fix(ci): run hourly review autofix through NVIDIA NIM - #769
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
4a37f3f to
401d46c
Compare
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='bafc08927b517f3b21311124e95f11e205c3ec28'
head='401d46cba6b9ceb45957578ed2b8d1da6fc0da9c'
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '=== commit range ==='
git diff --name-status "$base" "$head"
printf '%s\n' '=== changed workflow and contract candidates ==='
git diff --name-only "$base" "$head" | grep -E '(^|/)(\.github/workflows/|CHANGELOG\.md|.*(test|contract|doctor|apa).*)' || true
printf '%s\n' '=== workflow inventory ==='
fd -t f . .github/workflows 2>/dev/null | sort || true
printf '%s\n' '=== source workflow blob IDs ==='
for f in .github/workflows/opencode-review-dispatch.yml .github/workflows/opencode-pr-autofix.yml; do
printf '%s: ' "$f"
git rev-parse "${base}:${f}" 2>/dev/null || printf 'absent\n'
printf '%s: ' "$f"
git rev-parse "${head}:${f}" 2>/dev/null || printf 'absent\n'
done
printf '%s\n' '=== complete diff ==='
git diff --find-renames --find-copies --unified=80 "$base" "$head" --Length of output: 51692 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='bafc08927b517f3b21311124e95f11e205c3ec28'
head='401d46cba6b9ceb45957578ed2b8d1da6fc0da9c'
red='a44b17369e818b2f8de5161b72565522e49dffee'
printf '%s\n' '=== exact-head workflow security references ==='
git grep -nE \
'github-models|models\.github\.ai|STRIX_GITHUB_MODELS_TOKEN|USE_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|NVIDIA_API_KEY|nvidia-nim|GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_(TOKEN|URL)|opencode run' \
"$head" -- .github/workflows/pr-review-autofix.yml || true
printf '%s\n' '=== exact-head scheduled workflow cadence and dispatch linkage ==='
git grep -nE \
'cron:|pr-review-autofix|repository_dispatch|uses:|ref:' \
"$head" -- .github/workflows/pr-review-fix-scheduler.yml .github/workflows/pr-review-autofix.yml || true
printf '%s\n' '=== workflow sections around all model subprocesses ==='
git show "${head}:.github/workflows/pr-review-autofix.yml" | nl -ba | sed -n '235,450p'
printf '%s\n' '=== test-first commit sequence ==='
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$red" "$head"
printf '%s\n' '=== RED commit changed paths ==='
git diff-tree --no-commit-id --name-status -r "$red"
printf '%s\n' '=== implementation commit changed paths ==='
git diff-tree --no-commit-id --name-status -r "$head"
printf '%s\n' '=== contract test evolution from RED to implementation ==='
git diff --unified=25 "${red}^" "$red" -- tests/test_pr_review_autofix_nvidia_nim_contract.py
git diff --unified=25 "$red" "$head" -- tests/test_pr_review_autofix_nvidia_nim_contract.py
printf '%s\n' '=== README-independent reviewer byte comparison ==='
test "$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")" = \
"$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
printf '%s\n' 'review dispatch blob unchanged: yes'Length of output: 9250 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='bafc08927b517f3b21311124e95f11e205c3ec28'
head='401d46cba6b9ceb45957578ed2b8d1da6fc0da9c'
red='a44b17369e818b2f8de5161b72565522e49dffee'
printf '%s\n' '=== exact-head model-execution sections ==='
git show "${head}:.github/workflows/pr-review-autofix.yml" | sed -n '300,540p'
printf '%s\n' '=== test-first commit metadata ==='
for commit in "$red" "$head"; do
git show -s --format='commit=%H%nparents=%P%nsubject=%s%n' "$commit"
done
printf '%s\n' '=== ancestry ==='
git merge-base --is-ancestor "$red" "$head" && echo 'RED commit is an ancestor of implementation: yes'
git merge-base --is-ancestor "$base" "$head" && echo 'requested base is an ancestor of implementation: yes'
printf '%s\n' '=== RED commit changed paths ==='
git diff-tree --no-commit-id --name-status -r "$red"
printf '%s\n' '=== implementation commit changed paths ==='
git diff-tree --no-commit-id --name-status -r "$head"
printf '%s\n' '=== contract test evolution ==='
git diff --unified=12 "${red}^" "$red" -- tests/test_pr_review_autofix_nvidia_nim_contract.py
git diff --unified=12 "$red" "$head" -- tests/test_pr_review_autofix_nvidia_nim_contract.py
printf '%s\n' '=== independent reviewer blob equality ==='
base_blob="$(git rev-parse "${base}:.github/workflows/opencode-review-dispatch.yml")"
head_blob="$(git rev-parse "${head}:.github/workflows/opencode-review-dispatch.yml")"
printf 'base=%s\nhead=%s\n' "$base_blob" "$head_blob"
test "$base_blob" = "$head_blob"Length of output: 20923 🤖 web_search executed:
Length of output: 6015
Verified at exact head
I did not execute repository tests. The sandbox review policy permits static inspection only. Hosted exact-head CI and the remaining merge gates still require completion.
