@reviewsensei/cli-linux-x64-gnu 0.6.12 → 0.6.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -3
- package/bin/_internal/base_library.zip +0 -0
- package/bin/_internal/review_sensei/schemas/broker-diagnostics.json +412 -0
- package/bin/_internal/review_sensei/schemas/coverage-manifest.schema.json +4 -0
- package/bin/_internal/review_sensei.egg-info/PKG-INFO +57 -4
- package/bin/_internal/review_sensei.egg-info/SOURCES.txt +9 -0
- package/bin/review-sensei +0 -0
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# @reviewsensei/cli-linux-x64-gnu
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
3
|
+
ReviewSensei is a provider-neutral AI code review engine that turns unified
|
|
4
|
+
Git diffs into validated summaries and findings. This package contains the
|
|
5
|
+
standalone Python engine bundled for Linux x64 with glibc 2.36+.
|
|
6
|
+
|
|
7
|
+
Install the public launcher, which selects the matching native package:
|
|
8
|
+
|
|
9
|
+
```console
|
|
10
|
+
npm install --save-dev @reviewsensei/cli@0.6.15
|
|
11
|
+
npx review-sensei --help
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
Use [`@reviewsensei/cli`](https://www.npmjs.com/package/@reviewsensei/cli) for
|
|
15
|
+
installation, provider/model configuration, authentication, and review examples.
|
|
16
|
+
The launcher forwards CLI arguments unchanged and inherits your working directory
|
|
17
|
+
and environment; the engine reads `.reviewsensei.yml` or an explicit `--config`.
|
|
18
|
+
There is no separate platform-package configuration, npm command, installer, or
|
|
19
|
+
download hook. A separate Python installation is unnecessary.
|
|
Binary file
|
|
@@ -0,0 +1,412 @@
|
|
|
1
|
+
{
|
|
2
|
+
"broker_capability_invalid": {
|
|
3
|
+
"stage": "request_validation",
|
|
4
|
+
"action": "check_request",
|
|
5
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
6
|
+
},
|
|
7
|
+
"broker_content_length_required": {
|
|
8
|
+
"stage": "request_validation",
|
|
9
|
+
"action": "check_request",
|
|
10
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
11
|
+
},
|
|
12
|
+
"broker_cors_not_supported": {
|
|
13
|
+
"stage": "request_validation",
|
|
14
|
+
"action": "check_request",
|
|
15
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
16
|
+
},
|
|
17
|
+
"broker_event_rejected": {
|
|
18
|
+
"stage": "workflow_identity",
|
|
19
|
+
"action": "check_workflow",
|
|
20
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
21
|
+
},
|
|
22
|
+
"broker_installation_unavailable": {
|
|
23
|
+
"stage": "repository_installation",
|
|
24
|
+
"action": "check_installation",
|
|
25
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
26
|
+
},
|
|
27
|
+
"broker_invalid_request": {
|
|
28
|
+
"stage": "request_validation",
|
|
29
|
+
"action": "check_request",
|
|
30
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
31
|
+
},
|
|
32
|
+
"broker_ledger_invalid": {
|
|
33
|
+
"stage": "broker_ledger",
|
|
34
|
+
"action": "contact_operator",
|
|
35
|
+
"hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
|
|
36
|
+
},
|
|
37
|
+
"broker_ledger_unavailable": {
|
|
38
|
+
"stage": "broker_ledger",
|
|
39
|
+
"action": "contact_operator",
|
|
40
|
+
"hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
|
|
41
|
+
},
|
|
42
|
+
"broker_payload_too_large": {
|
|
43
|
+
"stage": "request_validation",
|
|
44
|
+
"action": "check_request",
|
|
45
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
46
|
+
},
|
|
47
|
+
"broker_rate_limited": {
|
|
48
|
+
"stage": "broker_admission",
|
|
49
|
+
"action": "retry_later",
|
|
50
|
+
"hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
|
|
51
|
+
},
|
|
52
|
+
"broker_replay": {
|
|
53
|
+
"stage": "broker_admission",
|
|
54
|
+
"action": "retry_later",
|
|
55
|
+
"hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
|
|
56
|
+
},
|
|
57
|
+
"broker_repository_rejected": {
|
|
58
|
+
"stage": "repository_installation",
|
|
59
|
+
"action": "check_installation",
|
|
60
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
61
|
+
},
|
|
62
|
+
"broker_request_invalid": {
|
|
63
|
+
"stage": "request_validation",
|
|
64
|
+
"action": "check_request",
|
|
65
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
66
|
+
},
|
|
67
|
+
"broker_runner_rejected": {
|
|
68
|
+
"stage": "workflow_identity",
|
|
69
|
+
"action": "check_workflow",
|
|
70
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
71
|
+
},
|
|
72
|
+
"broker_session_actor_rejected": {
|
|
73
|
+
"stage": "session_validation",
|
|
74
|
+
"action": "check_session",
|
|
75
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
76
|
+
},
|
|
77
|
+
"broker_session_attestation_invalid": {
|
|
78
|
+
"stage": "session_validation",
|
|
79
|
+
"action": "check_session",
|
|
80
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
81
|
+
},
|
|
82
|
+
"broker_session_grant_invalid": {
|
|
83
|
+
"stage": "session_validation",
|
|
84
|
+
"action": "check_session",
|
|
85
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
86
|
+
},
|
|
87
|
+
"broker_session_grant_rejected": {
|
|
88
|
+
"stage": "session_validation",
|
|
89
|
+
"action": "check_session",
|
|
90
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
91
|
+
},
|
|
92
|
+
"broker_session_head_rejected": {
|
|
93
|
+
"stage": "session_validation",
|
|
94
|
+
"action": "check_session",
|
|
95
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
96
|
+
},
|
|
97
|
+
"broker_session_invalid": {
|
|
98
|
+
"stage": "session_validation",
|
|
99
|
+
"action": "check_session",
|
|
100
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
101
|
+
},
|
|
102
|
+
"broker_unknown": {
|
|
103
|
+
"stage": "broker",
|
|
104
|
+
"action": "contact_operator",
|
|
105
|
+
"hint": "The broker supplied no recognized reason. Use the correlation ID and run time to inspect broker logs; do not infer a cause."
|
|
106
|
+
},
|
|
107
|
+
"broker_workflow_rejected": {
|
|
108
|
+
"stage": "workflow_identity",
|
|
109
|
+
"action": "check_workflow",
|
|
110
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
111
|
+
},
|
|
112
|
+
"github_api_url_invalid": {
|
|
113
|
+
"stage": "broker_configuration",
|
|
114
|
+
"action": "contact_operator",
|
|
115
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
116
|
+
},
|
|
117
|
+
"github_app_id_invalid": {
|
|
118
|
+
"stage": "broker_configuration",
|
|
119
|
+
"action": "contact_operator",
|
|
120
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
121
|
+
},
|
|
122
|
+
"github_app_key_invalid": {
|
|
123
|
+
"stage": "broker_configuration",
|
|
124
|
+
"action": "contact_operator",
|
|
125
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
126
|
+
},
|
|
127
|
+
"github_capability_issue_failed": {
|
|
128
|
+
"stage": "capability_issuance",
|
|
129
|
+
"action": "contact_operator",
|
|
130
|
+
"hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
|
|
131
|
+
},
|
|
132
|
+
"github_capability_permissions_invalid": {
|
|
133
|
+
"stage": "capability_issuance",
|
|
134
|
+
"action": "contact_operator",
|
|
135
|
+
"hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
|
|
136
|
+
},
|
|
137
|
+
"github_capability_response_invalid": {
|
|
138
|
+
"stage": "capability_issuance",
|
|
139
|
+
"action": "contact_operator",
|
|
140
|
+
"hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
|
|
141
|
+
},
|
|
142
|
+
"github_installation_invalid": {
|
|
143
|
+
"stage": "repository_installation",
|
|
144
|
+
"action": "check_installation",
|
|
145
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
146
|
+
},
|
|
147
|
+
"github_installation_lookup_failed": {
|
|
148
|
+
"stage": "repository_installation",
|
|
149
|
+
"action": "check_installation",
|
|
150
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
151
|
+
},
|
|
152
|
+
"github_installation_permissions_invalid": {
|
|
153
|
+
"stage": "repository_installation",
|
|
154
|
+
"action": "check_installation",
|
|
155
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
156
|
+
},
|
|
157
|
+
"github_installation_repositories_failed": {
|
|
158
|
+
"stage": "repository_installation",
|
|
159
|
+
"action": "check_installation",
|
|
160
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
161
|
+
},
|
|
162
|
+
"github_installation_repositories_invalid": {
|
|
163
|
+
"stage": "repository_installation",
|
|
164
|
+
"action": "check_installation",
|
|
165
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
166
|
+
},
|
|
167
|
+
"github_installation_repositories_limit": {
|
|
168
|
+
"stage": "repository_installation",
|
|
169
|
+
"action": "check_installation",
|
|
170
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
171
|
+
},
|
|
172
|
+
"github_installation_repository_invalid": {
|
|
173
|
+
"stage": "repository_installation",
|
|
174
|
+
"action": "check_installation",
|
|
175
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
176
|
+
},
|
|
177
|
+
"github_installation_token_failed": {
|
|
178
|
+
"stage": "repository_installation",
|
|
179
|
+
"action": "check_installation",
|
|
180
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
181
|
+
},
|
|
182
|
+
"github_installation_token_invalid": {
|
|
183
|
+
"stage": "repository_installation",
|
|
184
|
+
"action": "check_installation",
|
|
185
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
186
|
+
},
|
|
187
|
+
"github_issue_comment_forbidden": {
|
|
188
|
+
"stage": "repository_installation",
|
|
189
|
+
"action": "check_installation",
|
|
190
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
191
|
+
},
|
|
192
|
+
"github_issue_comment_invalid": {
|
|
193
|
+
"stage": "repository_installation",
|
|
194
|
+
"action": "check_installation",
|
|
195
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
196
|
+
},
|
|
197
|
+
"github_issue_comment_lookup_failed": {
|
|
198
|
+
"stage": "repository_installation",
|
|
199
|
+
"action": "check_installation",
|
|
200
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
201
|
+
},
|
|
202
|
+
"github_issue_comment_response_invalid": {
|
|
203
|
+
"stage": "repository_installation",
|
|
204
|
+
"action": "check_installation",
|
|
205
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
206
|
+
},
|
|
207
|
+
"github_path_invalid": {
|
|
208
|
+
"stage": "broker_configuration",
|
|
209
|
+
"action": "contact_operator",
|
|
210
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
211
|
+
},
|
|
212
|
+
"github_pull_request_forbidden": {
|
|
213
|
+
"stage": "repository_installation",
|
|
214
|
+
"action": "check_installation",
|
|
215
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
216
|
+
},
|
|
217
|
+
"github_pull_request_invalid": {
|
|
218
|
+
"stage": "repository_installation",
|
|
219
|
+
"action": "check_installation",
|
|
220
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
221
|
+
},
|
|
222
|
+
"github_pull_request_lookup_failed": {
|
|
223
|
+
"stage": "repository_installation",
|
|
224
|
+
"action": "check_installation",
|
|
225
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
226
|
+
},
|
|
227
|
+
"github_pull_request_response_invalid": {
|
|
228
|
+
"stage": "repository_installation",
|
|
229
|
+
"action": "check_installation",
|
|
230
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
231
|
+
},
|
|
232
|
+
"github_repository_invalid": {
|
|
233
|
+
"stage": "repository_installation",
|
|
