Skip to content

Allow OpenCode deterministic fallback with app-token-limited checks #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 1 commit into from
Jun 29, 2026
Merged

Allow OpenCode deterministic fallback with app-token-limited checks #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4067,6 +4067,11 @@ jobs:

wait_for_peer_github_checks "$pending_file" || wait_status=$?
if [ "$wait_status" -eq 1 ]; then
if app_token_limited_check_lookup; then
echo "GitHub Checks statusCheckRollup lookup is unavailable to the OpenCode app token during deterministic fallback approval; branch protection remains authoritative for target-repository checks."
: >"$pending_file"
wait_status=0
else
body="$(printf '%s\n' \
"OpenCode could not validate deterministic fallback approval because current-head checks were unavailable." \
"" \
Expand All @@ -4079,12 +4084,17 @@ jobs:
"" \
"No PR review was posted because check lookup failure is a review-tool state, not a source finding.")"
stop_approval_without_review "CHECKS_LOOKUP_FAILED" "$body"
fi
elif [ "$wait_status" -eq 2 ]; then
build_waiting_for_checks_body "$pending_file" "$human_thread_body_file"
stop_approval_without_review "WAITING_FOR_CHECKS" "$(cat "$human_thread_body_file")"
fi

if ! collect_github_checks_with_retry collect_failed_github_checks "$failed_file"; then
if app_token_limited_check_lookup; then
echo "GitHub failed-check lookup is unavailable to the OpenCode app token during deterministic fallback approval; approving based on coverage evidence, mergeability, human-thread checks, and branch protection authority."
: >"$failed_file"
else
body="$(printf '%s\n' \
"OpenCode could not validate deterministic fallback approval because current-head failed checks were unavailable." \
"" \
Expand All @@ -4097,6 +4107,7 @@ jobs:
"" \
"No PR review was posted because check lookup failure is a review-tool state, not a source finding.")"
stop_approval_without_review "CHECKS_LOOKUP_FAILED" "$body"
fi
fi
if [ -s "$failed_file" ]; then
local failed_check_evidence_file failed_check_review_body_file failed_check_review_payload_file failed_check_inline_failure_body_file
Expand Down
2 changes: 2 additions & 0 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -695,6 +695,8 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$workflow_file" 'app_token_limited_check_lookup()' "opencode approval detects app-token-limited GitHub Checks lookups"
assert_file_contains "$workflow_file" 'branch protection remains authoritative for target-repository checks' "opencode approval documents branch protection authority when app-token check lookup is limited"
assert_file_contains "$workflow_file" 'approving based on source-backed OpenCode result and successful coverage evidence while branch protection remains authoritative' "opencode approval can approve source-backed reviews when app-token failed-check lookup is limited"
assert_file_contains "$workflow_file" 'during deterministic fallback approval; branch protection remains authoritative for target-repository checks' "opencode deterministic fallback tolerates app-token-limited pending-check lookup"
assert_file_contains "$workflow_file" 'during deterministic fallback approval; approving based on coverage evidence, mergeability, human-thread checks, and branch protection authority' "opencode deterministic fallback tolerates app-token-limited failed-check lookup"
assert_file_contains "$workflow_file" 'opencode-agent[bot]' "opencode review can find overview comments written by the OpenCode app token"
assert_file_contains "$workflow_file" 'update_review_overview()' "opencode approval step can rewrite the durable Review Overview after final gate decisions"
assert_file_contains "$workflow_file" 'update_review_overview "$event" "$body"' "opencode approval reviews refresh the durable overview with the actual approval-step event"
Expand Down
Loading