Skip to content

feat(hourly): onboard appguardrail + macos_utility_packs review-repair callers - #1326

Open
seonghobae wants to merge 5 commits into
mainfrom
feat/hourly-callers-appguardrail-macos
Open

feat(hourly): onboard appguardrail + macos_utility_packs review-repair callers#1326
seonghobae wants to merge 5 commits into
mainfrom
feat/hourly-callers-appguardrail-macos

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Adds the two missing per-repo hourly callers following the established thin-caller pattern:
    • appguardrail → minute 41 (fills the slot already reserved in the shared cron roster)
    • macos_utility_packs → minute 44 (fresh allocation; no collision)
  • Each ships caller workflow + doctoring doc + focused contract test; hourly-nvidia-nim-review-repair pull/push/compileall path blocks now track all six files.
  • Org variable OPENCODE_REPOSITORY_DISPATCH_TARGETS updated out-of-band to include both targets (activation prerequisite documented in doctoring).

Test plan

  • pytest tests/test_appguardrail_hourly_review_caller.py tests/test_macos_utility_packs_hourly_review_caller.py tests/test_nonnest2_hourly_review_caller.py tests/test_afipc_hourly_review_caller.py tests/test_pr_review_fix_hourly_contract.py → 41 passed
  • YAML parse check on all touched workflows

Open in Devin Review

Summary by CodeRabbit

  • 새 기능

    • AppGuardrail 및 macOS Utility Packs에 시간별 PR 리뷰·수리 자동화가 추가되었습니다.
    • 리뷰 작업은 실행 제한, 재시도, 동시성 제어를 적용해 안정적으로 처리됩니다.
    • 관련 운영 절차와 보안·권한·롤백 가이드가 문서화되었습니다.
  • 개선

    • 자동 리뷰의 기본 대체 모델이 gpt-5.4로 변경되었습니다.
    • 관련 품질 검증 범위와 워크플로 경로 검사가 확대되었습니다.
  • 테스트

    • 일정, 권한, 시크릿 범위, 대상 저장소 및 문서 계약에 대한 자동 검증이 추가되었습니다.

devin-ai-integration[bot]

This comment was marked as resolved.

seonghobae added a commit that referenced this pull request Aug 25, 2026
…-5.4 emission

Commit a724582 moved strix.yml's direct-OpenAI fallback from the
nonexistent gpt-5.6-luna to gpt-5.4 and aligned the smoke contracts, but
missed this call-site in test_required_workflow_queue_contract.py, so
main's required gate red-flagged every PR (seen on #1326). Assert the
emitted gpt-5.4 per the current workflow contract.
@coderabbitai

coderabbitai Bot commented Aug 25, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

Next included review available in 28 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c3c8d78d-a114-44da-8b33-e3b9807327e4

📥 Commits

Reviewing files that changed from the base of the PR and between 5580688 and dfa980c.

📒 Files selected for processing (3)
  • .github/workflows/hourly-nvidia-nim-review-repair.yml
  • docs/doctoring/appguardrail-hourly-review-caller.md
  • docs/doctoring/macos-utility-packs-hourly-review-caller.md
📝 Walkthrough

Walkthrough

AppGuardrail과 macOS Utility Packs에 시간별 PR 리뷰 수리 워크플로를 추가했습니다. 두 호출자의 운영 문서와 계약 테스트를 추가했습니다. 품질 경로와 compileall 대상을 갱신했습니다. OpenAI fallback 모델을 gpt-5.4로 변경했습니다.

Changes

시간별 리뷰 수리 호출자

Layer / File(s) Summary
AppGuardrail 호출자 계약
.github/workflows/appguardrail-hourly-review-repair.yml, docs/doctoring/appguardrail-hourly-review-caller.md, tests/test_appguardrail_hourly_review_caller.py
분 41 스케줄과 develop 대상 리뷰 수리 호출자를 추가했습니다. PR 50개, 디스패치 1개, 2시간 재시도 제한을 적용합니다. 권한과 시크릿 범위를 계약 테스트로 검증합니다.
macOS Utility Packs 호출자 계약
.github/workflows/macos_utility_packs-hourly-review-repair.yml, docs/doctoring/macos-utility-packs-hourly-review-caller.md, tests/test_macos_utility_packs_hourly_review_caller.py
분 44 스케줄과 비취소 동시성 설정을 추가했습니다. 공유 스케줄러에 대상 저장소, 브랜치, 처리 제한, 재시도 간격, 시크릿을 전달합니다. 운영 조건을 문서와 계약 테스트에 기록했습니다.
품질 워크플로 경로 통합
.github/workflows/hourly-nvidia-nim-review-repair.yml, tests/test_appguardrail_hourly_review_caller.py, tests/test_macos_utility_packs_hourly_review_caller.py
두 호출자와 관련 문서를 pull_requestpush 경로에 추가했습니다. 두 계약 테스트를 compileall 입력에 추가했습니다. 경로 집합과 추적 범위를 검증합니다.

