fix(review): 중앙 스케줄러의 대상 PR 디스패치 지원

[seonghobae]

개요

대상 저장소의 스케줄러가 중앙 Required OpenCode Review를 디스패치할 교차 저장소 자격증명이 없어 대기하는 문제를 해결합니다. 중앙 .github의 merge-scheduler 디스패치가 target_repository와 pr_number를 받아 한 PR만 안전하게 처리할 수 있도록 했습니다.

변경 사항

• ContextualWisdomLab/* 대상과 양의 PR 번호만 허용합니다.
• GitHub API에서 열린 PR의 base 저장소·base/head SHA를 다시 읽어 라이브 메타데이터에 바인딩합니다.
• 검증 뒤 헤드가 바뀌면 오래된 디스패치는 성공적으로 무동작합니다.
• 중앙 github.token은 중앙 Actions 조회/디스패치에만 사용하고, 앱/PAT는 대상 PR 읽기·변경에 사용합니다.
• 대상 저장소 Actions API에 중앙 전용 토큰으로 먼저 접근해 403이 발생하던 경로를 차단합니다.
• 대상 base branch에서 project flow를 파생합니다.

검증

• codegraph sync
• git diff --check
• python3 -m ruff check ...
• python3 -m py_compile scripts/ci/pr_review_merge_scheduler.py
• python3 scripts/ci/pr_review_merge_scheduler.py --self-test
• PyYAML safe load
• actionlint -shellcheck= -pyflakes= .github/workflows/pr-review-merge-scheduler.yml
• python3 -m pytest -q — 638 passed

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head abd8f7d6a83a827c23157335e00c3ef70d66b414.

• Head SHA: abd8f7d6a83a827c23157335e00c3ef70d66b414

• Workflow run: 29580222601

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["CI script: pr_review_merge_scheduler.py"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: pr_review_merge_scheduler.py"]
  R2 --> V2["bash -n plus Strix self-test"]
  Evidence --> S3["Test (3 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (3 files)"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: abd8f7d6a83a827c23157335e00c3ef70d66b414
• Workflow run: 29580222601
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head abd8f7d6a83a827c23157335e00c3ef70d66b414.

• Head SHA: abd8f7d6a83a827c23157335e00c3ef70d66b414

• Workflow run: 29580222601

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: pr-review-merge-scheduler.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: pr-review-merge-scheduler.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["CI script: pr_review_merge_scheduler.py"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: pr_review_merge_scheduler.py"]
  R2 --> V2["bash -n plus Strix self-test"]
  Evidence --> S3["Test (3 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (3 files)"]
  R3 --> V3["targeted test run"]

Loading

[seonghobae]

현재 헤드 보강 검증 (523bea3c454928294cef68e2a213bd9b3d8d8bb7): 이전 OpenCode coverage 실패가 지적한 1838, 3756, 3759-3760, 3768-3771 분기를 각각 실행하는 회귀 테스트를 추가했습니다.

• 전체 pytest: 642 passed
• coverage: 5,554 statements, 0 missed, total 100%
• pr_review_merge_scheduler.py: 1,669 statements, 0 missed, 100%
• 대상 테스트 5개: passed
• Ruff / git diff --check / CodeGraph sync: passed
• 정확한 중앙 OpenCode 실행: https://github.com/ContextualWisdomLab/.github/actions/runs/29582784880

참고로 이 헤드의 Strix 29582300093도 기존 기본 브랜치 래퍼가 provider 고갈·보고서 0개인 gate exit 1을 neutral skip으로 바꾼 false-green 실행입니다. 따라서 #587의 fail-closed 부트스트랩 후 이 PR의 Strix를 새 기본 래퍼로 다시 검증해야 합니다.