Repository navigation
fix(portal): preserve the deployed native retirement graph - #4841
Conversation
Affected-user evaluation at d91031b: the published controller graph is unchanged after integrating current main. Go tooling regenerated both complete locks; their original reviewed hashes remain 57247105c347d4018764df19f36646b0ec0c66302d930111c04b1d386dc03c36 and 6335830768e87322301ef84ad756f4de07f680148a3bd65d2b397a52681fe14c. Every repair-file byte matches the earlier reviewed head. The nested race suite passed, and the actual native Helm/Flux retirement controls passed with required native mode and the verified Helm 4.2.0 binary (71.292 seconds), including absence, retained-history and timeout outcomes. Earlier RED graph-drift and updater-policy controls remain recorded above. This proves the offline native proof path; it does not claim a bot dispatch, production cleanup, or vulnerability-free graph. Fresh hosted CI and exact-head semantic review are still required. |
@coderabbitai full review |
✅ Action performedFull review finished. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ➖ Normal Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 7 files. (1 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check The changes meet the coding requirements in #4840.validateNativeGraphauthenticates the pinned module and checksum locks, module versions, replacements, linked dependencies, checksums, and producer…Out of Scope Changes check The changes remain within #4840. The graph validator, graph tests, lock restoration, updater-policy tests, dependency configuration, documentation, and cache update support preservation and verificati…Title check The title clearly summarizes the main change: preserving the deployed native retirement dependency graph. Description check The description directly explains the problem, the graph verification, the isolated dependency-update policy, and the intended security-update behavior.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 7 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Resolution of the ancillary concerns in the 6e693c5 review:
No source file or head changed. This resolution restarts the ordered semantic-review round. CodeRabbit’s completed review reports zero remaining included reviews for this repository at 16:49:46 UTC, so I will use the next serving lane without requesting paid overage or redundantly retrying that exhausted allowance. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Ready at 6e693c5: CI run 38430033886 passed, the actual native controller/Helm behavior and complete graph controls passed, and Codex completed the restarted exact-head review with no major issues and no additional findings. Zero review threads are unresolved. The ancillary scope and optional coverage concerns have documented resolutions; no source changed afterward. Current merge state is CLEAN. This delivers proof fidelity and narrowly scoped updater behavior, not production retirement or remediation of the fixed fixture’s published advisories. The storage prerequisite and protected production readbacks remain separate. |
The base changed after #4831 merged. Its update changed the producer’s Kustomize replacement and several indirect selections; the new full-lock regression detected the drift. I converted this PR back to draft and explicitly removed it from the queue before refreshing the branch. The signed current-main merge preserves the already deployed source changes and restores the native fixture with Go module tooling. Both regenerated lock hashes are exactly the previously reviewed published selections. The native graph race tests, required actual Flux/Helm controls, root/nested vet, affected-package lint and the non-loopback rejection check pass. Production cleanup remains unexecuted. Head 9ec5a3b needs its own hosted checks and review; the earlier 6e693c5 review is stale. The remaining open fixture updater PRs are #4832, #4835 and #4836; #4831 already merged and #4833 closed independently. |
@codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
The reviewed native graph has been preserved across main’s newly merged fixture update in signed head b8ffd21. Go module tooling regenerated the locks to the exact previously reviewed hashes; all repair files remain byte-identical to reviewed 9ec5a3b. Legitimate main ancestry is preserved, with no weakened guard. The nested race suite and required actual native Helm/Flux controls pass. Hosted CI is queued; the prior current-head review is stale and will be replaced only after this head passes its checks. No production cleanup has run. |
@coderabbitai review |
✅ Action performedReview finished.