OpenAI 모델 fallback 변경

Layer / File(s) Summary
gpt-5.4 fallback 갱신
.github/workflows/opencode-review-dispatch.yml, tests/test_required_workflow_queue_contract.py, tests/test_strix_nvidia_nim_not_found_fallback.py
직접 OpenAI 후보를 openai/gpt-5.4로 변경했습니다. 기본 및 provider-mode fallback 기대값을 갱신했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟡 Moderate · up to 55806

The PR adds two hourly callers but also leaves the model fallback configuration inconsistent with the registered provider models and existing required checks, which can cause dispatch validation failures and incorrect runtime configuration. Merge is not ready until the model configuration and related contracts are aligned; the documentation citation issue is minor and localized.

Sequence Diagram(s)

sequenceDiagram
  participant HourlyCaller
  participant ReviewFixScheduler
  participant TargetRepository
  HourlyCaller->>ReviewFixScheduler: 시간별 리뷰 수리 작업 호출
  ReviewFixScheduler->>TargetRepository: develop 대상 열린 PR 조회
  ReviewFixScheduler->>TargetRepository: 최대 하나의 제한된 수리 디스패치
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 appguardrailmacos_utility_packs 시간별 리뷰-수리 호출자를 추가한다는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 4 files. (6 skipped: 6…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 4 files. (6 skipped: 6 unsupported.)

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/hourly-callers-appguardrail-macos

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

coderabbitai[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head review repair

Fixed the valid current-head findings:

  • synchronized the direct OpenAI candidate documentation with configured openai/gpt-5.4 and removed unverified price claims;
  • replaced the inaccurate GitHub token citation with the official OpenID Connect reference and retained the token-authentication reference as a separate APA 7th entry;
  • repinned the exact workflow blob contract to the current opencode-review-dispatch.yml hash.

The provider definition was already present at the reviewed head, so that earlier finding was stale and required no duplicate source change. Devin informational roster/path-filter notes are pre-existing documentation scope and do not affect the two new caller minutes; they remain recorded for the next roster-contract increment.

Exact-head validation: full central suite 1418 passed, 1 skipped, 16 subtests passed; targeted caller/review contracts 164 passed; git diff --check passed. Please review current head 0fdc2d8b and rerun required Checks.

@seonghobae
seonghobae enabled auto-merge (squash) August 25, 2026 10:19

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 0 new potential issues.

Open in Devin Review

…s (minute 44) callers

- Thin hourly callers delegate to pr-review-fix-scheduler with develop
  bases, single dispatch, and two-hour same-head retry floors.
- appguardrail fills its long-reserved roster slot; macos_utility_packs
  takes a fresh non-colliding minute.
- Doctoring records activation prerequisites incl. the
  OPENCODE_REPOSITORY_DISPATCH_TARGETS allowlist entries (set at org
  level in the same change window) with APA 7th references.
- Focused contract tests mirror the established trio; quality gate
  pull/push/compileall path blocks track all six files.
…provider base URL

resolved_llm_api_base_for_model had cross-provider handling only for
github_models/* fallbacks. When the primary provider was nvidia_nim (or
any provider that sets LLM_API_BASE), openai-direct/gpt-5.4 fallback
attempts inherited the NVIDIA inference endpoint while carrying the
OpenAI key, so litellm posted to the wrong host and every attempt died
with 'Error: 404 page not found' (STRIX_PROVIDER_UNAVAILABLE). Direct
OpenAI attempts now resolve to no custom base so litellm routes to
api.openai.com by default (#1327).
@seonghobae
seonghobae force-pushed the feat/hourly-callers-appguardrail-macos branch from 397a682 to 19f323d Compare August 25, 2026 12:24
devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae
seonghobae enabled auto-merge (squash) August 25, 2026 14:26
@opencode-agent
opencode-agent Bot disabled auto-merge August 25, 2026 15:03
# Conflicts:
#	.github/workflows/opencode-review-dispatch.yml
#	tests/test_pr_review_autofix_nvidia_nim_contract.py
@seonghobae
seonghobae enabled auto-merge (squash) August 25, 2026 23:11

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

Open in Devin Review

uses: ./.github/workflows/pr-review-fix-scheduler.yml
with:
target_repository: ContextualWisdomLab/appguardrail
base_branch: develop

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 base_branch develop differs from sibling callers

Both new callers use base_branch: develop, whereas every existing caller uses master/main. The doctoring documents develop consistently, so this reads as intentional, but it depends on the target repos actually protecting develop and on OPENCODE_REPOSITORY_DISPATCH_TARGETS being updated out-of-band.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@opencode-agent
opencode-agent Bot disabled auto-merge August 26, 2026 00:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant