@reviewsensei/cli-linux-x64-gnu 0.6.13 → 0.6.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/bin/_internal/base_library.zip +0 -0
- package/bin/_internal/review_sensei/schemas/broker-diagnostics.json +412 -0
- package/bin/_internal/review_sensei/schemas/session-record.schema.json +19 -0
- package/bin/_internal/review_sensei.egg-info/PKG-INFO +45 -8
- package/bin/_internal/review_sensei.egg-info/SOURCES.txt +13 -0
- package/bin/review-sensei +0 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -7,7 +7,7 @@ standalone Python engine bundled for Linux x64 with glibc 2.36+.
|
|
|
7
7
|
Install the public launcher, which selects the matching native package:
|
|
8
8
|
|
|
9
9
|
```console
|
|
10
|
-
npm install --save-dev @reviewsensei/cli@0.6.
|
|
10
|
+
npm install --save-dev @reviewsensei/cli@0.6.16
|
|
11
11
|
npx review-sensei --help
|
|
12
12
|
```
|
|
13
13
|
|
|
Binary file
|
|
@@ -0,0 +1,412 @@
|
|
|
1
|
+
{
|
|
2
|
+
"broker_capability_invalid": {
|
|
3
|
+
"stage": "request_validation",
|
|
4
|
+
"action": "check_request",
|
|
5
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
6
|
+
},
|
|
7
|
+
"broker_content_length_required": {
|
|
8
|
+
"stage": "request_validation",
|
|
9
|
+
"action": "check_request",
|
|
10
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
11
|
+
},
|
|
12
|
+
"broker_cors_not_supported": {
|
|
13
|
+
"stage": "request_validation",
|
|
14
|
+
"action": "check_request",
|
|
15
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
16
|
+
},
|
|
17
|
+
"broker_event_rejected": {
|
|
18
|
+
"stage": "workflow_identity",
|
|
19
|
+
"action": "check_workflow",
|
|
20
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
21
|
+
},
|
|
22
|
+
"broker_installation_unavailable": {
|
|
23
|
+
"stage": "repository_installation",
|
|
24
|
+
"action": "check_installation",
|
|
25
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
26
|
+
},
|
|
27
|
+
"broker_invalid_request": {
|
|
28
|
+
"stage": "request_validation",
|
|
29
|
+
"action": "check_request",
|
|
30
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
31
|
+
},
|
|
32
|
+
"broker_ledger_invalid": {
|
|
33
|
+
"stage": "broker_ledger",
|
|
34
|
+
"action": "contact_operator",
|
|
35
|
+
"hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
|
|
36
|
+
},
|
|
37
|
+
"broker_ledger_unavailable": {
|
|
38
|
+
"stage": "broker_ledger",
|
|
39
|
+
"action": "contact_operator",
|
|
40
|
+
"hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
|
|
41
|
+
},
|
|
42
|
+
"broker_payload_too_large": {
|
|
43
|
+
"stage": "request_validation",
|
|
44
|
+
"action": "check_request",
|
|
45
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
46
|
+
},
|
|
47
|
+
"broker_rate_limited": {
|
|
48
|
+
"stage": "broker_admission",
|
|
49
|
+
"action": "retry_later",
|
|
50
|
+
"hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
|
|
51
|
+
},
|
|
52
|
+
"broker_replay": {
|
|
53
|
+
"stage": "broker_admission",
|
|
54
|
+
"action": "retry_later",
|
|
55
|
+
"hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
|
|
56
|
+
},
|
|
57
|
+
"broker_repository_rejected": {
|
|
58
|
+
"stage": "repository_installation",
|
|
59
|
+
"action": "check_installation",
|
|
60
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
61
|
+
},
|
|
62
|
+
"broker_request_invalid": {
|
|
63
|
+
"stage": "request_validation",
|
|
64
|
+
"action": "check_request",
|
|
65
|
+
"hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
|
|
66
|
+
},
|
|
67
|
+
"broker_runner_rejected": {
|
|
68
|
+
"stage": "workflow_identity",
|
|
69
|
+
"action": "check_workflow",
|
|
70
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
71
|
+
},
|
|
72
|
+
"broker_session_actor_rejected": {
|
|
73
|
+
"stage": "session_validation",
|
|
74
|
+
"action": "check_session",
