chore: sync main into coverage-runner fix branch

.github/workflows/noema-review.yml

@@ -250,6 +250,23 @@ jobs:
           echo "::add-mask::$app_token"
           echo "token=$app_token" >>"$GITHUB_OUTPUT"
 
+      - name: Resolve Noema target repository visibility
+        if: env.PR_NUMBER != ''
+        id: target_visibility
+        env:
+          GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
+        run: |
+          set -euo pipefail
+          is_private="$(gh api "repos/${TARGET_REPOSITORY}" --jq '.private')"
+          case "$is_private" in
+            true | false) ;;
+            *)
+              echo "::error::Noema target repository visibility did not resolve to true or false."
+              exit 1
+              ;;
+          esac
+          echo "is_private=$is_private" >>"$GITHUB_OUTPUT"
+
       - name: Run Noema LLM review and submit verdict
         if: env.PR_NUMBER != ''
         env:
@@ -258,6 +275,8 @@ jobs:
           NOEMA_LLM_API_URL: ${{ vars.NOEMA_LLM_API_URL || '' }}
           NOEMA_LLM_MODEL: ${{ vars.NOEMA_LLM_MODEL || '' }}
           NOEMA_LLM_API_KEY: ${{ secrets.NOEMA_LLM_API_KEY || secrets.OPENAI_API_KEY || '' }}
+          NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+          TARGET_REPOSITORY_PRIVATE: ${{ steps.target_visibility.outputs.is_private }}
         run: |
           set -euo pipefail
           if [ -z "${PR_NUMBER:-}" ]; then
@@ -268,6 +287,11 @@ jobs:
             echo "::error::Noema reviewer credential selection succeeded but no token was minted; review cannot submit a verdict."
             exit 1
           fi
+          if [ "$TARGET_REPOSITORY_PRIVATE" = "false" ] && [ -n "${NVIDIA_NIM_API_KEY:-}" ] && [ -z "${NOEMA_LLM_API_URL:-}" ] && [ -z "${NOEMA_LLM_MODEL:-}" ]; then
+            export NOEMA_LLM_API_URL="https://integrate.api.nvidia.com/v1/chat/completions"
+            export NOEMA_LLM_MODEL="nvidia/nemotron-3-ultra-550b-a55b"
+            export NOEMA_LLM_API_KEY="${NVIDIA_NIM_API_KEY:-}"
+          fi
           if [ -z "${NOEMA_LLM_API_URL:-}" ] || [ -z "${NOEMA_LLM_MODEL:-}" ] || [ -z "${NOEMA_LLM_API_KEY:-}" ]; then
             echo "::error::Noema LLM is unconfigured: NOEMA_LLM_API_URL, NOEMA_LLM_MODEL, and NOEMA_LLM_API_KEY (or OPENAI_API_KEY) are required."
             exit 1

