fix(opencode): use same-repo status credential - #1227
Conversation
|
Warning Review limit reached
Next review available in: 53 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
opencode-agent
Bot
added
merge: urgent-review
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
opencode-agent
Bot
added
priority: critical
…s credential Resolve CHANGELOG and the opencode-review-dispatch blob pin after a normal merge of origin/main. The job-scoped github.token same-repo status path remains the PR change; the dispatch workflow pin now matches the merged blob SHA.
|
@opencode-agent @cwl-noema-review current-head review for Wait — re-read live SHA. This comment is for the merge commit that lands origin/main into #1227 without dropping the same-repo |
|
@opencode-agent @cwl-noema-review current-head review for Normal merge of origin/main resolved CHANGELOG and the |
|
@opencode-agent @cwl-noema-review current-head review for Same-repo |
|
Independent current-head review request for exact HEAD Gap G-03: required Strix still fail-closes 0-vuln complete scans on |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
5974bee1dbc2f28b33f69f1aab08066bdedaab70. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32644317344/job/97210369391)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32644317344/job/97210369391)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-same-repository-status-credential.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-same-repository-status-credential.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-same-repository-status-credential.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-same-repository-status-credential.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
5974bee1dbc2f28b33f69f1aab08066bdedaab70. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32644317344/job/97210369391)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32644317344/job/97210369391)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-same-repository-status-credential.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-same-repository-status-credential.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
* docs: refresh gap baseline after #1252 merged to main Bind the live 95-PR inventory to protected main 9f8f840. The SHA table is a snapshot, not merge authorization. * docs: align G-02 with BEHIND inventory and bind 99 live PRs Record GitHub CLEAN #1265 as snapshot metadata, not merge authorization, and keep #1162/#1227/#1215 as BEHIND after #1252. * docs: bind live 98-PR inventory while #1265 waits for OpenCode Keep GitHub CLEAN #1265 as snapshot metadata, not merge authorization, and record that required Strix CRs remain G-03. * docs: correct live PR 1263 head evidence
1 participant
Outcome
Use the job-scoped github.token for OpenCode commit-status publication when the repository_dispatch target is the central .github repository. Cross-repository targets retain the existing PAT/App credential chain.
Root cause
Run 32560612401 declared statuses: write but selected the separate OpenCode App token for a same-repository POST /statuses/{sha}; GitHub returned HTTP 403 because that installation token did not have commit-status write permission.
Verification
No new credential, permission, retry, or fallback path is introduced.