Skip to content

Ignore transient governance helper cancellations #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 4 commits into from
Jun 24, 2026
Merged

Ignore transient governance helper cancellations #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5efb412
Ignore transient governance helper cancellations
seonghobae Jun 24, 2026
7428ca7
Ignore governance helper cancellations in approval gate
seonghobae Jun 24, 2026
faa6b51
Prevent generic failed-check review fallbacks
seonghobae Jun 24, 2026
18f9b7a
Reject generic fallback helper output
seonghobae Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 48 additions & 14 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2444,10 +2444,22 @@ jobs:
local strix_evidence_file

if [ -x "${repo_root%/}/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" ]; then
if "${repo_root%/}/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "$evidence_file" "$repo_root"; then
local helper_findings_file
helper_findings_file="$(mktemp)"
if "${repo_root%/}/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "$evidence_file" "$repo_root" >"$helper_findings_file"; then
if grep -Fq "No deterministic missing-string markers" "$helper_findings_file" ||
! grep -Eq '^### [0-9]+\. ' "$helper_findings_file"; then
printf 'OpenCode failed-check fallback helper returned non-source-backed generic output; leaving the PR review unchanged for rerun.\n' >&2
rm -f "$helper_findings_file"
return 1
fi
cat "$helper_findings_file"
rm -f "$helper_findings_file"
return 0
fi
printf 'OpenCode failed-check fallback helper exited non-zero; using inline fallback.\n' >&2
rm -f "$helper_findings_file"
printf 'OpenCode failed-check fallback helper did not produce source-backed findings; leaving the PR review unchanged for rerun.\n' >&2
return 1
fi

extract_strix_failed_check_block() {
Expand Down Expand Up @@ -2615,28 +2627,36 @@ jobs:
rm -f "$strix_evidence_file"

if [ "$finding_index" -eq 0 ]; then
printf 'No automated line-specific fallback pattern matched this failed check. Do not approve or post a URL-only review; inspect the failed-check evidence below, identify the exact failing source line, explain the root cause, and provide the focused rerun command before approval.\n\n'
printf 'No automated source-backed fallback pattern matched this failed check; leaving the PR review unchanged for rerun.\n' >&2
return 1
fi
}

build_failed_check_fallback_body() {
local failed_checks_file="$1"
local evidence_file="$2"
local body_file="$3"
local findings_file

findings_file="$(mktemp)"
if ! emit_line_specific_fallback_findings "$evidence_file" >"$findings_file"; then
rm -f "$findings_file"
return 1
fi

{
printf '## Pull request overview\n\n'
printf 'OpenCode reviewed the current-head bounded evidence and found failing GitHub Checks that need source-backed diagnosis before merge.\n\n'
printf 'OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.\n\n'
printf -- '- Result: REQUEST_CHANGES\n'
printf -- "- Reason: one or more GitHub Checks failed on current head \`%s\`.\n" "$HEAD_SHA"
printf -- "- Reason: failed current-head checks were mapped to line-specific findings below for \`%s\`.\n" "$HEAD_SHA"
printf -- "- Head SHA: \`%s\`\n" "$HEAD_SHA"
printf -- '- Workflow run: %s\n' "$RUN_ID"
printf -- '- Workflow attempt: %s\n\n' "$RUN_ATTEMPT"
printf '<details>\n<summary>Failed checks</summary>\n\n'
cat "$failed_checks_file"
printf '\n</details>\n\n'
printf '## Findings\n\n'
emit_line_specific_fallback_findings "$evidence_file"
cat "$findings_file"
printf '<details>\n<summary>Failed check evidence for line-specific fixes</summary>\n\n'
if [ -s "$evidence_file" ]; then
sed -n '1,900p' "$evidence_file"
Expand All @@ -2645,6 +2665,7 @@ jobs:
fi
printf '\n</details>\n'
} >"$body_file"
rm -f "$findings_file"
}