.github/workflows/pr-review-merge-scheduler.yml

@@ -94,6 +94,7 @@ concurrency:
     github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number && format('pr-{0}', github.event.workflow_run.pull_requests[0].number) ||
     github.event_name == 'workflow_call' && inputs.pr_number != '' && format('pr-{0}', inputs.pr_number) ||
     github.event_name == 'workflow_call' && inputs.base_branch != '' && format('call-{0}', inputs.base_branch) ||
+    github.event_name == 'schedule' && format('schedule-{0}', github.event.schedule) ||
     github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository != '' && github.event.client_payload.pr_number != '' && format('target-{0}-pr-{1}', github.event.client_payload.target_repository, github.event.client_payload.pr_number) ||
     github.event_name == 'repository_dispatch' && github.event.client_payload.pr_number != '' && format('pr-{0}', github.event.client_payload.pr_number) ||
     github.event_name == 'repository_dispatch' && github.run_id ||
@@ -563,7 +564,11 @@ jobs:
         (github.event_name == 'repository_dispatch' && github.event.client_payload.org_sweep == true)
       )
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    # The complete organization walk exceeded the legacy 30-minute boundary in
+    # production. Keep one running and one latest pending */15 sweep through the
+    # schedule-specific concurrency key above, while allowing the current walk
+    # enough time to finish instead of cancelling before later repositories.
+    timeout-minutes: 60
     permissions:
       actions: write
       checks: read
@@ -583,10 +588,10 @@ jobs:
       ORG_SWEEP_MAX_PRS: ${{ github.event.client_payload.max_prs || inputs.max_prs || vars.ORG_SWEEP_MAX_PRS || '1000' }}
       ORG_SWEEP_REVIEW_DISPATCH_LIMIT: ${{ github.event.client_payload.review_dispatch_limit || inputs.review_dispatch_limit || vars.ORG_SWEEP_REVIEW_DISPATCH_LIMIT || '1' }}
       ORG_SWEEP_BRANCH_UPDATE_LIMIT: ${{ github.event.client_payload.branch_update_limit || inputs.branch_update_limit || vars.ORG_SWEEP_BRANCH_UPDATE_LIMIT || '1' }}
-      ORG_SWEEP_TRIGGER_REVIEWS: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.trigger_reviews != false || inputs.trigger_reviews == true }}
-      ORG_SWEEP_ENABLE_AUTO_MERGE: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.enable_auto_merge != false || inputs.enable_auto_merge == true }}
+      ORG_SWEEP_TRIGGER_REVIEWS: ${{ github.event_name == 'schedule' || github.event_name == 'repository_dispatch' && github.event.client_payload.trigger_reviews != false || inputs.trigger_reviews == true }}
+      ORG_SWEEP_ENABLE_AUTO_MERGE: ${{ github.event_name == 'schedule' || github.event_name == 'repository_dispatch' && github.event.client_payload.enable_auto_merge != false || inputs.enable_auto_merge == true }}
       ORG_SWEEP_MERGE_MODE: ${{ github.event.client_payload.merge_mode || inputs.merge_mode || 'direct_or_auto' }}
-      ORG_SWEEP_UPDATE_BRANCHES: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.update_branches != false || inputs.update_branches == true }}
+      ORG_SWEEP_UPDATE_BRANCHES: ${{ github.event_name == 'schedule' || github.event_name == 'repository_dispatch' && github.event.client_payload.update_branches != false || inputs.update_branches == true }}
       ORG_SWEEP_STALE_QUEUE_HOURS: ${{ vars.ORG_SWEEP_STALE_QUEUE_HOURS || '24' }}
       # A repository the sweep credential structurally cannot read (the OpenCode
       # app is not installed there / the PR_REVIEW_MERGE_TOKEN lacks it) returns

.github/workflows/strix.yml

@@ -258,6 +258,27 @@ jobs:
             echo "token=$app_token"
           } >>"$GITHUB_OUTPUT"
 
