Skip to content

Enable central review workflows for thin callers #125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 3 commits into from
Closed

Enable central review workflows for thin callers #125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b619aa8
Enable central review workflows for thin callers
seonghobae Jun 29, 2026
0621613
Merge remote-tracking branch 'origin/main' into codex/html4tree-fork-…
seonghobae Jun 29, 2026
0614842
Merge remote-tracking branch 'origin/main' into codex/html4tree-fork-…
seonghobae Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 63 additions & 40 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,29 @@ name: Required OpenCode Review
on:
pull_request_target:
types: [opened, synchronize, reopened, ready_for_review]
workflow_call:
inputs:
pr_number:
description: Pull request number to review
required: true
type: string
pr_base_ref:
description: Pull request base branch
required: true
type: string
pr_base_sha:
description: Pull request base SHA
required: true
type: string
pr_head_sha:
description: Pull request head SHA
required: true
type: string
canonical_ref:
description: Ref of ContextualWisdomLab/.github to use for trusted review scripts
required: false
default: main
type: string
workflow_dispatch:
inputs:
pr_number:
Expand Down Expand Up @@ -33,7 +56,7 @@ on:
type: string

concurrency:
group: opencode-review-${{ github.event_name }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || github.run_id }}
group: opencode-review-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number || github.run_id }}
cancel-in-progress: true

permissions:
Expand All @@ -59,7 +82,7 @@ jobs:
- name: Resolve trusted OpenCode source ref
id: trusted_source
env:
INPUT_CANONICAL_REF: ${{ github.event.inputs.canonical_ref || '' }}
INPUT_CANONICAL_REF: ${{ inputs.canonical_ref || github.event.inputs.canonical_ref || '' }}
WORKFLOW_REF: ${{ github.workflow_ref }}
run: |
set -euo pipefail
Expand All @@ -86,7 +109,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
token: ${{ secrets.OPENCODE_APPROVE_TOKEN || github.token }}
ref: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
ref: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
path: pr-head

- name: Install Python coverage measurement tools
Expand All @@ -95,8 +118,8 @@ jobs:
- name: Measure test and docstring evidence
id: measure
env:
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
COVERAGE_SOURCE_WORKDIR: ${{ github.workspace }}/pr-head
run: |
set -euo pipefail
Expand Down Expand Up @@ -517,7 +540,7 @@ jobs:
opencode-review-target:
name: opencode-review
needs: [coverage-evidence]
if: always() && (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request_target')
if: always() && (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request_target' || github.event_name == 'workflow_call')
runs-on: ubuntu-latest
permissions:
actions: read
Expand All @@ -535,7 +558,7 @@ jobs:
- name: Resolve trusted OpenCode source ref
id: trusted_source
env:
INPUT_CANONICAL_REF: ${{ github.event.inputs.canonical_ref || '' }}
INPUT_CANONICAL_REF: ${{ inputs.canonical_ref || github.event.inputs.canonical_ref || '' }}
WORKFLOW_REF: ${{ github.workflow_ref }}
run: |
set -euo pipefail
Expand All @@ -559,10 +582,10 @@ jobs:
env:
GH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || github.token }}
GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
PR_BASE_REF: ${{ github.event.pull_request.base.ref || github.event.inputs.pr_base_ref }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
PR_BASE_REF: ${{ github.event.pull_request.base.ref || inputs.pr_base_ref || github.event.inputs.pr_base_ref }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
run: |
set -euo pipefail
Expand Down Expand Up @@ -636,10 +659,10 @@ jobs:
env:
GH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || github.token }}
GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
OPENCODE_EVIDENCE_FILE: ${{ runner.temp }}/opencode-review-evidence.md
OPENCODE_FAILED_CHECK_EVIDENCE_FILE: ${{ runner.temp }}/opencode-failed-check-evidence.md
Expand Down Expand Up @@ -1430,10 +1453,10 @@ jobs:
OPENCODE_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-primary.md
OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
RUN_ID: ${{ github.run_id }}
RUN_ATTEMPT: ${{ github.run_attempt }}
run: |
Expand Down Expand Up @@ -1556,10 +1579,10 @@ jobs:
OPENCODE_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-fallback.md
OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
RUN_ID: ${{ github.run_id }}
RUN_ATTEMPT: ${{ github.run_attempt }}
run: |
Expand Down Expand Up @@ -1683,10 +1706,10 @@ jobs:
OPENCODE_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-second-fallback.md
OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
RUN_ID: ${{ github.run_id }}
RUN_ATTEMPT: ${{ github.run_attempt }}
run: |
Expand Down Expand Up @@ -1811,10 +1834,10 @@ jobs:
OPENCODE_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-catalog-fallback.md
OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
RUN_ID: ${{ github.run_id }}
RUN_ATTEMPT: ${{ github.run_attempt }}
run: |
Expand Down Expand Up @@ -1983,8 +2006,8 @@ jobs:
env:
GH_TOKEN: ${{ steps.opencode_app_token.outputs.token || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
RUN_ID: ${{ github.run_id }}
RUN_ATTEMPT: ${{ github.run_attempt }}
OPENCODE_PRIMARY_OUTCOME: ${{ steps.opencode_review_primary.outputs.review_status }}
Expand All @@ -1997,8 +2020,8 @@ jobs:
OPENCODE_CATALOG_FALLBACK_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-catalog-fallback.md
# The publish gate re-runs source-backed validation against PR-head data.
OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
run: |
set -euo pipefail

Expand Down Expand Up @@ -2265,8 +2288,8 @@ jobs:
USE_GITHUB_TOKEN: "true"
NPM_CONFIG_IGNORE_SCRIPTS: "true"
NO_COLOR: "1"
PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number || github.event.inputs.pr_number }}
HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
RUN_ID: ${{ github.run_id }}
RUN_ATTEMPT: ${{ github.run_attempt }}
OPENCODE_PRIMARY_OUTCOME: ${{ steps.opencode_review_primary.outputs.review_status }}
Expand All @@ -2277,8 +2300,8 @@ jobs:
OPENCODE_FALLBACK_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-fallback.md
OPENCODE_SECOND_FALLBACK_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-second-fallback.md
OPENCODE_CATALOG_FALLBACK_OUTPUT_FILE: ${{ runner.temp }}/opencode-review-catalog-fallback.md
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha || inputs.pr_base_sha || github.event.inputs.pr_base_sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.event.inputs.pr_head_sha }}
APPROVAL_CHECK_WAIT_ATTEMPTS: "81"
APPROVAL_CHECK_WAIT_SLEEP_SECONDS: "30"
CHECK_LOOKUP_RETRY_ATTEMPTS: "5"
Expand Down Expand Up @@ -3040,7 +3063,7 @@ jobs:
}

emit_known_missing_string_finding \
"github.event.inputs.strix_llm || 'openai/gpt-5'" \
"inputs.strix_llm || github.event.inputs.strix_llm || 'openai/gpt-5'" \
"Strix PR scans must default to GitHub Models GPT-5" \
".github/workflows/strix.yml" \
"scripts/ci/test_strix_quick_gate.sh"
Expand Down
Loading
Loading