|
|
75
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
76
|
+
},
|
|
77
|
+
"broker_session_attestation_invalid": {
|
|
78
|
+
"stage": "session_validation",
|
|
79
|
+
"action": "check_session",
|
|
80
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
81
|
+
},
|
|
82
|
+
"broker_session_grant_invalid": {
|
|
83
|
+
"stage": "session_validation",
|
|
84
|
+
"action": "check_session",
|
|
85
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
86
|
+
},
|
|
87
|
+
"broker_session_grant_rejected": {
|
|
88
|
+
"stage": "session_validation",
|
|
89
|
+
"action": "check_session",
|
|
90
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
91
|
+
},
|
|
92
|
+
"broker_session_head_rejected": {
|
|
93
|
+
"stage": "session_validation",
|
|
94
|
+
"action": "check_session",
|
|
95
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
96
|
+
},
|
|
97
|
+
"broker_session_invalid": {
|
|
98
|
+
"stage": "session_validation",
|
|
99
|
+
"action": "check_session",
|
|
100
|
+
"hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
|
|
101
|
+
},
|
|
102
|
+
"broker_unknown": {
|
|
103
|
+
"stage": "broker",
|
|
104
|
+
"action": "contact_operator",
|
|
105
|
+
"hint": "The broker supplied no recognized reason. Use the correlation ID and run time to inspect broker logs; do not infer a cause."
|
|
106
|
+
},
|
|
107
|
+
"broker_workflow_rejected": {
|
|
108
|
+
"stage": "workflow_identity",
|
|
109
|
+
"action": "check_workflow",
|
|
110
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
111
|
+
},
|
|
112
|
+
"github_api_url_invalid": {
|
|
113
|
+
"stage": "broker_configuration",
|
|
114
|
+
"action": "contact_operator",
|
|
115
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
116
|
+
},
|
|
117
|
+
"github_app_id_invalid": {
|
|
118
|
+
"stage": "broker_configuration",
|
|
119
|
+
"action": "contact_operator",
|
|
120
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
121
|
+
},
|
|
122
|
+
"github_app_key_invalid": {
|
|
123
|
+
"stage": "broker_configuration",
|
|
124
|
+
"action": "contact_operator",
|
|
125
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
126
|
+
},
|
|
127
|
+
"github_capability_issue_failed": {
|
|
128
|
+
"stage": "capability_issuance",
|
|
129
|
+
"action": "contact_operator",
|
|
130
|
+
"hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
|
|
131
|
+
},
|
|
132
|
+
"github_capability_permissions_invalid": {
|
|
133
|
+
"stage": "capability_issuance",
|
|
134
|
+
"action": "contact_operator",
|
|
135
|
+
"hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
|
|
136
|
+
},
|
|
137
|
+
"github_capability_response_invalid": {
|
|
138
|
+
"stage": "capability_issuance",
|
|
139
|
+
"action": "contact_operator",
|
|
140
|
+
"hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
|
|
141
|
+
},
|
|
142
|
+
"github_installation_invalid": {
|
|
143
|
+
"stage": "repository_installation",
|
|
144
|
+
"action": "check_installation",
|
|
145
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
146
|
+
},
|
|
147
|
+
"github_installation_lookup_failed": {
|
|
148
|
+
"stage": "repository_installation",
|
|
149
|
+
"action": "check_installation",
|
|
150
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
151
|
+
},
|
|
152
|
+
"github_installation_permissions_invalid": {
|
|
153
|
+
"stage": "repository_installation",
|
|
154
|
+
"action": "check_installation",
|
|
155
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
156
|
+
},
|
|
157
|
+
"github_installation_repositories_failed": {
|
|
158
|
+
"stage": "repository_installation",
|
|
159
|
+
"action": "check_installation",
|
|
160
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
161
|
+
},
|
|
162
|
+
"github_installation_repositories_invalid": {
|
|
163
|
+
"stage": "repository_installation",
|
|
164
