Skip to content

ci(workflows): stop chronic autonomous heal loops - #503

Merged
4444J99 merged 14 commits into
mainfrom
fix/chronic-heal-root-causes
Jul 12, 2026
Merged

ci(workflows): stop chronic autonomous heal loops#503
4444J99 merged 14 commits into
mainfrom
fix/chronic-heal-root-causes

Conversation

@4444J99

@4444J99 4444J99 commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What changed

Root cause

The heal fleet was fixing symptoms on branches that violated the owner repository's policy contract. Repeated branches carried either an unterminated volatile opencode.json, an optional Gemini review invocation with no authentication method, or nonconventional metadata. Two branches also contained real product work that had never received durable mainline custody.

This PR moves the fixes to the owner: producers now satisfy policy, optional review has an availability gate, volatile state is excluded, and the substantive deltas are preserved with tests.

Superseded-heal map

Open heals Disposition in this PR
#483 TypeScript validation, dependency-review input repair, and dashboard type payload preserved in 683a78f.
#491, #496 Byte-equivalent non-log context-handoff payload preserved in 191eebd, then corrected and tested.
#484, #499 Patch/marker artifacts only; no product delta adopted. The root fixes here replace the repair bundle.
#485-#490, #492-#495, #497-#498, #500 Volatile logs/agents/opencode.json only; superseded by the runtime-state exclusion and owner policy fixes.

No existing PR is merged or closed by this change. After this exact head is green and merged, those branches can be patch-equivalence closed against the resulting default-branch commit.

Verification

  • .venv/bin/python -m pytest — 2,010 tests, 0 failures, 0 errors, 11 runtime-fixture skips; 85.91% line coverage.
  • npm test && npm run build && npm run typecheck — passed (TypeScript emits no output).
  • bash src/automation/project_meta/context-handoff/tests/test_workflow.sh — minimal, standard, and full payloads generated and validated within token targets.
  • actionlint -shellcheck= <changed workflows> — passed; shell scripts are covered by the pre-commit shellcheck hook.
  • SKIP=mypy,bandit,detect-secrets,resolve-managed-links,no-commit-to-branch,eslint,python-safety-dependencies-check pre-commit run --all-files --show-diff-on-failure — passed, matching CI's full-repository skip contract.
  • Full hooks including mypy, bandit, detect-secrets, and eslint passed on every changed file where applicable.
  • bash src/automation/scripts/validate-standards.sh --branch and git diff --check — passed.

Impact

The owner repository gets one reviewable root fix instead of another recursive repair branch. Provider credentials remain optional and are never exposed; absence is reported as a clean skip rather than a red required check.

@github-actions github-actions Bot added documentation Improvements or additions to documentation github-actions Related to GitHub Actions workflows configuration Configuration changes dependencies Pull requests that update a dependency file typescript labels Jul 12, 2026
@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🔗 Broken Links Detected

Full Github Actions output

Please fix the broken links before merging.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🤖 Hi @4444J99, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

@github-actions

github-actions Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 3284069.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout 34e114876b0b11c390a56381ad16ebd13914f8d5 🟢 7
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1018 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
actions/actions/setup-node 49933ea5288caeca8642d1e84afbd3f7d6820020 🟢 6.1
Details
CheckScoreReason
Binary-Artifacts🟢 9binaries present in source code
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/peter-evans/create-pull-request c5a7806660adbe173f04e3e038b0ccdcd758773c 🟢 5.2
Details
CheckScoreReason
Code-Review⚠️ 2Found 3/11 approved changesets -- score normalized to 2
Maintained🟢 1011 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/typescript 5.8.3 🟢 7.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1018 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 38 contributing companies or organizations

Scanned Files

  • .github/workflows/demo-sandbox-reusable.yml
  • package-lock.json

@github-actions

github-actions Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

💬 Task Catcher Summary

💬 Unresolved discussions - Resolve review threads

📋 Task Overview

Category Count
PR Body Unchecked Tasks 0
PR Body Checked Tasks 0 ✅
Comment Tasks 0
Blocker Items 0 🚨
Suggestions 1 💡
Unresolved Review Threads 4

🎯 Next Steps

  • 💬 Resolve review discussion threads

Options:

  • ✅ Check off tasks as you complete them
  • 📋 Create issues for tasks to handle later: Add create-issues-for-tasks label
  • 🚫 Ignore tasks for merge: Add ignore-task-checks label

Last scanned: 2026-07-12 18:11 UTC
Triggered by: issue_comment

github-code-quality[bot]
github-code-quality Bot found potential problems Jul 12, 2026
View reviewed changes
Comment thread src/automation/project_meta/context_handoff/context_generator.py Fixed
@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

⚠️ Large Pull Request Detected

This PR is quite large:

  • 30 files changed
  • 3284 total line changes

Consider:

  • Breaking this into smaller, focused PRs
  • Each PR should address a single concern
  • Smaller PRs are easier to review and less likely to introduce bugs

If this PR must remain large, please provide extra context in the description about why these changes are grouped together.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🔗 Broken Links Detected

Summary

Status Count
🔍 Total 3082
✅ Successful 1696
⏳ Timeouts 0
🔀 Redirected 64
👻 Excluded 1275
❓ Unknown 0
🚫 Errors 47
⛔ Unsupported 0

Errors per input

Errors in .config/schema-org/README.md

Errors in CONTRIBUTING.md

  • [ERROR] file:///home/runner/work/README_STANDARDS.md | Cannot find file: File not found. Check if file exists and path is correct

Errors in docs/ai_framework/agents/neon-migration-specialist.agent.md

Errors in docs/ai_framework/agents/neon-optimization-analyzer.agent.md

Errors in docs/ai_framework/chatmodes/azure-verified-modules-terraform.chatmode.md

Errors in docs/audits/activation/2026-06-11-EV-447.md

Errors in docs/audits/activation/README.md

Errors in docs/guides/BATCH_ONBOARDING_GUIDE.md

Errors in docs/guides/COPILOT_QUICK_START.md

Errors in docs/guides/CUSTOM_INSTRUCTIONS_SETUP.md

Errors in docs/guides/GITHUB_PROJECTS_DEPLOYMENT.md

Errors in docs/guides/GITHUB_PROJECTS_IMPLEMENTATION.md

Errors in docs/guides/GITHUB_PROJECTS_QUICKREF.md

Errors in docs/guides/GITHUB_PROJECTS_VISUAL.md

Errors in docs/guides/MCP_SERVER_SETUP.md

Errors in docs/guides/monitoring.md

  • [ERROR] file:///home/runner/work/dot-github--theoria/dot-github--theoria/.github/workflows/metrics-collection.yml | Cannot find file: File not found. Check if file exists and path is correct

Errors in docs/guides/NEW_CONTRIBUTOR_GUIDE.md

Errors in docs/guides/README.chatmodes.md

  • [ERROR] file:///home/runner/work/dot-github--theoria/dot-github--theoria/docs/ai_framework/chatmodes/csharp-dotnet-codebase-cleanup.chatmode.md | Cannot find file: File not found. Check if file exists and path is correct

Errors in docs/guides/SCHEMA_ORG_SEMVER_GUIDE.md

Errors in docs/guides/SECRETS_SETUP.md

Errors in docs/guides/SLACK_INTEGRATION_CONFIGURATION.md

Errors in docs/reference/COPILOT_ENHANCEMENTS_INDEX.md

Errors in docs/reference/ORGANIZATIONAL_CONTENT_INDEX.md

Errors in docs/reports/GITHUB_PROJECTS_SUMMARY.md

Errors in docs/reports/POSTING_WALKTHROUGH_ANNOUNCEMENT.md

Errors in docs/reports/WALKTHROUGH_ANNOUNCEMENT.md

Errors in docs/reports/WEEK_9_COMPLETION_SUMMARY.md

Errors in docs/runbooks/SECRET_SCANNING_RESOLUTION.md

Errors in docs/workflows/REUSABLE_WORKFLOWS.md

Errors in profile/README.md

Errors in README.md

Errors in src/ai_framework/agents/neon-migration-specialist.agent.md

Errors in src/ai_framework/agents/neon-optimization-analyzer.agent.md

Errors in src/ai_framework/chatmodes/azure-verified-modules-terraform.chatmode.md

