Repository navigation
[CI] Web→Platform legal policy sync 자동화 - #10
Conversation
📝 WalkthroughWalkthrough법률 정책 변경과 수동 실행을 처리하는 workflow를 추가했다. Workflow는 immutable source, canonical manifest, SHA-256 hash, Platform legal lock을 검증한다. 조건을 충족하면 stable branch와 단일 draft PR을 동기화한다. 계약 테스트를 추가하고 CI에 연결했다. Changes법률 정책 동기화
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant WebRepository
participant GitHubActions
participant PlatformRepository
participant DraftPullRequest
WebRepository->>GitHubActions: 법률 정책 변경 또는 수동 실행
GitHubActions->>WebRepository: immutable source commit checkout
GitHubActions->>PlatformRepository: manifest 및 legal lock 검증
alt 신뢰된 sync 실행 및 변경 있음
GitHubActions->>PlatformRepository: lock commit 및 stable branch push
GitHubActions->>DraftPullRequest: draft PR 생성 또는 갱신
else main과 동일한 manifest
GitHubActions->>DraftPullRequest: stale draft PR 종료
end
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/sync-legal-policy-to-platform.yml (1)
175-187: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuechanged 판정 기준선이 실행 모드에 따라 달라진다.
write_enabled == 'true'일 때 175행 단계는 이미chore/web-policy-sync로 checkout된 작업 트리의 lock을 읽는다. test-only 실행에서는main의 lock을 읽는다. 미merge된 draft PR이 있으면 같은 Web commit에 대해 test-only는changed=true, sync는changed=false를 낸다.282행의
git diff --cached --quiet가 잘못된 push를 막으므로 차단급은 아니다. 진단 가능성을 위해 두 해시를 각각 기록하는 것을 고려한다. 예:main기준 해시와 sync branch 기준 해시를 별도 출력으로 남긴다.Also applies to: 202-219
scripts/contracts/sync-legal-policy-workflow.test.mjs (2)
12-19: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueruby 부재 시 실패 원인이 드러나지 않는다.
ruby가 없으면
spawnSync는status: null과error를 반환한다.parsed.stderr는 빈 문자열이므로 17행은 "workflow YAML must parse"만 출력한다. 개발자는 YAML 문법 오류로 오해한다.
parsed.error를 먼저 확인해 원인을 구분한다.♻️ 제안 변경
const parsed = spawnSync("ruby", ["-e", ruby, workflowPath], { encoding: "utf8" }) + assert.equal(parsed.error, undefined, `ruby is required to parse workflow YAML: ${parsed.error?.message ?? ""}`) assert.equal(parsed.status, 0, parsed.stderr || "workflow YAML must parse")
223-247: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePR 본문 문구 전체를 단정하면 유지보수 비용이 커진다.
223-247행은 PR 본문의 섹션 제목과 체크리스트 문장을 모두 고정한다. 261행은
shellcheck disable=SC2016주석의 존재를 단정한다. 문구나 주석을 바꿀 때마다 테스트가 깨진다.계약으로 지켜야 할 항목(draft 유지, source commit, manifest 해시, Promoted legal evidence 섹션)만 남기고, 나머지 문구 단정은 줄이는 것을 고려한다.
Also applies to: 261-261
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e63c83b4-31d8-4877-8431-8ca844b58bd0
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/sync-legal-policy-to-platform.ymlscripts/contracts/sync-legal-policy-workflow.test.mjs
0c06abd to
e620080
Compare
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Initial
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review limit reached
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
e620080eb68ab951b932908fd5017dc83e8165b8 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 e620080eb68ab951b932908fd5017dc83e8165b8
📜 Review details
- Actionable comments: 1
- Nitpick comments: 0
- Inline review comments posted: 1
- Highest severity: P1
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..e620080eb68ab951b932908fd5017dc83e8165b8
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review request was rate limited
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
7bb4d5af7fa3d9171b59ac166fcee2639fbcc693 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 7bb4d5af7fa3d9171b59ac166fcee2639fbcc693
📜 Review details
- Actionable comments: 2
- Nitpick comments: 0
- Inline review comments posted: 2
- Highest severity: P1
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..7bb4d5af7fa3d9171b59ac166fcee2639fbcc693
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (5)
.github/workflows/sync-legal-policy-to-platform.yml (1)
71-74: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
source_ref형식을 allow-list로 제한하십시오.현재 검증은 빈 값과 개행만 차단합니다.
