From 2c3f9a7f82ec334d95def75a43fc07e8d27288fc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 13 Jul 2026 16:58:36 +0900 Subject: [PATCH] fix(opencode): align review identity tests and retry ref --- .github/workflows/opencode-review.yml | 12 +++++++++++- scripts/ci/test_strix_quick_gate.sh | 18 ++++++++++-------- 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index 1f57799ca..b13bcb1e3 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -7158,9 +7158,19 @@ jobs: exit 0 fi + central_workflow_ref="$( + GH_TOKEN="$RETRY_DISPATCH_TOKEN" \ + gh api "repos/${CENTRAL_WORKFLOW_REPOSITORY}" \ + --jq '.default_branch // empty' 2>/dev/null || true + )" + if [ -z "$central_workflow_ref" ]; then + echo "::warning::Deferred exhausted-pool retry skipped because the central workflow repository default branch could not be resolved; the merge scheduler org sweep remains the retry path." + exit 0 + fi + if ! GH_TOKEN="$RETRY_DISPATCH_TOKEN" gh workflow run "$CENTRAL_WORKFLOW_FILE" \ --repo "$CENTRAL_WORKFLOW_REPOSITORY" \ - --ref main \ + --ref "$central_workflow_ref" \ -f "target_repository=${GITHUB_REPOSITORY}" \ -f "pr_number=${PR_NUMBER}" \ -f "pr_base_ref=${PR_BASE_REF}" \ diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 0aa38bf5c..17a820c04 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -775,7 +775,9 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_not_contains "$workflow_file" "gh workflow run pr-review-merge-scheduler.yml" "opencode approval must not rely on repo-local workflow dispatch for organization required workflows" assert_file_contains "$workflow_file" "gh api \"repos/\${GH_REPOSITORY}\" --jq '.default_branch // empty'" "opencode scheduler dispatch uses the target repository default branch" assert_file_contains "$workflow_file" 'base_branch="${PR_BASE_REF:-${default_branch:-main}}"' "opencode scheduler follow-up derives the target base branch instead of hard-coding main" - assert_file_not_contains "$workflow_file" "--ref main" "opencode scheduler dispatch must support develop-default repositories" + assert_file_contains "$workflow_file" 'gh api "repos/${CENTRAL_WORKFLOW_REPOSITORY}"' "opencode deferred review retry resolves the central workflow repository default branch" + assert_file_contains "$workflow_file" '--ref "$central_workflow_ref"' "opencode deferred review retry dispatches from the resolved central workflow ref" + assert_file_not_contains "$workflow_file" "--ref main" "opencode workflow dispatch does not hard-code either repository default branch" assert_file_contains "$workflow_file" "continue-on-error: true" "opencode post-approval scheduler dispatch failure does not fail a completed approval check" assert_file_contains "$workflow_file" "Merge scheduler follow-up failed after approval; leaving OpenCode review intact." "opencode post-approval scheduler failure is reported as a warning" assert_file_contains "$workflow_file" "--no-trigger-reviews" "opencode post-approval scheduler follow-up avoids duplicate OpenCode review runs" @@ -949,11 +951,11 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" 'CONFIGURED_REVIEW_WRITE_TOKEN_SOURCE:' "opencode approval logs which configured review token source is used" assert_file_contains "$workflow_file" '[ "${GH_REPOSITORY:-}" = "${GITHUB_REPOSITORY:-}" ]' "opencode approval does not replace the app token with the workflow token for target-repository check lookups" assert_file_contains "$workflow_file" 'check_lookup_token_source="github-token"' "opencode approval marks target statusCheckRollup lookups as workflow-token reads" - assert_file_contains "$workflow_file" 'review_write_token="$configured_review_write_token"' "opencode approval starts review writes from the configured token before selecting the app primary" - assert_file_contains "$workflow_file" 'review_write_token="$OPENCODE_APP_TOKEN"' "opencode approval uses the OIDC-backed OpenCode app token for review writes when available" - assert_file_contains "$workflow_file" 'review_write_token="$CHECK_LOOKUP_GH_TOKEN"' "opencode approval only falls back to the workflow token when no app review token is available" - assert_file_contains "$workflow_file" 'review_write_fallback_token="$CHECK_LOOKUP_GH_TOKEN"' "opencode approval keeps same-repository workflow token as review publication fallback" - assert_file_contains "$workflow_file" 'review write fallback token