fix(review): offline coverage deps for naruon backend and keyverse service#612
Open
seonghobae wants to merge 2 commits into
Open
fix(review): offline coverage deps for naruon backend and keyverse service#612seonghobae wants to merge 2 commits into
seonghobae wants to merge 2 commits into
Conversation
…rvice Since the 2026-07-17 offline isolation of the Python coverage sandbox (#584), repositories whose test suites import third-party packages fail the coverage-evidence job with ModuleNotFoundError (fastapi for ContextualWisdomLab/naruon, pydantic for ContextualWisdomLab/keyverse), so OpenCode publishes REQUEST_CHANGES for every backend-touching PR in those repositories and their queues cannot drain. Extend the trusted coverage image's hash-pinned runtime set — the same remediation pattern as the saju-caldav set (#594, whose pins this file retains verbatim) — with the reviewed naruon backend/requirements.txt runtime pins and the keyverse account-unification service dependencies (adds pyyaml). Hashes are regenerated with the documented command: uv pip compile --generate-hashes --python-version 3.12 \ --python-platform x86_64-manylinux_2_28 \ requirements-opencode-review-ci.txt \ -o requirements-opencode-review-ci-hashes.txt Validated by installing the compiled set with `pip install --require-hashes --only-binary=:all:` in python:3.12-slim and importing fastapi, pydantic, sqlalchemy, yaml, httpx, openai, and alembic. PR-controlled manifests remain inert; only this reviewed, hash-pinned set reaches the trusted image. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Extends the offline, hash-pinned Python dependency set used by the OpenCode coverage sandbox so test suites for ContextualWisdomLab/naruon (backend) and ContextualWisdomLab/keyverse (services/account_unification) can run without network access.
Changes:
- Adds additional trusted runtime pins (e.g., FastAPI/Pydantic/SQLAlchemy stack and related deps) to the reviewed requirements list.
- Regenerates the fully hash-pinned lockfile to support
--require-hashes --only-binary=:all:installs in the sandbox.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| requirements-opencode-review-ci.txt | Adds the additional direct pins needed for naruon/keyverse (and retains existing saju-caldav pins) in the reviewed runtime manifest. |
| requirements-opencode-review-ci-hashes.txt | Regenerated hash-locked dependency graph for offline installation and reproducible builds. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+50
to
+53
| PyJWT==2.13.0 | ||
| defusedxml==0.7.1 | ||
| ruff==0.15.21 | ||
| pyyaml==6.0.3 |
Comment on lines
+47
to
+48
| setuptools==83.0.0 | ||
| wheel==0.47.0 |
| websockets==16.1 | ||
| PyJWT==2.13.0 | ||
| defusedxml==0.7.1 | ||
| ruff==0.15.21 |
CVE-2026-59885 / CVE-2026-59886 (GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r) were published against pyasn1 0.6.3, so the repo-wide pip-audit hard gate and dependency-review now fail every PR until this transitive pin moves to 0.6.4. Hashes are the official PyPI sdist/wheel digests; full-file resolution validated with pip install --dry-run --require-hashes --only-binary=:all: on python:3.13-slim (pyasn1-modules 0.4.2 accepts >=0.6.1,<0.8.0). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Comment on lines
+1504
to
+1506
| pyasn1==0.6.4 \ | ||
| --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \ | ||
| --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b |
Comment on lines
+20
to
+21
| starlette==1.3.1 | ||
| uvicorn==0.51.0 |
| setuptools==83.0.0 | ||
| wheel==0.47.0 | ||
| websockets==16.1 | ||
| PyJWT==2.13.0 |
Comment on lines
+16
to
+49
| # Trusted runtime set required to execute ContextualWisdomLab/naruon backend and | ||
| # ContextualWisdomLab/keyverse account-unification tests inside the networkless | ||
| # OpenCode coverage sandbox. Pins follow those repositories' reviewed manifests; | ||
| # fastapi/httpx/icalendar above stay the single resolved versions. | ||
| starlette==1.3.1 | ||
| uvicorn==0.51.0 | ||
| pydantic-settings==2.14.2 | ||
| aiosmtplib==5.1.2 | ||
| aioimaplib==2.0.1 | ||
| sqlalchemy==2.0.51 | ||
| alembic==1.18.5 | ||
| greenlet==3.5.3 | ||
| asyncpg==0.31.0 | ||
| pgvector==0.5.0 | ||
| rankweave==0.1.0 | ||
| pytest-asyncio==1.4.0 | ||
| openai==2.45.0 | ||
| langchain-text-splitters==1.1.2 | ||
| tiktoken==0.13.0 | ||
| google-api-python-client==2.198.0 | ||
| google-auth-httplib2==0.4.0 | ||
| google-auth-oauthlib==1.4.0 | ||
| email-validator==2.3.0 | ||
| cryptography==49.0.0 | ||
| python-multipart==0.0.32 | ||
| prometheus-fastapi-instrumentator==8.0.2 | ||
| opentelemetry-api==1.43.0 | ||
| opentelemetry-sdk==1.43.0 | ||
| opentelemetry-instrumentation-fastapi==0.64b0 | ||
| opentelemetry-exporter-otlp==1.43.0 | ||
| protobuf==7.35.1 | ||
| setuptools==83.0.0 | ||
| wheel==0.47.0 | ||
| websockets==16.1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Extends the trusted OpenCode coverage image's hash-pinned Python runtime set so the networkless coverage sandbox can execute the test suites of
ContextualWisdomLab/naruon(backend) andContextualWisdomLab/keyverse(services/account_unification).Why
Since the 2026-07-17 offline isolation (#584), the sandbox has only
coverage/interrogate/pytest/pytest-cov/uv. Repositories whose tests import third-party packages fail deterministically:ModuleNotFoundError: No module named 'fastapi'(e.g. review run 29791397066)ModuleNotFoundError: No module named 'pydantic'(review run 29877526040)OpenCode then publishes REQUEST_CHANGES on every backend-touching PR, so those repository queues cannot drain through the governance pipeline. This follows the established remediation pattern of #594 (saju-caldav offline deps) and retains that PR's pins verbatim — if this lands first, #594 becomes redundant; if #594 lands first, this rebases to the same content.
How
requirements-opencode-review-ci.txt: adds a reviewed section mirroringnaruon/backend/requirements.txtruntime pins plus keyverse's service deps (addspyyaml).fastapi/httpx/icalendarstay single-resolved at the saju-caldav versions.requirements-opencode-review-ci-hashes.txt: regenerated with the documented command (uv pip compile --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28).PR-controlled manifests remain inert: only this reviewed, hash-pinned set reaches the trusted image;
--require-hashes --only-binary=:all:is unchanged.Verification
pip install --require-hashes --only-binary=:all: -r requirements-opencode-review-ci-hashes.txtsucceeds inpython:3.12-slim(x86_64).python -c "import fastapi, pydantic, sqlalchemy, yaml, httpx, openai, alembic"passes in that environment.🤖 Generated with Claude Code
Update (2026-07-22)
pyasn10.6.3 → 0.6.4 inrequirements-strix-ci-hashes.txt: CVE-2026-59885 / CVE-2026-59886 published against 0.6.3 make the repo-widepip-audithard gate anddependency-reviewfail every PR to this repo until the pin moves. Hashes are official PyPI digests; full-filepip install --dry-run --require-hashes --only-binary=:all:on python:3.13-slim resolves cleanly (pyasn1-0.6.4selected, exit 0).