ci: run hourly PR repair through NVIDIA NIM OpenCode by seonghobae · Pull Request #778 · ContextualWisdomLab/.github

seonghobae · 2026-08-05T08:52:27Z

Summary

Add a central, reusable hourly PR-maintenance path that keeps independent review and merge gates unchanged while moving scheduled review repair inference to OpenCode backed exclusively by NVIDIA_NIM_API_KEY.

Changes

add nvidia-nim-pr-maintenance.yml with an hourly 23 * * * * cadence, one dispatch per run, one-hour same-head retry floor, and immutable reusable-workflow source resolution from GitHub OIDC workflow-SHA claims;
add nvidia-nim-pr-review-autofix.yml, a file-scoped OpenCode repair worker using the NVIDIA OpenAI-compatible endpoint and no Copilot/GitHub Models inference credential;
add a thin wrapper around the existing scheduler so its proven queue/review logic dispatches the dedicated NIM worker without altering the existing review-agent workflow or keys;
require same-repository heads, live exact-head revalidation, allowlisted edit paths, shell-denied OpenCode permissions, pinned Actions/OpenCode binary, and fail-closed behavior for missing secrets or moved heads;
add static workflow contracts, wrapper unit coverage, central CHANGELOG, and APA 7th doctoring.

Security boundaries

NVIDIA_NIM_API_KEY is bound only to process variable NVIDIA_API_KEY for model inference.
COPILOT_GITHUB_TOKEN, GitHub Models inference, and STRIX_GITHUB_MODELS_TOKEN are absent from the new worker.
Existing OpenCode/Noema review agents and their credential chain are not modified.
The repair worker cannot approve, merge, release, execute shell commands through the model, access the web, or edit paths outside current file-scoped review evidence.
Every repair creates a new head that must pass normal exact-head checks and independent review.

Prerequisite stack

This PR now targets fix/trusted-uv-lock-coverage-clean from #743. The protected main branch still contains vulnerable Strix dependency snapshots (aiohttp==3.14.1 and cryptography==49.0.0), which caused Python Security run 30991910227 to report known vulnerabilities before the run was cancelled. #743 carries the reviewed secure floor (aiohttp==3.14.3, cryptography==50.0.0, and compatible PyOpenSSL) together with the trusted-uv materialization prerequisite.

Required order:

fix(coverage): materialize trusted uv lock dependencies #743 receives exact-head automated review and a qualifying independent APPROVED review, then merges without bypass.
This PR is retargeted from the prerequisite branch to the resulting protected main.
Every check, Strix/OpenCode/Noema review, unresolved-thread gate, and independent approval reruns on the resulting exact head and base.
Only then may the hourly NVIDIA NIM maintenance workflow merge and become active.

No predecessor-head, cancelled dependency audit, status-only review, or prerequisite-branch result is reused as final merge evidence after retargeting.

Verification

Required current-head evidence:

repository Python tests and production coverage/docstring gates;
actionlint and workflow syntax checks;
CodeQL, Semgrep, security, secret, dependency, SBOM, and Scorecard workflows;
exact-head dry-run scheduler execution;
exact-head Strix/OpenCode/Noema review and qualifying independent approval before merge.

Standards and research

The doctoring note records GitHub reusable-workflow/OIDC source identity, OpenCode custom OpenAI-compatible providers, NVIDIA NIM endpoints, and bounded orchestration implications from Conductor, TRINITY, and Fugu in APA 7th format.

coderabbitai · 2026-08-05T08:52:37Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b685f2ba-437d-4b30-9421-794980975159

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2ebda8063d3c541e2552dc474c3c8601ddc986f8.
Head SHA: 2ebda8063d3c541e2552dc474c3c8601ddc986f8
Workflow run: 30992373031
Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: nvidia-nim-hourly-pr-maintenance.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_fix_scheduler_nim.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V5["targeted test run"]

opencode-agent · 2026-08-05T09:15:44Z

OpenCode Review Overview

Head SHA: 517a1de5dc493ec638821d8ea55c1f449a05e23d
Workflow run: 30994827813
Workflow attempt: 1
Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 517a1de5dc493ec638821d8ea55c1f449a05e23d.
Head SHA: 517a1de5dc493ec638821d8ea55c1f449a05e23d
Workflow run: 30994827813
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: nvidia-nim-hourly-pr-maintenance.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: nvidia-nim-hourly-pr-maintenance.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_fix_scheduler_nim.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_fix_scheduler_nim.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (3 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (3 files)"]
  R5 --> V5["targeted test run"]

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2ebda8063d3c541e2552dc474c3c8601ddc986f8.
Head SHA: 2ebda8063d3c541e2552dc474c3c8601ddc986f8
Workflow run: 30992396659
Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: nvidia-nim-hourly-pr-maintenance.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_fix_scheduler_nim.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V5["targeted test run"]

seonghobae · 2026-08-05T09:27:42Z

Superseded by clean stacked PR #781. Retargeting this branch after its long divergence left GitHub's generated merge ref and Python Security audit on the stale vulnerable main tree (aiohttp==3.14.1, cryptography==49.0.0). PR #781 is built directly on exact prerequisite head 91f0e3616897f47a40029ae5ca5846f0b84a75e9, is zero commits behind, preserves the prerequisite CHANGELOG, and contains only the seven intended NVIDIA NIM scheduler files. Continue review and integration on #781.