source=${review_write_fallback_token_source:-none}' "opencode approval logs the review publication fallback token source" + assert_file_contains "$workflow_file" 'review_write_token="${OPENCODE_APP_TOKEN:-}"' "opencode approval binds review writes exclusively to the OIDC-backed OpenCode app token" + assert_file_contains "$workflow_file" 'review_write_token_source="opencode-app"' "opencode approval labels its app-only review identity" + assert_file_contains "$workflow_file" 'review write fallback token source=disabled' "opencode approval logs that cross-identity review fallback is disabled" + assert_file_contains "$workflow_file" 'OPENCODE_REVIEW_IDENTITY_UNAVAILABLE' "opencode approval fails closed when the app review identity is unavailable" + assert_file_not_contains "$workflow_file" 'review_write_fallback_token=' "opencode approval does not retain a workflow-token review fallback" assert_file_not_contains "$workflow_file" 'using github-token primary and opencode-app fallback' "opencode approval must not intentionally prefer github-actions for same-repository review writes" assert_file_not_contains "$workflow_file" 'review_write_token="${OPENCODE_APP_TOKEN:-$GH_TOKEN}"' "opencode approval keeps explicit app-token review-write selection instead of implicit shell fallback" assert_file_contains "$workflow_file" 'post_pull_review_with_retry "inline review" "$review_write_token"' "opencode inline review writes use the bounded review-write helper" @@ -973,7 +975,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" 'warn_gh_publication_failure "initial review overview update"' "opencode initial overview update soft-fails permission-denied publication errors" assert_file_contains "$workflow_file" 'warn_gh_publication_failure "initial review overview comment"' "opencode initial overview comment soft-fails permission-denied publication errors" assert_file_contains "$workflow_file" 'warn_gh_publication_failure "pull review with primary review token"' "opencode approval explains primary review publication failures" - assert_file_contains "$workflow_file" 'warn_gh_publication_failure "pull review with fallback review token"' "opencode approval explains fallback review publication failures" + assert_file_not_contains "$workflow_file" 'warn_gh_publication_failure "pull review with fallback review token"' "opencode approval has no cross-identity fallback review publication path" assert_file_contains "$workflow_file" 'GitHub returned HTTP 422 for this review write; likely causes are token/event policy' "opencode approval logs an actionable HTTP 422 publication reason" assert_file_contains "$workflow_file" 'GitHub rate-limited the review write token; retry after the reported reset window' "opencode approval logs an actionable rate-limit publication reason" assert_file_contains "$workflow_file" 'REVIEW_PUBLISH_RETRY_ATTEMPTS: "1"' "opencode approval gives review publication a bounded retry budget" @@ -985,7 +987,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" 'review_publish_retry_sleep_seconds()' "opencode approval can wait until a near GitHub rate-limit reset before retrying review publication" assert_file_contains "$workflow_file" 'GitHub review publication retry sleep capped from %s to %s seconds.' "opencode approval logs capped review publication retry sleeps" assert_file_contains "$workflow_file" 'post_pull_review_with_retry "primary review"' "opencode approval retries primary review publication before preserving the approval gate" - assert_file_contains "$workflow_file" 'post_pull_review_with_retry "fallback review"' "opencode approval retries fallback review publication before preserving the approval gate" + assert_file_not_contains "$workflow_file" 'post_pull_review_with_retry "fallback review"' "opencode approval never retries review publication under a different identity" assert_file_contains "$workflow_file" 'hit a retryable GitHub API throttle; retrying attempt' "opencode approval logs retry reasons for rate-limited review publication" assert_file_contains "$workflow_file" 'OpenCode could not publish the pull review for head %s, so the review state was not changed.' "opencode approval fails closed when review publication fails" assert_file_contains "$workflow_file" 'REQUEST_CHANGES | INLINE_COMMENT_PUBLISH_FAILED) echo "::endgroup::" ;;' "opencode only closes a review-body log group for events that opened one"