+      - name: Resolve target repository visibility
+        id: target_visibility
+        env:
+          GH_TOKEN: ${{ steps.target_app_token.outputs.token || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
+          TARGET_REPOSITORY: ${{ github.event.client_payload.target_repository || github.event.pull_request.base.repo.full_name || github.repository }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]]; then
+            echo "::error::Strix target repository must belong to ContextualWisdomLab."
+            exit 1
+          fi
+          is_private="$(gh api "repos/${TARGET_REPOSITORY}" --jq '.private')"
+          case "$is_private" in
+            true | false) ;;
+            *)
+              echo "::error::Target repository visibility did not resolve to true or false."
+              exit 1
+              ;;
+          esac
+          echo "is_private=$is_private" >>"$GITHUB_OUTPUT"
+
       - name: Materialize target workspace
         if: github.event_name != 'repository_dispatch'
         env:
@@ -422,13 +443,20 @@ jobs:
       - name: Gate Strix secrets
         id: gate
         env:
-          STRIX_MODEL: ${{ github.event.client_payload.strix_llm || 'gpt-5.6-luna' }}
+          STRIX_MODEL: ${{ github.event.client_payload.strix_llm || (steps.target_visibility.outputs.is_private == 'false' && 'nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b' || 'gpt-5.6-luna') }}
+          STRIX_MODEL_REQUESTED: ${{ github.event.client_payload.strix_llm || '' }}
           STRIX_OPENAI_API_KEY: ${{ secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY }}
           STRIX_OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          STRIX_NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
           STRIX_VERTEX_CREDENTIALS: ${{ secrets.GCP_SA_KEY }}
           STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
+          TARGET_REPOSITORY_PRIVATE: ${{ steps.target_visibility.outputs.is_private }}
         run: |
           strix_model="$(printf '%s' "$STRIX_MODEL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+          if [ -z "$STRIX_MODEL_REQUESTED" ] && [ "$strix_model" = "nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b" ] && [ -z "${STRIX_NVIDIA_NIM_API_KEY:-}" ]; then
+            strix_model="gpt-5.6-luna"
+          fi
+          echo "strix_model=$strix_model" >> "$GITHUB_OUTPUT"
           case "$strix_model" in
             openai/gpt-5-mini* | openai/gpt-5-nano* | \
             openai/openai/gpt-5-mini* | openai/openai/gpt-5-nano* | \
@@ -469,6 +497,20 @@ jobs:
                 exit 1
               fi
               ;;
+            nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b)
+              if [ "$TARGET_REPOSITORY_PRIVATE" != "false" ]; then
+                echo '::error::NVIDIA NIM hosted trial scans are limited to public repositories.'
+                exit 1
+              fi
+              echo 'enabled=true' >> "$GITHUB_OUTPUT"
+              echo 'provider_mode=nvidia_nim' >> "$GITHUB_OUTPUT"
+              sanitized_nvidia_key="$(printf '%s' "$STRIX_NVIDIA_NIM_API_KEY" | tr -d '\r\n')"
+              trimmed_nvidia_key="$(printf '%s' "$sanitized_nvidia_key" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+              if [ -z "$trimmed_nvidia_key" ]; then
+                echo '::error::NVIDIA_NIM_API_KEY is required for Strix NVIDIA NIM scans.'
+                exit 1
+              fi
+              ;;
             vertex_ai/gemini-3.1-pro-preview-customtools | vertex_ai/gemini-2.5-flash)
               echo 'enabled=true' >> "$GITHUB_OUTPUT"
               echo 'provider_mode=vertex_ai' >> "$GITHUB_OUTPUT"
@@ -480,7 +522,7 @@ jobs:
               fi
               ;;
             *)
-              echo '::error::STRIX_LLM must select GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model.'
+              echo '::error::STRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model.'
               exit 1
               ;;
           esac
@@ -550,7 +592,7 @@ jobs:
       - name: Mask LLM API key
         if: steps.gate.outputs.enabled == 'true'
         env:
-          LLM_API_KEY: ${{ steps.gate.outputs.provider_mode == 'github_models' && (secrets.STRIX_GITHUB_MODELS_TOKEN || github.token) || steps.gate.outputs.provider_mode == 'openai_direct' && (secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY) || steps.gate.outputs.provider_mode == 'openrouter' && secrets.OPENROUTER_API_KEY || '' }}
+          LLM_API_KEY: ${{ steps.gate.outputs.provider_mode == 'github_models' && (secrets.STRIX_GITHUB_MODELS_TOKEN || github.token) || steps.gate.outputs.provider_mode == 'openai_direct' && (secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY) || steps.gate.outputs.provider_mode == 'openrouter' && secrets.OPENROUTER_API_KEY || steps.gate.outputs.provider_mode == 'nvidia_nim' && secrets.NVIDIA_NIM_API_KEY || '' }}
         run: |
           # Sanitize CR/LF before masking to prevent broken ::add-mask::
           # commands and potential workflow command injection.
@@ -566,7 +608,7 @@ jobs:
       - name: Prepare LLM API key input file
         if: steps.gate.outputs.enabled == 'true'
         env:
-          LLM_API_KEY_SECRET: ${{ steps.gate.outputs.provider_mode == 'github_models' && (secrets.STRIX_GITHUB_MODELS_TOKEN || github.token) || steps.gate.outputs.provider_mode == 'openai_direct' && (secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY) || steps.gate.outputs.provider_mode == 'openrouter' && secrets.OPENROUTER_API_KEY || '' }}
+          LLM_API_KEY_SECRET: ${{ steps.gate.outputs.provider_mode == 'github_models' && (secrets.STRIX_GITHUB_MODELS_TOKEN || github.token) || steps.gate.outputs.provider_mode == 'openai_direct' && (secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY) || steps.gate.outputs.provider_mode == 'openrouter' && secrets.OPENROUTER_API_KEY || steps.gate.outputs.provider_mode == 'nvidia_nim' && secrets.NVIDIA_NIM_API_KEY || '' }}
           PROVIDER_MODE: ${{ steps.gate.outputs.provider_mode }}
         run: |
           sanitized="$(printf '%s' "$LLM_API_KEY_SECRET" | tr -d '\r\n')"
@@ -583,6 +625,10 @@ jobs:
             echo '::error::OPENROUTER_API_KEY is required for Strix OpenRouter scans.'
             exit 1
           fi
+          if [ -z "$trimmed" ] && [ "$PROVIDER_MODE" = "nvidia_nim" ]; then
+            echo '::error::NVIDIA_NIM_API_KEY is required for Strix NVIDIA NIM scans.'
+            exit 1
+          fi
           umask 077
           llm_api_key_file="$RUNNER_TEMP/llm_api_key.txt"
           printf '%s' "$trimmed" > "$llm_api_key_file"
@@ -596,6 +642,14 @@ jobs:
           printf '%s' 'https://openrouter.ai/api/v1' > "$llm_api_base_file"
           echo "LLM_API_BASE_FILE=$llm_api_base_file" >> "$GITHUB_ENV"
 