Errors in src/automation/scripts/utils/README_PROJECTS.md

Errors in src/automation/scripts/utils/setup-automation-rules.md

Redirects per input

Redirects in .github/docs/REUSABLE_WORKFLOWS.md

Redirects in CODE_OF_CONDUCT.md

Redirects in docs/ai_framework/agents/data-decommissioning.agent.md

Redirects in docs/ai_framework/agents/data-reclamation.agent.md

Redirects in docs/ai_framework/chatmodes/atlassian-requirements-to-jira.chatmode.md

Redirects in docs/ai_framework/chatmodes/kusto-assistant.chatmode.md

Redirects in docs/architecture/AI_CODE_INTELLIGENCE.md

Redirects in docs/architecture/WORKSPACE_CONTAINERIZATION_PROTOCOLS.md

Redirects in docs/automation/AUTOMATION_MASTER_GUIDE.md

Redirects in docs/getting-started/CONFIGURATION.md

Redirects in docs/governance/CODE_OF_CONDUCT.md

Redirects in docs/guides/AGENT_ARCHITECTURE_GUIDE.md

Redirects in docs/guides/COPILOT_QUICK_START.md

Redirects in docs/guides/CUSTOM_INSTRUCTIONS_SETUP.md

Redirects in docs/guides/dependency-management.md

Redirects in docs/guides/GITHUB_COPILOT_ACTIONS_SETUP.md

Redirects in docs/guides/MCP_SERVER_SETUP.md

Redirects in docs/guides/PR_COMPLIANCE_GUIDE.md

Redirects in docs/guides/SECRET_MANAGEMENT_GUIDE.md

Redirects in docs/guides/SLACK_INTEGRATION_CONFIGURATION.md

Redirects in docs/guides/testing-best-practices.md

Redirects in docs/reference/COPILOT_ENHANCEMENTS_INDEX.md

Redirects in docs/reference/SEMANTIC_VERSIONING.md

Redirects in docs/reports/WEEK5_DEPLOYMENT_CHECKLIST.md

Redirects in profile/README.md

Redirects in README.md

Redirects in src/ai_framework/chatmodes/atlassian-requirements-to-jira.chatmode.md

Redirects in src/automation/scripts/utils/1PASSWORD_QUICK_START.md

Full Github Actions output

Please fix the broken links before merging.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

⚠️ Large Pull Request Detected

This PR is quite large:

  • 30 files changed
  • 2947 total line changes

Consider:

  • Breaking this into smaller, focused PRs
  • Each PR should address a single concern
  • Smaller PRs are easier to review and less likely to introduce bugs

If this PR must remain large, please provide extra context in the description about why these changes are grouped together.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🧪 Integration Test Results

Test Suite Status
Month 1 Test Results ✅ Passed
Month 2 Test Results ✅ Passed
Month 3 Test Results ✅ Passed
Critical Path ✅ Passed

Overall: ✅ All tests passed!

View detailed test reports

@claude

claude Bot commented Jul 12, 2026

Copy link
Copy Markdown

Code Review — PR #503: ci(policy): stop chronic autonomous heal loops

Reviewed by: Claude (claude-sonnet-4-6)

Overview

This PR correctly diagnoses and fixes a chronic recursive-repair problem: autonomous workflow producers were generating branches and PR titles that violated the repository's own policy contract, triggering another round of heals in an infinite loop. The strategy — fix the producers rather than adding more bypass conditions — is sound.

The description and superseded-heal map are excellent. Verification section is thorough. The regression tests in test_workflow_policy_contracts.py are exactly the right shape for this problem.

Bugs

🔴 Dead variable in _get_blocked_tasks() — context_generator.py:1629

def _get_blocked_tasks(self) -> list[str]:
    tasks = self.state.get("tasks", {})
    set(self.state.get("context", {}).get("completed_tasks", []))  # result discarded!
    failed = set(self.state.get("context", {}).get("failed_tasks", []))

The set(...) result on line 1629 is computed but never assigned. The original intent was almost certainly completed = set(...), matching the pattern in _get_eligible_tasks(). As written, completed is never defined in this method — it's just dead code from an incomplete port. The function still works (it only uses failed), but it silently omits the "blocked because a dependency failed" logic for tasks whose deps appear in both completed and failed, and the dead call is confusing.

Fix: completed = set(self.state.get("context", {}).get("completed_tasks", [])) — or delete the line if completed isn't used.

🔴 Shell-injection via heredoc interpolation — generate_context.sh and test_workflow.sh

gen = ContextPayloadGenerator('$STATE_FILE')
gen.save_context('$OUTPUT', level_map['$LEVEL'])

$STATE_FILE, $OUTPUT, and $LEVEL are interpolated directly into Python string literals inside heredocs. A path containing a single quote — or other shell-special characters — breaks the Python string and could execute arbitrary code. This is an injection vulnerability at the boundary between shell and Python.

Fix: Pass values as environment variables and read them in Python, or invoke context_generator.py via its existing argparse CLI instead of an inline heredoc:

"$PYTHON" "$SCRIPT_DIR/context_generator.py" \
  --state-file "$STATE_FILE" \
  --output "$OUTPUT" \
  --level "$LEVEL" \
  --show-tokens

Medium Issues

🟡 types.d.ts redefines react instead of installing @types/react

The ambient module declaration works for the narrow case here, but creates future maintenance risk:

  • FC<P = Record<string, never>> differs from the real signature (React's FC defaults to {}, and the return type is ReactNode, not JSX.Element | null)
  • [elementName: string]: any on IntrinsicElements defeats strict JSX checking
  • If @types/react is ever added, this declaration will conflict or silently shadow it

Recommended fix: npm install --save-dev @types/react @types/react-dom and delete types.d.ts. skipLibCheck: true in tsconfig.json handles any transitive type conflicts.

🟡 Silent removal of deny-licenses is a policy regression

-        deny-licenses: GPL-3.0, AGPL-3.0

This is described as removing an "unsupported input," but it also means the dependency-review action no longer blocks copyleft licenses. The description doesn't mention this as a deliberate policy decision. If deny-licenses is unsupported by the current pin, the correct fix is to re-implement it via allow-licenses exclusion or upgrade the pin — not silently drop the restriction.

Suggested: Either restore it under a supported mechanism or add an explicit comment in the workflow (and this PR description) acknowledging the policy gap.

🟡 Gemini availability logic — USE_VERTEX_AI == USE_CODE_ASSIST condition is opaque

elif [[ "$HAS_WIF_PROVIDER" == "true" && "$USE_VERTEX_AI" == "$USE_CODE_ASSIST" ]]; then
  reason="Workload Identity requires exactly one Gemini backend"

When both vars are "false", this fires correctly (no backend selected). When both are "true", it fires correctly (ambiguous). But the equality comparison is non-obvious to a future reader. A comment explaining the invariant ("exactly one of these must be true") would prevent accidental "fixes" that break it.

Low / Minor Issues

🔵 QUICKSTART.md hardcodes a personal repo URL

git clone https://github.com/ivi374forivi/.github.git

This should reference the canonical org URL, not a personal account.

🔵 main() in context_generator.py generates context twice

output_path = gen.save_context(args.output, level_map[args.level])
context = gen.generate_context(level_map[args.level])   # duplicate call

save_context already calls generate_context internally. The second call is only needed to pass to get_token_count. No functional issue, but save_context could return the context dict to avoid the duplicate.

🔵 Branch description normalization removes dashes from descriptions

.replace(/[._/-]+/g, ' ')

The regex includes -, so my-feature-name becomes my feature name in the PR title. For most branch names this is the right behaviour for readability, but it's a subtle change from the previous logic. If any downstream consumers parse the generated PR title to recover branch metadata, they'll be affected.

What's Working Well

  • Strategy is correct: fixing producers rather than adding more bypass conditions eliminates the loop at the root.
  • test_workflow_policy_contracts.py is excellent — pin-tests the exact strings that must appear in each producer. This will catch any regression immediately.
  • Gemini availability gate is well-structured: graceful skip + job summary entry means the check turns green with a clear explanation rather than red with a cryptic auth error.
  • /logs/agents/ in .gitignore cleanly separates runtime state from product diffs.
  • Underscore input fix for actions/first-interaction is correct — the pinned SHA uses underscore-named inputs.
  • Conventional title/branch normalization across all producers is thorough and correctly aligned with CLAUDE.md conventions.
  • test_pending_decision_without_timestamp_is_supported directly covers the crash from [limen HEAL-cifix-organvm-dot-github--theoria-464] fix failing CI on organvm/dot-github--theoria#464 #491/[limen HEAL-cifix-organvm-dot-github--theoria-476] fix failing CI on organvm/dot-github--theoria#476 #496.

