fix(automation): run hourly NVIDIA NIM review repair

[seonghobae]

Superseded by current-main replacement #782. #782 carries the same hourly NVIDIA NIM-only review-repair contract directly on protected main after #743, with fresh TDD evidence and exact-head security/supply-chain checks. This stacked predecessor is closed without merge; no predecessor-head check or approval is transferred.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5ed63-32cd-4b1a-a705-2f5f8886f994

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review @coderabbitai review

Review exact current head 1d70f782f81612a69dfacff9a39aa192c16c6b2f against exact prerequisite base 4d076f636b6de5043e8501e93c06ed0a8c896eb3 only. Contracts-only head 71d1fc599538715a71c5eb2423e97cc7d566f01f failed permanent run 30992189499 with 13 expected failures. Current permanent runs 30992533806 and 30992534144 pass the hourly cadence, immutable called/dispatch workflow source, NVIDIA_NIM_API_KEY-only provider, missing-secret fail-closed, permission-denial, model-child GitHub/OIDC credential stripping, and byte-for-byte independent reviewer boundary. Verify same-repository exact-head guards, one-dispatch/single-flight limits, no COPILOT_GITHUB_TOKEN or GitHub Models model-auth fallback, secret step scoping, documentation/APA 7 evidence, and the fact that the scheduler cannot approve, merge, release, or weaken checks. Submit a formal exact-head review or actionable findings; do not reuse the prior head.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='4d076f636b6de5043e8501e93c06ed0a8c896eb3'
head='1d70f782f81612a69dfacff9a39aa192c16c6b2f'

git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"

printf '%s\n' '=== Commit range ==='
git diff --stat "${base}" "${head}"
printf '%s\n' '=== Changed files ==='
git diff --name-status "${base}" "${head}"
printf '%s\n' '=== Commit metadata ==='
git show -s --format='HEAD %H%nParents %P%nSubject %s' "${head}"

printf '%s\n' '=== Changed source outlines ==='
git diff --name-only "${base}" "${head}" |
  while IFS= read -r file; do
    case "$file" in
      *.py|*.js|*.ts|*.sh)
        printf '\n--- %s ---\n' "$file"
        ast-grep outline "$file" --items all 2>/dev/null || true
        ;;
    esac
  done

Length of output: 4537

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='4d076f636b6de5043e8501e93c06ed0a8c896eb3'
head='1d70f782f81612a69dfacff9a39aa192c16c6b2f'

printf '%s\n' '=== Exact workflow diffs ==='
git diff --unified=80 "${base}" "${head}" -- \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/pr-review-fix-scheduler.yml

for file in \
  .github/workflows/hourly-nvidia-nim-review-repair.yml \
  .github/workflows/pr-review-autofix.yml \
  .github/workflows/pr-review-fix-scheduler.yml \
  tests/test_pr_review_autofix_nvidia_nim_contract.py \
  tests/test_pr_review_fix_hourly_contract.py \
  tests/test_pr_review_fix_scheduler_source_pin.py \
  docs/automation/hourly-review-repair.md \
  docs/doctoring/hourly-nvidia-nim-autofix.md \
  CHANGELOG.md
do
  printf '\n=== %s at requested head ===\n' "$file"
  git show "${head}:${file}"
done

printf '%s\n' '=== Independent reviewer boundary ==='
printf 'base blob: '
git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml"
printf 'head blob: '
git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml"
git diff --exit-code "${base}" "${head}" -- .github/workflows/opencode-review-dispatch.yml

Length of output: 102987

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='1d70f782f81612a69dfacff9a39aa192c16c6b2f'

printf '%s\n' '=== Scheduler helper outline ==='
ast-grep outline scripts/ci/pr_review_fix_scheduler.py --items all 2>/dev/null || true

printf '%s\n' '=== Scheduler helper at requested head ==='
git show "${head}:scripts/ci/pr_review_fix_scheduler.py"

printf '%s\n' '=== Scheduler helper tests and references ==='
rg -n -C 4 --glob '*.py' \
  '(pr_review_fix_scheduler|retry_hours|max_dispatches|repository_dispatch|pr-review-autofix)' \
  scripts tests .github 2>/dev/null || true