is_github_billing_lock_evidence() {
Expand Down Expand Up @@ -3132,6 +3153,7 @@ jobs:
| select((.name // "") != "opencode-review")
| select((.checkSuite.workflowRun.workflow.name // "") != "OpenCode Review")
| select((.conclusion // "" | ascii_upcase) as $c | ["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"] | index($c))
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and (.name // "") == "metadata-only gate evaluation" and (.checkSuite.workflowRun.workflow.name // "") == "PR Governance") | not)
| "- " + ((.checkSuite.workflowRun.workflow.name // "") + "/" + (.name // "check") | gsub("^/"; "")) + ": " + (.conclusion // "unknown") + (if (.detailsUrl // "") != "" then " (" + .detailsUrl + ")" else "" end)
elif .__typename == "StatusContext" then
select(((.context // "") | ascii_downcase | contains("opencode-review")) | not)
Expand Down Expand Up @@ -3399,9 +3421,12 @@ jobs:

if run_failed_check_diagnosis "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"; then
create_pull_review_with_payload "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"
else
build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"
elif build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"; then
create_pull_review "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")"
else
echo "::error::Failed GitHub Checks were present, but OpenCode could not derive source-backed line-specific findings after retries. Leaving the PR review unchanged so the current-head review can be rerun with better evidence."
echo "::endgroup::"
exit 1
fi
echo "::endgroup::"
exit 0
Expand Down Expand Up @@ -3586,11 +3611,14 @@ jobs:
create_pull_review_with_payload "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"
echo "::endgroup::"
exit 0
else
build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"
elif build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"; then
create_pull_review "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")"
echo "::endgroup::"
exit 0
else
echo "::error::Failed GitHub Checks were present, but OpenCode could not derive source-backed line-specific findings after retries. Leaving the PR review unchanged so the current-head review can be rerun with better evidence."
echo "::endgroup::"
exit 1
fi
fi
unresolved_human_threads_file="$(mktemp)"
Expand Down Expand Up @@ -3657,9 +3685,12 @@ jobs:
publish_request_changes_from_control "$control_json"
elif run_failed_check_diagnosis "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"; then
create_pull_review_with_payload "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"
else
build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"
elif build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"; then
create_pull_review "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")"
else
echo "::error::Failed GitHub Checks were present, but OpenCode could not derive source-backed line-specific findings after retries. Leaving the PR review unchanged so the current-head review can be rerun with better evidence."
echo "::endgroup::"
exit 1
fi
else
publish_request_changes_from_control "$control_json"
Expand Down Expand Up @@ -3691,9 +3722,12 @@ jobs:
fi
if run_failed_check_diagnosis "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"; then
create_pull_review_with_payload "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")" "$failed_check_review_payload_file" "$failed_check_inline_failure_body_file"
else
build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"
elif build_failed_check_fallback_body "$failed_checks_file" "$failed_check_evidence_file" "$failed_check_review_body_file"; then
create_pull_review "REQUEST_CHANGES" "$(cat "$failed_check_review_body_file")"
else
echo "::error::Failed GitHub Checks were present, but OpenCode could not derive source-backed line-specific findings after retries. Leaving the PR review unchanged so the current-head review can be rerun with better evidence."
echo "::endgroup::"
exit 1
fi
else
if request_changes_for_merge_conflict_if_present; then
Expand Down
1 change: 1 addition & 0 deletions scripts/ci/collect_failed_check_evidence.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,7 @@ gh api graphql \
if .__typename == "CheckRun" then
select((.status // "") == "COMPLETED")
| select((.conclusion // "" | ascii_upcase) as $c | ["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"] | index($c))
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and (.name // "") == "metadata-only gate evaluation" and (.checkSuite.workflowRun.workflow.name // "") == "PR Governance") | not)
| [
"check_run",
(((.checkSuite.workflowRun.workflow.name // "") + "/" + (.name // "check")) | gsub("^/"; "")),
Expand Down
3 changes: 2 additions & 1 deletion scripts/ci/emit_opencode_failed_check_fallback_findings.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -745,5 +745,6 @@ emit_strix_provider_failure_finding "$strix_evidence_file"
emit_strix_cancelled_without_log_finding "$strix_evidence_file"