Summary

Two real bugs to fix before merge: the dead variable in _get_blocked_tasks and the shell-injection in the heredoc scripts. The deny-licenses removal warrants an explicit acknowledgement. Everything else is advisory. The overall approach and test coverage are solid.

Reviewed by Claude (claude-sonnet-4-6) · #503

@4444J99 4444J99 changed the title ci(policy): stop chronic autonomous heal loops ci(workflows): stop chronic autonomous heal loops Jul 12, 2026
@github-actions

github-actions Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Coverage report

Click to see where and how coverage changed

FileStatementsMissingCoverageCoverage
(new stmts)		Lines missing
  src/automation/project_meta/context-handoff
  context_generator.py 76, 80
Project Total  

This report was generated by python-coverage-comment-action

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🧪 Integration Test Results

Test Suite Status
Month 1 Test Results ✅ Passed
Month 2 Test Results ✅ Passed
Month 3 Test Results ✅ Passed
Critical Path ✅ Passed

Overall: ✅ All tests passed!

View detailed test reports

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jul 12, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🧪 Integration Test Results

Test Suite Status
Month 1 Test Results ✅ Passed
Month 2 Test Results ✅ Passed
Month 3 Test Results ✅ Passed
Critical Path ✅ Passed

Overall: ✅ All tests passed!

View detailed test reports

@claude

claude Bot commented Jul 12, 2026

Copy link
Copy Markdown

Code Review — PR #503: ci(workflows): stop chronic autonomous heal loops

Summary: This PR is a well-structured root-cause fix that addresses a chronic autonomous-heal loop by making the owner repository itself satisfy its own policy contracts. The approach is architecturally sound — fixing producers rather than repeatedly patching symptoms.

Strengths

Security fix in reusable/pr-batching.yml (critical)
The move from inline ${{ steps.create-batch.outputs.included }} string interpolation directly into a JSON.parse(...) call to using environment variables is the correct defense against script injection. This is the most important change in the PR and is handled exactly right.

Shell injection elimination in generate_context.sh
Replacing the heredoc with $PYTHON "$SCRIPT_DIR/context_generator.py" --state-file "$STATE_FILE" ... eliminates the class of injection where caller-controlled path values like STATE_FILE and OUTPUT could become Python source. The test test_shell_wrapper_treats_hostile_output_path_as_data validates this contract explicitly — excellent.

Python correctness in context_generator.py

  • datetime.utcnow() → datetime.now(timezone.utc): correct (utcnow is deprecated and tz-naive)
  • exit(main()) → sys.exit(main()): correct (built-in exit is for interactive use only)
  • Removing the dead set(self.state.get(...)) expression in _get_blocked_tasks is a clean fix
  • key=lambda x: x.get("decision", {}).get("decided_at") or "" — the or "" handles None safely without raising

Gemini availability gate
The availability check logic correctly prevents a permanently-red required check when optional provider credentials are absent. The ::notice annotation and step-summary fallback give clean observability without noise.

Test coverage
Both new test files are high quality. test_workflow_policy_contracts.py locks in the key invariants as regression tests, and test_context_handoff.py covers all three compression levels, the pending-decision edge case, EOF formatting, and the injection resistance property.

Issues and Suggestions

src/automation/dashboard/types.d.ts — fragile ambient redeclaration

The file re-declares the react module as an ambient module rather than relying on @types/react. This is a workaround that works now but will silently break if @types/react is ever added to package.json (module augmentation conflicts) or if a future React API is called that isn't declared here.

More specifically:

  • FC<P = Record<string, never>> differs semantically from React's FC<P = {}> — Record<string, never> is an empty object type with no index signature, which may reject valid prop shapes in other components
  • The JSX.Element interface is empty, which removes JSX type safety under strict: true
  • [elementName: string]: any in IntrinsicElements disables all intrinsic element checking

Recommendation: Add @types/react as a dev dependency instead. If keeping React out of package.json is intentional (the component might be illustrative only), add a comment explaining the constraint and consider skipLibCheck: false so genuine type errors still surface.

validate_context.py — is_valid=False with empty errors is confusing

After the change, is_valid can be False while self.errors is empty (because token overflow produces a warning, not an error). The test explicitly asserts assert not errors alongside assert not valid. Callers seeing (False, [], [...]) may be confused about whether the payload is actually invalid or just advisory.

