fix(ci): run exact-head gates on stacked pull requests

[seonghobae]

Closes #298.

Current exact authority

Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. Current exact Ready head is 1efbd632719b0e54c5a33e3a95224a4bd2f869d3 on fix/stacked-pr-ci-gates-298; GitHub reports it mechanically mergeable against that unchanged protected base. The effective delta remains limited to:

• .github/workflows/ci.yml;
• src/workflowExactHead.test.ts.

This is Inkspan-owned CI evidence/reliability work only. It adds no product runtime, credential, model, persistence, release identity, ruleset, permission, or deployment authority.

Repaired CI evidence boundary

The lane repairs three related repository-local evidence defects:

1. canonical CI restricted pull_request to base main, so stacked PR heads could miss the ordinary repository matrix;
2. immutable checkout was configured but runtime HEAD was not compared with ${{ github.event.pull_request.head.sha || github.sha }} immediately after checkout and before setup/repository-code consumption;
3. the real browser-evidence job could exhaust the prior 30-minute ceiling during dependency-locked Playwright system/browser installation even when unchanged product code subsequently passed on rerun.

Historical TDD lineage: stacked-trigger RED e75a0035d753d8d58a9c04a8c254bf8914135e24 -> trigger repair 3ea55387d8d7d88a80933b398abda78e42a4496b; runtime-checkout RED 85572a50d79a11c27c9171cc9180d7a53128bea0 -> exact-checkout attestation; browser-timeout RED a74e150c06c22e3caee48446d03c3b0726bfc0f5 -> bounded browser-only 60-minute ceiling while build-and-test and Office remain at 30 minutes.

Review-driven false-green repair

After the PR moved to Ready, CodeRabbit identified a real contract-test weakness on predecessor head b7e9bb8156a3e46204523ab37292566811f560f8: src/workflowExactHead.test.ts relied on global string counts, so timeout or verification-step movement between jobs could false-green.

Current head 1efbd632719b0e54c5a33e3a95224a4bd2f869d3 repairs only that test/evidence boundary. It slices build-and-test, browser-release-evidence, and office independently; binds each expected timeout to its own job; proves the exact checkout ref and persist-credentials: false per job; requires Verify exact checkout immediately after checkout and before pnpm/setup-python consumers; and structurally checks that pull_request has no base-branch filter. No workflow runtime semantics or product behavior changed in this review repair. CodeRabbit has marked its Major thread addressed/resolved on this exact commit.

A later Devin informational note observes that runtime verification intentionally compares local HEAD with the same immutable event SHA used by checkout; this proves checkout honored the event-bound exact ref but is not an independent GitHub-API re-resolution of the event payload. That is informational, not a contradiction in this lane's stated contract: live PR/base resolution remains an external governance/review responsibility before lifecycle action.

Exact-current-head verification

For unchanged current head 1efbd632719b0e54c5a33e3a95224a4bd2f869d3 against protected base 3b38ead2d00f44eb578d0689087b9293b3dabe1e:

• CI 32635939468: completed / success;
  • build-and-test 97185600342: success including exact checkout verification, immutable install, typecheck, exact 100% owned-production coverage, library build, packed-package verification, and demo build;
  • Cross-engine Clipboard / Playwright 1.62.0 97185600177: success including exact checkout verification, dependency/browser revision installation, and real-engine evidence within the bounded 60-minute ceiling;
  • Office Python 3.11 97185600282, 3.12 97185600292, 3.13 97185600341, and 3.14 97185600286: success including exact checkout verification, dependency consistency, 100% docstring/branch coverage, wheel, and packaged schema/license gates;
• Security Scan 32635939483: aggregate completed / success, but NON-PASSING for merge/release acceptance under the exact-source contract. Dependency Review job 97185600223 checked out synthetic PR-merge commit 12668622e38473c14dbb7d22bb9e3e0c05f1ea8a, not submitted source head 1efbd632719b0e54c5a33e3a95224a4bd2f869d3; its exact 3b38ead2d00f44eb578d0689087b9293b3dabe1e...1efbd632719b0e54c5a33e3a95224a4bd2f869d3 dependency-graph comparison returned HTTP 403, emitted Dependency review is unavailable for ContextualWisdomLab/inkspan; skipping dependency-review hard gate., set supported=false, skipped the pinned Dependency Review action, and still concluded success. The existing foreign owner repair is ContextualWisdomLab/.github PR #897; do not create an Inkspan-local substitute.
• SAST Semgrep 32635939469: aggregate completed / success and zero Semgrep findings, but NON-PASSING for merge/release acceptance under the exact-source contract. Job 97185600190 checked out and scanned the same synthetic PR-merge commit 12668622e38473c14dbb7d22bb9e3e0c05f1ea8a, not the submitted source head. The existing foreign exact-submitted-revision repair is ContextualWisdomLab/.github PR #941; do not create an Inkspan-local substitute.
• formal submitted reviews: automated COMMENTED reviews and maintainer thread replies only, 0 approvals;
• unresolved inline review threads: 0; the Devin informational observations were verified against this exact head, answered with their intended scope, and resolved without treating them as approval;
• Draft: no / Ready; mechanically mergeable: yes.

Repository-local CI success does not cure central wrong-checkout, skipped-hard-gate, or synthetic-source evidence and does not establish separately applicable organization-level ruleset requirements or qualifying independent approval. Predecessor, cancelled, absent, skipped, pending, neutral, failed, status-only, synthetic-source, wrong-checkout, or model-only evidence does not transfer.

Downstream criterion and integration boundary

There is no correct Inkspan-local source workaround for the central Security/SAST evidence defects. Advance the existing central owner paths only: .github #897 must make Dependency Review fail closed and bind exact source identity, and .github #941 must make Semgrep checkout/attestation bind the exact submitted revision. After those repairs reach protected central main, rerun unchanged or descendant #299 and require fresh current evidence showing the exact submitted Inkspan source head/repository is checked out and scanned, and that Dependency Review actually executes after a transport-successful HTTP 200 exact base/head comparison. Synthetic refs/pull/*/merge evidence is not a substitute.

After this repository-local CI contract eventually integrates, every stacked PR must independently acquire its own exact-current-head repository workflow generation; absence cannot be filled with parent/predecessor evidence. The 60-minute browser ceiling is a finite infrastructure allowance, not permission to make browser evidence optional or unbounded.

Keep #299 Ready but unmerged while the central exact-source/supply-chain evidence above is non-passing, #118 owns the protected v0.6.0 release/publication boundary, and qualifying independent approval / then-live governance remain unmet. Before merge, refetch the unchanged exact head and protected base, ancestry/mergeability, live governance, formal reviews/threads, and every applicable repository/central workflow. Do not self-approve, transfer predecessor evidence, weaken gates, move protected main, or fabricate release identity.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 4 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 36e9c165-d42e-4286-936d-fcb635e0e29e

📥 Commits

Reviewing files that changed from the base of the PR and between b7e9bb8 and 7d21685.

📒 Files selected for processing (1)

• src/workflowExactHead.test.ts

📝 Walkthrough

Walkthrough

CI가 모든 pull request에서 실행되도록 트리거를 조정했습니다. 일반 작업과 Office 작업은 30분, 브라우저 작업은 60분 제한을 사용합니다. 각 작업은 checkout 후 현재 HEAD의 커밋 SHA를 검증합니다. 관련 계약 테스트를 추가했습니다.

Changes

CI 정확한 HEAD 게이트

Layer / File(s)	Summary
CI 작업 제어와 checkout 검증 .github/workflows/ci.yml	build-and-test와 office에 30분 제한을 추가했습니다. browser-release-evidence의 제한을 60분으로 변경했습니다. 각 작업의 checkout 후 현재 HEAD가 기대한 커밋 SHA와 일치하는지 검증합니다.
CI 계약 검증 src/workflowExactHead.test.ts	main push와 모든 pull request 트리거를 확인합니다. 작업별 제한 시간과 checkout SHA 검증 단계를 확인합니다.