-로 시작하는 값이나 공백을 포함한 값도 통과해 checkout과 하위 git 호출로 그대로 전달됩니다.sync모드는 Line 119의 ancestry 검증으로 보호되지만,test-only실행에서는 오류 원인이 불명확한 실패로 나타납니다.♻️ 형식 검증 강화 제안
- if [[ -z "${source_ref}" || "${source_ref}" == *$'\n'* || "${source_ref}" == *$'\r'* ]]; then - echo "source_ref must be one non-empty line" >&2 + if [[ ! "${source_ref}" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]*$ ]]; then + echo "source_ref must be one line of [A-Za-z0-9._/-] and must not start with '-'" >&2 exit 1 fiscripts/contracts/sync-legal-policy-workflow.test.mjs (4)
248-251: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
.yaml정책 파일을JSON.parse로 읽습니다.현재 정책 파일이 JSON 호환이라 동작합니다. 정책 파일에 YAML 고유 문법이 들어오면 이 테스트는 hash mismatch 검증 대신 파싱 예외로 실패합니다. 실패 원인이 계약과 무관해집니다. 정규 YAML 파서로 읽거나, 파싱 없이 파일 본문 문자열을 변형해 mismatch를 만드세요.
277-277: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
/PAT/패턴이 지나치게 넓습니다.이 regex는 workflow 본문의
PATH같은 정상 문자열에도 매칭됩니다. 향후 workflow가PATH를 다루면 오탐으로 실패합니다. 의도를 좁혀 토큰 secret 참조만 검사하세요. 예:/secrets\.[A-Z_]*PAT[A-Z_]*/.
428-440: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuefake
gh가 마지막 호출만 캡처합니다.스크립트는
>로 파일을 덮어씁니다. close step이gh를 두 번 이상 호출하면 첫 호출은 검증에서 사라집니다.>>로 append하고 전체 캡처를 비교하면 호출 횟수까지 고정할 수 있습니다.♻️ 호출 누적 캡처 제안
- writeFileSync(path.join(fakeBin, "gh"), "#!/usr/bin/env bash\nprintf '%s\\n' \"$*\" > \"${GH_CAPTURE}\"\n") + writeFileSync(path.join(fakeBin, "gh"), "#!/usr/bin/env bash\nprintf '%s\\n' \"$*\" >> \"${GH_CAPTURE}\"\n")
27-33: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
runShell이 step의working-directory와env를 반영하도록 동기화하세요.테스트가
checker.run,changes.run,commitStep.run에서 각각platform또는temp를 CWD로 직접 고정하고 있어working-directory/stepenv:변경 시 실제 CI 실행 컨텍스트가 달라져도 계약 테스트가 감지하지 못합니다. step 정의의working-directory와env를 실제 실행에 반영하거나, 각 step의working-directory를 assertion으로 고정하세요.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 0aad7f48-d83f-4285-9eb1-5a49308415b3
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/sync-legal-policy-to-platform.ymlscripts/contracts/sync-legal-policy-workflow.test.mjs
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/ci.yml
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review remained pending beyond the bounded attempt
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
faf492872b6485cb78b48885f8359f3393b75497 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 faf492872b6485cb78b48885f8359f3393b75497
📜 Review details
- Actionable comments: 1
- Nitpick comments: 0
- Inline review comments posted: 1
- Highest severity: P2
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..faf492872b6485cb78b48885f8359f3393b75497
26968f4 to
b774c1d
Compare
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review limit reached
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
b774c1d7ba43376db547b9ff0979149e4798f6fa - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 b774c1d7ba43376db547b9ff0979149e4798f6fa
📜 Review details
- Actionable comments: 2
- Nitpick comments: 0
- Inline review comments posted: 2
- Highest severity: P1
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..b774c1d7ba43376db547b9ff0979149e4798f6fa
ce64a48 to
dd0c7e0
Compare
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review limit reached
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
dd0c7e07e3bf1df94b86f4a458b293d59e67ef59 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 dd0c7e07e3bf1df94b86f4a458b293d59e67ef59
📜 Review details
- Actionable comments: 1
- Nitpick comments: 0
- Inline review comments posted: 1
- Highest severity: P2
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..dd0c7e07e3bf1df94b86f4a458b293d59e67ef59
6bc27c3 to
90e41a0
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/sync-legal-policy-to-platform.yml (1)
256-261: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
changed출력을 제거하거나 사용처를 명확히 하십시오.Line 257의
changed는 Line 258의main_changed와 값이 같습니다. 이후 단계는main_changed,branch_changed,sync_required만 사용합니다. 중복 출력은 조건 해석에 혼동을 만듭니다. contract test가changed를 고정하지 않는다면 제거하십시오.scripts/contracts/sync-legal-policy-workflow.test.mjs (1)
516-527: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueprovenance-only 시나리오의 change-detection assertion이 직전 블록과 완전히 동일합니다.