+      - name: Prepare NVIDIA NIM API base
+        if: steps.gate.outputs.provider_mode == 'nvidia_nim'
+        run: |
+          umask 077
+          llm_api_base_file="$RUNNER_TEMP/llm_api_base.txt"
+          printf '%s' 'https://integrate.api.nvidia.com/v1' > "$llm_api_base_file"
+          echo "LLM_API_BASE_FILE=$llm_api_base_file" >> "$GITHUB_ENV"
+
       - name: Prepare GitHub Models API base
         if: steps.gate.outputs.provider_mode == 'github_models'
         run: |
@@ -605,7 +659,7 @@ jobs:
           echo "LLM_API_BASE_FILE=$llm_api_base_file" >> "$GITHUB_ENV"
 
       - name: Prepare GitHub Models fallback credentials
-        if: steps.gate.outputs.provider_mode == 'openai_direct' || steps.gate.outputs.provider_mode == 'openrouter'
+        if: steps.gate.outputs.provider_mode == 'openai_direct' || steps.gate.outputs.provider_mode == 'openrouter' || steps.gate.outputs.provider_mode == 'nvidia_nim'
         env:
           GITHUB_MODELS_FALLBACK_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
         run: |
@@ -680,7 +734,7 @@ jobs:
       - name: Prepare Strix model input file
         if: steps.gate.outputs.enabled == 'true'
         env:
-          STRIX_MODEL: ${{ github.event.client_payload.strix_llm || 'gpt-5.6-luna' }}
+          STRIX_MODEL: ${{ steps.gate.outputs.strix_model }}
         run: |
           umask 077
           strix_llm_file="$RUNNER_TEMP/strix_llm.txt"
@@ -709,11 +763,14 @@ jobs:
             openrouter/free | openrouter/openrouter/free)
               printf '%s' 'openrouter/free' > "$strix_llm_file"
               ;;
+            nvidia_nim/nvidia/nemotron-3-ultra-550b-a55b)
+              printf '%s' "$strix_model" > "$strix_llm_file"
+              ;;
             vertex_ai/gemini-3.1-pro-preview-customtools | vertex_ai/gemini-2.5-flash)
               printf '%s' "$strix_model" > "$strix_llm_file"
               ;;
             *)
-              echo '::error::STRIX_LLM must select GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model.'
+              echo '::error::STRIX_LLM must select NVIDIA NIM Nemotron, GitHub Models openai/gpt-5 or newer, direct OpenAI GPT-5.4 or newer, OpenRouter openrouter/free, or an approved organization Vertex AI model.'
               exit 1
               ;;
           esac
@@ -732,7 +789,7 @@ jobs:
           STRIX_LLM_FILE: ${{ env.STRIX_LLM_FILE }}
           STRIX_REPO_ROOT: ${{ runner.temp }}/trusted-workspace
           LLM_API_BASE_FILE: ${{ env.LLM_API_BASE_FILE }}
-          STRIX_LLM_DEFAULT_PROVIDER: ${{ steps.gate.outputs.provider_mode == 'vertex_ai' && 'vertex_ai' || 'openai' }}
+          STRIX_LLM_DEFAULT_PROVIDER: ${{ steps.gate.outputs.provider_mode == 'vertex_ai' && 'vertex_ai' || steps.gate.outputs.provider_mode == 'nvidia_nim' && 'nvidia_nim' || 'openai' }}
           LLM_API_KEY_FILE: ${{ env.LLM_API_KEY_FILE }}
           GOOGLE_APPLICATION_CREDENTIALS: ${{ env.GOOGLE_APPLICATION_CREDENTIALS }}
           CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE: ${{ env.CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE }}
@@ -750,7 +807,7 @@ jobs:
           STRIX_LLM_MAX_RETRIES: 1
           STRIX_TRANSIENT_RETRY_PER_MODEL: 2
           STRIX_TRANSIENT_RETRY_BACKOFF_SECONDS: 60
-          STRIX_FALLBACK_MODELS: ${{ steps.gate.outputs.provider_mode == 'github_models' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openai_direct' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openrouter' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || '' }}
+          STRIX_FALLBACK_MODELS: ${{ steps.gate.outputs.provider_mode == 'github_models' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openai_direct' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'openrouter' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || steps.gate.outputs.provider_mode == 'nvidia_nim' && 'github_models/openai/o3 github_models/openai/gpt-5-chat' || '' }}
           STRIX_GITHUB_MODELS_API_BASE_FILE: ${{ env.STRIX_GITHUB_MODELS_API_BASE_FILE }}
           STRIX_GITHUB_MODELS_KEY_FILE: ${{ env.STRIX_GITHUB_MODELS_KEY_FILE }}
           STRIX_FAIL_ON_PROVIDER_SIGNAL: "1"

