOURCE_WORKDIR" . @@ -1367,6 +1370,12 @@ jobs: # the tree-local CARGO_HOME so missing dependencies fail fast with a # clear offline error instead of a network timeout. export CARGO_NET_OFFLINE=true + # Coverage always measures with the trusted image toolchain: a + # repository rust-toolchain(.toml) requesting any other channel would + # make the rustup proxy attempt a download the offline sandbox cannot + # perform. The env override takes precedence over directory overrides, + # keeping toolchain selection deterministic and offline-safe. + export RUSTUP_TOOLCHAIN=1.94.1 ensure_rust_gpu_adapter ensure_rust_desktop_deps } From 136c82785cfadbeadcad1f63f497c776920d51b9 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 21 Jul 2026 23:27:27 +0000 Subject: [PATCH 4/7] fix(review): pin pyasn1 exactly, prefetch with the pinned toolchain, drop global image CARGO_HOME Address second review round: requirements-strix-ci.txt now pins pyasn1==0.6.4 to match the lock; the crate prefetch prefers rustup run 1.94.1 so lockfile parsing and cache layout match the sandbox toolchain, falling back to the runner cargo; the image no longer bakes a global CARGO_HOME so the tree-local cache set per measured command is the only cargo home the sandbox sees. --- .github/workflows/opencode-review.yml | 42 +++++++++++++++++---------- requirements-strix-ci.txt | 2 +- 2 files changed, 27 insertions(+), 17 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index c03c8b72..b2f1fb94 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -294,19 +294,26 @@ jobs: mv "$fetch_dir" "$COVERAGE_SOURCE_WORKDIR" git -C "$COVERAGE_SOURCE_WORKDIR" status --short if [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.toml" ] && [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.lock" ]; then - if command -v cargo >/dev/null 2>&1; then - # Pre-fetch the locked crate graph into the tree-local CARGO_HOME that the - # network-isolated coverage sandbox already uses, so `cargo llvm-cov` can - # compile Rust coverage offline. `cargo fetch` downloads content-addressed - # crates without executing any build scripts, and a failed prefetch keeps - # the same fail-closed sandbox behavior: the offline build surfaces the - # missing dependencies for this head. - if ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ - cargo fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/Cargo.toml"; then - echo "::warning::Locked cargo prefetch failed; offline Rust coverage will surface the missing dependencies for this head." - fi - else + # Pre-fetch the locked crate graph into the tree-local CARGO_HOME that the + # network-isolated coverage sandbox already uses, so `cargo llvm-cov` can + # compile Rust coverage offline. Prefer the same pinned toolchain the + # sandbox measures with so lockfile parsing and cache layout cannot + # drift from the runner's default cargo. `cargo fetch` downloads + # content-addressed crates without executing any build scripts, and a + # failed prefetch keeps the same fail-closed sandbox behavior: the + # offline build surfaces the missing dependencies for this head. + prefetch_cargo=() + if command -v rustup >/dev/null 2>&1 \ + && rustup toolchain install 1.94.1 --profile minimal --no-self-update >/dev/null 2>&1; then + prefetch_cargo=(rustup run 1.94.1 cargo) + elif command -v cargo >/dev/null 2>&1; then + prefetch_cargo=(cargo) + fi + if [ "${#prefetch_cargo[@]}" -eq 0 ]; then echo "::warning::cargo is unavailable on this runner, so the locked crate graph was not pre-fetched; offline Rust coverage for this head will fail with missing dependencies." + elif ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ + "${prefetch_cargo[@]}" fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/Cargo.toml"; then + echo "::warning::Locked cargo prefetch failed; offline Rust coverage will surface the missing dependencies for this head." fi fi tar -cf "$COVERAGE_SOURCE_ARCHIVE" -C "$COVERAGE_SOURCE_WORKDIR" . @@ -612,14 +619,17 @@ jobs: # rustc/cargo cannot parse modern version-4 Cargo.lock files and ships # no llvm-cov/llvm-profdata, so `cargo llvm-cov` coverage evidence for # Rust repositories needs this toolchain. The rustup-init binary is - # sha256-pinned and the toolchain channel is version-pinned. - ENV RUSTUP_HOME=/usr/local/rustup \ - CARGO_HOME=/usr/local/cargo + # sha256-pinned and the toolchain channel is version-pinned. Only + # RUSTUP_HOME is exported for the runtime; CARGO_HOME is deliberately + # not baked into the image so the sandbox's tree-local CARGO_HOME + # (which holds the pre-fetched crate cache) is the only cargo home the + # measured commands ever see. + ENV RUSTUP_HOME=/usr/local/rustup RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/rustup-init \ https://static.rust-lang.org/rustup/archive/1.28.2/x86_64-unknown-linux-gnu/rustup-init \ && echo '20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c /tmp/rustup-init' | sha256sum -c - \ && chmod 0755 /tmp/rustup-init \ - && /tmp/rustup-init -y --no-modify-path --profile minimal \ + && CARGO_HOME=/usr/local/cargo /tmp/rustup-init -y --no-modify-path --profile minimal \ --default-toolchain 1.94.1 --component llvm-tools-preview \ && ln -sf /usr/local/cargo/bin/* /usr/local/bin/ \ && chmod -R a+rX /usr/local/rustup /usr/local/cargo \ diff --git a/requirements-strix-ci.txt b/requirements-strix-ci.txt index 353a4c4d..950f15c9 100644 --- a/requirements-strix-ci.txt +++ b/requirements-strix-ci.txt @@ -4,4 +4,4 @@ protobuf<7.0.0 cryptography==49.0.0 python-multipart==0.0.31 # CVE-2026-59886: univ.Real big-exponent DoS; fixed in 0.6.4 -pyasn1>=0.6.4 +pyasn1==0.6.4 From a0cd0deb4d81dbfcae4d6b5bfe8cf89813c7acdd Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 21 Jul 2026 23:34:40 +0000 Subject: [PATCH 5/7] fix(review): prefetch locked crate graphs for nested workspaces too Address review feedback: the crate prefetch now walks every tracked Cargo.toml with a sibling Cargo.lock (root and nested workspaces alike, matching the sandbox's nested-manifest coverage discovery) instead of only the repository root. --- .github/workflows/opencode-review.yml | 38 ++++++++++++++++++--------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index b2f1fb94..bf20154f 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -293,15 +293,18 @@ jobs: mkdir -p "$(dirname "$COVERAGE_SOURCE_WORKDIR")" mv "$fetch_dir" "$COVERAGE_SOURCE_WORKDIR" git -C "$COVERAGE_SOURCE_WORKDIR" status --short - if [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.toml" ] && [ -f "$COVERAGE_SOURCE_WORKDIR/Cargo.lock" ]; then - # Pre-fetch the locked crate graph into the tree-local CARGO_HOME that the - # network-isolated coverage sandbox already uses, so `cargo llvm-cov` can - # compile Rust coverage offline. Prefer the same pinned toolchain the - # sandbox measures with so lockfile parsing and cache layout cannot - # drift from the runner's default cargo. `cargo fetch` downloads - # content-addressed crates without executing any build scripts, and a - # failed prefetch keeps the same fail-closed sandbox behavior: the - # offline build surfaces the missing dependencies for this head. + # Pre-fetch every locked crate graph in the merge tree (root and nested + # workspaces alike, matching the sandbox's nested-manifest coverage + # discovery) into the tree-local CARGO_HOME that the network-isolated + # coverage sandbox already uses, so `cargo llvm-cov` can compile Rust + # coverage offline. Prefer the same pinned toolchain the sandbox + # measures with so lockfile parsing and cache layout cannot drift from + # the runner's default cargo. `cargo fetch` downloads content-addressed + # crates without executing any build scripts, and a failed prefetch + # keeps the same fail-closed sandbox behavior: the offline build + # surfaces the missing dependencies for this head. + prefetch_manifests="$(git -C "$COVERAGE_SOURCE_WORKDIR" ls-files 'Cargo.toml' '*/Cargo.toml')" + if [ -n "$prefetch_manifests" ]; then prefetch_cargo=() if command -v rustup >/dev/null 2>&1 \ && rustup toolchain install 1.94.1 --profile minimal --no-self-update >/dev/null 2>&1; then @@ -310,10 +313,19 @@ jobs: prefetch_cargo=(cargo) fi if [ "${#prefetch_cargo[@]}" -eq 0 ]; then - echo "::warning::cargo is unavailable on this runner, so the locked crate graph was not pre-fetched; offline Rust coverage for this head will fail with missing dependencies." - elif ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ - "${prefetch_cargo[@]}" fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/Cargo.toml"; then - echo "::warning::Locked cargo prefetch failed; offline Rust coverage will surface the missing dependencies for this head." + echo "::warning::cargo is unavailable on this runner, so no locked crate graph was pre-fetched; offline Rust coverage for this head will fail with missing dependencies." + else + while IFS= read -r prefetch_manifest; do + [ -n "$prefetch_manifest" ] || continue + prefetch_dir="$(dirname "$prefetch_manifest")" + if [ ! -f "$COVERAGE_SOURCE_WORKDIR/$prefetch_dir/Cargo.lock" ]; then + continue + fi + if ! CARGO_HOME="$COVERAGE_SOURCE_WORKDIR/.opencode-sandbox-home/.cargo" \ + "${prefetch_cargo[@]}" fetch --locked --manifest-path "$COVERAGE_SOURCE_WORKDIR/$prefetch_manifest"; then + echo "::warning::Locked cargo prefetch failed for ${prefetch_manifest}; offline Rust coverage will surface the missing dependencies for this head." + fi + done <<<"$prefetch_manifests" fi fi tar -cf "$COVERAGE_SOURCE_ARCHIVE" -C "$COVERAGE_SOURCE_WORKDIR" . From 5a5b57e67594b8f68b8810ae4ae154971c0a37e8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 04:15:42 +0000 Subject: [PATCH 6/7] chore: re-trigger scheduler evaluation after resolving review threads From df1d2698fdfe399b8dadc4db7341c2880378215c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 19:18:49 +0000 Subject: [PATCH 7/7] chore: refresh head to re-dispatch review after provider-pool exhaustion