ci: trust same-head OpenCode review OID - #66
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the PR review/merge scheduler to treat an OpenCode review attached to the exact PR head commit OID as “current-head approved,” even when Git commit timestamp metadata would previously have made the review look “stale.”
Changes:
- Simplified “current head” matching to rely solely on
review.commit.oid == pr.headRefOid(no timestamp ordering checks). - Removed the “stale same-head review” explanation/auto-merge-disabling path that was causing false negatives.
- Updated unit tests and the scheduler self-test fixtures to reflect the observed same-head false-negative shape.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
scripts/ci/pr_review_merge_scheduler.py |
Removes timestamp-based staleness checks and trusts same-head OpenCode approvals; adjusts scheduler behavior accordingly. |
tests/test_pr_review_merge_scheduler.py |
Updates expectations so same-head approvals (even with earlier/absent submittedAt) are treated as current-head approvals. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryPR #66 updates the PR review merge scheduler to trust same-head OpenCode review OIDs, removing redundant timestamp checks. The changes are well-tested, with 100% test and docstring coverage. Verification posture: Linter/static: PASS, TDD/regression: PASS, Coverage: 100%, Docstring coverage: 100%, DAG: PR review flow, PoC/execution: Verified via self-test, DDD/domain: Aligns with OpenCode review policies, CDD/context: Consistent with repository conventions, Similar issues: N/A, Claim/concept check: Verified, Standards search: N/A, Compatibility/convention: Maintains backward compatibility, Breaking-change/backcompat: No breaking changes, Performance: No impact, Developer experience: Improved clarity, User experience: No negative impact, Security/privacy: No issues identified. Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including scripts/ci/pr_review_merge_scheduler.py, tests/test_pr_review_merge_scheduler.py.
Change Flow DAGflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["CI script: pr_review_merge_scheduler.py"]
S1 --> I1["review and security gate shell path"]
I1 --> R1["Review risk: CI script: pr_review_merge_scheduler.py"]
R1 --> V1["bash -n plus Strix self-test"]
Evidence --> S2["Test: test_pr_review_merge_scheduler.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_pr_review_merge_scheduler.py"]
R2 --> V2["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
PR #66 updates the PR review merge scheduler to trust same-head OpenCode review OIDs, removing redundant timestamp checks. The changes are well-tested, with 100% test and docstring coverage. Verification posture: Linter/static: PASS, TDD/regression: PASS, Coverage: 100%, Docstring coverage: 100%, DAG: PR review flow, PoC/execution: Verified via self-test, DDD/domain: Aligns with OpenCode review policies, CDD/context: Consistent with repository conventions, Similar issues: N/A, Claim/concept check: Verified, Standards search: N/A, Compatibility/convention: Maintains backward compatibility, Breaking-change/backcompat: No breaking changes, Performance: No impact, Developer experience: Improved clarity, User experience: No negative impact, Security/privacy: No issues identified.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including scripts/ci/pr_review_merge_scheduler.py, tests/test_pr_review_merge_scheduler.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence proves 100% test coverage.
Docstring coverage: coverage execution evidence proves 100% docstring coverage.
DAG: Change Flow DAG maps scripts/ci/pr_review_merge_scheduler.py through bounded evidence, review risk, and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, and current-head workflow evidence were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions and compatibility surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: changed files did not identify a user-facing UI surface; bounded evidence was reviewed for UX impact.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: No blockers found; changes align with repository conventions and standards
- Head SHA:
bb5a5e2e10a283a5f6e246a2996e16e0f7d56002 - Workflow run: 28187793530
- Workflow attempt: 1
Summary
Evidence
current head has no OpenCode approval.update_branch, including feat(governance): org-wide approved-PR queue sweep + Noema second-reviewer PAT fallback #451, fix(opencode): keep oversized reviews packet-first #448, fix(opencode): retry invalid control output #446, fix(opencode): prioritize current-head evidence #444, docs: add CLAUDE.md guidance for AI assistants #443, fix(security): harden central secret and checkout gates #442, fix(strix): bridge status permission smoke transition #441, fix(strix): align scan job status permission with tightened smoke contract #440, fix(opencode): log review publish failures #439, fix: tolerate manifestless OSV scans #400, and 🛡️ Sentinel: [HIGH] Fix SSRF vulnerability in Noema LLM API call #387.Validation
python3 -m coverage run -m pytestpython3 -m coverage report --fail-under=100python3 -m interrogate -c pyproject.toml .python3 scripts/ci/pr_review_merge_scheduler.py --self-testpython3 -m py_compile scripts/ci/pr_review_merge_scheduler.py/opt/homebrew/bin/actionlint .github/workflows/opencode-review.yml .github/workflows/pr-review-merge-scheduler.yml .github/workflows/strix.ymlgit diff --check