feat(workflows): add sandboxed OriginWeave browser evidence - #1857
feat(workflows): add sandboxed OriginWeave browser evidence#1857seonghobae wants to merge 11 commits into
Conversation
Signed-off-by: Seongho Bae <me@seonghobae.me>
|
Warning Review limit reachedNext included review available in 41 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough재사용 가능한 GitHub Actions 워크플로가 호출 리비전에서 MV3 호환성 검사를 실행합니다. 고정된 Chrome과 ChromeDriver를 SHA256으로 검증하고, Chromium 샌드박스를 설정한 뒤 결과와 검증 파일을 보존합니다. 문서와 계약 테스트가 실행 조건을 명시합니다. ChangesOriginWeave MV3 증거
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to This adds a read-only reusable MV3 browser-evidence workflow with pinned browser artifacts, sandbox configuration, and bounded evidence retention. No current merge-blocking risk remains. Sequence Diagram(s)sequenceDiagram
participant Caller as 호출 저장소
participant Runner as Actions 러너
participant Chrome as Chrome for Testing
participant MV3 as OriginWeave MV3 실행기
participant Artifacts as 아티팩트 저장소
Caller->>Runner: 재사용 워크플로 호출
Runner->>Chrome: 고정 Chrome과 ChromeDriver 다운로드
Chrome-->>Runner: 아카이브 및 체크섬
Runner->>MV3: 샌드박스 환경에서 호환성 검사 실행
MV3-->>Runner: JSON 결과 생성
Runner->>Artifacts: 검증 파일과 결과 업로드
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Triage: resolved merge conflict against
|
Resolve the CHANGELOG.md conflict by keeping both sides: this branch's entry above main's, matching the file's newest-first convention. No entry dropped. Verified after resolution: 2891 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
seonghobae
added
enhancement
ChatGPT Codex Connector
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The PR adds a reusable OriginWeave sandboxed MV3 evidence workflow plus documentation and a contract test. The workflow itself implements sensible controls: workflow_call triggering, read-only permissions, egress hardening with explicit allowed endpoints, repository identity check, pinned dependency versions, SHA-256 verification of downloaded Chrome/ChromeDriver archives, preservation of the Chromium sandbox via CHROME_DEVEL_SANDBOX, and bounded artifact retention. The contract test bolsters regressions on these invariants. However, the independent adversarial validation could not confirm concrete blocking regressions to justify request_changes. The documentation lines flagged in the workflow evidence are semantically adequate but represent conservative documentation of boundaries rather than defects. A formal comment rather than approval is warranted because source-level review probes were not independently falsified with definitive evidence within the bounded allowed locations, and documentation claims about consumer-run acceptance should be held to a high bar before treating this as fully evidenced.
Reviewed changed lines
.github/workflows/originweave-mv3-evidence.yml:5 (RIGHT): permissions: contents: read grants least privilege for a reusable workflow that executes an untrusted consumer-supplied script at exact caller revision..github/workflows/originweave-mv3-evidence.yml:30 (RIGHT): Repository identity check fails closed if a non-OriginWeave repo invokes the reusable workflow..github/workflows/originweave-mv3-evidence.yml:57 (RIGHT): sha256sum --check verifies the two downloaded archives before extraction, reducing supply-chain tampering risk..github/workflows/originweave-mv3-evidence.yml:63 (RIGHT): Root-owned, mode-4755 chrome_sandbox configuration combined with CHROME_DEVEL_SANDBOX preserves Chromium's renderer sandbox.tests/test_originweave_mv3_workflow_contract.py:13 (RIGHT): Contract test asserts the pinned checksums and sandbox-related settings, reducing accidental changes.
Adversarial validation
.github/workflows/originweave-mv3-evidence.yml:57 (RIGHT)confirmed: The two hard-coded SHA-256 values could be silently out of date relative to the Chrome archive and cause the workflow to fail at download verification time. — Contract test asserts the exact checksums; the workflow runs sha256sum --check before unzip, so a mismatch would fail the run rather than slip through silently..github/workflows/originweave-mv3-evidence.yml:85 (RIGHT)falsified: Upload step with if: always() could publish files from a failed run, misleading reviewers about consumer-run success. — Artifact name includes head sha and if-no-files-found: warn; but the artifact merely stores sha and JSON output without an explicit success marker, so a failed run could still publish data indistinguishable from success.- Residual risk: Source-level independent falsification was not completed with definitive evidence. A source change usually requires at least two distinct probes, but the available bounded context did not permit concrete confirmed regression counterexamples at the workflow or test call sites. Documentation-level concerns are advisory and not blocking.
Findings
- [low] docs/doctoring/originweave-mv3-evidence.md:7 (RIGHT): The requirement that an OriginWeave caller pin the workflow to a specific reviewed protected-main commit is documented but has no automated enforcement in the workflow itself.
- [low] docs/doctoring/originweave-mv3-evidence.md:15 (RIGHT): Feature acceptance wording relies on a consumer-run success signal that is not machine-validated by this reusable workflow.
- [low] .github/workflows/originweave-mv3-evidence.yml:85 (RIGHT): Upload uses if: always() and can attach artifacts from failed runs; artifact metadata does not explicitly distinguish successful from failed browser evidence.
- Result: COMMENT
- Head SHA:
afeffe3b6a7a5494be1dae12322a0fc2a78c6efe - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
afeffe3b6a7a5494be1dae12322a0fc2a78c6efe. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/34320064083/job/102394819986)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/34320064083/job/102394819986)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: originweave-mv3-evidence.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: originweave-mv3-evidence.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: AGENTS.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: AGENTS.md"]
R2 --> V2["required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
R3 --> V3["required checks"]
Evidence --> S4["Repository file: CLAUDE.md"]
S4 --> I4["repository behavior"]
I4 --> R4["Review risk: Repository file: CLAUDE.md"]
R4 --> V4["required checks"]
Evidence --> S5["Docs: originweave-mv3-evidence.md"]
S5 --> I5["operator or user guidance"]
I5 --> R5["Review risk: Docs: originweave-mv3-evidence.md"]
R5 --> V5["docs review"]
Evidence --> S6["Test: test_originweave_mv3_workflow_contract.py"]
S6 --> I6["regression suite"]
I6 --> R6["Review risk: Test: test_originweave_mv3_workflow_contract.py"]
R6 --> V6["targeted test run"]
OpenCode Review Overview
|
2 participants
Summary
Verification
uv run --with pytest pytest -q tests/test_originweave_mv3_workflow_contract.py— 1 passedactionlint .github/workflows/originweave-mv3-evidence.yml— passeduv run --with pytest pytest -q— 2815 passed, 1 pre-existing skip, 21 subtests passedgit diff --check— passedBoundary
This PR supplies the owner workflow only. It does not claim OriginWeave consumer execution or product shipment. After protected-main integration, OriginWeave must pin the exact merged SHA in its thin caller, then #43/#70/#245 must adopt it and produce fresh exact-head browser evidence.
Refs #1792 and ContextualWisdomLab/OriginWeave#212.
Summary by CodeRabbit
새 기능
문서
테스트