if [ "$finding_index" -eq 0 ]; then
printf 'No automated line-specific fallback pattern matched this failed check. Do not approve or post a URL-only review; inspect the failed-check evidence below, identify the exact failing source line, explain the root cause, and provide the focused rerun command before approval.\n\n'
printf 'No source-backed failed-check fallback finding matched the available evidence; leaving the PR review unchanged so the current-head review can be rerun with better evidence.\n' >&2
exit 1
fi
9 changes: 7 additions & 2 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -572,6 +572,8 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" 'select((.workflowName // "") == "Strix Security Scan" or (.workflowName // "") == "Strix")' "failed-check evidence only appends Strix workflow runs"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" 'group_by(.__context_key)' "failed-check evidence groups manual Strix statuses by context before accepting superseding success"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" 'map(last)' "failed-check evidence accepts only the latest status per context"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" 'metadata-only gate evaluation' "failed-check evidence ignores cancelled metadata-only PR Governance helper gates"
assert_file_contains "$workflow_file" 'metadata-only gate evaluation' "opencode approval gate ignores cancelled metadata-only PR Governance helper gates"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" '"strix security scan/"*' "failed-check evidence maps stale Strix workflow helper checks to the manual strix evidence status"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" '[ "$failed_run_id" -ge "$success_run_id" ]' "failed-check evidence only supersedes Strix helper checks older than the manual success run"
assert_file_contains "$REPO_ROOT/scripts/ci/collect_failed_check_evidence.sh" 'redact_sensitive_log()' "failed-check evidence redacts sensitive values before emitting logs"
Expand Down Expand Up @@ -722,7 +724,10 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$workflow_file" '"lsp": "allow"' "opencode generated config enables LSP"
assert_file_contains "$workflow_file" '"lsp": true' "opencode generated config starts built-in LSP servers when available"
assert_file_contains "$workflow_file" "OpenCode runtime tools are enabled: bash, task, webfetch, websearch, and lsp." "opencode review prompt names the enabled runtime tools"
assert_file_contains "$workflow_file" "OpenCode failed-check fallback helper exited non-zero; using inline fallback." "opencode failed-check fallback handles helper failures without aborting under set -e"
assert_file_contains "$workflow_file" "OpenCode failed-check fallback helper did not produce source-backed findings; leaving the PR review unchanged for rerun." "opencode failed-check fallback avoids generic review comments when helper output is not source-backed"
assert_file_contains "$workflow_file" "OpenCode failed-check fallback helper returned non-source-backed generic output; leaving the PR review unchanged for rerun." "opencode failed-check fallback rejects stale helper scripts that exit zero with generic no-evidence text"
assert_file_contains "$workflow_file" "could not derive source-backed line-specific findings after retries" "opencode failed-check fallback fails the check instead of posting URL-only request-changes reviews"
assert_file_not_contains "$workflow_file" "OpenCode failed-check fallback helper exited non-zero; using inline fallback." "opencode failed-check fallback must not silently downgrade helper failures to generic inline fallback reviews"
assert_file_contains "$workflow_file" "Do not depend on Copilot Review, CodeRabbitAI, or any human reviewer" "opencode review format is independent of other review agents"
assert_file_contains "$REPO_ROOT/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "emit_strix_report_findings" "failed-check fallback emits every Strix vulnerability report as a separate finding"
assert_file_contains "$REPO_ROOT/scripts/ci/emit_opencode_failed_check_fallback_findings.sh" "Strix provider signal left current-head security evidence incomplete" "failed-check fallback does not claim reports are absent after Strix emitted vulnerabilities"
Expand All @@ -746,7 +751,7 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
assert_file_contains "$workflow_file" "- Root cause:" "opencode review request-changes body includes root cause per finding"
assert_file_contains "$workflow_file" "- Regression test:" "opencode review request-changes body includes regression test direction per finding"
assert_file_contains "$workflow_file" "- Suggested diff:" "opencode review request-changes body includes suggested diff per finding"
assert_file_contains "$workflow_file" "OpenCode reviewed the current-head bounded evidence and found failing GitHub Checks that need source-backed diagnosis before merge." "opencode review workflow requests changes when current-head GitHub Checks failed"
assert_file_contains "$workflow_file" "OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge." "opencode review workflow requests changes only when current-head failed checks are mapped to source-backed findings"
assert_file_contains "$workflow_file" "OpenCode reviewed the current-head evidence but could not verify peer GitHub Checks before approval." "opencode review workflow explains check lookup failures instead of approving"
assert_file_contains "$workflow_file" '["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"]' "opencode review workflow treats failed check-run conclusions as request-changes blockers"
assert_file_contains "$workflow_file" '["FAILURE","ERROR"]' "opencode review workflow treats failed status contexts as request-changes blockers"
Expand Down