fix(ci): run hourly review autofix through NVIDIA NIM

[seonghobae]

Purpose

Migrate the write-capable scheduled OpenCode PR review-autofix worker from GitHub Models to the organization secret NVIDIA_NIM_API_KEY, while preserving the existing read-only review agent's independent workflow, credential, and model-pool contract.

This PR is intentionally stacked on #731 because #731 establishes the hourly scheduler cadence, one-hour same-head retry, immutable scheduler-source binding, dependency snapshots, and central security baseline.

Changes

• configure the scheduled worker with the single enabled provider nvidia-nim through OpenCode's OpenAI-compatible provider adapter;
• use mistralai/mistral-nemotron as the primary repair model and nvidia/nemotron-3-nano-30b-a3b as the bounded helper model;
• bind NVIDIA_API_KEY from secrets.NVIDIA_NIM_API_KEY only in the two OpenCode execution steps;
• fail closed before model execution when the NVIDIA secret is empty;
• remove GitHub Models provider, endpoint, model, token, and USE_GITHUB_TOKEN model-auth fallback from the scheduled autofix path;
• keep file edits constrained to the current actionable-review allowlist and retain the existing exact-head, same-repository, syntax, conflict-marker, and pre-push guards;
• remove GITHUB_TOKEN from the ordinary model step and launch both OpenCode child processes with GITHUB_TOKEN, GH_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, and ACTIONS_ID_TOKEN_REQUEST_URL explicitly unset;
• retain GitHub credentials only in reviewed shell logic that validates metadata or publishes the verified branch update;
• pin .github/workflows/opencode-review-dispatch.yml byte-for-byte so the existing independent reviewer-agent key system is not changed;
• add APA 7th doctoring for provider, credential, source-integrity, subprocess-isolation, MSA, rollback, and activation boundaries.

TDD evidence

The test-only phase failed against the inherited GitHub Models configuration. The production phase then satisfied focused contracts for:

1. hourly scheduler cadence inherited from fix(ci): restore central review, security, snapshots, and hourly repair #731;
2. NVIDIA NIM as the only scheduled autofix provider;
3. published primary and helper model identifiers;
4. exactly two NVIDIA_NIM_API_KEY bindings;
5. no GitHub Models/model-auth fallback;
6. immutable default-branch dispatch source checkout;
7. explicit denial of non-file OpenCode interactions;
8. fail-closed missing-secret behavior;
9. removal of GitHub and OIDC credentials from both model subprocesses; and
10. byte-for-byte preservation of the independent reviewer workflow.

A deterministic GitHub-hosted one-shot verification executed the focused contracts and git diff --check before publishing the workflow update. The one-shot workflow removed itself, so the final PR contains exactly three reviewed files.

Security and operational boundaries

• This PR does not change the review agent, its secrets, or its model pool.
• The NVIDIA credential is not a GitHub credential and cannot authorize repository mutation.
• The OpenCode model child receives no GitHub API or OIDC token material.
• The worker cannot approve its own output, weaken branch protection, reinterpret queued checks as success, or publish a release.
• Missing NVIDIA service credentials or provider availability leave scheduled autofix failed/blocked while independent review and manual maintenance remain available.
• No second timer is created; this worker is invoked by the hourly central scheduler from fix(ci): restore central review, security, snapshots, and hourly repair #731.

Standards traceability

docs/doctoring/hourly-nvidia-nim-autofix.md records the design and APA 7th references to GitHub's event/secret guidance, NVIDIA NIM API/model documentation, and OpenCode provider/permission documentation. The implementation applies those boundaries without claiming formal certification.

Required before merge

• fix(ci): restore central review, security, snapshots, and hourly repair #731 merged into protected main;
• this PR retargeted/rebased onto that exact main without helper-workflow residue;
• exact-current-head workflow, coverage/docstring, security, CodeRabbit, OpenCode/Noema review, unresolved-thread, and branch-protection gates successful;
• approval from an identity other than the last pusher;
• SHA-bound merge without administrator bypass.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e1a27870-ccd9-4575-8c9d-03e34610c918

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}