fix(ci): run hourly review autofix through NVIDIA NIM

.github/workflows/pr-review-autofix.yml

@@ -42,6 +42,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ContextualWisdomLab/.github
+          ref: ${{ github.sha }}
           fetch-depth: 1
           persist-credentials: false
           path: trusted-autofix-source
@@ -231,9 +232,9 @@ jobs:
           EOF
           jq -n --arg workspace "$TARGET_WORKSPACE" '{
             "$schema": "https://opencode.ai/config.json",
-            "model": "github-models/openai/gpt-5",
-            "small_model": "github-models/deepseek/deepseek-v3-0324",
-            "enabled_providers": ["github-models"],
+            "model": "nvidia-nim/mistralai/mistral-nemotron",
+            "small_model": "nvidia-nim/nvidia/nemotron-3-nano-30b-a3b",
+            "enabled_providers": ["nvidia-nim"],
             "permission": {
               "edit": "allow",
               "bash": "deny",
@@ -242,10 +243,13 @@ jobs:
               "glob": "allow",
               "list": "allow",
               "task": "deny",
+              "skill": "deny",
+              "question": "deny",
               "webfetch": "deny",
               "websearch": "deny",
               "lsp": "deny",
-              "external_directory": "deny"
+              "external_directory": "deny",
+              "doom_loop": "deny"
             },
             "agent": {
               "ci-autofix": {
@@ -261,45 +265,40 @@ jobs:
                   "glob": "allow",
                   "list": "allow",
                   "task": "deny",
+                  "skill": "deny",
+                  "question": "deny",
                   "webfetch": "deny",
                   "websearch": "deny",
                   "lsp": "deny",
-                  "external_directory": "deny"
+                  "external_directory": "deny",
+                  "doom_loop": "deny"
                 }
               }
             },
             "provider": {
-              "github-models": {
+              "nvidia-nim": {
                 "npm": "@ai-sdk/openai-compatible",
-                "name": "GitHub Models",
+                "name": "NVIDIA NIM",
                 "options": {
-                  "baseURL": "https://models.github.ai/inference",
-                  "apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"
+                  "baseURL": "https://integrate.api.nvidia.com/v1",
+                  "apiKey": "{env:NVIDIA_API_KEY}"
                 },
                 "models": {
-                  "openai/gpt-5": {
-                    "name": "OpenAI GPT-5",
+                  "mistralai/mistral-nemotron": {
+                    "name": "Mistral Nemotron",
                     "tool_call": true,
-                    "reasoning": true,
-                    "options": {
-                      "reasoningEffort": "high"
-                    },
-                    "variants": {
-                      "high": {
-                        "reasoningEffort": "high"
-                      }
-                    },
                     "limit": {
-                      "context": 200000,
-                      "output": 100000
+                      "context": 128000,
+                      "output": 4096
                     }
                   },
-                  "deepseek/deepseek-v3-0324": {
-                    "name": "DeepSeek V3 0324",
+                  "nvidia/nemotron-3-nano-30b-a3b": {
+                    "name": "Nemotron 3 Nano 30B A3B",
                     "tool_call": true,
+                    "reasoning": true,
                     "limit": {
                       "context": 128000,
-                      "output": 4096
+                      "output": 32768
                     }
                   }
                 }
@@ -310,16 +309,18 @@ jobs:
       - name: Run OpenCode review autofix
         if: env.RESOLVE_CONFLICT != 'true'
         env:
-          STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
-          GITHUB_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token || github.token }}
-          MODEL: github-models/openai/gpt-5
-          USE_GITHUB_TOKEN: "true"
+          NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+          MODEL: nvidia-nim/mistralai/mistral-nemotron
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
           OPENCODE_AUTOFIX_WORKDIR: ${{ runner.temp }}/opencode-autofix-project
         run: |
           set -euo pipefail
+          if [ -z "${NVIDIA_API_KEY:-}" ]; then
+            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled OpenCode autofix."
+            exit 1
+          fi
           prompt_file="${RUNNER_TEMP}/opencode-autofix-prompt.md"
           allowed_paths_context="$(
             awk '
@@ -374,7 +375,8 @@ jobs:
           }
           trap restore_workspace_config EXIT
           cd "$TARGET_WORKSPACE"
-          timeout 18000 opencode run "$(cat "$prompt_file")" \
+          env -u GITHUB_TOKEN -u GH_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL \
+            timeout 18000 opencode run "$(cat "$prompt_file")" \
             --pure \
             --agent ci-autofix \
             --model "$MODEL" \
@@ -446,17 +448,20 @@ jobs:
       - name: Merge base branch and resolve conflicts with OpenCode
         if: env.RESOLVE_CONFLICT == 'true'
         env:
-          STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
+          NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token || github.token }}
           GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token || github.token }}
-          MODEL: github-models/openai/gpt-5
-          USE_GITHUB_TOKEN: "true"
+          MODEL: nvidia-nim/mistralai/mistral-nemotron
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
           OPENCODE_AUTOFIX_WORKDIR: ${{ runner.temp }}/opencode-autofix-project
         run: |
           set -euo pipefail
+          if [ -z "${NVIDIA_API_KEY:-}" ]; then
+            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled OpenCode autofix."
+            exit 1
+          fi
           cd "$TARGET_WORKSPACE"
 