Suggestion: Either promote token-over-limit to an error, or return a separate is_warning boolean, or document in the return type annotation that is_valid=False can occur from warnings alone.

auto-pr-create.yml — release type removed from typeMap

The old map had 'release': 'release'. The new map omits release, so release/v1.2.0 branches now get commitType = 'chore'. If release branches are expected to produce PRs via this workflow, the resulting titles would be chore(v1.2.0): ... instead of something more semantically appropriate. This may be intentional given that release isn't a standard conventional-commit type, but worth confirming.

gemini-review.yml — WIF "exactly one backend" check edge case

elif [[ "$HAS_WIF_PROVIDER" == "true" && "$USE_VERTEX_AI" == "$USE_CODE_ASSIST" ]]; then
  reason="Workload Identity requires exactly one Gemini backend"

This fires when both are false (neither backend configured) OR both are true. The false == false case is ambiguous — a repository that hasn't configured either Gemini backend at all but has WIF will get this error message, which could be confusing since the message implies "you configured both" rather than "you configured neither." Consider splitting into two cases with distinct messages.

tsconfig.json — moduleResolution: "Node" with module: "ESNext"

moduleResolution: "Node" with module: "ESNext" is a mismatch; "Node" resolution is for CommonJS. For ESNext modules, "NodeNext" or "Bundler" (TS 5.0+) is the correct pairing. With the dashboard using .tsx files this likely doesn't surface a compile error today because noEmit: true and skipLibCheck: true mask it, but it could cause surprising behavior if the config is reused. Consider "moduleResolution": "Bundler" for TypeScript 5.x.

Minor

  • The %7B%7B catch-all added to .lycheeignore will suppress any URL containing {{ (URL-encoded). This is correct but very broad — confirm this doesn't shadow a genuine link that happens to contain those bytes.
  • link-checker.yml switching from if: false to if: vars.ENABLE_MARKDOWN_LINK_CHECKS == 'true' is a good pattern. Ensure the CI documentation is updated to note these vars if they aren't already configured.
  • inject-badge logic fix in demo-deployment.yml is correct: the old && inputs.inject-badge || true always evaluated to true regardless of the input, which the new != 'workflow_dispatch' || github.event.inputs['inject-badge'] == 'true' properly fixes.

Verdict

The security fixes (injection prevention in pr-batching.yml and generate_context.sh) and the behavioral correctness fixes (Gemini gate, deprecation-safe datetime, dead code removal) are all well-executed. The test suite is thorough and the policy-contract tests are a good pattern for this kind of structural guarantee.

The main actionable items before merge are:

  1. Reconsider types.d.ts in favor of @types/react, or at minimum add a rationale comment
  2. Clarify the (False, [], warnings) return contract from validate_all
  3. Confirm the WIF "neither backend configured" message is acceptable to operators

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jul 12, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@claude

claude Bot commented Jul 12, 2026

Copy link
Copy Markdown

Code Review — PR #503

Overall this is a well-scoped, high-quality PR. The root-cause diagnosis is correct, the fixes are targeted, and the regression suite is substantive. A few findings below, ordered by severity.

Security — Fixed (noteworthy)

generate_context.sh shell-injection fix — The heredoc-based approach allowed $STATE_FILE, $OUTPUT, and $LEVEL to be interpolated directly into executed Python source. The replacement ("$PYTHON" "$SCRIPT_DIR/context_generator.py" --state-file "$STATE_FILE" ...) passes every caller-controlled value as a subprocess argument, eliminating that vector entirely. The new test test_shell_wrapper_treats_hostile_output_path_as_data confirms the fix holds.

reusable/pr-batching.yml JavaScript injection fix — Moving ${{ steps.create-batch.outputs.included }} out of the inline script string and into env: is the correct mitigation. The || '[]' fallback also handles the edge case where the output is empty.

Both are exactly the right approach.

Bug — Fixed (noteworthy)

validate_context.py: token limits were advisory, not enforced — The old code called self.validate_token_count(level) but discarded the return value; is_valid was schema_valid and types_valid. The fix captures token_valid and includes it in is_valid. The test test_validator_rejects_payload_over_token_target confirms that oversized payloads now actually fail validation. Worth highlighting because this was a silent regression — oversized payloads were emitting warnings while validate_all() returned True.