234
|
+
"action": "check_installation",
|
|
235
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
236
|
+
},
|
|
237
|
+
"github_repository_lookup_failed": {
|
|
238
|
+
"stage": "repository_installation",
|
|
239
|
+
"action": "check_installation",
|
|
240
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
241
|
+
},
|
|
242
|
+
"github_repository_response_invalid": {
|
|
243
|
+
"stage": "repository_installation",
|
|
244
|
+
"action": "check_installation",
|
|
245
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
246
|
+
},
|
|
247
|
+
"github_response_invalid": {
|
|
248
|
+
"stage": "github_api",
|
|
249
|
+
"action": "contact_operator",
|
|
250
|
+
"hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
|
|
251
|
+
},
|
|
252
|
+
"github_response_too_large": {
|
|
253
|
+
"stage": "github_api",
|
|
254
|
+
"action": "contact_operator",
|
|
255
|
+
"hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
|
|
256
|
+
},
|
|
257
|
+
"github_workflow_tag_invalid": {
|
|
258
|
+
"stage": "workflow_identity",
|
|
259
|
+
"action": "check_workflow",
|
|
260
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
261
|
+
},
|
|
262
|
+
"github_workflow_tag_unavailable": {
|
|
263
|
+
"stage": "workflow_identity",
|
|
264
|
+
"action": "check_workflow",
|
|
265
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
266
|
+
},
|
|
267
|
+
"oidc_actor_invalid": {
|
|
268
|
+
"stage": "oidc_validation",
|
|
269
|
+
"action": "check_workflow",
|
|
270
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
271
|
+
},
|
|
272
|
+
"oidc_audience_invalid": {
|
|
273
|
+
"stage": "oidc_validation",
|
|
274
|
+
"action": "check_workflow",
|
|
275
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
276
|
+
},
|
|
277
|
+
"oidc_claims_invalid": {
|
|
278
|
+
"stage": "oidc_validation",
|
|
279
|
+
"action": "check_workflow",
|
|
280
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
281
|
+
},
|
|
282
|
+
"oidc_event_invalid": {
|
|
283
|
+
"stage": "oidc_validation",
|
|
284
|
+
"action": "check_workflow",
|
|
285
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
286
|
+
},
|
|
287
|
+
"oidc_header_invalid": {
|
|
288
|
+
"stage": "oidc_validation",
|
|
289
|
+
"action": "check_workflow",
|
|
290
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
291
|
+
},
|
|
292
|
+
"oidc_identity_invalid": {
|
|
293
|
+
"stage": "oidc_validation",
|
|
294
|
+
"action": "check_workflow",
|
|
295
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
296
|
+
},
|
|
297
|
+
"oidc_issuer_invalid": {
|
|
298
|
+
"stage": "oidc_validation",
|
|
299
|
+
"action": "check_workflow",
|
|
300
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
301
|
+
},
|
|
302
|
+
"oidc_job_workflow_ref_invalid": {
|
|
303
|
+
"stage": "oidc_validation",
|
|
304
|
+
"action": "check_workflow",
|
|
305
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
306
|
+
},
|
|
307
|
+
"oidc_job_workflow_sha_invalid": {
|
|
308
|
+
"stage": "oidc_validation",
|
|
309
|
+
"action": "check_workflow",
|
|
310
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
311
|
+
},
|
|
312
|
+
"oidc_jti_invalid": {
|
|
313
|
+
"stage": "oidc_validation",
|
|
314
|
+
"action": "check_workflow",
|
|
315
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
316
|
+
},
|
|
317
|
+
"oidc_jwks_invalid": {
|
|
318
|
+
"stage": "oidc_validation",
|
|
319
|
+
"action": "retry_later",
|
|
320
|
+
"hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
|
|
321
|
+
},
|
|
322
|
+
"oidc_jwks_too_large": {
|
|
323
|
+
"stage": "oidc_validation",
|
|
324
|
+
"action": "retry_later",
|
|
325
|
+
"hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
|
|
326
|
+
},
|
|
327
|
+
"oidc_jwks_unavailable": {
|
|
328
|
+
"stage": "oidc_validation",
|
|
329
|
+
"action": "retry_later",
