fix(review): GPT-4.1을 첫 승인 후보로 우선#604
Conversation
seonghobae
changed the title
|
Current-head governance correction: |
seonghobae
changed the title
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR reprioritizes the OpenCode review model candidate order to try GPT-4.1 first (based on observed reliability/performance), while keeping other models as ordered fallbacks, and aligns this ordering across workflow + Python + Strix contracts. It also hardens trusted execution boundaries by preventing GitHub Actions command injection from coverage logs and by failing closed on non-regular or symlink entries in the materialized PR worktree.
Changes:
- Reorders
OPENCODE_MODEL_CANDIDATESto start withgithub-models/openai/gpt-4.1and updates corresponding assertions. - Adds stop-command enveloping for replaying untrusted coverage summaries (collision-safe token).
- Adds fail-closed validation of tracked file modes and symlink presence in the PR worktree; cleans
.codegraphstate before indexing.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| tests/test_opencode_agent_contract.py | Updates ordering expectations and adds regression tests for stop-command replay + symlink rejection contracts. |
| scripts/ci/test_strix_quick_gate.sh | Updates Strix gate assertions to match the new model candidate ordering. |
| .github/workflows/opencode-review.yml | Reorders model candidates and introduces new security checks (stop-commands envelope, worktree entry validation, .codegraph cleanup). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
current HEAD 039c3c1에서 Strix HIGH 원인을 수정했습니다.
로컬 검증: OpenCode 계약 및 보안 경계 74 tests passed, Strix required-workflow smoke passed, Ruff passed, YAML parse 및 git diff check passed. actionlint는 이 머신에서 기존 여러 프로세스와 동일하게 장시간 정지하여 current-head CI 결과를 기준으로 계속 추적합니다. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
2fbfdf6fc9eb8b2059ac4d78d7b05e7c3307da29. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/29802039348/job/88544837313)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/29802039348/job/88544837313)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: test_strix_quick_gate.sh"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: test_strix_quick_gate.sh"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_opencode_agent_contract.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_opencode_agent_contract.py"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: test_strix_quick_gate.sh"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: test_strix_quick_gate.sh"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test: test_opencode_agent_contract.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_opencode_agent_contract.py"]
R3 --> V3["targeted test run"]
|
변경 사항
stop-commands경계로 감쌉니다.근거
AGENTS.md에는 GPT-4.1을 승인 후보에서 금지하는 계약이 없습니다.자동 리뷰 증거 계약
adversarial_validation의 각 probe는 구조화된path와 양의line,evidence의 정확한path:line을 서로 같게 작성해야 합니다.source-line-sha256receipt는 그 동일한 current-head 줄에 결합되어야 합니다.검증
bash scripts/ci/test_strix_quick_gate.shpython3 -m pytest -q tests/test_opencode_agent_contract.py tests/test_opencode_model_pool_runner.py— 59 passedpython3 -m pytest -q— 639 passedpython3 -m ruff check .github scripts testsactionlint -no-color -shellcheck= -pyflakes= .github/workflows/opencode-review.ymlgit diff --check