[openvoiceos-bot]

Control canary. Do not merge; this pull request is closed as soon as its run is read.

It removes torchao from this repository's exclude_packages and keeps the caller on
gh-automations dev, which does not carry the central torchao entry yet. The run must
fail on the torchao row. That failure is the control for the live stage of
OpenVoiceOS/gh-automations#157: without it, a green run on the sibling canary shows
nothing, because a gate that passes before the change proves nothing.

Evidence goes to knowledge/wiki/audits/gate-ledger/live-gh-automations-157.md.

Lane: harness-d. Task: T-6919.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Tada! The results of the latest automation run are here. 🎉

I've aggregated the results of the automated checks for this PR below.

📋 Repo Health

I've checked the repo's reflexes (aka build speed). ⚡

✅ All required files present.

Latest Version: 0.2.6a11

✅ ovos_stt_plugin_nemo/version.py — Version file
✅ README.md — README
✅ LICENSE — License file
✅ pyproject.toml — pyproject.toml
⚠️ setup.py — setup.py
✅ CHANGELOG.md — Changelog
✅ ovos_stt_plugin_nemo/version.py has valid version block markers

🔍 Lint

I've finished the analysis you requested. 💡

❌ ruff: issues found in 4 file(s) — see job log
✅ actionlint: 10 workflow file(s), no finding

🔒 Security (pip-audit)

Shields up! Scanning for potential threats. 🛡️

⚠️ 9 known vulnerabilities in 5 packages (259 packages scanned). This job warns and does not fail; update the affected packages.

Package	Version	ID	Description	Fix
hydra-core	1.3.2	PYSEC-2026-3850 / CVE-2026-68508	## Summary hydra.utils.instantiate() resolves and calls Python objects from config. If an application passes untrus...	1.3.4
lightning	2.4.0	PYSEC-2026-3972 / CVE-2026-31221	PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the check...	no fix available
lightning	2.4.0	PYSEC-2026-3624 / CVE-2026-58659	PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load...	2.6.6
nltk	3.10.3	PYSEC-2026-3740 / CVE-2026-81726	### Summary Several model-artifact APIs still treat caller-controlled model paths as ordinary filenames even when NLT...	no fix available
setuptools	79.0.1	PYSEC-2026-3447 / CVE-2026-59890	setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior ...	83.0.0
torch	2.9.1	PYSEC-2026-139 / CVE-2026-4538	A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Lo...	no fix available
torch	2.9.1	PYSEC-2025-194 / CVE-2025-3000	A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. T...	2.13.0
torch	2.9.1	PYSEC-2025-195 / CVE-2025-3001	A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm...	2.10.0
torch	2.9.1	PYSEC-2026-2286 / CVE-2026-24747	PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `...	2.10.0

⚖️ License Check

Ensuring every file has a proper birth certificate. 👶

✅ No license violations found.

⚠️ No licence metadata found (not blocking):

• huey==3.4.0 — no released version carries licence metadata either
• torchao==0.18.0+cpu — no released version carries licence metadata either

Policy: Apache 2.0 (universal donor). StrongCopyleft / NetworkCopyleft / WeakCopyleft / Other / Error categories fail. MPL allowed.

🏷️ Release Preview

I've performed a final polish on the release notes. 🧼

Current: 0.2.6a11 → Next: 0.2.6a12

Signal	Value
Label	(none)
PR title	ci: control canary for gh-automations#157 (do not merge)
Bump	alpha

✅ PR title follows conventional commit format.

---

🚀 Release Channel Compatibility

Predicted next version: 0.2.6a12

Channel	Status	Note	Current Constraint
Stable	⚪	Not in channel	-
Testing	⚪	Not in channel	-
Alpha	⚪	Not in channel	-

🔌 Plugin Detection

I've verified the plugin's 'security' signature. ✍️

❌ Plugin Status: ERRORS (1)

Plugin Info:

• Name: ovos-stt-plugin-nemo
• Description: A nemo stt plugin for OVOS

Plugin Types: stt

OPM Detection:

Plugin Type	Wheel	Editable
stt	✅	✅

Entry Point Validation:

Entry Point	Type	Import	Interface
ovos-stt-plugin-nemo	stt	✅ 24750ms	✅

⊘ No settingsmeta.json

Issues:

• ❌ Import time for ovos-stt-plugin-nemo exceeds 500ms (24750ms)
• ⚠️ No settingsmeta.json found
• ⚠️ No settingsmeta.json found

🔨 Build Tests

I've fired up the furnaces and forged your changes. ⚒️

✅ All versions pass

Python	Build	Install	Tests	pytest
3.10	✅	✅	✅	5 passed in 20.32s
3.11	✅	✅	✅	5 passed in 12.96s

---

Built by scripts, maintained by community 🤝