Line 503-514와 Line 516-527은 입력 env와 기대 output 4개가 같습니다. 유일한 fixture 차이인
sourceCommit은 이 4개 assertion에 영향을 주지 않습니다. 즉 이 블록만으로는 provenance 변경 경로를 구분해 검증하지 못합니다. 실제 구분은 Line 529-534의commitStep결과에서만 이루어집니다.중복 assertion을 줄이고, provenance 차이가 반영되는 지점(
commitStep의committed=true와 commit message 내SOURCE_SHA)을 명시적으로 검증하세요.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c700f348-1e1f-4cda-bb55-2620fb86e102
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/sync-legal-policy-to-platform.ymlscripts/contracts/sync-legal-policy-workflow.test.mjs
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/ci.yml
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review limit reached
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
90e41a0b5a9033ef385d644fde119d28dc49a8c9 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 90e41a0b5a9033ef385d644fde119d28dc49a8c9
📜 Review details
- Actionable comments: 1
- Nitpick comments: 0
- Inline review comments posted: 1
- Highest severity: P2
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..90e41a0b5a9033ef385d644fde119d28dc49a8c9
2e1edf7 to
803f5d2
Compare
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review limit reached
- Initial review: #10 (review)
- Fix commit: 2e1edf7
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
803f5d21eb0da130c7d4073d01adfeb753436c01 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 803f5d21eb0da130c7d4073d01adfeb753436c01
📜 Review details
- Initial actionable comments: 1
- Addressed comments: 1
- Rejected review candidates: 1 (
client-idis the pinned v3 input;app-idis deprecated) - New actionable comments: 0
- Inline review comments posted: 0
- Highest severity: none
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..803f5d21eb0da130c7d4073d01adfeb753436c01
✅ Verification
/usr/bin/env PATH=/opt/homebrew/opt/node@20/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin node --test scripts/contracts/sync-legal-policy-workflow.test.mjs: exit 0, 10/10 passactionlint .github/workflows/sync-legal-policy-to-platform.yml: exit 0git diff --check origin/main...HEAD: exit 0- commit hook platform contracts: exit 0, 15/15 pass
- independent full-diff review: 0 actionable findings
- pinned
actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1v3.2.0action.yml:client-idsupported;app-iddeprecated
896cd5c to
57130b6
Compare
|
AquilaXk
left a comment
AquilaXk
left a comment
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (0)
No nitpick comments.
ℹ️ Review info
- Review source: Codex CLI
- Review phase: Re-review
- Repository visibility: public
- Trigger: CodeRabbit unavailable - current-head review limit reached
- Initial review: #10 (review)
- Fix commit: 896cd5c
- Base:
596dd01387f54cf95937cf96d64c61720c01d4b4 - Head:
57130b672f59e10c26b0d76e0f0ebf78e4963058 - Command:
/Users/aquila/.codex/codex-review-isolated/run-codex-review /Volumes/MACSSD/Projects/GitProjects/aquila-blog/.worktrees/web-policy-sync-9 596dd01387f54cf95937cf96d64c61720c01d4b4 57130b672f59e10c26b0d76e0f0ebf78e4963058
📜 Review details
- Initial actionable comments: 3
- Addressed comments: 1
- Rejected comments: 2
- New actionable comments: 0
- Inline review comments posted: 0
- Highest severity: none
- Reviewed range:
596dd01387f54cf95937cf96d64c61720c01d4b4..57130b672f59e10c26b0d76e0f0ebf78e4963058
✅ Verification
/usr/bin/env PATH=/opt/homebrew/opt/node@20/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin node --test scripts/contracts/sync-legal-policy-workflow.test.mjs: exit 0, 11/11 passactionlint .github/workflows/sync-legal-policy-to-platform.yml: exit 0git diff --check origin/main...HEAD: exit 0- commit hook platform contracts: exit 0, 15/15 pass
- independent full-diff review: 0 actionable findings
- delayed CodeRabbit review triage:
ls-remoteprovider failure fixed; Ruby diagnostic and inherited-env claims rejected with inline evidence
Description
Web canonical legal policy manifest를 Platform metadata lock의 단일 draft PR로 전달하는 fail-closed workflow를 추가합니다.
main의 legal sources, canonical manifest, frontend active legal metadata 변경만 automatic triggertest-only는 App token·push·PR 없이 export/hash/import/check만 실행origin/mainancestry의 immutable commit만 허용origin/main대비 exact legal lock-only diff를 통과해야 재사용mainPR 0/1개만 reconcilepull_request_target, placeholder, reset/force push, best-effort 경로 없음Related tickets
Closes #9
Platform migration umbrella: AquilaXk/aquila-blog#1453
Verification
node --test scripts/contracts/sync-legal-policy-workflow.test.mjs— Node 20, 11/11 passactionlint .github/workflows/sync-legal-policy-to-platform.yml— passgit diff --check origin/main...HEAD— passyarn contracts:check— 15/15 pass, generated contract drift 없음596dd01387f54cf95937cf96d64c61720c01d4b4, single commit57130b672f59e10c26b0d76e0f0ebf78e496305830931459651— attempt 1/2 모두 success, 4/430931459623— attempt 1/2 모두 success, 3/330931459895— attempt 1/2 모두 success실제 cross-repository
test-only/draft PR 생성·갱신은 kill switch와 GitHub App 설정을 소유하는 Task 14에서 controlled sync로 검증합니다.Risk / rollback
57130b67을 revert합니다. alternate provider나 fallback 경로는 사용하지 않습니다.PR Checklist