…ance

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 517a1de5dc493ec638821d8ea55c1f449a05e23d.
Head SHA: 517a1de5dc493ec638821d8ea55c1f449a05e23d
Workflow run: 30994797088
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: nvidia-nim-hourly-pr-maintenance.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: nvidia-nim-hourly-pr-maintenance.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_fix_scheduler_nim.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_fix_scheduler_nim.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (3 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (3 files)"]
  R5 --> V5["targeted test run"]

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 517a1de5dc493ec638821d8ea55c1f449a05e23d.
Head SHA: 517a1de5dc493ec638821d8ea55c1f449a05e23d
Workflow run: 30994827813
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: nvidia-nim-hourly-pr-maintenance.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: nvidia-nim-hourly-pr-maintenance.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script: pr_review_fix_scheduler_nim.py"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script: pr_review_fix_scheduler_nim.py"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (3 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (3 files)"]
  R5 --> V5["targeted test run"]

seonghobae · 2026-08-05T10:01:45Z

Closing as superseded by #779. Both PRs implement the same hourly NVIDIA NIM/OpenCode review-repair outcome, but #779 is the surviving bounded implementation: it preserves the existing independent reviewer workflow byte-for-byte, strips GitHub/OIDC credentials from model child processes, pins scheduler source identity, has exact-head TDD and full workflow evidence, and contains no branch-local one-shot repair workflow. This branch still includes .github/workflows/one-shot-fix-nim-conflict-staging.yml, which is transient write-capable automation and must not remain in a final tree. No unique production requirement should be merged from this duplicate branch; any still-valid idea must be reconciled into #779 through normal reviewed changes.

seonghobae added 9 commits August 5, 2026 17:39

ci: add hourly NVIDIA NIM PR maintenance scheduler

a12bc11

ci: route hourly review repair to NVIDIA NIM autofix

b73fe34

ci: add NVIDIA NIM OpenCode review autofix worker

5007a33

test(ci): lock hourly NVIDIA NIM maintenance contracts

5a653e9

fix(ci): restore shared scheduler globals after NIM dispatch

bc56187

docs(ci): doctor hourly NVIDIA NIM repair architecture

1d309e5

docs: add central automation changelog

50b5768

refactor(ci): make NIM scheduler import deterministic

93ffc8a

fix(ci): make NIM scheduler runnable as a script

6b7c87f

seonghobae added 5 commits August 5, 2026 18:05

fix(ci): declare reusable scheduler GitHub write secrets

b4ac90c

test(ci): cover reusable secrets and wrapper cleanup

a2691d1

docs(ci): add primary TRINITY orchestration citation

b34834a

fix(ci): exchange OpenCode app token for cross-repository scheduling

278a5f8

test(ci): lock OpenCode app-token scheduler fallback

2ebda80

seonghobae changed the base branch from main to fix/trusted-uv-lock-coverage-clean August 5, 2026 09:13

opencode-agent Bot requested changes Aug 5, 2026

View reviewed changes

seonghobae mentioned this pull request Aug 5, 2026

ci: run hourly PR repair through NVIDIA NIM OpenCode #781

Closed

seonghobae closed this Aug 5, 2026

merge(fix/trusted-uv-lock-coverage-clean): refresh NVIDIA NIM mainten…

6c89cb1

…ance

seonghobae reopened this Aug 5, 2026

seonghobae added 5 commits August 5, 2026 18:41

fix(ci): minimize central scheduler token permissions

c73832a

test(ci): enforce central scheduler least privilege

e53efc8

test(ci): define safe conflict-repair staging contract

1ea0896

ci: repair NVIDIA NIM conflict staging once

a2873cd

ci: trigger one-shot NVIDIA NIM conflict repair

517a1de

opencode-agent Bot requested changes Aug 5, 2026

View reviewed changes

seonghobae closed this Aug 5, 2026

Navigation Menu

Uh oh!

ci: run hourly PR repair through NVIDIA NIM OpenCode - #778

ci: run hourly PR repair through NVIDIA NIM OpenCode#778
seonghobae wants to merge 20 commits into
fix/trusted-uv-lock-coverage-cleanfrom
fix/hourly-nvidia-nim-autofix

seonghobae commented Aug 5, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

Review skipped

Uh oh!

opencode-agent Bot left a comment

Uh oh!

opencode-agent Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

opencode-agent Bot left a comment

Uh oh!

seonghobae commented Aug 5, 2026

Uh oh!

opencode-agent Bot left a comment

Uh oh!

opencode-agent Bot left a comment

Uh oh!

seonghobae commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

seonghobae commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Security boundaries

Prerequisite stack

Verification

Standards and research

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Changed-File Evidence Map

Uh oh!

opencode-agent Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OpenCode Review Overview

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Changed-File Evidence Map

Uh oh!

seonghobae commented Aug 5, 2026

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

seonghobae commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 5, 2026 •

edited

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

opencode-agent Bot commented Aug 5, 2026 •

edited

Loading