|
|
330
|
+
"hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
|
|
331
|
+
},
|
|
332
|
+
"oidc_key_not_found": {
|
|
333
|
+
"stage": "oidc_validation",
|
|
334
|
+
"action": "check_workflow",
|
|
335
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
336
|
+
},
|
|
337
|
+
"oidc_ref_invalid": {
|
|
338
|
+
"stage": "oidc_validation",
|
|
339
|
+
"action": "check_workflow",
|
|
340
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
341
|
+
},
|
|
342
|
+
"oidc_repository_invalid": {
|
|
343
|
+
"stage": "oidc_validation",
|
|
344
|
+
"action": "check_workflow",
|
|
345
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
346
|
+
},
|
|
347
|
+
"oidc_repository_owner_invalid": {
|
|
348
|
+
"stage": "oidc_validation",
|
|
349
|
+
"action": "check_workflow",
|
|
350
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
351
|
+
},
|
|
352
|
+
"oidc_run_attempt_invalid": {
|
|
353
|
+
"stage": "oidc_validation",
|
|
354
|
+
"action": "check_workflow",
|
|
355
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
356
|
+
},
|
|
357
|
+
"oidc_run_id_invalid": {
|
|
358
|
+
"stage": "oidc_validation",
|
|
359
|
+
"action": "check_workflow",
|
|
360
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
361
|
+
},
|
|
362
|
+
"oidc_run_number_invalid": {
|
|
363
|
+
"stage": "oidc_validation",
|
|
364
|
+
"action": "check_workflow",
|
|
365
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
366
|
+
},
|
|
367
|
+
"oidc_runner_environment_invalid": {
|
|
368
|
+
"stage": "oidc_validation",
|
|
369
|
+
"action": "check_workflow",
|
|
370
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
371
|
+
},
|
|
372
|
+
"oidc_sha_invalid": {
|
|
373
|
+
"stage": "oidc_validation",
|
|
374
|
+
"action": "check_workflow",
|
|
375
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
376
|
+
},
|
|
377
|
+
"oidc_signature_invalid": {
|
|
378
|
+
"stage": "oidc_validation",
|
|
379
|
+
"action": "check_workflow",
|
|
380
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
381
|
+
},
|
|
382
|
+
"oidc_subject_invalid": {
|
|
383
|
+
"stage": "oidc_validation",
|
|
384
|
+
"action": "check_workflow",
|
|
385
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
386
|
+
},
|
|
387
|
+
"oidc_time_invalid": {
|
|
388
|
+
"stage": "oidc_validation",
|
|
389
|
+
"action": "check_workflow",
|
|
390
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
391
|
+
},
|
|
392
|
+
"oidc_token_invalid": {
|
|
393
|
+
"stage": "oidc_validation",
|
|
394
|
+
"action": "check_workflow",
|
|
395
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
396
|
+
},
|
|
397
|
+
"oidc_workflow_invalid": {
|
|
398
|
+
"stage": "oidc_validation",
|
|
399
|
+
"action": "check_workflow",
|
|
400
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
401
|
+
},
|
|
402
|
+
"oidc_workflow_ref_invalid": {
|
|
403
|
+
"stage": "oidc_validation",
|
|
404
|
+
"action": "check_workflow",
|
|
405
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
406
|
+
},
|
|
407
|
+
"oidc_workflow_sha_invalid": {
|
|
408
|
+
"stage": "oidc_validation",
|
|
409
|
+
"action": "check_workflow",
|
|
410
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
411
|
+
}
|
|
412
|
+
}
|
|
@@ -43,6 +43,8 @@
|
|
|
43
43
|
"enum": [
|
|
44
44
|
"binary",
|
|
45
45
|
"generated",
|
|
46
|
+
"lockfile-format",
|
|
47
|
+
"no-review-stage",
|
|
46
48
|
"too-large-hunk",
|
|
47
49
|
"too-large-file",
|
|
48
50
|
"chunk-failed",
|
|
@@ -81,6 +83,8 @@
|
|
|
81
83
|
"enum": [
|
|
82
84
|
"binary",
|
|
83
85
|
"generated",
|
|
86
|
+
"lockfile-format",
|
|
87
|
+
"no-review-stage",
|
|
84
88
|
"too-large-hunk",
|
|
85
89
|
"too-large-file",
|
|
86
90
|
"chunk-failed",
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: review-sensei
|
|
3
|
-
Version: 0.6.
