Repository navigation
Run the shared CV-005 contracts instead of a local copy - #603
Merged
Merged
Conversation
The repository's Rust copy of the CV-005 contract is replaced by cv005-contracts check, pinned to a shared-actions commit in the Makefile, with the repository's one parameter in .github/cv005.toml. CI runs the target in its own step, since no cargo test carries the contract now. The library also holds the publisher's checkout to persist-credentials: false, so the checkout sets it.
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (17)
💤 Files with no reviewable changes (8)
Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Summary
TestingThe author reports that the contract target passes and that reverting specified changes triggers the corresponding findings. The author also reports successful formatting, lint, and retained-test runs. WalkthroughThe coverage workflow now gates CodeScene uploads on token availability and the main branch. A pinned shared CV-005 checker replaces local workflow-contract tests. Runner-placement tests gain a separate workflow reader. ChangesWorkflow contracts and runner placement
Priority: ⬇️ Low Change: Refactor Merge Risk: ⚪ Minimal · up to No concrete merge-blocking issue is established in the workflow-contract migration or token handling changes. Merge after normal checks pass. 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
Check the token, record the sign Comment |
Contributor
Reviewer's GuideThe PR moves CV-005 validation from a large local Rust implementation to the pinned shared Sequence diagram for CI CV-005 contract checkssequenceDiagram
participant CI as GitHub Actions CI
participant Make as Makefile
participant UV as uv
participant CLI as cv005-contracts
participant Repo as Repository workflows
CI->>UV: Setup uv
CI->>Make: make test-workflow-contracts
Make->>UV: tool run --python 3.13
UV->>CLI: Fetch pinned shared-actions commit
Make->>CLI: check --repository .
CLI->>Repo: Read .github/cv005.toml and workflows
CLI-->>CI: Pass or fail CV-005 contracts
Sequence diagram for scoped CodeScene token uploadsequenceDiagram
participant Workflow as coverage-main.yml
participant GitHub as GitHub expressions
participant Upload as CodeScene upload action
participant CodeScene as CodeScene
Workflow->>GitHub: Evaluate secrets.CS_ACCESS_TOKEN != ''
GitHub-->>Workflow: codescene-token output
alt Token available and main ref
Workflow->>Upload: access-token: secrets.CS_ACCESS_TOKEN
Upload->>CodeScene: Upload lcov.info
else Token unavailable or non-main ref
Workflow-->>Upload: Skip upload
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
leynos
marked this pull request as ready for review
September 29, 2026 23:05
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces this repository's Rust copy of the CV-005 contract with
cv005-contracts checkfrom leynos/shared-actions, pinned to a full commit (a38feb9b, the merge of shared-actions #540) inCV005_CONTRACTS_REF. The repository's only parameter isrepositoryin.github/cv005.toml.make test-workflow-contractsruns the CLI, and CI runs that target in a "Check the CV-005 contracts" step, because the deleted cargo tests were the only thing running the contract there.Removed:
tests/coverage_workflows.rs, its module directory andtests/codescene_environment.rs. The runner-placement contract in that directory is not CV-005 and stays, astests/runner_placement.rswithtests/runner_placement/{placement,placement_cases,reader}.rs; its reader is trimmed to what placement reads, so no dependency changes.tests/codescene_uploader_contract.rsstays: the library holds that the two coverage actions share one commit, not which commit is approved.The library found the publisher still in the older token shape, so
coverage-main.ymlnow takes the shape the estate rule holds:publisher.upload/token.scope: the upload step boundCS_ACCESS_TOKENin itsenvand passed${{ env.CS_ACCESS_TOKEN }}asaccess-token. The upload action is composite and hands its step'senvto the nested steps it runs, so the token now enters noenv: aCheck CodeScene tokenstep (idcodescene-token) runs exactlyecho "available=${{ secrets.CS_ACCESS_TOKEN != '' }}" >> "$GITHUB_OUTPUT", the upload'sif:issteps.codescene-token.outputs.available == 'true' && github.ref == 'refs/heads/main', and it passesaccess-token: ${{ secrets.CS_ACCESS_TOKEN }}directly.publisher.least-privilege: the publisher's checkout setspersist-credentials: false.ci.ymlhad no uv, which the target needs, so the job gains aSetup uvstep before the new "Check the CV-005 contracts" step.Proof:
make test-workflow-contractspasses; on the base it fails the six findings above.cancel-in-progress: truefails it withpublisher.concurrency; removingpersist-credentials: falsefails it withpublisher.least-privilege; deleting the check step fails it withtoken.check-step; restoringaccess-token: ${{ env.CS_ACCESS_TOKEN }}fails it withpublisher.upload.cargo fmt --check,mdtablefix --check,markdownlint-cli2,cargo clippy --all-targets --all-features -- -D warnings,cargo test --test runner_placement(19 tests) andcargo test --test codescene_uploader_contractpass.make lintandmake testrun in CI.Developers' guide updated: the "Only the upload step holds the token" bullet described the old shape.
Summary by Sourcery
Replace the local CV-005 workflow contract implementation with the pinned shared contract checker and align the coverage workflow with its requirements.
Enhancements:
Build:
CI:
Documentation:
Tests:
Chores: