fix(security): bind repository scanners to exact PR head - #799
fix(security): bind repository scanners to exact PR head#799seonghobae wants to merge 26 commits into
Conversation
📝 WalkthroughWalkthroughPR의 실제 head 저장소와 SHA를 보안 스캔 입력과 SARIF 식별자에 고정했습니다. Dependency Review API는 HTTP 200에서만 성공하며, 관련 계약 테스트와 quality CI를 추가했습니다. 운영 계약과 rollback 절차도 문서화했습니다. ChangesExact-head 보안 스캔
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant DependencyReviewAPI
participant Trivy
participant Scorecard
participant SARIFUpload
PullRequest->>GitHubActions: head repository와 head SHA 제공
GitHubActions->>DependencyReviewAPI: base SHA와 head SHA 비교 요청
DependencyReviewAPI-->>GitHubActions: HTTP 200 또는 실패 상태 반환
GitHubActions->>Trivy: head repository와 head SHA checkout
GitHubActions->>Scorecard: head repository와 head SHA checkout
Trivy->>SARIFUpload: head ref와 head SHA를 포함한 SARIF 업로드
Scorecard->>SARIFUpload: head ref와 head SHA를 포함한 SARIF 업로드
Possibly related issues
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent Extend this exact-current-head security-scan repair test-first to address #810, and do nothing if PR #799 branch head is no longer A downstream exact-head canary exposed a valid organization-level fail-open defect in the same workflow. Use two auditable commits in order:
Update doctoring so its claimed fail-closed behavior matches production and include current APA 7 primary references to GitHub Dependency Review, Dependency Graph, and Dependency Review REST API. Add one concise Do not change After GREEN, run the focused dependency-free contract and the complete central Python test/100% statement+branch coverage/public-docstring/compile contract available on the branch. Then leave PR #799 unmerged and request fresh exact-GREEN CodeRabbit/OpenCode/Noema review plus every required security workflow; do not claim queued, absent, skipped, predecessor-head, or synthetic-merge evidence as current-head success. Report immutable RED and GREEN SHAs in this PR conversation. |
|
@opencode-agent Extend this existing security-scan repair test-first on exact current head Fresh downstream evidence from Use the existing PR #799 rather than creating a competing PR because it already owns Required RED → GREEN extension:
Modify only the already-owned PR #799 security-scan workflow/contract/helper/documentation/CHANGELOG surface needed for this repair. Do not add any repository-write, OIDC, branch/ref publication, PR creation/merge, release/package/signing authority, temporary write-capable workflow, self-modifying workflow, model-modified-tree publication, or conflict strategy. Do not merge or mark Ready. After GREEN, require fresh exact-current-head central quality/security/review evidence and preserve independent non-author approval and branch protection as mandatory gates. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
protected_main='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
printf '%s\n' '== Current commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit exists =='
git rev-parse "${requested_head}^{commit}"
printf '%s\n' '== Requested protected commit exists =='
git rev-parse "${protected_main}^{commit}"
printf '%s\n' '== Merge base =='
git merge-base "$protected_main" "$requested_head"
printf '%s\n' '== Changed files =='
git diff --name-status "$protected_main" "$requested_head"
printf '%s\n' '== Workflow outline =='
ast-grep outline .github/workflows/security-scan.yml --items all || true
printf '%s\n' '== Focused test candidates =='
fd -t f 'security.*scan.*exact.*head|exact.*head.*security.*scan|security.*scan.*dependency.*review' tests . 2>/dev/null || true
printf '%s\n' '== Workflow security-sensitive lines =='
rg -n -C 4 --glob '.github/workflows/security-scan.yml' \
'actions/checkout|dependency-review-action|upload-sarif|head\.repo|head\.sha|refs/pull|persist-credentials|permissions:|security-events|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity' .Length of output: 2385 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
for file in \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
do
printf '\n== %s ==\n' "$file"
nl -ba "$file"
done
printf '\n== Complete diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.mdLength of output: 1191 🏁 Script executed: #!/bin/bash
set -u
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
print_file() {
file="$1"
printf '\n== %s ==\n' "$file"
if command -v awk >/dev/null 2>&1; then
awk '{ printf "%6d %s\n", NR, $0 }' "$file"
else
cat "$file"
fi
}
for file in \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
do
print_file "$file"
done
printf '\n== Complete scoped diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md || trueLength of output: 65118 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
--jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'
printf '%s\n' '== Check runs for the requested head =='
gh api "repos/${repo}/commits/aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url}'
printf '%s\n' '== Workflow-run conclusions for the requested head =='
gh run list --repo "$repo" \
--commit aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae \
--limit 100 \
--json databaseId,name,status,conclusion,event,headSha,url \
--jq '.[] | {databaseId, name, status, conclusion, event, headSha, url}'Length of output: 23567
Finding — P1: dependency-review can succeed without dependency-review evidence In Treat unavailable support as unavailable security evidence. Fail the job with a concise error that identifies the repository and exact base/head. Do not print the response body. This behavior is relevant to the reported EgressWeave public-repository The remaining requested controls are present:
I cannot approve while the dependency-review fail-open path remains.
