feat(ci): add a bounded subprocess primitive - #1280
Conversation
|
Warning Review limit reachedNext included review available in 7 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (18)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughPOSIX bounded subprocess 계층을 추가했다. 검증 및 웹 E2E 실행에 출력 한도, 프로세스 그룹 정리, UTF-8 suffix, 심볼릭 링크 경계, 실행 오류 분류를 적용했다. 관련 결과 필드와 회귀 테스트도 추가했다. Changes샌드박스 실행 경계
Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk: ⚪ Minimal · up to This change adds bounded subprocess and file-suffix handling with no actionable merge-blocking risk remaining after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant sandboxed_web_e2e
participant BackendService
participant FrontendService
participant bounded_subprocess
sandboxed_web_e2e->>BackendService: bounded 서비스 시작
sandboxed_web_e2e->>FrontendService: bounded 서비스 시작
sandboxed_web_e2e->>BackendService: readiness 확인
sandboxed_web_e2e->>FrontendService: readiness 확인
sandboxed_web_e2e->>bounded_subprocess: E2E 명령 실행
bounded_subprocess-->>sandboxed_web_e2e: 제한된 stdout/stderr와 종료 상태
sandboxed_web_e2e->>BackendService: 종료 및 capture 정리
sandboxed_web_e2e->>FrontendService: 종료 및 capture 정리
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
88f5fcc62671ca6e635be05a9ab583adf7399c7a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32663339769/job/97252770534)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32663339769/job/97252770534)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: CHANGELOG.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: CHANGELOG.md"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: sandboxed-output-resource-bounds.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: sandboxed-output-resource-bounds.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: bounded_subprocess.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: bounded_subprocess.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (3 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (3 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: CHANGELOG.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: CHANGELOG.md"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: sandboxed-output-resource-bounds.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: sandboxed-output-resource-bounds.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: bounded_subprocess.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: bounded_subprocess.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (3 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (3 files)"]
R4 --> V4["targeted test run"]
|
* fix(sandbox): bound verification evidence * fix(sandbox): classify missing verification executable * fix(sandbox): classify non-executable commands
* fix(sandbox): bound verification evidence * fix(sandbox): bound web E2E evidence * fix(sandbox): classify missing verification executable * fix(sandbox): classify missing web executables * fix(sandbox): classify non-executable commands * fix(sandbox): reject invalid readiness URL schemes
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head local evidence for |
|
@opencode-agent review | Independent exact-current-head formal review requested for |
|
Exact-head RCA for e587c05: Strix run 32691970400 failed closed after repeated NVIDIA NIM HTTP 429 responses, then the distinct fallback returned HTTP 404; no vulnerability report artifact was produced. This is provider/backend infrastructure evidence, not a source finding in the bounded subprocess change. Keep the fail-closed gate and rerun the failed Strix job normally. |
Current-head re-review request\n\nCurrent exact head: e587c05\n\nThe previous REQUEST_CHANGES review is tied to an older Strix/provider-failure head. Current-head evidence must be re-established from this SHA; predecessor failures and approvals are not being reused. Please inspect the complete current diff and publish a substantive review after the current required Checks finish. No merge is requested until exact-head checks and independent approval are current. |
Exact-head verification receipt
No source, workflow, ruleset, protected-branch, or bypass mutation was used. |
|
Exact-head formal review request for e587c05. Please inspect the complete changed-file diff, with emphasis on bounded subprocess behavior, timeout/cancellation, and authority boundary. Publish a substantive Reviews API verdict tied only to this exact SHA, including security/control-plane impact, test gaps, and residual uncertainty. Do not reuse predecessor-head evidence or failed provider checks as source findings. @opencode-agent |
|
Exact-head |
1 participant
Outcome
First clean current-main layer replacing the monolithic #931.
This layer intentionally does not change sandboxed_verify, sandboxed_web_e2e, result schemas, workspace symlink policy, or the pip-audit lock. Those consumers remain separate stack layers.
Evidence
Part 1 of the clean replacement for #931.
Summary by CodeRabbit
새로운 기능
버그 수정
문서