|
|
3
|
+
Version: 0.6.15
|
|
4
4
|
Summary: Provider-neutral AI code review engine with an Ollama adapter.
|
|
5
5
|
Author: Mohamad Alsabbagh
|
|
6
6
|
License-Expression: MIT
|
|
@@ -136,8 +136,8 @@ Node.js 22 or newer can invoke the same Python review engine through the
|
|
|
136
136
|
provider-neutral `@reviewsensei/cli` launcher:
|
|
137
137
|
|
|
138
138
|
```bash
|
|
139
|
-
npx --yes @reviewsensei/cli@0.6.
|
|
140
|
-
npx --yes @reviewsensei/cli@0.6.
|
|
139
|
+
npx --yes @reviewsensei/cli@0.6.15 --version
|
|
140
|
+
npx --yes @reviewsensei/cli@0.6.15 --help
|
|
141
141
|
```
|
|
142
142
|
|
|
143
143
|
The launcher selects one of the five native packages (macOS arm64/x64,
|
|
@@ -334,6 +334,28 @@ limits stay in place; opt-in `--orchestrate-large-changes` adds a separate
|
|
|
334
334
|
total-work budget so larger diffs can be chunked without silent truncation or
|
|
335
335
|
unbounded provider calls.
|
|
336
336
|
|
|
337
|
+
Npm `package-lock.json` and `npm-shrinkwrap.json` changes are reviewed as
|
|
338
|
+
material dependency input. Every original hunk remains in the request; a
|
|
339
|
+
bounded aid identifies visible dependency members with exact diff hashes and
|
|
340
|
+
left/right line references. This is patch evidence, not a validated full
|
|
341
|
+
dependency graph or an integrity/security audit of downloaded packages. The
|
|
342
|
+
lockfile version and owning package may be unknown in isolated hunks. Other
|
|
343
|
+
recognized lockfile formats currently report `unsupported` with reason
|
|
344
|
+
`lockfile-format`; generated non-lockfile exclusions still report `generated`.
|
|
345
|
+
|
|
346
|
+
Validated partial results with explicit complete enumeration and evidence of
|
|
347
|
+
some reviewed work can be checkpointed and published. Their findings and
|
|
348
|
+
coverage limitations remain visible; approval is withheld, and enforcement
|
|
349
|
+
modes keep the check at `action_required`. Publication success means the
|
|
350
|
+
findings were delivered, not that review coverage became complete. Missing
|
|
351
|
+
coverage, incomplete enumeration, summary-only results, and total analysis
|
|
352
|
+
failure still cannot enter the partial identity-bound publication path. Legacy
|
|
353
|
+
complete artifacts without coverage retain checkpoint/publication compatibility;
|
|
354
|
+
their existing compatibility behavior is unchanged. The default
|
|
355
|
+
review exit is `2` for a partial result; workflow `operational` exit semantics
|
|
356
|
+
allow safe checkpointed findings to reach publication. Existing publisher
|
|
357
|
+
diff-size and location-validation limits still apply.
|
|
358
|
+
|
|
337
359
|
Repository paths are strict canonical NFC UTF-8, `/`-separated, relative paths:
|
|
338
360
|
no empty, dot, parent, absolute, drive/UNC, backslash, surrounding whitespace,
|
|
339
361
|
control/format/surrogate, or silently normalized forms are accepted. Glob
|
|
@@ -659,6 +681,32 @@ policy commit. Every other policy decision is a field of `.reviewsensei.yml`:
|
|
|
659
681
|
requests no Variables permission and never creates the customer-owned
|
|
660
682
|
`OLLAMA_API_KEY` secret.
|
|
661
683
|
|
|
684
|
+
Reusable-workflow callers can optionally set `with.hosted_runner` to one
|
|
685
|
+
Ubuntu-compatible Linux runner label, such as `ubicloud-standard-2` or an
|
|
686
|
+
operator-owned label. Omitted and empty inputs use `ubuntu-latest`. Labels must
|
|
687
|
+
contain 1-128 letters, digits, dots, underscores, or hyphens and start with a
|
|
688
|
+
letter or digit; JSON arrays, runner groups, spaces, and expressions are not
|
|
689
|
+
supported. The read-only bootstrap stays on `ubuntu-latest` and validates the
|
|
690
|
+
input before scheduling preflight, command, and hosted-provider jobs on that
|
|
691
|
+
runner. The local Ollama job keeps `[self-hosted, linux, x64, ollama]`; this
|
|
692
|
+
infrastructure input does not select an inference backend or grant permissions.
|
|
693
|
+
ReviewSensei's own repository workflows retain their existing runner routing.
|
|
694
|
+
|
|
695
|
+
After the public `v5` channel includes this input, an operator can opt a trusted
|
|
696
|
+
caller into Ubicloud with its existing repository variable:
|
|
697
|
+
|
|
698
|
+
```yml
|
|
699
|
+
with:
|
|
700
|
+
hosted_runner: ${{ vars.ENABLE_UBICLOUD_HOSTED == 'true' && 'ubicloud-standard-2' || 'ubuntu-latest' }}
|
|
701
|
+
# Keep the caller's existing invocation inputs and named secrets.
|
|
702
|
+
```
|
|
703
|
+
|
|
704
|
+
Do not add this argument to a caller of an older reusable workflow that does
|
|
705
|
+
not declare it: GitHub rejects unknown workflow inputs. Updating `main` alone
|
|
706
|
+
does not activate tag-pinned callers; the approved `v5` release and broker
|
|
707
|
+
workflow identity must advance together. No setup variable or credential is
|
|
708
|
+
created by this feature.
|
|
709
|
+
|
|
662
710
|
When explicitly enabled, same-repository pull requests can run automatic review
|
|
663
711
|
with either provider mode: cloud on a GitHub-hosted runner or local Ollama on
|
|
664
712
|
the labelled self-hosted runner. ReviewSensei checks out only trusted base
|
|
@@ -708,7 +756,12 @@ blocker. See
|
|
|
708
756
|
for the criteria and rollback path.
|
|
709
757
|
|
|
710
758
|
Manual review and authorized `@sensei` replies use the same selected provider
|
|
711
|
-
mode.
|
|
759
|
+
mode. Generated `github reply` commands use the same inference configuration
|
|
760
|
+
and CLI overrides as normal reviews, including `cloud-ollama` and
|
|
761
|
+
`local-ollama`. Run from the trusted policy checkout or pass `--config` with
|
|
762
|
+
its trusted configuration. A local backend receives no ambient cloud key;
|
|
763
|
+
an explicitly named `--api-key-env` remains an operator opt-in.
