From 92d9510ef6b0ed17c699032da5d0716c026b2b11 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 31 Jul 2026 20:19:44 +0900 Subject: [PATCH] fix(opencode): bind NVIDIA_NIM_API_KEY for NIM model pool Org secret is NVIDIA_NIM_API_KEY, not NVIDIA_API_KEY. Map it into the process env that opencode.jsonc and the pool skip check expect so nvidia-nim/* candidates are not skipped on every run. --- .github/workflows/opencode-review-dispatch.yml | 4 ++-- docs/nvidia-nim-opencode-hotfix.md | 5 +++++ scripts/ci/run_opencode_review_model_pool.sh | 6 ++++++ scripts/ci/test_strix_quick_gate.sh | 3 +++ 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index 668557dd4..c11d61ad4 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -4033,7 +4033,7 @@ jobs: # in the opencode.jsonc "openai" provider block. OPENCODE_API_KEY: ${{ secrets.OPENCODE_ZEN_API_KEY }} OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} - NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }} + NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY || secrets.NVIDIA_API_KEY }} OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} SHARE: "false" NPM_CONFIG_IGNORE_SCRIPTS: "true" @@ -4689,7 +4689,7 @@ jobs: # Exposed so the "openai" provider in opencode.jsonc resolves during the # failed-check diagnosis opencode run that shares this config. OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} - NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }} + NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY || secrets.NVIDIA_API_KEY }} OPENCODE_APP_TOKEN: ${{ steps.opencode_app_token.outputs.token }} OPENCODE_EVIDENCE_FILE: ${{ runner.temp }}/opencode-review-evidence.md OPENCODE_FAILED_CHECK_EVIDENCE_FILE: ${{ runner.temp }}/opencode-failed-check-evidence.md diff --git a/docs/nvidia-nim-opencode-hotfix.md b/docs/nvidia-nim-opencode-hotfix.md index 619128f9f..bc1a4f120 100644 --- a/docs/nvidia-nim-opencode-hotfix.md +++ b/docs/nvidia-nim-opencode-hotfix.md @@ -39,3 +39,8 @@ For this merge-aid hotfix only: Remove the `nvidia-nim/*` prefixes from `OPENCODE_MODEL_CANDIDATES`, drop the `nvidia-nim` provider block, and delete this note once GitHub Models / OpenCode catalog reliability is restored. + +## Secret name + +Org secret is **`NVIDIA_NIM_API_KEY`**. Workflows bind it to process env `NVIDIA_API_KEY` +(fallback: `secrets.NVIDIA_API_KEY` if present) so `opencode.jsonc` `{env:NVIDIA_API_KEY}` resolves. diff --git a/scripts/ci/run_opencode_review_model_pool.sh b/scripts/ci/run_opencode_review_model_pool.sh index f849c4db1..3f2c35a1b 100644 --- a/scripts/ci/run_opencode_review_model_pool.sh +++ b/scripts/ci/run_opencode_review_model_pool.sh @@ -352,6 +352,12 @@ is_nvidia_nim_candidate() { esac } +# Org secret is NVIDIA_NIM_API_KEY; opencode.jsonc expects NVIDIA_API_KEY. +# Normalize once so skip checks and the provider env share one name. +if [ -z "${NVIDIA_API_KEY:-}" ] && [ -n "${NVIDIA_NIM_API_KEY:-}" ]; then + export NVIDIA_API_KEY="$NVIDIA_NIM_API_KEY" +fi + is_low_sensitivity_candidate() { case "$1" in openai/*-mini | openai/*-nano | \ diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index daada89a7..2c6d153a8 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -1200,6 +1200,9 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" "nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 nvidia-nim/nvidia/llama-3.1-nemotron-ultra-253b-v1 nvidia-nim/nvidia/nemotron-3-super-120b-a12b nvidia-nim/meta/llama-3.3-70b-instruct nvidia-nim/deepseek-ai/deepseek-v4-pro nvidia-nim/mistralai/codestral-22b-instruct-v0.1 opencode/gpt-5.6-terra github-models/deepseek/deepseek-v3-0324 openai/gpt-5.6-luna openrouter/deepseek/deepseek-v3.2 openrouter/qwen/qwen3-coder github-models/openai/gpt-4.1 github-models/openai/gpt-5" "opencode review starts with paid Zen before DeepSeek V3 and full-size GPT fallbacks" assert_file_contains "$workflow_file" "github-models/deepseek/deepseek-r1-0528" "opencode review keeps a reachable DeepSeek R1 reasoning fallback model" assert_file_contains "$workflow_file" "github-models/deepseek/deepseek-v3-0324" "opencode review has a reachable DeepSeek V3 fallback model" +assert_file_contains "$workflow_file" "secrets.NVIDIA_NIM_API_KEY || secrets.NVIDIA_API_KEY" "opencode review binds org NVIDIA_NIM_API_KEY into NVIDIA_API_KEY env" +assert_file_contains "$REPO_ROOT/scripts/ci/run_opencode_review_model_pool.sh" "NVIDIA_NIM_API_KEY" "model pool normalizes NVIDIA_NIM_API_KEY to NVIDIA_API_KEY" + assert_file_contains "$workflow_file" "github-models/openai/gpt-5" "opencode review still has a bounded GPT-5 fallback model" assert_file_contains "$workflow_file" "Publish bounded OpenCode review comment" "opencode review workflow publishes the agent control comment for the approval gate" assert_file_contains "$workflow_file" "statusCheckRollup" "opencode review workflow reads current-head GitHub Checks before approval"