From 06b3f8bef1f5ca0039c53a23f59e8108321cd492 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 30 Jun 2026 08:01:04 +0900 Subject: [PATCH] Allow deterministic fallback with app-token checks --- .github/workflows/opencode-review.yml | 11 +++++++++++ scripts/ci/test_strix_quick_gate.sh | 2 ++ 2 files changed, 13 insertions(+) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index 1c8f5c553..e2b6e9443 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -4067,6 +4067,11 @@ jobs: wait_for_peer_github_checks "$pending_file" || wait_status=$? if [ "$wait_status" -eq 1 ]; then + if app_token_limited_check_lookup; then + echo "GitHub Checks statusCheckRollup lookup is unavailable to the OpenCode app token during deterministic fallback approval; branch protection remains authoritative for target-repository checks." + : >"$pending_file" + wait_status=0 + else body="$(printf '%s\n' \ "OpenCode could not validate deterministic fallback approval because current-head checks were unavailable." \ "" \ @@ -4079,12 +4084,17 @@ jobs: "" \ "No PR review was posted because check lookup failure is a review-tool state, not a source finding.")" stop_approval_without_review "CHECKS_LOOKUP_FAILED" "$body" + fi elif [ "$wait_status" -eq 2 ]; then build_waiting_for_checks_body "$pending_file" "$human_thread_body_file" stop_approval_without_review "WAITING_FOR_CHECKS" "$(cat "$human_thread_body_file")" fi if ! collect_github_checks_with_retry collect_failed_github_checks "$failed_file"; then + if app_token_limited_check_lookup; then + echo "GitHub failed-check lookup is unavailable to the OpenCode app token during deterministic fallback approval; approving based on coverage evidence, mergeability, human-thread checks, and branch protection authority." + : >"$failed_file" + else body="$(printf '%s\n' \ "OpenCode could not validate deterministic fallback approval because current-head failed checks were unavailable." \ "" \ @@ -4097,6 +4107,7 @@ jobs: "" \ "No PR review was posted because check lookup failure is a review-tool state, not a source finding.")" stop_approval_without_review "CHECKS_LOOKUP_FAILED" "$body" + fi fi if [ -s "$failed_file" ]; then local failed_check_evidence_file failed_check_review_body_file failed_check_review_payload_file failed_check_inline_failure_body_file diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 7a10c93e9..f25955813 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -695,6 +695,8 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" 'app_token_limited_check_lookup()' "opencode approval detects app-token-limited GitHub Checks lookups" assert_file_contains "$workflow_file" 'branch protection remains authoritative for target-repository checks' "opencode approval documents branch protection authority when app-token check lookup is limited" assert_file_contains "$workflow_file" 'approving based on source-backed OpenCode result and successful coverage evidence while branch protection remains authoritative' "opencode approval can approve source-backed reviews when app-token failed-check lookup is limited" + assert_file_contains "$workflow_file" 'during deterministic fallback approval; branch protection remains authoritative for target-repository checks' "opencode deterministic fallback tolerates app-token-limited pending-check lookup" + assert_file_contains "$workflow_file" 'during deterministic fallback approval; approving based on coverage evidence, mergeability, human-thread checks, and branch protection authority' "opencode deterministic fallback tolerates app-token-limited failed-check lookup" assert_file_contains "$workflow_file" 'opencode-agent[bot]' "opencode review can find overview comments written by the OpenCode app token" assert_file_contains "$workflow_file" 'update_review_overview()' "opencode approval step can rewrite the durable Review Overview after final gate decisions" assert_file_contains "$workflow_file" 'update_review_overview "$event" "$body"' "opencode approval reviews refresh the durable overview with the actual approval-step event"