|
+
"action": "check_installation",
|
|
165
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
166
|
+
},
|
|
167
|
+
"github_installation_repositories_limit": {
|
|
168
|
+
"stage": "repository_installation",
|
|
169
|
+
"action": "check_installation",
|
|
170
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
171
|
+
},
|
|
172
|
+
"github_installation_repository_invalid": {
|
|
173
|
+
"stage": "repository_installation",
|
|
174
|
+
"action": "check_installation",
|
|
175
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
176
|
+
},
|
|
177
|
+
"github_installation_token_failed": {
|
|
178
|
+
"stage": "repository_installation",
|
|
179
|
+
"action": "check_installation",
|
|
180
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
181
|
+
},
|
|
182
|
+
"github_installation_token_invalid": {
|
|
183
|
+
"stage": "repository_installation",
|
|
184
|
+
"action": "check_installation",
|
|
185
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
186
|
+
},
|
|
187
|
+
"github_issue_comment_forbidden": {
|
|
188
|
+
"stage": "repository_installation",
|
|
189
|
+
"action": "check_installation",
|
|
190
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
191
|
+
},
|
|
192
|
+
"github_issue_comment_invalid": {
|
|
193
|
+
"stage": "repository_installation",
|
|
194
|
+
"action": "check_installation",
|
|
195
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
196
|
+
},
|
|
197
|
+
"github_issue_comment_lookup_failed": {
|
|
198
|
+
"stage": "repository_installation",
|
|
199
|
+
"action": "check_installation",
|
|
200
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
201
|
+
},
|
|
202
|
+
"github_issue_comment_response_invalid": {
|
|
203
|
+
"stage": "repository_installation",
|
|
204
|
+
"action": "check_installation",
|
|
205
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
206
|
+
},
|
|
207
|
+
"github_path_invalid": {
|
|
208
|
+
"stage": "broker_configuration",
|
|
209
|
+
"action": "contact_operator",
|
|
210
|
+
"hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
|
|
211
|
+
},
|
|
212
|
+
"github_pull_request_forbidden": {
|
|
213
|
+
"stage": "repository_installation",
|
|
214
|
+
"action": "check_installation",
|
|
215
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
216
|
+
},
|
|
217
|
+
"github_pull_request_invalid": {
|
|
218
|
+
"stage": "repository_installation",
|
|
219
|
+
"action": "check_installation",
|
|
220
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
221
|
+
},
|
|
222
|
+
"github_pull_request_lookup_failed": {
|
|
223
|
+
"stage": "repository_installation",
|
|
224
|
+
"action": "check_installation",
|
|
225
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
226
|
+
},
|
|
227
|
+
"github_pull_request_response_invalid": {
|
|
228
|
+
"stage": "repository_installation",
|
|
229
|
+
"action": "check_installation",
|
|
230
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
231
|
+
},
|
|
232
|
+
"github_repository_invalid": {
|
|
233
|
+
"stage": "repository_installation",
|
|
234
|
+
"action": "check_installation",
|
|
235
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
236
|
+
},
|
|
237
|
+
"github_repository_lookup_failed": {
|
|
238
|
+
"stage": "repository_installation",
|
|
239
|
+
"action": "check_installation",
|
|
240
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
241
|
+
},
|
|
242
|
+
"github_repository_response_invalid": {
|
|
243
|
+
"stage": "repository_installation",
|
|
244
|
+
"action": "check_installation",
|
|
245
|
+
"hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
|
|
246
|
+
},
|
|
247
|
+
"github_response_invalid": {
|
|
248
|
+
"stage": "github_api",
|
|
249
|
+
"action": "contact_operator",
|
|
250
|
+
"hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
|
|
251
|
+
},
|
|
252
|
+