|
|
Review-only request for exact current head |
|
@cwl-noema-review Independently review exact current head |
|
@coderabbitai review Final read-only exact-head review for |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact head |
|
@cwl-noema-review review Independently review exact head |
![pr-auto-rebase[bot]](iframe.php?url=https%3A%2F%2Fgithub.githubassets.com%2Fimages%2Fgravatars%2Fgravatar-user-420.png){kind=avatar}
aee317b to
323c07b
Compare
|
@opencode-agent Exact-head correction for #810: extend only current PR #799 head Preserve the existing exact-PR-head checkout/SARIF binding repair. Add the dependency-review availability repair test-first in two auditable commits:
Keep exact Do not add or use a temporary/self-modifying/write-capable workflow, |
|
Review-only exact-head request for |
|
@cwl-noema-review Independently review exact head |
|
@coderabbitai review Final read-only review for exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
head='323c07b794d11f82c04db91544bc3a3f5cf5ad5c'
printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
--jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'
printf '%s\n' '== Local checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit =='
git rev-parse "${head}^{commit}"
printf '%s\n' '== Changed files against PR base =='
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
git diff --name-status "$base" "$head"
printf '%s\n' '== Workflow structure =='
ast-grep outline .github/workflows/security-scan.yml --items all || true
printf '%s\n' '== Exact-head and policy-sensitive workflow lines =='
rg -n -C 5 \
'actions/checkout|dependency-review-action|upload-sarif|head\.repo\.full_name|head\.sha|refs/pull|persist-credentials|permissions:|security-events:|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity|BASE_SHA|HEAD_SHA|supported=' \
.github/workflows/security-scan.yml
printf '%s\n' '== Focused contract test candidates =='
fd -t f 'test_security_scan_exact_head.py|test_security_scan_sarif_exact_head.py|test_security_scan_dependency_review.py' tests 2>/dev/null \
| sort \
| xargs -r -n1 sh -c 'echo "== $0 =="; sed -n "1,260p" "$0"'
printf '%s\n' '== Scoped documentation and changelog changes =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_security_scan_dependency_review.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
printf '%s\n' '== Check runs for requested head =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url}'
printf '%s\n' '== Workflow runs for requested head =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,status,conclusion,event,headSha,url \
--jq '.[] | {databaseId,name,status,conclusion,event,headSha,url}'Length of output: 58020
Finding — P1: dependency-review can pass without dependency-review evidence In The exact head still contains the EgressWeave fail-open path from the prior review. Treat The requested exact-head controls are present:
I cannot approve while the dependency-review fail-open path remains. You are interacting with an AI system. |
|
Supersede the immediately preceding review-only request at issue comment Current-head inspection still shows After a new exact GREEN head implements #810, request fresh CodeRabbit/OpenCode/Noema review and every required quality/security/supply-chain workflow against that new SHA only. Predecessor-head success and this superseded review request are stale evidence. |
|
Exact-head read-only review request for @opencode-agent review Review only this exact head. Preserve reviewer identities and credentials; do not mutate the branch, synthesize approval, bypass protection, or merge from the author identity. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
head='e7690e359791353fb5547e1b4a4d1e4272f78cc3'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
echo '== PR and commit identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested-head: '; git rev-parse "${head}^{commit}"
printf 'requested-base: '; git rev-parse "${base}^{commit}"
printf 'merge-base: '; git merge-base "$base" "$head"
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
--jq '{number,headRefOid,baseRefOid,isDraft,mergeStateStatus}'
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== Dependency-review workflow block =='
nl -ba .github/workflows/security-scan.yml | sed -n '245,335p'
echo '== Scanner checkout and SARIF controls =='
rg -n -C 5 \