           # Merge the base branch into the detached head. A clean merge stays
@@ -516,7 +521,8 @@ jobs:
               fi
             }
             trap restore_workspace_config EXIT
-            timeout 18000 opencode run "$(cat "$prompt_file")" \
+            env -u GITHUB_TOKEN -u GH_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL \
+              timeout 18000 opencode run "$(cat "$prompt_file")" \
               --pure \
               --agent ci-autofix \
               --model "$MODEL" \

CHANGELOG.md

@@ -11,6 +11,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Add a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` invocations, with bounded organization-wide sweeping, immutable current-head dispatch payloads, idempotent receipts, and fail-closed author/repository validation.
 - Add hourly bounded review-repair scheduling that preserves the existing reviewer identities and credential chain while continuing non-conflicting maintenance during pending checks or reviews.
 - Add a read-only exact-head Python quality workflow that compiles the changed central control-plane modules on Python 3.10 and runs their deterministic Python 3.14 tests with hash-locked tooling, 100% production statement and branch coverage, and 100% production docstrings.
+- Run the write-capable scheduled OpenCode review-autofix worker through the scoped `NVIDIA_NIM_API_KEY` credential while preserving the independent read-only reviewer workflow and its key contract.
 
 ### Security
 
@@ -19,6 +20,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 - Redact separate sensitive-option values echoed by child processes, concatenated or CamelCase credential-key values, and conservatively classified oversized assignments.
 - Bound structured-diagnostic traversal and replace malformed JSON-looking records, over-deep subtrees, or parser/encoder recursion failures with fail-closed redacted evidence instead of crashing or retrying through weaker handling.
 - Keep pull-request-controlled code outside the mention-router trust boundary, retain least-privilege workflow permissions, validate reusable workflow sources immutably, and preserve default-branch dependency snapshots for meaningful dependency review.
+- Remove GitHub and OIDC credentials from both OpenCode model subprocesses and fail closed before execution when the NVIDIA NIM credential is unavailable.
 
 ### Fixed
 
@@ -30,3 +32,4 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 ### Documentation
 
 - Add APA 7 doctoring records for trusted review-agent invocation, hourly repair, central security baselines, JavaScript runtime coverage classification, and sandbox command/output redaction boundaries, including verification evidence, modular behavior, limitations, and rollback requirements.
+- Add APA 7 doctoring for the hourly NVIDIA NIM autofix provider, credential, subprocess-isolation, source-integrity, modularity, and rollback boundaries.