feat: surface privacy-safe Podman reclaim evidence - #150
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughPodman reclaim 계획을 개인정보 보호형 증거 계약으로 투영합니다. 읽기 전용 Tauri 명령과 프런트엔드 검증을 추가합니다. 후보별 검토 경계를 강화하고, Cleanup 화면에 증거 조회와 승인된 dangling 이미지 정리를 통합합니다. ChangesPodman 증거 조회
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to The PR adds a privacy-safe, read-only Podman evidence view, but the older desktop route can still expose sensitive machine and filesystem details, so the new privacy boundary is not exclusive. The image-cleanup confirmation also presents the approval phrase only as placeholder text, and parallel Podman views may drift. These bounded security and UX-safety risks require owner follow-up or explicit acceptance before merge. Sequence Diagram(s)sequenceDiagram
participant Cleanup
participant PodmanEvidence
participant Tauri
participant Podman
Cleanup->>PodmanEvidence: load evidence
PodmanEvidence->>Tauri: invoke inspect_podman_desktop_evidence
Tauri->>Podman: run read-only probe
Podman-->>Tauri: reclaim plan
Tauri-->>PodmanEvidence: privacy-safe evidence
PodmanEvidence-->>Cleanup: validated status and review labels
Cleanup->>Tauri: execute approved dangling-image cleanup
Tauri-->>Cleanup: cleanup result
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 96.72% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 61 functions across 18 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head53b7d53481f3375bd58013bc181ceb9b6971c07d. -
Head SHA:
53b7d53481f3375bd58013bc181ceb9b6971c07d -
Workflow run: 31357301155
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 3
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (18 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (18 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: podman-desktop-evidence.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: podman-desktop-evidence.md"]
R2 --> V2["docs review"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (18 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (18 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: podman-desktop-evidence.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: podman-desktop-evidence.md"]
R2 --> V2["docs review"]
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Pull request was converted to draft
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Pull request was converted to draft
| } catch (e) { | ||
| podmanPruneError = String(e); | ||
| podmanPruneError = podmanEvidenceErrorMessage(e); |
There was a problem hiding this comment.
📝 Info: Prune failures collapse to one generic message
prunePodmanDanglingImages now routes errors through podmanEvidenceErrorMessage, which always returns one static sentence, discarding actionable causes such as confirmation-mismatch or candidate-set-changed that String(e) previously surfaced. Enforced by a contract test as a privacy boundary, but it removes all diagnostic distinction from prune failures.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Purpose
Surface privacy-safe, read-only Podman reclaim evidence in the desktop without turning logical reclaim candidates into mutation authority or verified host-physical-reclaim claims. This remains the canonical clean product line replacing stale #133.
Exact current state
05688274c428d5c57152ea93d4e336ba89a1b49bmain@79067c1160ddedf7fc962cbf8067ce7e83c4564a33048735988— SUCCESS33048736051— SUCCESS33048735909— SUCCESS33048735904— FAILURE in the shared release-artifact verifier dependency; this PR does not own that verifier and carries no release-verifier deltaProduct/security/accessibility boundary
physically_reclaimable_bytesremains unknown unless a future versioned before/after proof establishes itCurrent dependency boundary
The Release failure is owned by canonical release-verifier PR #264. Do not add a Podman-local workaround or duplicate verifier implementation. Review can proceed while that independent dependency is repaired/integrated; Release remains a non-passing merge gate.
Repository-wide exact owned-production coverage remains independently owned by Draft PR #156 and is still materially below the required exact 100%. Feature-local Test/Security/SAST success does not substitute for that global gate.
Required before merge
Merge only after an unchanged exact head satisfies the shared Release verifier, actual repository-wide exact non-vacuous 100% owned-production coverage, every applicable central required workflow, zero valid unresolved findings, fresh ancestry/mergeability, package/SBOM/provenance requirements, and the live ruleset's qualifying approval requirements. Pending, failed, stale, predecessor, synthetic, configuration-only, or dependency-bypassed evidence is non-passing.
Summary by CodeRabbit
새로운 기능
개선 사항