From 07519719aabdf6abd2101711133ee01c534359b2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 10 Jul 2026 10:13:13 +0900 Subject: [PATCH] fix opencode required workflow same-repo guard --- .github/workflows/opencode-review.yml | 2 +- scripts/ci/test_strix_quick_gate.sh | 3 ++- tests/test_opencode_agent_contract.py | 6 ++++++ 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index c9045c2e4..d7c4a4c35 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -57,7 +57,7 @@ jobs: || ( github.event_name == 'pull_request_target' && github.event.action != 'closed' - && github.event.pull_request.head.repo.full_name == github.repository + && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name ) runs-on: ubuntu-latest permissions: diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index f439bd067..ab8b51160 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -385,7 +385,8 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" 'cancel-in-progress: true' "opencode review cancels stale in-progress review attempts when a newer PR event arrives" assert_file_contains "$workflow_file" "Checkout pull request merge ref for coverage measurement" "opencode pull_request_target coverage execution uses the trusted merge ref" assert_file_contains "$workflow_file" "stale OpenCode run: event head=" "opencode review side effects are skipped for stale heads" - assert_file_contains "$workflow_file" "github.event.pull_request.head.repo.full_name == github.repository" "opencode pull_request_target coverage execution is limited to same-repository PR heads" + assert_file_contains "$workflow_file" "github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name" "opencode pull_request_target coverage execution is limited to same-repository PR heads using the target PR base repo" + assert_file_not_contains "$workflow_file" "github.event.pull_request.head.repo.full_name == github.repository" "opencode required workflow must not compare PR head repo to the central workflow source repository" assert_file_contains "$workflow_file" "needs.coverage-evidence.result != 'cancelled'" "opencode review does not enqueue stale side-effect jobs after coverage evidence cancellation" assert_file_contains "$workflow_file" "opencode-review-target:" "opencode trusted review job owns the required check surface" assert_file_contains "$workflow_file" "Initialize CodeGraph index for OpenCode" "opencode review workflow initializes CodeGraph before review" diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index 23479c6e7..e353df1d8 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -149,6 +149,12 @@ def test_opencode_manual_dispatch_canonical_ref_overrides_workflow_ref(): def test_opencode_target_coverage_materializes_merge_tree_without_checkout_action(): """Avoid pull_request_target action checkouts of untrusted PR refs.""" workflow = Path(".github/workflows/opencode-review.yml").read_text(encoding="utf-8") + assert ( + "github.event.pull_request.head.repo.full_name == " + "github.event.pull_request.base.repo.full_name" + ) in workflow + assert "github.event.pull_request.head.repo.full_name == github.repository" not in workflow + start = workflow.index( " - name: Materialize pull request merge tree for coverage measurement\n" )