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head401d46cba6b9ceb45957578ed2b8d1da6fc0da9c. -
Head SHA:
401d46cba6b9ceb45957578ed2b8d1da6fc0da9c -
Workflow run: 30969419031
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: pr-review-autofix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: pr-review-autofix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: hourly-nvidia-nim-autofix.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: hourly-nvidia-nim-autofix.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_pr_review_autofix_nvidia_nim_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_pr_review_autofix_nvidia_nim_contract.py"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: pr-review-autofix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: pr-review-autofix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: hourly-nvidia-nim-autofix.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: hourly-nvidia-nim-autofix.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_pr_review_autofix_nvidia_nim_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_pr_review_autofix_nvidia_nim_contract.py"]
R4 --> V4["targeted test run"]
|
|
Current primary-source verification completed for the exact provider contract: NVIDIA's catalog currently exposes free hosted endpoints for both Keep this PR stacked and Draft until #743 and #757 complete. Before integration, rerun the permanent contract against the new #757 head and re-prove: only |
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head2e2f87de173f6439282189766178cf208522ed3d. -
Head SHA:
2e2f87de173f6439282189766178cf208522ed3d -
Workflow run: 30970736642
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: pr-review-autofix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: pr-review-autofix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: hourly-nvidia-nim-autofix.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: hourly-nvidia-nim-autofix.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_pr_review_autofix_nvidia_nim_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_pr_review_autofix_nvidia_nim_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head2e2f87de173f6439282189766178cf208522ed3d. -
Head SHA:
2e2f87de173f6439282189766178cf208522ed3d -
Workflow run: 30970777912
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: pr-review-autofix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: pr-review-autofix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: hourly-nvidia-nim-autofix.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: hourly-nvidia-nim-autofix.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_pr_review_autofix_nvidia_nim_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_pr_review_autofix_nvidia_nim_contract.py"]
R4 --> V4["targeted test run"]
|
Exact-head stack correction: this draft now points to head |
|
Superseded by #779. The replacement carries the same NVIDIA-NIM-only write-capable OpenCode contract on the current #759 prerequisite, adds the requested hourly cadence and one-hour retry floor, preserves the independent reviewer workflow byte-for-byte, and has exact-head red/green contract evidence. Keeping both stacks would create duplicate scheduled writers and conflicting integration histories. Closing without merge; no review or check from this stale branch is reused. |
1 participant
Purpose
Restore the organization requirement that the write-capable scheduled OpenCode PR autofix worker uses
NVIDIA_NIM_API_KEY, not GitHub Models or Copilot, while preserving the existing independent read-only reviewer workflow and its key contract.This is the clean integration path for the NVIDIA NIM provider contract previously developed in merged stacked PR #752. It remains a draft on top of #757 until the central control-plane base stabilizes.
Changes
nvidia-nimOpenCode provider;mistralai/mistral-nemotronas the primary repair model andnvidia/nemotron-3-nano-30b-a3bas the bounded helper model;NVIDIA_API_KEYonly fromsecrets.NVIDIA_NIM_API_KEYin the two OpenCode execution steps;.github/workflows/opencode-review-dispatch.ymlbyte-for-byte;CHANGELOG.md.Test-first history
a44b17369e818b2f8de5161b72565522e49dffee401d46cba6b9ceb45957578ed2b8d1da6fc0da9c4da6ee062d14cad8dd1bd9f68af57556a821a6bfThe contract covers provider exclusivity, explicit Copilot exclusion, secret scope, missing-secret failure, subprocess credential removal, immutable source binding, permission denial, hourly cadence, and independent reviewer preservation.
Security and modular boundaries
Current stack state
feat/comment-agent-mention-dispatch(fix(ci): restore review control plane and respond to agent mentions #757)c01d1cd6e36f3507066d7f07c00e5bf7ff5865844da6ee062d14cad8dd1bd9f68af57556a821a6bfbafc08927b517f3b21311124e95f11e205c3ec28The branches have diverged because #757 received subsequent coverage and security repairs. This PR intentionally remains draft and must be rebuilt or reconciled onto the exact stabilized #757 head before review-ready status. No prior check or review result will be reused after that reconciliation.
Merge order
mainafter exact-head gates and independent approval.ContextualWisdomLab/pg-llm-batch#50revalidates against the integrated central baseline.Merge remains prohibited while this PR is draft or until its reconciled exact head passes all checks, current-head reviews, independent approval, unresolved-thread policy, and branch protection without bypass.