Repository navigation
test: verify unlocked requirements evidence on an isolated dependency change - #2554
Closed
groupthinking wants to merge 3 commits into
Closed
groupthinking wants to merge 3 commits into
groupthinking wants to merge 3 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Contributor
🔍 PR Validation |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF ScorecardScorecard details
Scanned Files
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Controlled hosted verification for dependency recorder commit c62c51f.
Base branch must point exactly to 1b826c1; candidate head is 87990c3. The head adds the two-file recorder repair and the exact apps/web/package.json and package-lock.json bytes already tested and published at #2400 head 8634445. This four-file comparison invokes the actual dependency-review workflow off main; it is not a second product upgrade or a merge candidate.
Required readback: exact base/head and run identity; current-head CI checks; complete dependency-review artifact with schema 3, matching count/hash/raw API rows, original review outcome, and source proof for any unchanged unlocked requirements resolution rows. Existing vulnerability/license checks must remain enforced. Do not infer runtime/model/payment success from this test.
Local recorder validation: 101 affected tests and Ruff pass. The full actual 68-row failed comparison replays without dropping rows or changing its failing review outcome. The canary manifests and lock are byte-identical to tested #2400, but no separate canary install/build or hosted success is claimed. Independent review's attached-hash and malformed-version findings are corrected with failing-before/passing-after regressions and exact probe readback.
Hosted verification is complete and this temporary test PR is closed without merging. Both source branches are preserved. No resolver drift occurred in this comparison; the actual-input replay separately proves that repaired branch. No automatic merge or deployment was requested.
Closes #2552. This reference links the exact tested repair for repository validation; this diagnostic PR will remain unmerged.
Hosted verification — 2026-11-02
Controlled off-main canary #2554 ran this exact recorder at head 87990c3 against base 1b826c1. Dependency run 41530056594, attempt 1, passed full-tree snapshot submission, combined-lock submission, dependency policy review, evidence recording and upload. Head combined snapshot 117439219 reports four manifests and 2,191 packages; exact-base run 41526123217 had already submitted both snapshot types.
Downloaded artifact 13181672366 contains schema-3 review.json with the exact base/head/run/attempt and review_outcome=success. Its 22 raw rows comprise all 20 expected package-lock.json version/scope changes plus two apps/web/package.json changes; the rows contain no reported vulnerability entries. An independent live API read returned HTTP 200, an empty snapshot-warning header and no next page. The entire raw JSON is byte-identical to the uploaded file: SHA-256 0ba4804ac578e6d40500d12e86b8bf766cb5b02df36352ddb26efda5cdad99d7. The downloaded ZIP also matches GitHub's archive digest, SHA-256 2906844dcae21c5523d66454598f522461e3cefaf8b438481fb295034307ff52. The recorded success agrees with the actual policy action; policy settings were not changed.
No fresh unlocked-Python resolver drift occurred in this comparison, so unchanged_requirements_resolutions is empty. The separate captured 68-row production-input replay exercises that repaired branch, retaining every row and its original failing verdict. Both base and head full-tree scanners hit the existing 240-second limit/exit 137 for root requirements.txt and docs/guides/requirements.txt and fell back to declared dependencies without their transitive graph. A warning-free compare is therefore not a claim of complete transitive Python resolution.
Hosted logs confirm all 34 new recorder cases passed in repair Python 3.11 and canary Python 3.12; each inspected unit run passed 3,074 tests with nine deselected, five xpassed and 118 passing subtests. The repair PR's own dependency check correctly used the source-only path and did not produce an artifact. Canary evidence does not establish that each original update PR against main has passed; their exact-head reviews and checks remain separate.
The final CI build also passed TypeScript, ESLint, the web build, real-service Studio preflight and the production-image build. The preview E2E suite passed 16 tests; its cached ready-pack result is not proof of fresh video generation. Repair implementation and review continue in #2553.