Skip to content

fix(opencode): App 전용 review identity 계약을 통합 게이트와 일치 #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
opencode-agent merged 2 commits into from
Jul 13, 2026
Merged

fix(opencode): App 전용 review identity 계약을 통합 게이트와 일치 #523

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c3f9a7
fix(opencode): align review identity tests and retry ref
seonghobae Jul 13, 2026
33699a0
Merge remote-tracking branch 'origin/main' into HEAD
seonghobae Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -775,7 +775,9 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_not_contains "$workflow_file" "gh workflow run pr-review-merge-scheduler.yml" "opencode approval must not rely on repo-local workflow dispatch for organization required workflows"
assert_file_contains "$workflow_file" "gh api \"repos/\${GH_REPOSITORY}\" --jq '.default_branch // empty'" "opencode scheduler dispatch uses the target repository default branch"
assert_file_contains "$workflow_file" 'base_branch="${PR_BASE_REF:-${default_branch:-main}}"' "opencode scheduler follow-up derives the target base branch instead of hard-coding main"
assert_file_not_contains "$workflow_file" "--ref main" "opencode scheduler dispatch must support develop-default repositories"
assert_file_contains "$workflow_file" 'CENTRAL_WORKFLOW_REF: main' "opencode deferred review retry declares the trusted central workflow ref separately from the target base"
assert_file_contains "$workflow_file" '--ref "$CENTRAL_WORKFLOW_REF"' "opencode deferred review retry dispatches from the declared central workflow ref"
assert_file_not_contains "$workflow_file" "--ref main" "opencode workflow dispatch does not confuse the central workflow ref with a target repository default branch"
assert_file_contains "$workflow_file" "continue-on-error: true" "opencode post-approval scheduler dispatch failure does not fail a completed approval check"
assert_file_contains "$workflow_file" "Merge scheduler follow-up failed after approval; leaving OpenCode review intact." "opencode post-approval scheduler failure is reported as a warning"
assert_file_contains "$workflow_file" "--no-trigger-reviews" "opencode post-approval scheduler follow-up avoids duplicate OpenCode review runs"
Expand Down Expand Up @@ -949,11 +951,11 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$workflow_file" 'CONFIGURED_REVIEW_WRITE_TOKEN_SOURCE:' "opencode approval logs which configured review token source is used"
assert_file_contains "$workflow_file" '[ "${GH_REPOSITORY:-}" = "${GITHUB_REPOSITORY:-}" ]' "opencode approval does not replace the app token with the workflow token for target-repository check lookups"
assert_file_contains "$workflow_file" 'check_lookup_token_source="github-token"' "opencode approval marks target statusCheckRollup lookups as workflow-token reads"
assert_file_contains "$workflow_file" 'review_write_token="$configured_review_write_token"' "opencode approval starts review writes from the configured token before selecting the app primary"
assert_file_contains "$workflow_file" 'review_write_token="$OPENCODE_APP_TOKEN"' "opencode approval uses the OIDC-backed OpenCode app token for review writes when available"
assert_file_contains "$workflow_file" 'review_write_token="$CHECK_LOOKUP_GH_TOKEN"' "opencode approval only falls back to the workflow token when no app review token is available"
assert_file_contains "$workflow_file" 'review_write_fallback_token="$CHECK_LOOKUP_GH_TOKEN"' "opencode approval keeps same-repository workflow token as review publication fallback"
assert_file_contains "$workflow_file" 'review write fallback token source=${review_write_fallback_token_source:-none}' "opencode approval logs the review publication fallback token source"
assert_file_contains "$workflow_file" 'review_write_token="${OPENCODE_APP_TOKEN:-}"' "opencode approval binds review writes exclusively to the OIDC-backed OpenCode app token"
assert_file_contains "$workflow_file" 'review_write_token_source="opencode-app"' "opencode approval labels its app-only review identity"
assert_file_contains "$workflow_file" 'review write fallback token source=disabled' "opencode approval logs that cross-identity review fallback is disabled"
assert_file_contains "$workflow_file" 'OPENCODE_REVIEW_IDENTITY_UNAVAILABLE' "opencode approval fails closed when the app review identity is unavailable"
assert_file_not_contains "$workflow_file" 'review_write_fallback_token=' "opencode approval does not retain a workflow-token review fallback"
assert_file_not_contains "$workflow_file" 'using github-token primary and opencode-app fallback' "opencode approval must not intentionally prefer github-actions for same-repository review writes"
assert_file_not_contains "$workflow_file" 'review_write_token="${OPENCODE_APP_TOKEN:-$GH_TOKEN}"' "opencode approval keeps explicit app-token review-write selection instead of implicit shell fallback"
assert_file_contains "$workflow_file" 'post_pull_review_with_retry "inline review" "$review_write_token"' "opencode inline review writes use the bounded review-write helper"
Expand All @@ -973,7 +975,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$workflow_file" 'warn_gh_publication_failure "initial review overview update"' "opencode initial overview update soft-fails permission-denied publication errors"
assert_file_contains "$workflow_file" 'warn_gh_publication_failure "initial review overview comment"' "opencode initial overview comment soft-fails permission-denied publication errors"
assert_file_contains "$workflow_file" 'warn_gh_publication_failure "pull review with primary review token"' "opencode approval explains primary review publication failures"
assert_file_contains "$workflow_file" 'warn_gh_publication_failure "pull review with fallback review token"' "opencode approval explains fallback review publication failures"
assert_file_not_contains "$workflow_file" 'warn_gh_publication_failure "pull review with fallback review token"' "opencode approval has no cross-identity fallback review publication path"
assert_file_contains "$workflow_file" 'GitHub returned HTTP 422 for this review write; likely causes are token/event policy' "opencode approval logs an actionable HTTP 422 publication reason"
assert_file_contains "$workflow_file" 'GitHub rate-limited the review write token; retry after the reported reset window' "opencode approval logs an actionable rate-limit publication reason"
assert_file_contains "$workflow_file" 'REVIEW_PUBLISH_RETRY_ATTEMPTS: "1"' "opencode approval gives review publication a bounded retry budget"
Expand All @@ -985,7 +987,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$workflow_file" 'review_publish_retry_sleep_seconds()' "opencode approval can wait until a near GitHub rate-limit reset before retrying review publication"
assert_file_contains "$workflow_file" 'GitHub review publication retry sleep capped from %s to %s seconds.' "opencode approval logs capped review publication retry sleeps"
assert_file_contains "$workflow_file" 'post_pull_review_with_retry "primary review"' "opencode approval retries primary review publication before preserving the approval gate"
assert_file_contains "$workflow_file" 'post_pull_review_with_retry "fallback review"' "opencode approval retries fallback review publication before preserving the approval gate"
assert_file_not_contains "$workflow_file" 'post_pull_review_with_retry "fallback review"' "opencode approval never retries review publication under a different identity"
assert_file_contains "$workflow_file" 'hit a retryable GitHub API throttle; retrying attempt' "opencode approval logs retry reasons for rate-limited review publication"
assert_file_contains "$workflow_file" 'OpenCode could not publish the pull review for head %s, so the review state was not changed.' "opencode approval fails closed when review publication fails"
assert_file_contains "$workflow_file" 'REQUEST_CHANGES | INLINE_COMMENT_PUBLISH_FAILED) echo "::endgroup::" ;;' "opencode only closes a review-body log group for events that opened one"
Expand Down
Loading