Estimated code review effort: 3 (보통) | ~20 minutes

Merge Risk: 🟡 Moderate · up to b7e9b

The CI contract test does not verify that timeout and exact-head checks remain attached to the intended jobs and occur in the required order, so a future workflow edit could silently weaken stacked pull-request validation. This bounded correctness risk should be fixed or explicitly accepted before merging.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	변경 사항은 [#298]의 stacked PR 트리거, 런타임 exact-head 검증, 브라우저 60분 제한, 일반 작업 30분 제한 및 계약 테스트 요구사항을 충족합니다.
Out of Scope Changes check	✅ Passed	변경 사항은 [#298]의 CI 수정과 관련된 워크플로 및 실행 가능한 계약 테스트로 제한됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 stacked pull request에서 exact-head CI 게이트를 실행하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/stacked-pr-ci-gates-298

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent

Fresh exact-head review request for Draft #299 after its Inkspan-owned CI repair converged. Current head is b7e9bb8156a3e46204523ab37292566811f560f8 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; the effective delta remains only .github/workflows/ci.yml and src/workflowExactHead.test.ts. Repository CI 32186084715, Security Scan 32186084926, and SAST Semgrep 32186085025 are all terminal success on this exact head, with the browser evidence job succeeding under the bounded 60-minute ceiling while build/Office remain 30 minutes. Formal reviews and unresolved threads are currently zero.

Please produce genuinely same-head evidence. Verify that stacked pull_request heads acquire canonical CI, that runtime checkout is compared with the event head before repository-code consumption, and that only browser-release-evidence receives the 60-minute ceiling. Do not treat predecessor/status/model evidence as approval. Keep this PR Draft/unmerged while #118 owns the protected v0.6.0 freeze.

[seonghobae]

Additional exact consumer evidence for the existing browser-timeout RCA, with no new CI writer introduced: Inkspan #160 predecessor head e1506fc7c938325bf822e4c8ad0da85c24841531 ran canonical CI 32230067663; build/package/100%-coverage and Office Python 3.11–3.14 succeeded, while browser job 95997872226 checked out that exact SHA and was cancelled at the protected 30-minute ceiling during playwright install --with-deps chromium firefox webkit. The job entered Ubuntu dependency installation at 07:55:47Z, repeatedly stalled/retried against the Azure Ubuntu mirror, and GitHub cancelled it at 08:25:38Z before any real-engine test step. Security 32230067703 and SAST 32230067660 succeeded on the same SHA.

This independently reproduces the same first causal boundary already repaired by this lane: the browser-only 30-minute workflow ceiling, not #160 product behavior. Keep the bounded #299 remedy unchanged (browser 60 minutes only; build/Office 30). Do not rerun or transfer this predecessor #160 evidence as passing. #160 has since moved to a new exact test-first head for separate converter work, so this run is RCA evidence only.

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

@opencode-agent

Fresh exact-current-head review request for Ready #299 after the review-driven contract-test repair. Current head is 1efbd632719b0e54c5a33e3a95224a4bd2f869d3 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; the effective delta remains only .github/workflows/ci.yml and src/workflowExactHead.test.ts. Exact-head repository CI 32635939468, Security Scan 32635939483, and SAST Semgrep 32635939469 are terminal success; all inline threads are resolved and there are still 0 qualifying approvals.

Please review only this exact head. Verify the per-job false-green repair: every relevant job binds its own timeout and immutable checkout ref, Verify exact checkout occurs immediately after checkout and before setup/repository-code consumption, and pull_request has no base filter so stacked heads receive canonical CI. Do not transfer the predecessor request on b7e9bb8156a3e46204523ab37292566811f560f8, automated COMMENTED reviews, or status-only/model evidence as approval. Keep merge authority separate from technical success and #118's release boundary.