mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-11-13 18:03:37 +00:00
c0f277589f
On every push the reusable Action re-reviews the whole merge-base range, so later pushes on a large PR cost the same as the first one. This adds an opt-in `checkpoint_range` input that records the last completely reviewed head in the sticky summary and narrows the next run to checkpoint..head. Every gate fails closed to a full review: force-push, base change, config or rule change, incomplete prior run, or any resolver error. The config fingerprint hashes one environment variable per axis instead of a single "|"-joined string. The joined form let a value containing the separator shift the field boundaries, so `route_severity_below=low|a` with an empty `route_categories` hashed identically to `low` with `route_categories=a|` — a checkpoint surviving a config change that should have invalidated it. It also made the digest depend on how the YAML happened to be wrapped. `llm_extra_headers`, `llm_auth_header` and `llm_timeout` are axes too: extra headers can point the same `llm_model` string at a different backend model or provider, and a timeout change shifts which runs finish. Header values can be credentials, so that axis goes in as a digest rather than raw. The author check is pinned to `github-actions` when `github_token` is the default one, which always belongs to that app. Unpinned, `dependabot[bot]`, `renovate[bot]` and any linter App all read as ours. A caller-supplied token keeps the wider bot check, since an installation token cannot ask GitHub which app it is. A version `ocr version` does not print yields an empty fingerprint rather than a `spec:` fallback: `ocr_version` defaults to "latest", so the spec is a constant that distinguishes nothing. Empty matches no stored fingerprint and blocks the checkpoint write — don't narrow, don't advance. |
||
|---|---|---|
| .. | ||
| github-actions | ||
| publish | ||
| add-license.sh | ||
| install.js | ||
| platform.js | ||
| update.js | ||
| verify-action-pins.sh | ||
| verify-english-only.go | ||
| verify-license.sh | ||
| version.js | ||
| version.test.js | ||