'permissions:|actions/checkout|head\.repo\.full_name|head\.sha|persist-credentials|dependency-review-action|upload-sarif|refs/pull|trivy|scorecard|severity|fail-on-severity' \
.github/workflows/security-scan.yml
echo '== Focused and central test contracts =='
for file in \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_required_workflow_queue_contract.py
do
echo "== ${file} =="
rg -n -C 14 \
'test_security_scan_skips_dependency_review_when_dependency_graph_is_unavailable|dependency-review|dependency_review|supported=false|supported=true|HTTP 200|403|404|/dev/null|curl|connect-timeout|max-time|BASE_SHA|HEAD_SHA|head\.repo|head\.sha|refs/pull|persist-credentials|upload-sarif' \
"$file" || true
done
echo '== Doctoring and changelog =='
for file in docs/doctoring/security-scan-exact-head.md CHANGELOG.md; do
echo "== ${file} =="
rg -n -C 8 \
'dependency.review|dependency-review|HTTP 200|403|404|unavailable|fail.closed|response.body|connect-timeout|max-time|rollback|APA|exact.head|exact-head' \
"$file" || true
done
echo '== Full scoped diff =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
.github/workflows/security-scan-exact-head-quality-ci.yml \
.github/workflows/security-scan.yml \
CHANGELOG.md \
README.md \
docs/doctoring/security-scan-exact-head.md \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_required_workflow_queue_contract.py
echo '== Temporary patch artifact =='
fd -t f '2026-08-07-dependency-review-timeouts\.patch' . || true
echo '== Relevant exact-head checks =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | select(.name | test("Security Scan Exact-Head Quality CI|Python Security|SAST|Security Scan|CodeQL|Semgrep|Secret Scan|OSV|Scorecard|SBOM")) | {name,status,conclusion,head_sha:.head_sha,details_url}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path,line,author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}'Length of output: 4514 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
head='e7690e359791353fb5547e1b4a4d1e4272f78cc3'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
show_range() {
file="$1"
first="$2"
last="$3"
printf '\n== %s, Lines %s-%s ==\n' "$file" "$first" "$last"
awk -v first="$first" -v last="$last" \
'NR >= first && NR <= last { printf "%6d %s\n", NR, $0 }' "$file"
}
echo '== Dependency-review workflow block =='
show_range .github/workflows/security-scan.yml 245 335
echo '== Scanner checkout and SARIF controls =='
rg -n -C 5 \
'permissions:|actions/checkout|head\.repo\.full_name|head\.sha|persist-credentials|dependency-review-action|upload-sarif|refs/pull|trivy|scorecard|severity|fail-on-severity' \
.github/workflows/security-scan.yml
echo '== Focused exact-head contract =='
cat -n tests/test_security_scan_exact_head.py
echo '== SARIF exact-head contract =='
cat -n tests/test_security_scan_sarif_exact_head.py
echo '== Central dependency-review contract =='
rg -n -C 16 \
'test_security_scan_skips_dependency_review_when_dependency_graph_is_unavailable|dependency-review|dependency_review|supported=false|supported=true|HTTP 200|403|404|BASE_SHA|HEAD_SHA|dependency-review-action' \
tests/test_required_workflow_queue_contract.py || true
echo '== Doctoring and changelog =='
for file in docs/doctoring/security-scan-exact-head.md CHANGELOG.md; do
printf '\n== %s ==\n' "$file"
rg -n -C 8 \
'dependency.review|dependency-review|HTTP 200|403|404|unavailable|fail.closed|response.body|connect-timeout|max-time|rollback|APA|exact.head|exact-head' \
"$file" || true
done
echo '== Full seven-file diff =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
.github/workflows/security-scan-exact-head-quality-ci.yml \
.github/workflows/security-scan.yml \
CHANGELOG.md \
README.md \
docs/doctoring/security-scan-exact-head.md \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py
echo '== Temporary patch artifact =='
find . -type f -name '2026-08-07-dependency-review-timeouts.patch' -print
echo '== Relevant exact-head checks =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | select(.name | test("Security Scan Exact-Head Quality CI|Python Security|SAST|Security Scan|CodeQL|Semgrep|Secret Scan|OSV|Scorecard|SBOM")) | {name,status,conclusion,head_sha:.head_sha,details_url}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path,line,author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}'Length of output: 89753
I found one blocking current-head defect. I cannot approve this head. P1 — The central test contract still requires the removed fail-open path.
