fix(review): offline coverage deps for naruon backend and keyverse service#612
Open
seonghobae wants to merge 3 commits into
Open
fix(review): offline coverage deps for naruon backend and keyverse service#612seonghobae wants to merge 3 commits into
seonghobae wants to merge 3 commits into
Conversation
…rvice Since the 2026-07-17 offline isolation of the Python coverage sandbox (#584), repositories whose test suites import third-party packages fail the coverage-evidence job with ModuleNotFoundError (fastapi for ContextualWisdomLab/naruon, pydantic for ContextualWisdomLab/keyverse), so OpenCode publishes REQUEST_CHANGES for every backend-touching PR in those repositories and their queues cannot drain. Extend the trusted coverage image's hash-pinned runtime set — the same remediation pattern as the saju-caldav set (#594, whose pins this file retains verbatim) — with the reviewed naruon backend/requirements.txt runtime pins and the keyverse account-unification service dependencies (adds pyyaml). Hashes are regenerated with the documented command: uv pip compile --generate-hashes --python-version 3.12 \ --python-platform x86_64-manylinux_2_28 \ requirements-opencode-review-ci.txt \ -o requirements-opencode-review-ci-hashes.txt Validated by installing the compiled set with `pip install --require-hashes --only-binary=:all:` in python:3.12-slim and importing fastapi, pydantic, sqlalchemy, yaml, httpx, openai, and alembic. PR-controlled manifests remain inert; only this reviewed, hash-pinned set reaches the trusted image. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Extends the offline, hash-pinned Python dependency set used by the OpenCode coverage sandbox so test suites for ContextualWisdomLab/naruon (backend) and ContextualWisdomLab/keyverse (services/account_unification) can run without network access.
Changes:
- Adds additional trusted runtime pins (e.g., FastAPI/Pydantic/SQLAlchemy stack and related deps) to the reviewed requirements list.
- Regenerates the fully hash-pinned lockfile to support
--require-hashes --only-binary=:all:installs in the sandbox.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| requirements-opencode-review-ci.txt | Adds the additional direct pins needed for naruon/keyverse (and retains existing saju-caldav pins) in the reviewed runtime manifest. |
| requirements-opencode-review-ci-hashes.txt | Regenerated hash-locked dependency graph for offline installation and reproducible builds. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
CVE-2026-59885 / CVE-2026-59886 (GHSA-8ppf-4f7h-5ppj, GHSA-hm4w-wwcw-mr6r) were published against pyasn1 0.6.3, so the repo-wide pip-audit hard gate and dependency-review now fail every PR until this transitive pin moves to 0.6.4. Hashes are the official PyPI sdist/wheel digests; full-file resolution validated with pip install --dry-run --require-hashes --only-binary=:all: on python:3.13-slim (pyasn1-modules 0.4.2 accepts >=0.6.1,<0.8.0). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Extends the trusted OpenCode coverage image's hash-pinned Python runtime set so the networkless coverage sandbox can execute the test suites of ContextualWisdomLab/naruon (backend) and ContextualWisdomLab/keyverse (services/account_unification).
Why
Since the 2026-07-17 offline isolation (#584), the sandbox has only coverage/interrogate/pytest/pytest-cov/uv. Repositories whose tests import third-party packages fail deterministically:
OpenCode then publishes REQUEST_CHANGES on every backend-touching PR, so those repository queues cannot drain through the governance pipeline.
Naruon's backend/tests/conftest.py imports the application root. Collection therefore loads the mail, database, LLM, Google, telemetry, upload, and authentication service graph. The broader runtime set is required for real collection and execution rather than import-only stubbing. Naruon also imports starlette.websockets directly, so starlette remains an explicit reviewed pin.
How
Verification
Strix lock security update
This PR also moves pyasn1 0.6.3 to 0.6.4 in requirements-strix-ci-hashes.txt. That separate reviewed lock is scanned by the repo-wide hard gates, and pyasn1 0.6.3 is affected by the newly published High advisories GHSA-8ppf-4f7h-5ppj / CVE-2026-59885 and CVE-2026-59886. Leaving the old pin makes pip-audit and dependency-review fail every PR in this repository. The 0.6.4 hashes are official PyPI wheel/source digests, and the full Strix lock resolves with require-hashes and binary-only enforcement.