|
|
764
|
+
Each authorized mention receives a temporary 👀 reaction while the reply
|
|
712
765
|
is generated; ReviewSensei removes it after the reply or another terminal
|
|
713
766
|
outcome. Follow-up mentions in the same inline or PR conversation include the
|
|
714
767
|
bounded prior thread, diff context, findings, and trusted-base learnings. Cloud
|
|
@@ -79,6 +79,10 @@ docs/adr/0056-host-fact-placement-and-honest-approval-presentation.md
|
|
|
79
79
|
docs/adr/0056-remove-pr-wide-review-count-caps.md
|
|
80
80
|
docs/adr/0057-one-check-run-as-the-single-merge-authority.md
|
|
81
81
|
docs/adr/0058-budgeted-document-context.md
|
|
82
|
+
docs/adr/0059-dependency-review-and-partial-publication.md
|
|
83
|
+
docs/adr/0060-stale-baseline-full-review-recovery.md
|
|
84
|
+
docs/adr/0061-human-reply-reassessment.md
|
|
85
|
+
docs/adr/0062-optional-hosted-runner-label.md
|
|
82
86
|
docs/adr/README.md
|
|
83
87
|
docs/architecture/index.md
|
|
84
88
|
docs/process/adr-process.md
|
|
@@ -137,6 +141,7 @@ examples/stages/03-learning-proposals.json
|
|
|
137
141
|
src/review_sensei/__init__.py
|
|
138
142
|
src/review_sensei/__main__.py
|
|
139
143
|
src/review_sensei/baseline.py
|
|
144
|
+
src/review_sensei/broker_diagnostics.py
|
|
140
145
|
src/review_sensei/cli.py
|
|
141
146
|
src/review_sensei/concurrency.py
|
|
142
147
|
src/review_sensei/configuration.py
|
|
@@ -144,6 +149,7 @@ src/review_sensei/context.py
|
|
|
144
149
|
src/review_sensei/convergence.py
|
|
145
150
|
src/review_sensei/conversation.py
|
|
146
151
|
src/review_sensei/coverage.py
|
|
152
|
+
src/review_sensei/dependencies.py
|
|
147
153
|
src/review_sensei/diagnostics.py
|
|
148
154
|
src/review_sensei/diff.py
|
|
149
155
|
src/review_sensei/disposition.py
|
|
@@ -151,6 +157,7 @@ src/review_sensei/document_context.py
|
|
|
151
157
|
src/review_sensei/errors.py
|
|
152
158
|
src/review_sensei/evaluation.py
|
|
153
159
|
src/review_sensei/hosted.py
|
|
160
|
+
src/review_sensei/human_assessment.py
|
|
154
161
|
src/review_sensei/learnings.py
|
|
155
162
|
src/review_sensei/models.py
|
|
156
163
|
src/review_sensei/openrouter_qualification.py
|
|
@@ -187,6 +194,7 @@ src/review_sensei/hosting/github/checks.py
|
|
|
187
194
|
src/review_sensei/hosting/github/conversation.py
|
|
188
195
|
src/review_sensei/hosting/github/errors.py
|
|
189
196
|
src/review_sensei/hosting/github/http.py
|
|
197
|
+
src/review_sensei/hosting/github/human_assessment.py
|
|
190
198
|
src/review_sensei/hosting/github/jwt.py
|
|
191
199
|
src/review_sensei/hosting/github/learning_pr.py
|
|
192
200
|
src/review_sensei/hosting/github/observed.py
|
|
@@ -212,6 +220,7 @@ src/review_sensei/providers/registry.py
|
|
|
212
220
|
src/review_sensei/providers/routing.py
|
|
213
221
|
src/review_sensei/providers/transport.py
|
|
214
222
|
src/review_sensei/schemas/blocker-admission.schema.json
|
|
223
|
+
src/review_sensei/schemas/broker-diagnostics.json
|
|
215
224
|
src/review_sensei/schemas/canary-binding.schema.json
|
|
216
225
|
src/review_sensei/schemas/candidate-finding.schema.json
|
|
217
226
|
src/review_sensei/schemas/channel-promotion.schema.json
|
package/bin/review-sensei
CHANGED
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@reviewsensei/cli-linux-x64-gnu",
|
|
3
|
-
"version": "0.6.
|
|
4
|
-
"description": "ReviewSensei
|
|
3
|
+
"version": "0.6.15",
|
|
4
|
+
"description": "ReviewSensei AI code review engine for Linux x64 with glibc 2.36+; native payload used by @reviewsensei/cli",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|