-
Notifications
You must be signed in to change notification settings - Fork 0
ci: schedule naruon hourly review repair #1143
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
4f79f96
ci: schedule naruon hourly review repair
seonghobae 2b5bcd2
fix(router): allow PR comment reactions
seonghobae 361f9eb
Revert "fix(router): allow PR comment reactions"
seonghobae d26e0cf
Merge remote-tracking branch 'origin/main' into HEAD
seonghobae c12457d
Merge remote-tracking branch 'origin/main' into HEAD
seonghobae 9c2842a
fix(ci): refresh audit lock and scheduler assertion
seonghobae File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| name: Naruon Hourly Review Repair | ||
|
|
||
| on: | ||
| schedule: | ||
| # Minute 11 is reserved for naruon in the central hourly queue. | ||
| - cron: "11 * * * *" | ||
|
|
||
| concurrency: | ||
| group: naruon-hourly-review-repair | ||
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| dispatch-review-repair: | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| uses: ./.github/workflows/pr-review-fix-scheduler.yml | ||
| with: | ||
| target_repository: ContextualWisdomLab/naruon | ||
| base_branch: develop | ||
| max_prs: "50" | ||
| max_dispatches: "1" | ||
| retry_hours: "2" | ||
| secrets: | ||
| PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }} | ||
| OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| # naruon hourly review-repair caller | ||
|
|
||
| 검토 기준일: **2026-08-19** | ||
|
|
||
| ## Decision | ||
|
|
||
| ContextualWisdomLab operates one protected hourly caller for | ||
| `ContextualWisdomLab/naruon`, the email-first knowledge-graph workspace. The | ||
| caller runs at minute 11, delegates to the product-neutral central review-fix | ||
| scheduler, inspects at most 50 open pull requests targeting protected | ||
| `develop`, and dispatches at most one bounded repair per heartbeat. | ||
|
|
||
| The caller does not implement review or mutation logic. It keeps naruon | ||
| standalone while privileged automation remains in `ContextualWisdomLab/.github`. | ||
| The two-hour same-head retry floor prevents duplicate writer pressure when | ||
| OpenCode, security checks, or attachment-parser validation outlasts one | ||
| heartbeat. Queued checks and missing independent approval remain merge gates; | ||
| the repair worker cannot manufacture either result. | ||
|
|
||
| ## Credential and authority boundary | ||
|
|
||
| The caller exposes only `contents: read` and job-scoped `id-token: write`. It | ||
| maps `PR_REVIEW_MERGE_TOKEN` and `OPENCODE_APPROVE_TOKEN` explicitly, and never | ||
| forwards `NVIDIA_NIM_API_KEY`, `COPILOT_GITHUB_TOKEN`, or `secrets: inherit`. | ||
| The reusable scheduler validates the exact target and dispatch authority before | ||
| materializing mutation credentials. | ||
|
|
||
| ## Verification and rollback | ||
|
|
||
| Contract tests pin the minute 11 cadence, target repository, `develop` base, | ||
| single dispatch, two-hour retry floor, explicit secret scope, and central | ||
| quality-workflow path filters. Scheduled execution is the operational | ||
| acceptance check; source tests alone do not prove a protected-branch merge. | ||
|
|
||
| Rollback removes this caller, its contract test, doctoring, and path-filter | ||
| entries. It does not change the reusable scheduler or other product callers. | ||
|
|
||
| ## APA 7th references | ||
|
|
||
| GitHub, Inc. (n.d.). *Events that trigger workflows*. GitHub Docs. | ||
| https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule | ||
|
|
||
| GitHub, Inc. (n.d.). *Reuse workflows*. GitHub Docs. | ||
| https://docs.github.com/en/actions/how-tos/sharing-automations/reuse-workflows | ||
|
|
||
| GitHub, Inc. (n.d.). *Automatic token authentication*. GitHub Docs. | ||
| https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| """Contract tests for naruon's bounded hourly review-repair caller.""" | ||
|
|
||
| from pathlib import Path | ||
|
|
||
|
|
||
| CALLER = Path(".github/workflows/naruon-hourly-review-repair.yml") | ||
| DOCTORING = Path("docs/doctoring/naruon-hourly-review-caller.md") | ||
| QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") | ||
|
|
||
|
|
||
| def _read(path: Path) -> str: | ||
| """Return one repository contract file as UTF-8 text.""" | ||
| return path.read_text(encoding="utf-8") | ||
|
|
||
|
|
||
| def test_naruon_caller_is_hourly_bounded_and_non_cancelling() -> None: | ||
| """naruon gets one protected-develop repair heartbeat per hour.""" | ||
| caller = _read(CALLER) | ||
|
|
||
| assert 'cron: "11 * * * *"' in caller | ||
| assert "group: naruon-hourly-review-repair" in caller | ||
| assert "cancel-in-progress: false" in caller | ||
| assert "uses: ./.github/workflows/pr-review-fix-scheduler.yml" in caller | ||
| assert "target_repository: ContextualWisdomLab/naruon" in caller | ||
| assert "base_branch: develop" in caller | ||
| assert 'max_prs: "50"' in caller | ||
| assert 'max_dispatches: "1"' in caller | ||
| assert 'retry_hours: "2"' in caller | ||
|
|
||
|
|
||
| def test_naruon_caller_keeps_token_and_secret_scope_explicit() -> None: | ||
| """The caller forwards only established scheduler credentials.""" | ||
| caller = _read(CALLER) | ||
| workflow_scope, jobs_scope = caller.split("\njobs:\n", maxsplit=1) | ||
|
|
||
| assert "\npermissions:\n contents: read\n" in workflow_scope | ||
| assert "\n permissions:\n contents: read\n id-token: write\n" in jobs_scope | ||
| assert "PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}" in caller | ||
| assert "OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}" in caller | ||
| assert "secrets: inherit" not in caller | ||
| assert "NVIDIA_NIM_API_KEY" not in caller | ||
| assert "COPILOT_GITHUB_TOKEN" not in caller | ||
| for forbidden in ( | ||
| "actions: write", | ||
| "contents: write", | ||
| "issues: write", | ||
| "pull-requests: write", | ||
| "statuses: write", | ||
| ): | ||
| assert forbidden not in caller | ||
|
|
||
|
|
||
| def test_naruon_contract_and_doctoring_are_path_filtered() -> None: | ||
| """The central contract gate follows caller and doctoring changes.""" | ||
| quality = _read(QUALITY_WORKFLOW) | ||
| for path in ( | ||
| ".github/workflows/naruon-hourly-review-repair.yml", | ||
| "docs/doctoring/naruon-hourly-review-caller.md", | ||
| ): | ||
| assert quality.count(path) == 2 | ||
| assert quality.count("tests/test_naruon_hourly_review_caller.py") == 3 | ||
|
|
||
| doctoring = _read(DOCTORING) | ||
| for phrase in ( | ||
| "ContextualWisdomLab/naruon", | ||
| "minute 11", | ||
| "base", | ||
| "two-hour same-head retry floor", | ||
| "NVIDIA_NIM_API_KEY", | ||
| "COPILOT_GITHUB_TOKEN", | ||
| "independent approval", | ||
| ): | ||
| assert phrase in doctoring |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔍 Unrelated pip hash bump bundled in
requirements-pip-audit-ci-hashes.txt bumps pip 26.1.2 to 26.2.1, unrelated to scheduling the naruon caller. Confirm the lock was regenerated via the recorded
uv pip compilecommand rather than hand-edited.Was this helpful? React with 👍 or 👎 to provide feedback.