_get_blocked_tasks() dead code — set(self.state.get("context", {}).get("completed_tasks", [])) was computing a set and immediately discarding it. Correct to remove it.

datetime.utcnow() deprecation — Using datetime.now(timezone.utc) is the right fix for Python 3.12 where utcnow() is deprecated.

Minor Issue

tsconfig.json uses deprecated moduleResolution: "Node" — TypeScript 5.x deprecates "Node" in favour of "NodeNext" or "Bundler". Since this config is noEmit: true and skipLibCheck: true, it won't cause failures today, but a future tsc upgrade may surface warnings. Consider "moduleResolution": "Bundler" (matches the project's ESNext module output) or "NodeNext" (if the project uses CommonJS).

Observation — types.d.ts

The partial react module declaration in src/automation/dashboard/types.d.ts is a reasonable escape hatch for getting PredictiveWidget.tsx to typecheck without pulling in @types/react. A few notes:

  • FC<P = Record<string, never>> is correct for components with no props.
  • [elementName: string]: any in JSX.IntrinsicElements is the minimum needed to silence JSX element errors.
  • If @types/react is ever added as a dev dependency, this declaration will conflict. The comment in the file (or a // TODO: annotation) noting this intention would make the intent clear to future maintainers.

Excluding it from ESLint via pre-commit is the right call.

Workflow Logic — Looks Correct

demo-deployment.yml inject-badge boolean fix — The old expression github.event_name == 'workflow_dispatch' && inputs.inject-badge || true was broken: when workflow_dispatch, inputs.inject-badge is a string "false" which is truthy in GitHub Actions expression syntax, so the badge was always injected. The new expression github.event_name != 'workflow_dispatch' || github.event.inputs['inject-badge'] == 'true' correctly handles the string comparison.

gemini-review.yml availability gate — The multi-condition auth check covers the key invalid states (zero auth methods, multiple auth methods, WIF without project/SA, mismatched backend vars). The ::notice annotation is a clean way to surface the skip reason in the job summary without failing the check.

merge_group additions — The pattern of adding the trigger and then guarding all deployment steps with github.event_name != 'merge_group' is correct and consistent across ci.yml, docker-build-push.yml, and run-integration-tests.yml. The test test_required_checks_run_on_merge_queue_without_publishing_images counts the exact number of guard conditions (10) which is a useful regression anchor.

Test Coverage

The two new test files add good coverage:

  • test_context_handoff.py covers all three compression levels, the pending-decision sort edge case, blocked-task detection, EOF formatting, and the shell injection mitigation.
  • test_workflow_policy_contracts.py is a solid policy contract suite — it checks YAML validity, input name contracts, bypass removal, branch/title compliance, and the merge_group wiring in one place.

One small note on test_failed_dependency_is_reported_as_blocked: it accesses generator._get_blocked_tasks() directly (private method). This is fine for a regression test, but if the method is renamed the test breaks silently. Consider whether testing through generate_context() and checking the execution_state.blocked_tasks field would be more durable.

Verdict

The security fixes, bug fixes, and policy enforcement changes are all correct. The tests are meaningful and non-trivial. The only actionable suggestion before merge is the moduleResolution deprecation in tsconfig.json — the rest are observations for future consideration.

Reviewed by Claude Sonnet 4.6 via claude-code-action

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🧪 Integration Test Results

Test Suite Status
Month 1 Test Results ✅ Passed
Month 2 Test Results ✅ Passed
Month 3 Test Results ✅ Passed
Critical Path ✅ Passed

Overall: ✅ All tests passed!

View detailed test reports

@4444J99
4444J99 added this pull request to the merge queue Jul 12, 2026
Merged via the queue into main with commit 62a8f08 Jul 12, 2026
90 checks passed
@4444J99
4444J99 deleted the fix/chronic-heal-root-causes branch July 12, 2026 18:16
This was referenced Jul 12, 2026
Merged
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
+1 more reviewer
@github-code-quality github-code-quality[bot] github-code-quality[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@4444J99 4444J99

Labels

configuration Configuration changes dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation github-actions Related to GitHub Actions workflows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@4444J99