"github_response_too_large": {
|
|
253
|
+
"stage": "github_api",
|
|
254
|
+
"action": "contact_operator",
|
|
255
|
+
"hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
|
|
256
|
+
},
|
|
257
|
+
"github_workflow_tag_invalid": {
|
|
258
|
+
"stage": "workflow_identity",
|
|
259
|
+
"action": "check_workflow",
|
|
260
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
261
|
+
},
|
|
262
|
+
"github_workflow_tag_unavailable": {
|
|
263
|
+
"stage": "workflow_identity",
|
|
264
|
+
"action": "check_workflow",
|
|
265
|
+
"hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
|
|
266
|
+
},
|
|
267
|
+
"oidc_actor_invalid": {
|
|
268
|
+
"stage": "oidc_validation",
|
|
269
|
+
"action": "check_workflow",
|
|
270
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
271
|
+
},
|
|
272
|
+
"oidc_audience_invalid": {
|
|
273
|
+
"stage": "oidc_validation",
|
|
274
|
+
"action": "check_workflow",
|
|
275
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
276
|
+
},
|
|
277
|
+
"oidc_claims_invalid": {
|
|
278
|
+
"stage": "oidc_validation",
|
|
279
|
+
"action": "check_workflow",
|
|
280
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
281
|
+
},
|
|
282
|
+
"oidc_event_invalid": {
|
|
283
|
+
"stage": "oidc_validation",
|
|
284
|
+
"action": "check_workflow",
|
|
285
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
286
|
+
},
|
|
287
|
+
"oidc_header_invalid": {
|
|
288
|
+
"stage": "oidc_validation",
|
|
289
|
+
"action": "check_workflow",
|
|
290
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
291
|
+
},
|
|
292
|
+
"oidc_identity_invalid": {
|
|
293
|
+
"stage": "oidc_validation",
|
|
294
|
+
"action": "check_workflow",
|
|
295
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
296
|
+
},
|
|
297
|
+
"oidc_issuer_invalid": {
|
|
298
|
+
"stage": "oidc_validation",
|
|
299
|
+
"action": "check_workflow",
|
|
300
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
301
|
+
},
|
|
302
|
+
"oidc_job_workflow_ref_invalid": {
|
|
303
|
+
"stage": "oidc_validation",
|
|
304
|
+
"action": "check_workflow",
|
|
305
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
306
|
+
},
|
|
307
|
+
"oidc_job_workflow_sha_invalid": {
|
|
308
|
+
"stage": "oidc_validation",
|
|
309
|
+
"action": "check_workflow",
|
|
310
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
311
|
+
},
|
|
312
|
+
"oidc_jti_invalid": {
|
|
313
|
+
"stage": "oidc_validation",
|
|
314
|
+
"action": "check_workflow",
|
|
315
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
316
|
+
},
|
|
317
|
+
"oidc_jwks_invalid": {
|
|
318
|
+
"stage": "oidc_validation",
|
|
319
|
+
"action": "retry_later",
|
|
320
|
+
"hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
|
|
321
|
+
},
|
|
322
|
+
"oidc_jwks_too_large": {
|
|
323
|
+
"stage": "oidc_validation",
|
|
324
|
+
"action": "retry_later",
|
|
325
|
+
"hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
|
|
326
|
+
},
|
|
327
|
+
"oidc_jwks_unavailable": {
|
|
328
|
+
"stage": "oidc_validation",
|
|
329
|
+
"action": "retry_later",
|
|
330
|
+
"hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
|
|
331
|
+
},
|
|
332
|
+
"oidc_key_not_found": {
|
|
333
|
+
"stage": "oidc_validation",
|
|
334
|
+
"action": "check_workflow",
|
|
335
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
336
|
+
},
|
|
337
|
+
"oidc_ref_invalid": {
|
|
338
|
+
"stage": "oidc_validation",
|
|
339
|
+
"action": "check_workflow",
|
|
340
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
341
|
+
},
|
|
342
|
+
"oidc_repository_invalid": {
|
|
343
|
+
"stage": "oidc_validation",
|
|
344
|
+
"action": "check_workflow",
|
|
345
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
346
|
+
},
|
|
347
|
+
"oidc_repository_owner_invalid": {
|
|
348
|
+
"stage": "oidc_validation",
|
|
349
|
+
"action": "check_workflow",
|
|
350
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
351
|
+
},
|
|
352
|
+
"oidc_run_attempt_invalid": {
|
|
353
|
+
"stage": "oidc_validation",
|
|
354
|
+
"action": "check_workflow",
|
|
355
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
356
|
+
},
|
|
357
|
+
"oidc_run_id_invalid": {
|
|
358
|
+
"stage": "oidc_validation",
|
|
359
|
+
"action": "check_workflow",
|
|
360
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
361
|
+
},
|
|
362
|
+
"oidc_run_number_invalid": {
|
|
363
|
+
"stage": "oidc_validation",
|
|
364
|
+
"action": "check_workflow",
|
|
365
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
366
|
+
},
|
|
367
|
+
"oidc_runner_environment_invalid": {
|
|
368
|
+
"stage": "oidc_validation",
|
|
369
|
+
"action": "check_workflow",
|
|
370
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
371
|
+
},
|
|
372
|
+
"oidc_sha_invalid": {
|
|
373
|
+
"stage": "oidc_validation",
|
|
374
|
+
"action": "check_workflow",
|
|
375
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
376
|
+
},
|
|
377
|
+
"oidc_signature_invalid": {
|
|
378
|
+
"stage": "oidc_validation",
|
|
379
|
+
"action": "check_workflow",
|
|
380
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
381
|
+
},
|
|
382
|
+
"oidc_subject_invalid": {
|
|
383
|
+
"stage": "oidc_validation",
|
|
384
|
+
"action": "check_workflow",
|
|
385
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
386
|
+
},
|
|
387
|
+
"oidc_time_invalid": {
|
|
388
|
+
"stage": "oidc_validation",
|
|
389
|
+
"action": "check_workflow",
|
|
390
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
391
|
+
},
|
|
392
|
+
"oidc_token_invalid": {
|
|
393
|
+
"stage": "oidc_validation",
|
|
394
|
+
"action": "check_workflow",
|
|
395
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
396
|
+
},
|
|
397
|
+
"oidc_workflow_invalid": {
|
|
398
|
+
"stage": "oidc_validation",
|
|
399
|
+
"action": "check_workflow",
|
|
400
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
401
|
+
},
|
|
402
|
+
"oidc_workflow_ref_invalid": {
|
|
403
|
+
"stage": "oidc_validation",
|
|
404
|
+
"action": "check_workflow",
|
|
405
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
406
|
+
},
|
|
407
|
+
"oidc_workflow_sha_invalid": {
|
|
408
|
+
"stage": "oidc_validation",
|
|
409
|
+
"action": "check_workflow",
|
|
410
|
+
"hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
|
|
411
|
+
}
|
|
412
|
+
}
|
|
@@ -41,6 +41,16 @@
|
|
|
41
41
|
{"type": "string", "pattern": "^[a-f0-9]{8,64}$"}
|
|
42
42
|
]
|
|
43
43
|
},
|
|
44
|
+
"reservation_owner": {
|
|
45
|
+
"description": "Owning run from the authenticated OIDC broker; absent in legacy reservations.",
|
|
46
|
+
"type": "object",
|
|
47
|
+
"additionalProperties": false,
|
|
48
|
+
"required": ["run_id", "head_sha"],
|
|
49
|
+
"properties": {
|
|
50
|
+
"run_id": {"type": "string", "pattern": "^[1-9][0-9]{0,18}$"},
|
|
51
|
+
"head_sha": {"type": "string", "pattern": "^[a-f0-9]{40}$"}
|
|
52
|
+
}
|
|
53
|
+
},
|
|
44
54
|
"reserved_slot": {
|
|
45
55
|
"type": ["string", "null"],
|
|
46
56
|
"enum": ["initial", "verification", "failed-attempt", null]
|
|
@@ -233,6 +243,15 @@
|
|
|
233
243
|
}
|
|
234
244
|
},
|
|
235
245
|
"allOf": [
|
|
246
|
+
{
|
|
247
|
+
"if": {"required": ["reservation_owner"]},
|
|
248
|
+
"then": {
|
|
249
|
+
"properties": {
|
|
250
|
+
"reservation_id": {"type": "string"},
|
|
251
|
+
"reserved_slot": {"type": "string"}
|
|
252
|
+
}
|
|
253
|
+
}
|
|
254
|
+
},
|
|
236
255
|
{
|
|
237
256
|
"if": {
|
|
238
257
|
"required": ["transaction"],
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: review-sensei
|
|
3
|
-
Version: 0.6.
|
|
3
|
+
Version: 0.6.16
|
|
4
4
|
Summary: Provider-neutral AI code review engine with an Ollama adapter.
|
|
5
5
|
Author: Mohamad Alsabbagh
|
|
6
6
|
License-Expression: MIT
|
|
@@ -136,8 +136,8 @@ Node.js 22 or newer can invoke the same Python review engine through the
|
|
|
136
136
|
provider-neutral `@reviewsensei/cli` launcher:
|
|
137
137
|
|
|
138
138
|
```bash
|
|
139
|
-
npx --yes @reviewsensei/cli@0.6.
|
|
140
|
-
npx --yes @reviewsensei/cli@0.6.
|
|
139
|
+
npx --yes @reviewsensei/cli@0.6.16 --version
|
|
140
|
+
npx --yes @reviewsensei/cli@0.6.16 --help
|
|
141
141
|
```
|
|
142
142
|
|
|
143
143
|
The launcher selects one of the five native packages (macOS arm64/x64,
|
|
@@ -240,7 +240,7 @@ broker resolves the same tag at capability exchange time and checks the
|
|
|
240
240
|
executing workflow SHA. Moving `v5` is therefore the public cutoff action.
|
|
241
241
|
The selected provider mode applies consistently to automatic pull-request
|
|
242
242
|
reviews, manual reviews, learning proposals, artifacts, and authorized
|
|
243
|
-
`@
|
|
243
|
+
`@reviewsensei` conversations. Cloud runs use GitHub-hosted compute; local runs use
|
|
244
244
|
the operator-controlled labeled self-hosted runner. Every generated write
|
|
245
245
|
switch except automatic approval defaults to `false`; automatic approval
|
|
246
246
|
defaults to `true` and requires automatic review and GitHub writes as separate
|
|
@@ -681,6 +681,32 @@ policy commit. Every other policy decision is a field of `.reviewsensei.yml`:
|
|
|
681
681
|
requests no Variables permission and never creates the customer-owned
|
|
682
682
|
`OLLAMA_API_KEY` secret.
|
|
683
683
|
|
|
684
|
+
Reusable-workflow callers can optionally set `with.hosted_runner` to one
|
|
685
|
+
Ubuntu-compatible Linux runner label, such as `ubicloud-standard-2` or an
|
|
686
|
+
operator-owned label. Omitted and empty inputs use `ubuntu-latest`. Labels must
|
|
687
|
+
contain 1-128 letters, digits, dots, underscores, or hyphens and start with a
|
|
688
|
+
letter or digit; JSON arrays, runner groups, spaces, and expressions are not
|
|
689
|
+
supported. The read-only bootstrap stays on `ubuntu-latest` and validates the
|
|
690
|
+
input before scheduling preflight, command, and hosted-provider jobs on that
|
|
691
|
+
runner. The local Ollama job keeps `[self-hosted, linux, x64, ollama]`; this
|
|
692
|
+
infrastructure input does not select an inference backend or grant permissions.
|
|
693
|
+
ReviewSensei's own repository workflows retain their existing runner routing.
|
|
694
|
+
|
|
695
|
+
After the public `v5` channel includes this input, an operator can opt a trusted
|
|
696
|
+
caller into Ubicloud with its existing repository variable:
|
|
697
|
+
|
|
698
|
+
```yml
|
|
699
|
+
with:
|
|
700
|
+
hosted_runner: ${{ vars.ENABLE_UBICLOUD_HOSTED == 'true' && 'ubicloud-standard-2' || 'ubuntu-latest' }}
|
|
701
|
+
# Keep the caller's existing invocation inputs and named secrets.
|
|
702
|
+
```
|
|
703
|
+
|
|
704
|
+
Do not add this argument to a caller of an older reusable workflow that does
|
|
705
|
+
not declare it: GitHub rejects unknown workflow inputs. Updating `main` alone
|
|
706
|
+
does not activate tag-pinned callers; the approved `v5` release and broker
|
|
707
|
+
workflow identity must advance together. No setup variable or credential is
|
|
708
|
+
created by this feature.
|
|
709
|
+
|
|
684
710
|
When explicitly enabled, same-repository pull requests can run automatic review
|
|
685
711
|
with either provider mode: cloud on a GitHub-hosted runner or local Ollama on
|
|
686
712
|
the labelled self-hosted runner. ReviewSensei checks out only trusted base
|
|
@@ -717,7 +743,7 @@ approval. An unclassified ReviewSensei root, malformed or incomplete thread
|
|
|
717
743
|
data, an unverified configuration, or a draft/closed/fork/stale/App-authored PR
|
|
718
744
|
fails closed or reports why approval was withheld. The finalizer runs after
|
|
719
745
|
review publication and after the AI resolves a blocking ReviewSensei thread;
|
|
720
|
-
`@
|
|
746
|
+
`@reviewsensei` replies themselves remain ordinary comments. Existing approval markers
|
|
721
747
|
prevent duplicate approvals, and ReviewSensei never calls a merge endpoint or
|
|
722
748
|
enables auto-merge.
|
|
723
749
|
|
|
@@ -729,14 +755,25 @@ blocker. See
|
|
|
729
755
|
[ADR 0032](docs/adr/0032-blocking-finding-classification-for-approvals.md)
|
|
730
756
|
for the criteria and rollback path.
|
|
731
757
|
|
|
732
|
-
Manual review and authorized `@
|
|
733
|
-
mode.
|
|
758
|
+
Manual review and authorized `@reviewsensei` replies use the same selected provider
|
|
759
|
+
mode. Generated `github reply` commands use the same inference configuration
|
|
760
|
+
and CLI overrides as normal reviews, including `cloud-ollama` and
|
|
761
|
+
`local-ollama`. Run from the trusted policy checkout or pass `--config` with
|
|
762
|
+
its trusted configuration. A local backend receives no ambient cloud key;
|
|
763
|
+
an explicitly named `--api-key-env` remains an operator opt-in.
|
|
764
|
+
The canonical handle is `@reviewsensei`; `@ReviewSensei` and other ASCII case
|
|
765
|
+
variants work too. `@sensei` remains supported, with its existing case behavior.
|
|
766
|
+
Both handles use the same authorization, publication policy, and bounded context.
|
|
767
|
+
Existing installations need a caller update as well as the matching runtime and
|
|
768
|
+
broker update; see [the caller rollout guide](docs/mention-handle-rollout.md).
|
|
769
|
+
|
|
770
|
+
Each authorized mention receives a temporary 👀 reaction while the reply
|
|
734
771
|
is generated; ReviewSensei removes it after the reply or another terminal
|
|
735
772
|
outcome. Follow-up mentions in the same inline or PR conversation include the
|
|
736
773
|
bounded prior thread, diff context, findings, and trusted-base learnings. Cloud
|
|
737
774
|
mode sends that bounded conversation context to Ollama Cloud; local mode keeps
|
|
738
775
|
it on the configured local service. Published review summaries and inline
|
|
739
|
-
findings also tell readers to reply with @
|
|
776
|
+
findings also tell readers to reply with @reviewsensei followed by their question.
|
|
740
777
|
`review.json` is uploaded only when
|
|
741
778
|
`github.artifacts: diagnostics` is set in `.reviewsensei.yml`; setup-v5 does not
|
|
742
779
|
create a separate version artifact. See
|
|
@@ -16,6 +16,7 @@ docs/evaluation.md
|
|
|
16
16
|
docs/github-app-auth.md
|
|
17
17
|
docs/github-app-registration.md
|
|
18
18
|
docs/installation.md
|
|
19
|
+
docs/mention-handle-rollout.md
|
|
19
20
|
docs/openrouter-qualification.md
|
|
20
21
|
docs/ownership-and-licensing.md
|
|
21
22
|
docs/patch-suggestions.md
|
|
@@ -80,6 +81,12 @@ docs/adr/0056-remove-pr-wide-review-count-caps.md
|
|
|
80
81
|
docs/adr/0057-one-check-run-as-the-single-merge-authority.md
|
|
81
82
|
docs/adr/0058-budgeted-document-context.md
|
|
82
83
|
docs/adr/0059-dependency-review-and-partial-publication.md
|
|
84
|
+
docs/adr/0060-stale-baseline-full-review-recovery.md
|
|
85
|
+
docs/adr/0061-human-reply-reassessment.md
|
|
86
|
+
docs/adr/0062-optional-hosted-runner-label.md
|
|
87
|
+
docs/adr/0063-authenticated-reservation-recovery.md
|
|
88
|
+
docs/adr/0064-canonical-mention-handle.md
|
|
89
|
+
docs/adr/0065-complete-human-inventory-and-approval-retry.md
|
|
83
90
|
docs/adr/README.md
|
|
84
91
|
docs/architecture/index.md
|
|
85
92
|
docs/process/adr-process.md
|
|
@@ -138,6 +145,7 @@ examples/stages/03-learning-proposals.json
|
|
|
138
145
|
src/review_sensei/__init__.py
|
|
139
146
|
src/review_sensei/__main__.py
|
|
140
147
|
src/review_sensei/baseline.py
|
|
148
|
+
src/review_sensei/broker_diagnostics.py
|
|
141
149
|
src/review_sensei/cli.py
|
|
142
150
|
src/review_sensei/concurrency.py
|
|
143
151
|
src/review_sensei/configuration.py
|
|
@@ -153,6 +161,7 @@ src/review_sensei/document_context.py
|
|
|
153
161
|
src/review_sensei/errors.py
|
|
154
162
|
src/review_sensei/evaluation.py
|
|
155
163
|
src/review_sensei/hosted.py
|
|
164
|
+
src/review_sensei/human_assessment.py
|
|
156
165
|
src/review_sensei/learnings.py
|
|
157
166
|
src/review_sensei/models.py
|
|
158
167
|
src/review_sensei/openrouter_qualification.py
|
|
@@ -189,11 +198,13 @@ src/review_sensei/hosting/github/checks.py
|
|
|
189
198
|
src/review_sensei/hosting/github/conversation.py
|
|
190
199
|
src/review_sensei/hosting/github/errors.py
|
|
191
200
|
src/review_sensei/hosting/github/http.py
|
|
201
|
+
src/review_sensei/hosting/github/human_assessment.py
|
|
192
202
|
src/review_sensei/hosting/github/jwt.py
|
|
193
203
|
src/review_sensei/hosting/github/learning_pr.py
|
|
194
204
|
src/review_sensei/hosting/github/observed.py
|
|
195
205
|
src/review_sensei/hosting/github/oidc.py
|
|
196
206
|
src/review_sensei/hosting/github/publication.py
|
|
207
|
+
src/review_sensei/hosting/github/reservation_recovery.py
|
|
197
208
|
src/review_sensei/hosting/github/session_ledger.py
|
|
198
209
|
src/review_sensei/hosting/github/setup.py
|
|
199
210
|
src/review_sensei/hosting/github/trigger.py
|
|
@@ -203,6 +214,7 @@ src/review_sensei/hosting/github/fixtures/historical-v4-uninstall.yml
|
|
|
203
214
|
src/review_sensei/hosting/github/fixtures/merge-focused-v4-caller.yml
|
|
204
215
|
src/review_sensei/hosting/github/fixtures/merge-focused-v4-config.yml
|
|
205
216
|
src/review_sensei/hosting/github/fixtures/released-v4-resolve-trigger-runner-switch.yml
|
|
217
|
+
src/review_sensei/hosting/github/fixtures/sensei-only-v5-caller.yml
|
|
206
218
|
src/review_sensei/providers/__init__.py
|
|
207
219
|
src/review_sensei/providers/base.py
|
|
208
220
|
src/review_sensei/providers/fixture.py
|
|
@@ -214,6 +226,7 @@ src/review_sensei/providers/registry.py
|
|
|
214
226
|
src/review_sensei/providers/routing.py
|
|
215
227
|
src/review_sensei/providers/transport.py
|
|
216
228
|
src/review_sensei/schemas/blocker-admission.schema.json
|
|
229
|
+
src/review_sensei/schemas/broker-diagnostics.json
|
|
217
230
|
src/review_sensei/schemas/canary-binding.schema.json
|
|
218
231
|
src/review_sensei/schemas/candidate-finding.schema.json
|
|
219
232
|
src/review_sensei/schemas/channel-promotion.schema.json
|
package/bin/review-sensei
CHANGED
|
Binary file
|
package/package.json
CHANGED