The current workflow correctly contains neither branch. It accepts only HTTP Replace this legacy test with a fail-closed contract that requires:
The other inspected controls are correct on this exact head:
The focused workflow can pass while the complete central suite still fails on the stale contract. Keep the PR unapproved until that test is repaired and the complete suite passes on a new exact head. You are interacting with an AI system. |
|
@opencode-agent Implement the minimal test-only GREEN repair on exact current head The current exact-head OpenCode coverage run Modify only
Do not modify the production workflow, dependencies, docs, credentials, permissions, refs, release paths, or any other file. Run the corrected contract file plus |
|
@opencode-agent Perform a read-only exact-head review of PR #799 at This head includes the minimal stale-contract correction for the dependency-review fail-closed boundary and is based on current protected main. Exact-head Security Scan Quality, SAST, Secret, OSV, Scorecard, and SBOM are successful; CodeQL, Security Scan, and Python Security are still authoritative until completion. Independently verify explicit head-repository/SHA checkout and SARIF identity, exact base/head dependency compare, HTTP-200-only support, body discard, connection/total timeout, every unavailable/403/404/transport outcome failing closed, immutable dependency-review hard gate, focused tests and documentation accuracy. Submit a formal outcome only after all exact-head required checks complete cleanly. Do not merge, auto-merge, rebase, retarget, release, or publish. |
|
@opencode-agent @cwl-noema-review Review-only exact-head request for |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heada6cd746e86c07452d03e0f5cef8e8d13c22f28c6. -
Head SHA:
a6cd746e86c07452d03e0f5cef8e8d13c22f28c6 -
Workflow run: 31153541779
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: security-scan-exact-head.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: security-scan-exact-head.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
@opencode-agent Perform a read-only formal review of exact current head |
|
@opencode-agent Review exact current head |
|
@cwl-noema-review Review exact current head |
|
/oc Refetch the live pull request and stop without writing unless its exact head is Apply the minimum test-only repair. Rename that test to describe fail-closed dependency-review evidence. Preserve assertions for Run that focused test first, then |
Purpose
Restore exact-head security evidence for organization-required repository scanners and fail closed when dependency-review evidence is unavailable. DiskSage PR #137 exposed synthetic-merge scanner input; the public EgressWeave canary exposed a separate fail-open path where HTTP 403 skipped dependency review while the aggregate Security Scan remained green.
Exact current stack
a6cd746e86c07452d03e0f5cef8e8d13c22f28c6;e71fdab2ab088001f218765ecb5e3b7fabfee11a;Implemented boundary
refs/pull/<number>/headand that same exact head SHA.000, empty/malformed status, and every unexpected outcome fail closed./dev/null; diagnostics expose only bounded repository, base/head identity, and status evidence.actions/dependency-review-actionhard gate; no greensupported=falsepath exists.Exact-head acceptance evidence
For
a6cd746e86c07452d03e0f5cef8e8d13c22f28c6, all exact-head workflows completed successfully:31153100905;31153100932;31153100875;31153100955;31153100913;31153100874;31153101198;31153100952;31153100999;All inline review threads are resolved or outdated; zero actionable unresolved thread remains. Formal exact-current-head OpenCode/Noema review and a qualifying independent non-author approval remain required. Queued, cancelled, predecessor-head, synthetic-merge, status-only, author-only, local-only, or repair-workflow evidence is not accepted.
Stack order
This scanner repair overlaps the fail-closed dependency-review subset carried by
.github#813, whose primary purpose is the OpenCode fatal-process-group prerequisite. Keep this PR Draft until #813 reaches protectedmain. Then rebase or merge the new protected base, remove any base-identical overlap from the effective diff, and regenerate every exact-head quality, security, review, and approval surface. No evidence transfers across that base change.Operator and merge contract
For a public GitHub.com repository, unavailable dependency-review evidence is a repository/organization configuration or capability problem until proven otherwise. Correct dependency graph, GitHub security capability, organization policy, entitlement, or token access and rerun; do not manufacture a green check by weakening the hard gate. Private/internal exceptions require explicit organization policy and independently reviewable entitlement evidence.
docs/doctoring/security-scan-exact-head.mdrecords exact-head authorization, SARIF identity, fail-closed behavior, bounded execution, rollback, operator remediation, and APA 7 primary sources. After #813 integration and this PR's base refresh, merge only after exact-current-head automated review, qualifying independent non-author approval, zero unresolved valid findings, and every branch-protection rule succeed without bypass.