Repository navigation
Repoint the dead required context: the repair as a script, not a command to type - #1337
Conversation
…command to type main already carries the diagnosis and the prescribed edit; what was missing is something safe to execute against live branch protection. The dead required context is 'scan / Hypatia Neurosymbolic Analysis' -- the push/schedule-only call site of the Hypatia scan. The PR-time call site of the same reusable publishes 'Hypatia verdict grid / Hypatia Neurosymbolic Analysis'. A required check matched by name cannot be satisfied by a differently-named check, so #1336 merged through the always bypass with 65 checks green, and the gate stayed broken. scripts/apply-branch-gates.sh cannot fix this and says so: it derives contexts from checks that run, then must choose a ruleset, and with six additive branch rulesets it reports AMBIGUOUS rather than guess. A general rewriter is the wrong instrument; a single named field in a single named ruleset is the right one. fix-required-context-name.sh changes exactly that field, refuses on every state it cannot justify (inactive ruleset, both names, neither name, duplicate, anything that would alter the rule or context count), and verifies the read-back instead of trusting the payload. Report-only by default. Cannot be run from here: installation tokens report repo admin=true and still return 403 for ruleset writes (administration:write), so requires an admin user token. 22 offline fixtures cover every refusal branch via an injected gh. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 31 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Fork governance
Scope: the three lanes below are static checks at the named commit. A K9-DEED conformance🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run. Hypatia verdict grid🟢 clean · commit Advisory: 2 row(s), worst 🟢 clean (0 critical, 0 high) — reported, never grading the change.
Hypatia scan: 49 finding(s)
panic-attack assail: 41 finding(s)
pons asinorum: 22 finding(s)
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8e8861c9f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| fi | ||
|
|
||
| # Verify against the server, not against the payload we sent. | ||
| "$GH" api "repos/$REPO/rulesets/$RULESET" >"$tmp/verify.json" |
There was a problem hiding this comment.
If the read-back request fails after a successful PUT, such as during a network interruption, the script still reports success and exits zero without verifying the protection settings. With set -uo pipefail but no explicit status check here, an empty response leaves all three verification variables empty; the subsequent numeric comparisons produce integer expression expected errors and fall through to the OK message. This is reproducible with the injectable $GH returning exit 1 and no stdout on the final GET. Explicitly reject a failed request and an invalid or empty verification response before comparing the counts.
Useful? React with 👍 / 👎.
|
Add Carrot credits or activate Agent usage billing to use Autofix |
Repo self-tests caught this in CI, not locally: inline Python is banned (scripts/tests/check-inline-python-test.sh), and my fixture generator opened that door. The fixtures are now built with jq -- same 22 cases, same fake gh, no interpreter beyond jq. check-inline-python.sh: 14 ledgered lines across 10 files, none new. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Codex found this on #1338 and it is a real bug, in the same family as everything this session has been about: the verification step could report verification it never performed. "$GH" api ".../rulesets/$id" >"$tmp/verify.json" v_bypass="$(jq -r '.bypass_actors|length' ...)" if [ "$v_bypass" -ne 0 ]; ... If that GET fails, verify.json is empty, jq yields an empty string, and `[ "" -ne 0 ]` is a *syntax* error that evaluates false. The mismatch branch is skipped, and the script prints 'verified: 0 bypass actors' and exits 0 — after writing to live branch protection and confirming nothing. A gate that reports a check it never ran, in the one script whose entire job is to not do that. Both scripts had it, including fix-required-context-name.sh, which shipped in #1337. Both now require the GET to succeed, require the response to be a ruleset payload, and require numeric counts before comparing. Fixtures added that fail against the old code and pass against the new: a GET that returns 521 for the read-back, and a GET that returns valid JSON of the wrong shape. Verified non-vacuous by reverting the script: 4 failures, restored: 24/24. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
What this is
#1336 landed the diagnosis. It did not fix the rule, and the rule is why every pull request in this repository merges through a bypass.
The required context is
scan / Hypatia Neurosymbolic Analysis, published byhypatia-scan.ymlonpushtomain/master/develop,scheduleandworkflow_dispatch— never on a pull request. The PR-time call site of the same reusable workflow publishesHypatia verdict grid / Hypatia Neurosymbolic Analysis. A required check is matched by name, and those names differ, so the required one cannot be produced while a PR is open.The measured consequence, on #1336 itself:
reviewDecisionmergeableMERGEABLEmergeStateStatusBLOCKED65 green checks and a clean review still could not merge. That is not a red gate, it is an undecidable one, and it merged via the
alwaysbypass — which discards the other nineteen required checks in the same action.Why a script
scripts/apply-branch-gates.shcannot do this and correctly declines:Deriving contexts from checks that run is right in general; it just has no way to choose which ruleset to rewrite. A general-purpose protection rewriter aimed at six additive rulesets is how protection gets silently dropped. This is the narrow instrument instead: one named context in one named ruleset, with refusals.
What it refuses
active(editing it would change nothing while looking like it did)Report-only by default.
--applyto write. Requiresadministration: write; this could not be executed from the agent session — installation tokens report repoadmin: trueand still return 403 for ruleset writes, so it needs an admin user token. That is reported, not worked around.Verification
scripts/tests/fix-required-context-name-test.sh— 22 fixtures, fakeghinjected via$GH, every refusal branch covered, no network.After it runs
gh pr view <n> --json mergeStateStatusshould stop readingBLOCKEDon an all-green pull request. Until then, the bypass remains the actual merge path and the nineteen other required checks remain decorative.