fix(review): expose coverage summary list read-only

[seonghobae]

원인

중앙 OpenCode 실행 30443337486은 ContextualWisdomLab/naruon#1179@c705f89에서 pnpm offline 설치와 프런트엔드 394개 테스트를 모두 통과했지만, changed-source coverage gate에 전달한 /tmp/javascript-coverage-summaries.*를 읽지 못했습니다.

mktemp가 root 소유 mode 0600 파일을 만들고, 실제 coverage gate는 UID 65532의 비권한 sandbox 프로세스로 실행되기 때문에 Permission denied가 발생했습니다.

변경

• coverage summary 목록을 완성한 뒤 mode 0444로 고정합니다.
• sandbox 사용자는 목록을 읽을 수 있지만 수정할 수 없습니다.
• Python/Bash 계약 테스트는 check_javascript_coverage_thresholds() 내부에서 find, chmod, --summary-list 순서를 검증합니다.

current-HEAD 검증

• head 320464674165c6287c418445d296da06a29a4679, base 66b073b80903e51873f7f861200af251177b7fb8
• python3 -m pytest -q tests/test_opencode_agent_contract.py — 37 passed
• python3 -m pytest -q — 674 passed
• scripts/ci/test_strix_quick_gate.sh — 242 scenarios PASS
• Ruff, actionlint -shellcheck=, YAML parse, Bash syntax, git diff --check — PASS
• mode 0444 생성·비권한 읽기 증거 — PASS
• hosted rollup: 29 success, 3 neutral, 14 skipped, pending 0
• CodeQL/Semgrep/Bandit/gitleaks/OSV/dependency-review/trivy-fs/Strix 및 coverage-evidence — PASS
• open Code Scanning: Scorecard low #14만 존재; Medium/High/Critical Dependabot 0; secret-scanning 0
• review threads 0, pagination 잔여 0; CodeRabbit current-head incremental review에서 actionable comment 0

별도 중앙 dispatch 30446303444는 이 PR의 핵심인 coverage-evidence를 PASS로 확인했습니다. 이후 anonymous Zen 모델이 top-level control JSON을 내지 않아 strict normalizer가 안전하게 거부했고 opencode-review commit status만 FAILURE가 되었습니다. 이는 coverage 수정의 소스 결함이 아니며, provider-native JSON 강제 후속은 #649에서 current-head 검증 중입니다.

Unblocks ContextualWisdomLab/naruon#1179

[coderabbitai]

📝 Walkthrough

Walkthrough

JavaScript/TypeScript coverage evidence 단계에서 summary_list 생성 후 0444 읽기 전용 권한을 적용하고, 관련 셸 및 Python 계약 테스트가 권한 설정과 실행 순서를 검증합니다.

Changes

Coverage summary 권한 처리

Layer / File(s)	Summary
summary_list 읽기 전용 처리 및 검증 .github/workflows/..., scripts/ci/test_strix_quick_gate.sh, tests/test_opencode_agent_contract.py	Coverage 측정 단계가 summary_list에 chmod 0444를 적용하도록 변경되었으며, 테스트가 파일 생성, 권한 설정, --summary-list 사용 순서를 확인합니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• ContextualWisdomLab/.github#635: 동일한 워크플로우의 coverage evidence 격리 및 비권한 실행 경계를 변경합니다.
• ContextualWisdomLab/.github#639: 동일한 Python 계약 테스트에서 coverage evidence materialization 검증을 변경합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	커버리지 summary list를 읽기 전용으로 노출하도록 하는 핵심 변경을 정확히 요약합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-coverage-summary-list-permissions

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

tests/test_opencode_agent_contract.py (1)

400-403: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

계약 테스트의 범위를 JavaScript coverage helper로 좁혀 주세요.

현재 전체 measure_step에서 chmod가 --summary-list보다 앞서는지만 확인하므로, chmod가 check_javascript_coverage_thresholds() 밖으로 이동해도 테스트가 통과할 수 있습니다. find ... >"$summary_list" 완료 후 chmod 0444, 이후 --summary-list 순서를 같은 함수 블록에서 검증해 주세요.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_opencode_agent_contract.py` around lines 400 - 403, Update the
contract assertions in the test around measure_step to isolate the
check_javascript_coverage_thresholds() function block rather than inspecting the
entire measure_step. Within that block, verify that find ... >"$summary_list"
completes before chmod 0444 "$summary_list", and that chmod occurs before
--summary-list "$summary_list".

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/test_opencode_agent_contract.py`:
- Around line 400-403: Update the contract assertions in the test around
measure_step to isolate the check_javascript_coverage_thresholds() function
block rather than inspecting the entire measure_step. Within that block, verify
that find ... >"$summary_list" completes before chmod 0444 "$summary_list", and
that chmod occurs before --summary-list "$summary_list".

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3bd1c2d8-42ac-4cef-b9fc-104e8128f4f8

📥 Commits

Reviewing files that changed from the base of the PR and between 213bef2 and 9005d63.

📒 Files selected for processing (3)

• .github/workflows/opencode-review-dispatch.yml
• scripts/ci/test_strix_quick_gate.sh
• tests/test_opencode_agent_contract.py

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.