Repository navigation
chore: sync public mirror from internal - #1126
Conversation
|
Resolved 0 review-bot thread(s) on this generated public mirror PR. Review of mirrored code belongs on the mono source PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59d910d7bf
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const output = execFileSync("gh", args, { | ||
| encoding: "utf8", | ||
| stdio: ["ignore", "pipe", "pipe"], | ||
| }); |
There was a problem hiding this comment.
When a GraphQL page exceeds Node's default 1 MiB child-process buffer, this execFileSync throws ENOBUFS and aborts the mirror sync before any threads are resolved. That is plausible because the query requests up to 100 threads with 20 comment bodies each; use an increased maxBuffer as pr-feedback-audit.mjs does, or request only the first comment author needed by this script.
Useful? React with 👍 / 👎.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| // GitHub Apps usually have login suffix "[bot]". Some review apps post | ||
| // without that suffix; keep this list aligned with pr-feedback-audit.mjs. | ||
| const KNOWN_REVIEW_BOT_LOGINS = | ||
| /^(?:cursor|coderabbitai|chatgpt-codex-connector|devin-ai-integration)\b/iu; |
There was a problem hiding this comment.
🟡 Prefixed human logins lose threads
A human login beginning cursor, coderabbitai, or another known prefix passes KNOWN_REVIEW_BOT_LOGINS and has its thread resolved. Human feedback then stops blocking the mirror merge.
Learn more
The regex uses a word boundary rather than an end anchor. A hyphen creates a word boundary, so valid human usernames can match a trusted bot prefix. The resolver then treats their thread exactly like a review-bot thread.
Example: The login cursor-reviewer matches cursor\b. Its unresolved human review is resolved automatically instead of remaining open.
Recommended fix: Match each known login exactly, allowing only the documented optional [bot] suffix.
| /^(?:cursor|coderabbitai|chatgpt-codex-connector|devin-ai-integration)\b/iu; | |
| /^(?:cursor|coderabbitai|chatgpt-codex-connector|devin-ai-integration)(?:\[bot\])?$/iu; |
Was this helpful? React with 👍 or 👎 to provide feedback.
| isOutdated | ||
| path | ||
| line | ||
| comments(first:20){nodes{url body author{__typename login}}} |
There was a problem hiding this comment.
🟡 Large reviews abort thread resolution
When returned comment bodies exceed Node's 1 MiB default, ghJson aborts before resolving any thread. Each page requests 2,000 full bodies although only the first author is used.
Learn more
The resolver only reads the first comment's author through firstCommentAuthor. Fetching bodies and URLs makes the synchronous gh output grow with every review comment. execFileSync rejects output beyond its default buffer, so the workflow fails before mutations begin.
Example: One page containing 100 bot threads with several long review replies can exceed 1 MiB. The command exits without resolving those threads, while the workflow never reaches auto-merge.
Recommended fix: Request only the first comment and its author fields. This supplies every field used for classification without transferring review text.
| comments(first:20){nodes{url body author{__typename login}}} | |
| comments(first:1){nodes{author{__typename login}}} |
Was this helpful? React with 👍 or 👎 to provide feedback.
| const typename = String(author.__typename ?? "").trim(); | ||
| if (typename === "Bot") { | ||
| return true; | ||
| } | ||
| const login = String(author.login ?? "").trim(); | ||
| if (!login) { | ||
| return false; | ||
| } | ||
| if (login.toLowerCase().endsWith("[bot]")) { | ||
| return true; | ||
| } | ||
| return KNOWN_REVIEW_BOT_LOGINS.test(login); |
There was a problem hiding this comment.
🔍 Bot scope exceeds named reviewers
isReviewBotAuthor accepts every Bot actor and [bot] login, not only named review services. Confirm all automated review authors are advisory.
Was this helpful? React with 👍 or 👎 to provide feedback.
| const publicMirror = existsSync(new URL("../.github/workflows/check-release-workflow-contract.mjs", import.meta.url)); | ||
| if (publicMirror) { | ||
| assert.match(release, /repository_dispatch:/); | ||
| assert.match(release, /maestro-signed-release/); | ||
| assert.match(release, /MONO_SHA256SUMS\.cosign\.bundle/); | ||
| assert.match(release, /node scripts\/verify-staged-release\.mjs release-binaries "\$RELEASE_VERSION"/); | ||
| assert.match(release, /files\+=\(release-metadata\.json/); | ||
| assert.doesNotMatch(release, /evalops-internal-arc/); | ||
| } else { | ||
| assert.match(release, /create-release-metadata\.mjs/); | ||
| assert.match(release, /files\+=\([^\n]*release-metadata\.json/); | ||
| } |
There was a problem hiding this comment.
🔍 Release mode inferred from one file
The test infers public-mirror mode from one helper's existence. Moving that helper silently selects the wrong release contract.
Was this helpful? React with 👍 or 👎 to provide feedback.
Summary
evalops/monoevalops/maestroas a generated public mirror of the private source of truthf5944e9e1007e740ec74ef4edbbbea7c41009dee05fda21e41980ab14923c5c9d6398d85a02fa7d05file(s) to copy/update and0stale file(s) to delete1sync-holdlabel to this PR; the sync workflow skips every push while it is setSource-of-truth status
Public Mirror Drift Audit
@evalops/deixic-codehttps://github.com/evalops/mono@main (f5944e9e1007)https://github.com/evalops/maestro@main (e7269043f33a)50public_projection_has_driftSample Changed Paths
Guidance
Let internal main generate and merge the public sync PR before relying on public main.
Drift sample
Public-only commits since last generated sync
Validation
Test Plan
maestro-sync-public-release-mirrorworkflow inpublic-treemoderequire-internal-prconfirms internal source PR lineageStaged Rollout
evalops/mono@f5944e9e1007e740ec74ef4edbbbea7c41009dee, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.