From 05390abc2a36aba4dc323e1b24eb3a1e3c5d1b26 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Tue, 30 Jun 2026 10:58:18 +0900
Subject: [PATCH] Retry OpenCode check lookup with workflow token

---
 .github/workflows/opencode-review.yml | 9 +++++++++
 scripts/ci/test_strix_quick_gate.sh   | 2 ++
 2 files changed, 11 insertions(+)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index bd192e97a..b7b9c3148 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -2693,6 +2693,7 @@ jobs:
           GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}
           STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
           OPENCODE_APP_TOKEN: ${{ steps.opencode_app_token.outputs.token }}
+          WORKFLOW_GITHUB_TOKEN: ${{ github.token }}
           OPENCODE_EVIDENCE_FILE: ${{ runner.temp }}/opencode-review-evidence.md
           OPENCODE_FAILED_CHECK_EVIDENCE_FILE: ${{ runner.temp }}/opencode-failed-check-evidence.md
           OPENCODE_FAILED_CHECK_DIAGNOSIS_FILE: ${{ runner.temp }}/opencode-failed-check-diagnosis.md
@@ -4262,6 +4263,14 @@ jobs:
               if "$collector" "$output_file"; then
                 return 0
               fi
+              if app_token_limited_check_lookup &&
+                [ -n "${WORKFLOW_GITHUB_TOKEN:-}" ] &&
+                [ "${WORKFLOW_GITHUB_TOKEN:-}" != "${GH_TOKEN:-}" ]; then
+                printf 'GitHub Checks lookup failed with OpenCode app token; retrying with workflow token before changing review state.\n' >&2
+                if env GH_TOKEN="$WORKFLOW_GITHUB_TOKEN" "$collector" "$output_file"; then
+                  return 0
+                fi
+              fi
               : >"$output_file"
               if [ "$attempt" -lt "$attempts" ]; then
                 printf 'GitHub Checks lookup failed; retrying %s/%s before changing review state.\n' "$attempt" "$attempts" >&2
diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh
index fe2a204a8..414f3a330 100755
--- a/scripts/ci/test_strix_quick_gate.sh
+++ b/scripts/ci/test_strix_quick_gate.sh
@@ -709,9 +709,11 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
 	assert_file_contains "$workflow_file" 'gh api -X PATCH "repos/${GH_REPOSITORY}/issues/comments/${overview_comment_id}"' "opencode review updates an existing Review Overview comment instead of duplicating it"
 	assert_file_contains "$workflow_file" "Exchange OpenCode app token for review writes" "opencode review obtains an app token before publishing review writes"
 	assert_file_contains "$workflow_file" 'GH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}' "opencode approval prefers the configured cross-repo token for target statusCheckRollup lookups"
+	assert_file_contains "$workflow_file" 'WORKFLOW_GITHUB_TOKEN: ${{ github.token }}' "opencode approval retains the workflow token as a check lookup fallback"
 	assert_file_contains "$workflow_file" 'review_write_token="${OPENCODE_APP_TOKEN:-$GH_TOKEN}"' "opencode approval separates review write credentials from check lookup credentials"
 	assert_file_contains "$workflow_file" 'env GH_TOKEN="$review_write_token" gh api -X POST "repos/${GH_REPOSITORY}/pulls/${PR_NUMBER}/reviews"' "opencode review writes use the review write token"
 	assert_file_contains "$workflow_file" 'app_token_limited_check_lookup()' "opencode approval detects app-token-limited GitHub Checks lookups"
+	assert_file_contains "$workflow_file" 'env GH_TOKEN="$WORKFLOW_GITHUB_TOKEN" "$collector" "$output_file"' "opencode approval retries statusCheckRollup lookup with the workflow token before failing"
 	assert_file_contains "$workflow_file" 'branch protection remains authoritative for target-repository checks' "opencode approval documents branch protection authority when app-token check lookup is limited"
 	assert_file_contains "$workflow_file" 'approving based on source-backed OpenCode result and successful coverage evidence while branch protection remains authoritative' "opencode approval can approve source-backed reviews when app-token failed-check lookup is limited"
 	assert_file_contains "$workflow_file" 'during deterministic fallback approval; branch protection remains authoritative for target-repository checks' "opencode deterministic fallback tolerates app-token-limited pending-check lookup"