Skip to content

fix(review): let the model-unavailable fallback read code-scanning alerts with github.token #510

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 2 commits into from
Jul 13, 2026
Merged

fix(review): let the model-unavailable fallback read code-scanning alerts with github.token #510

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6946f15
fix(review): stop preferring the OpenCode app token for code-scanning…
seonghobae Jul 13, 2026
bede118
Merge branch 'main' into fix/fallback-alerts-read
opencode-agent[bot] Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3916,9 +3916,13 @@ jobs:
env:
GH_TOKEN: ${{ steps.opencode_app_token.outputs.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
CHECK_LOOKUP_GH_TOKEN: ${{ github.token }}
CODE_SCANNING_GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}
# The OpenCode app installation token is exchanged from api.opencode.ai
# and never carries security-events read, so it cannot read the
# code-scanning alerts API; github.token has security-events: read from
# this job's permissions block, so it is the same-repository fallback.
CODE_SCANNING_GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
CONFIGURED_REVIEW_WRITE_TOKEN_SOURCE: ${{ steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || 'github-token' }}
CODE_SCANNING_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}
CODE_SCANNING_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || 'github-token' }}
GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}
STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
# Exposed so the "openai" provider in opencode.jsonc resolves during the
Expand Down
15 changes: 13 additions & 2 deletions tests/test_opencode_agent_contract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -645,10 +645,21 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
assert "collect_open_code_scanning_alerts" in workflow
assert (
"CODE_SCANNING_GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "
"secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "
"github.token }}"
"secrets.OPENCODE_APPROVE_TOKEN || github.token }}"
) in workflow
# The OpenCode app installation token never carries security-events read, so
# preferring it for the code-scanning alert lookup 403s ("Resource not
# accessible by integration") and defeats the model-unavailable fallback.
code_scanning_token_lines = [
line for line in workflow.splitlines() if "CODE_SCANNING_GH_TOKEN:" in line
]
assert code_scanning_token_lines
assert all("opencode_app_token" not in line for line in code_scanning_token_lines)
assert "CODE_SCANNING_TOKEN_SOURCE" in workflow
code_scanning_source_lines = [
line for line in workflow.splitlines() if "CODE_SCANNING_TOKEN_SOURCE:" in line
]
assert all("opencode-app" not in line for line in code_scanning_source_lines)
assert 'GH_TOKEN="$scan_token" timeout "$(check_lookup_api_timeout_seconds)s"' in workflow
assert "Open code-scanning alert lookup skipped because no target-repository read token" in workflow
assert "production source 또는 package manifest 변경이 없습니다" not in workflow
Expand Down
Loading