|
Readiness at d91031b: CI run 38445786536 is successful, and every readable inherited required workflow passes. GitHub reports CLEAN/MERGEABLE. The complete current thread census has zero unresolved findings. CodeRabbit summary 6150617233, updated at 18:46:54 UTC after request 6152630397, carries the exact-head no-actionable-findings verdict; the native parser returns GREEN and the head status says Review completed. The repeated aggregate docstring percentage is not a concrete missing public contract or configured required check. The same concern was assessed in 6150680478: the invariant and fixture boundary are documented beside the guard and in the lifecycle ADR, while named executable tests cover the private helpers. Current source has not changed that assessment. The scope check now explicitly passes. Advisory context remains visible; no vulnerability-free claim or security-check exemption is added. Affected-user evaluation is recorded at 6149937896: regenerated full locks retain the published graph, the nested race suite passes, and the actual required Helm/Flux retirement controls pass. This is native-proof delivery, not production cleanup. The optional configured code-quality surface remains unreadable to the completeness helper; it is not being called green. The authoritative CLEAN state and all readable required checks permit the normal queue operation, without admin bypass. |
Signed main integration is published at 8511856. The native module and checksum locks remain byte-identical to the reviewed canonical graph (SHA-256 57247105c347d4018764df19f36646b0ec0c66302d930111c04b1d386dc03c36 and 6335830768e87322301ef84ad756f4de07f680148a3bd65d2b397a52681fe14c). The nested native race tests pass, and the actual Helm history/hooks/asynchronous-uninstall test passes. Incoming unrelated main changes are preserved. The PR is draft again until this head passes hosted CI and fresh review; nothing was deployed or retired by this push. |
The current-base conflict recurred when the active fixture-only Kubernetes updater #4843 merged after the earlier integration. Signed head be2ba4e now integrates that main revision without altering the published controller graph. Both canonical module fingerprints still match, go mod tidy reports no changes and the actual nested race suite passes. The fixture-only Renovate exclusion already in this PR prevents new independent graph rewrites after it lands; this does not change runtime dependency or security checks. Fresh hosted CI and current-head review are still required. No updater was cancelled or closed by this session. |
cr:no-gate@be2ba4e. Fresh authenticated provider evidence on this repository reports unavailable included review capacity: #4838 (review). The current-head no-gate guard admits the record, hosted CI run 38462949010 is green, and there are no unresolved inline threads or delivered current-head CodeRabbit findings. Continuing to the next ordered lane under the acquired review-request lock; no paid review or overage is requested. |
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness at be2ba4e: hosted CI run 38462949010 is successful, and Codex comment 6155070068 explicitly reviewed this head with no major issues. The complete inline-thread census is zero, the published template contract passes, and GitHub reports CLEAN. The earlier canonical-graph and actual Helm/Flux evaluation remains unchanged: both module fingerprints match the published controller graph, go mod tidy has no diff, the nested race suite passes, and the actual pinned Helm history/hooks/asynchronous-uninstall control passes on this head. This delivers the offline retirement proof and prevents independent fixture-only graph rewrites; it neither suppresses production security reporting nor performs production cleanup. Proceeding through the normal head-pinned merge queue without bypass. |
The 22:03 UTC queue removal was Current-head user evaluation: the real published Flux/Helm adapter passed its lifecycle suite with Helm 4.2.0 and mandatory native controls in 315.101s; nested race tests passed in 2.069s, and vet/lint passed. History retention, no-hooks behavior, guarded deletion, actual absence and finite failure outcomes were exercised. Fresh CI/review remain pending, so this PR is a draft again and has not been requeued. |
Fresh CI at This is an unresolved CI startup failure, not a proven source defect or a green run. No timeout, metadata endpoint, method filter or credential boundary has been changed. A diagnostic retry was refused because the workflow is still running; no retry or production requeue occurred. Once that run terminates, one exact-head failed-job retry can test reproducibility before any source repair. This PR remains a draft and the normal review gates remain pending. |
After the run terminated, I requested one diagnostic failed-job retry of 38476242806 at the unchanged reviewed source head. This is pull-request CI only, not a production deploy or merge-queue re-entry. The retry is to test reproducibility of the isolated proxy-startup timeout; its result is outstanding. No source fix or green CI is claimed from requesting it. |
@coderabbitai review |
✅ Action performedReview finished.
|
Readiness at
Promoting and adding it to the merge queue at this head. |
1 participant
Why
Independent dependency updates made the cleanup proof test a different controller implementation from the one deployed. That proof must match production before protected cleanup can proceed.
What
Restore and verify the published controller dependency graph, and prevent independent updates only in its isolated offline proof. Production dependency updates and vulnerability reporting remain enabled; this is not a production security fix.
Fixes #4840
Part of #4266