docs/nvidia-nim-opencode-hotfix.md

@@ -0,0 +1,53 @@
+# NVIDIA NIM OpenCode model priority (hotfix)
+
+## Why
+
+OpenCode Agent failed to produce a usable review on the PR thread starting at
+ContextualWisdomLab/fast-mlsirm#290 (`opencode-review` check **skipped**, no
+`opencode-agent[bot]` review comment). Central review therefore prioritizes
+**NVIDIA NIM** models as additional catalog candidates so the model pool can
+still emit APPROVE / REQUEST_CHANGES when GitHub Models / free tiers stall.
+
+## Changes
+
+1. `opencode.jsonc`
+   - `enabled_providers`: `nvidia-nim` first, then `github-models`
+   - default `model` / `small_model` prefer NIM Nemotron / Llama 3.3
+   - new OpenAI-compatible provider `nvidia-nim` → `https://integrate.api.nvidia.com/v1`
+     with `apiKey: {env:NVIDIA_API_KEY}`
+2. `.github/workflows/opencode-review-dispatch.yml`
+   - `OPENCODE_MODEL_CANDIDATES` prefixes six NIM models before existing pool
+   - binds `NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}`
+3. `scripts/ci/run_opencode_review_model_pool.sh`
+   - skips `nvidia-nim/*` when `NVIDIA_API_KEY` is unset (same pattern as OpenRouter)
+
+## Temporary permission bypass (hotfix only)
+
+For this merge-aid hotfix only:
+
+- Branch-protection / ruleset admin override may be used to land the central
+  `.github` change if required checks conflict during the hotfix window.
+- **Do not** permanently weaken Security Scan, trivy-fs, osv-scan, or
+  CodeQL gates.
+- **Do not** flip OpenCode agent `permission.edit` / `bash` from `deny` to
+  `allow` permanently; review agents remain read-only.
+- Org secret `NVIDIA_API_KEY` must be set on ContextualWisdomLab for NIM pool
+  entries to execute; without it the pool falls through to prior candidates.
+
+## Rollback
+
+Remove the `nvidia-nim/*` prefixes from `OPENCODE_MODEL_CANDIDATES`, drop the
+`nvidia-nim` provider block, and delete this note once GitHub Models / OpenCode
+catalog reliability is restored.
+
+## Secret name
+
+Org secret is **`NVIDIA_NIM_API_KEY`**. Workflows bind it to process env `NVIDIA_API_KEY`
+(fallback: `secrets.NVIDIA_API_KEY` if present) so `opencode.jsonc` `{env:NVIDIA_API_KEY}` resolves.
+
+## Large-repo OpenCode timeouts (~1 hour)
+
+Primary/default run timeouts and the dynamic queue timeout cap default to
+**3600s** (hour-class) so large repositories are not cut off by the old 600s
+default when env is unset. Free-tier failover remains capped at 600s.
+Workflow-provided values (e.g. 5400s) still win over defaults.