printf '%s\n' '=== Privileged-operation and authentication references in affected control paths ==='
rg -n -i -C 3 \
  '(approve|merge|release|branch.protection|protection|statuses|check-runs|repository_dispatch|COPILOT_GITHUB_TOKEN|github-models|STRIX_GITHUB_MODELS_TOKEN|NVIDIA_NIM_API_KEY|ACTIONS_ID_TOKEN_REQUEST)' \
  .github/workflows/pr-review-fix-scheduler.yml \
  .github/workflows/pr-review-autofix.yml \
  scripts/ci/pr_review_fix_scheduler.py \
  scripts/ci/pr_review_autofix_context.py 2>/dev/null || true

printf '%s\n' '=== Workflow-context documentation references in repository ==='
rg -n -C 2 \
  '(job\.workflow_(repository|sha|ref|file_path)|workflow_sha|workflow_repository)' \
  .github docs tests 2>/dev/null || true

Length of output: 125482

---

🤖 web_search executed:

Verify the official NVIDIA documentation URLs for the NVIDIA NIM model identifiers mistralai/mistral-nemotronandnvidia/nemotron-3-nano-30b-a3b. In particular, determine whether this URL is valid: https://docs.api.nvidia.com/nim/re/reference/nvidia-nemotron-3-nano-30b-a3b

Length of output: 8852

---

@seonghobae Formal exact-head review completed for 1d70f782f81612a69dfacff9a39aa192c16c6b2f against 4d076f636b6de5043e8501e93c06ed0a8c896eb3.

I found no actionable findings.

Verified controls:

• The scheduler runs at minute 23 every hour.
• The same-head retry floor is one hour.
• Each scheduler run permits one dispatch.
• Repository-scoped concurrency uses cancel-in-progress: true.
• The scheduler validates and checks out job.workflow_repository, job.workflow_sha, job.workflow_ref, and job.workflow_file_path.
• The checkout SHA is verified before the scheduler helper runs.
• canonical_ref remains accepted but is not consumed.
• The repository-dispatch worker checks out trusted helper code at ${{ github.sha }}.
• OpenCode enables only nvidia-nim.
• The configured primary model is mistralai/mistral-nemotron.
• The configured helper model is nvidia/nemotron-3-nano-30b-a3b.
• NVIDIA_NIM_API_KEY is bound only to the two OpenCode execution steps.
• Both execution steps fail closed before model execution when the NVIDIA secret is empty.
• Both OpenCode child processes remove GITHUB_TOKEN, GH_TOKEN, and Actions OIDC request credentials.
• Both permission maps deny the specified non-file interactions.
• No COPILOT_GITHUB_TOKEN, GitHub Models provider, GitHub Models endpoint, or GitHub-token model-auth fallback remains in the autofix path.
• Same-repository head, exact base/head, live-head, file allowlist, syntax, and conflict-marker guards remain present.
• The scheduler helper dispatches at most one worker and does not call approval, pull-request merge, release, or branch-protection APIs.
• The conflict path can merge the base commit into a PR branch. It does not merge the pull request. It requires a new review and checks after the branch update.
• .github/workflows/opencode-review-dispatch.yml is byte-identical at both commits. Its blob SHA remains 41748bcecf9870a8bea10085d2682133082015ab.
• The operator and doctoring documents describe the implemented boundaries. The NVIDIA model documentation references resolve to NVIDIA documentation results.

This was a static exact-range review. I did not independently rerun the permanent workflows in this environment.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Superseded by current-main replacement #782.

#782 preserves the same reviewed hourly NVIDIA NIM repair behavior but is built directly on protected main at f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae, records permanent RED evidence (31002306348: 13 failed, 3 passed), and passes the permanent GREEN contract on exact implementation head 63b50227caefb49abd389a8da41edcfc1d32428e (31002522693). Keeping this older PR stacked on #759 would duplicate checks, reviews, and merge ownership. Closing without merge; #782 owns integration and activation.

[seonghobae]

Superseded by current-main replacement #782. #782 preserves the NVIDIA-NIM-only OpenCode worker and immutable reusable scheduler, adds the explicit Clearfolio product caller so the hourly timer cannot accidentally target the central .github repository, and is being validated directly against protected main after #743. Closing this stale stacked lineage prevents duplicate timers, duplicated review requests, and conflicting scheduler ownership; no prior check or approval evidence transfers.