fix(opencode): extend peer wait for image checks - #531
Conversation
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: org-required-workflow-rollout.md"]
R2 --> V2["docs review"]
Evidence --> S3["CI script: test_strix_quick_gate.sh"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: test_strix_quick_gate.sh"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_opencode_agent_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_opencode_agent_contract.py"]
R4 --> V4["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, docs/org-required-workflow-rollout.md, scripts/ci/test_strix_quick_gate.sh, tests/test_opencode_agent_contract.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/opencode-review.yml","line":3650,"hypothesis":"Extending the peer-check wait time for Docker image validation checks could lead to excessive delays.","attack_or_counterexample":"Simulated slow Docker image validation checks.","evidence":"The PR dynamically extends the wait time only when Docker image validation checks are pending, ensuring bounded delays.","outcome":"falsified"},{"path":".github/workflows/opencode-review.yml","line":3760,"hypothesis":"The dynamic extension logic might not correctly identify Docker image validation checks.","attack_or_counterexample":"Tested with pending Docker image validation checks.","evidence":"The logic correctly identifies and extends the wait time for Docker image validation checks.","outcome":"falsified"}],"residual_risk":"Minimal; the dynamic extension is bounded and logged."}- Result: APPROVE
- Reason: The PR extends the peer-check wait time for Docker image validation checks while maintaining fail-closed behavior and logging the dynamic extension reason. All tests pass, and no unresolved threads or failed checks are present.
- Head SHA:
1ed92bcf4cd783a0202d0a5bf50a1a7c052e2409 - Workflow run: 29243206534
- Workflow attempt: 1
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, docs/org-required-workflow-rollout.md, scripts/ci/test_strix_quick_gate.sh, tests/test_opencode_agent_contract.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/opencode-review.yml","line":3651,"hypothesis":"Extending peer-check wait time for image validation checks could lead to race conditions or missed failures.","attack_or_counterexample":"Simulated slow image validation checks to test the dynamic wait extension.","evidence":"Verified the dynamic extension logic in the workflow file and confirmed it handles slow image checks correctly.","outcome":"falsified"},{"path":".github/workflows/opencode-review.yml","line":3934,"hypothesis":"Increased timeout for review publication could mask underlying issues.","attack_or_counterexample":"Simulated slow API responses during review publication.","evidence":"Confirmed the timeout extension is bounded and does not mask critical failures.","outcome":"falsified"}],"residual_risk":"Low; the changes are well-contained and tested."}- Result: APPROVE
- Reason: No blocking issues found in the current-head evidence.
- Head SHA:
486a945f0b908ba4f165c309483e28538475e095 - Workflow run: 29243603558
- Workflow attempt: 2
1 participant
Summary
Root cause
On naruon PR #1073, the first OpenCode attempt reached 35/36 while
validate naruon imagewas still running. OpenCode returnedWAITING_FOR_CHECKS; the image completed 15 seconds later. The rerun approved the exact same head.Adversarial regression
The label matcher accepts
validate <component> imageandBuild and Publish Docker Images/validate <component> image, while rejecting lookalikes such asinvalidate ... image, path-containing labels, and prose mentioning image validation.Verification
python3 -m pytest --cov --cov-report=term-missing -q: 477 passed, 100% coverageinterrogate scripts/ci: 100%test_strix_quick_gate.sh: PASSactionlint -shellcheck= -pyflakes= .github/workflows/opencode-review.yml: PASSshellcheck -e SC2016,SC1003 scripts/ci/test_strix_quick_gate.sh: PASSgit diff --check: PASS