ci: run hourly PR repair through NVIDIA NIM OpenCode - #781
Conversation
|
Warning Review limit reached
Next review available in: 23 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Review exact head |
|
@opencode-agent @cwl-noema-review Exact-head review requested for |
|
I will verify the scheduler contract, OIDC source binding, NVIDIA NIM-only model credential boundary, GitHub credential separation, live repository and head validation, file restrictions, denied tool access, immutable pins, reviewer workflow preservation, test coverage, APA 7 doctoring, and the absence of approval, merge, release, or publish authority.
|
|
Superseded by #779. Both implement the requested hourly NVIDIA NIM OpenCode repair loop, but #779 integrates the existing central scheduler/autofix workflows instead of adding a parallel timer and worker, is stacked on the current #759 diagnostics/Strix-hardening prerequisite, preserves the independent reviewer workflow byte-for-byte, and already has exact-head red/green contract plus direct security-check evidence. Keeping both would create two write-capable schedules and two maintenance implementations. Closing without merge; this branch's checks are not reused. |
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: nvidia-nim-hourly-pr-maintenance.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: nvidia-nim-hourly-pr-maintenance.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_fix_scheduler_nim.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_fix_scheduler_nim.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: APPROVE - the inlined current-head hunks for .github/workflows/nvidia-nim-pr-maintenance.yml and .github/workflows/nvidia-nim-pr-review-autofix.yml, the PASS coverage evidence, the wired scheduler --self-test step, and the added tests (tests/test_nvidia_nim_pr_maintenance.py, tests/test_nvidia_nim_pr_maintenance_token.py) affirmatively support the PR intent.
Verification posture: trusted bounded evidence only; no OPENCODE_EXECUTION_RECEIPT tool receipts were present in this run, so runtime claims are limited to the diff/source-trace outcomes cited in the probes and the precomputed Coverage PASS.
Linter/static: no current-head lint findings in bounded evidence; repo security contracts (bandit, pip_audit, trivy, hadolint) were not re-run inside this model.
TDD/regression: new focused tests cover the scheduler contract and token exchange next to the new script; Coverage execution evidence reports supported repository test suites passed.
Coverage: Coverage execution evidence Result PASS (supported repository test suites passed).
Docstring coverage: Coverage execution evidence reports configured repository docstring gates passed or advisory.
DAG: the Mermaid flowchart in the review body maps the head-state changed flow (maintenance workflow -> pr_review_fix_scheduler_nim.py self-test/dispatch -> repository_dispatch worker -> OpenCode repair).
PoC/execution: the scheduler --self-test step is wired into the dispatch job; no sandbox PoC was executed inside this model (source limitation).
DDD/domain: no domain model change; pure CI/automation layer.
CDD/context: the scheduler/worker pair keeps the NVIDIA NIM repair file-scoped and bounded (max_dispatches 1, retry_hours 1).
Similar issues: no unresolved review threads or review bodies exist at head SHA; CodeGraph blast-radius search shows no callers of the new scheduler script.
Claim/concept check: cron "23 * * * *", one dispatch per run, the one-hour same-head retry floor, and the NVIDIA-only credential gate match PR title/body claims.
Standards search: schedule/repository_dispatch/workflow_call triggers plus OIDC audience-pinned immutable-SHA source resolution follow GitHub Actions conventions visible in the hunks.
Compatibility/convention: all new objects use multi-word names (pr_review_fix_scheduler_nim.py, nvidia-nim-pr-maintenance.yml, nvidia-nim-pr-review-autofix.yml, test_nvidia_nim_pr_maintenance_token.py); no bare single-word or reserved identifiers introduced.
Breaking-change/backcompat: purely additive (new workflows/script/tests/docs/CHANGELOG entries); workflow_call inputs are optional with defaults, so no existing caller breaks.
Implementation completeness: no placeholder bodies in the visible hunks; the self-test and the fail-closed credential gate are executable; the truncated tail of the autofix worker and scheduler internals were not inlined (source limitation recorded in residual risk).
Performance: hourly cadence with concurrency cancel-in-progress true and max_prs/max_dispatches bounds limit the API surface.
Developer experience: CI/review-automation DX surface - the dry_run input and --self-test give operators a safe pre-flight path; docs/automation/nvidia-nim-hourly-pr-maintenance.md documents cadence and bounds.
User experience: PR-repair-flow UX surface - run-name identifies the target repository, PR number, and head SHA, and bounded dispatch avoids noisy duplicate runs.
Visual/DOM: non-web change; reviewed CLI/workflow/review-comment output surfaces only.
Accessibility/i18n: not applicable to this CI automation change.
Supply-chain/license: actions are SHA-pinned (actions/checkout v7.0.0, step-security/harden-runner v2.20.0); no new runtime dependencies introduced.
Packaging: the new script and tests follow existing scripts/ci and tests/ conventions under pyproject requires-python >=3.10.
Security/privacy: OIDC audience-pinned token exchange, ::add-mask on the app token and the NVIDIA key, a fail-closed NVIDIA credential gate, and workflow-scope contents read; a P3 least-privilege note flags job-level actions/issues write.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/nvidia-nim-pr-maintenance.yml, .github/workflows/nvidia-nim-pr-review-autofix.yml, CHANGELOG.md, docs/automation/nvidia-nim-hourly-pr-maintenance.md, scripts/ci/pr_review_fix_scheduler_nim.py, and 2 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/nvidia-nim-pr-maintenance.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/nvidia-nim-pr-maintenance.yml","line":1,"hypothesis":"The new scheduler workflow cannot be triggered on the documented hourly cadence, or it would dispatch unbounded autofix runs, violating the one-dispatch-per-run and one-hour same-head retry-floor contract.","attack_or_counterexample":"Counterexample trigger/bound inputs: a non-hourly cron such as '0 0 * * *', max_dispatches left unbounded, and retry_hours absent, challenged against the trusted diff.","evidence":"Trusted focused changed hunk at .github/workflows/nvidia-nim-pr-maintenance.yml:1 (file head `name: NVIDIA NIM PR Maintenance`) rendered the full trigger contract: `on` declares workflow_call inputs max_dispatches (default \"1\") and retry_hours (default \"1\"), repository_dispatch type nvidia-nim-pr-maintenance, and schedule cron \"23 * * * *\" matching the hourly cadence, one-dispatch, and retry-floor claims; the counterexample inputs are rejected because the trace contains no unbounded or off-cadence path, falsifying the hypothesis; source-line-sha256=28e3e161f07d6f49c100423fc3d54699e4c5f3863d8e6ea9c0cb7eb4941314fa","outcome":"falsified"},{"path":".github/workflows/nvidia-nim-pr-maintenance.yml","line":190,"hypothesis":"The dispatch step can run with an empty write token when the OpenCode app token exchange fails, or it can re-dispatch the same PR head without the retry floor.","attack_or_counterexample":"Force steps.scheduler_app_token outputs empty (available=false) with both repo secrets unset and check whether GH_TOKEN can be empty or the bounded flags dropped.","evidence":"Trusted focused changed hunk at .github/workflows/nvidia-nim-pr-maintenance.yml:190 observed the dispatch command `python3 scripts/ci/pr_review_fix_scheduler_nim.py \"${args[@]}\"` with args --max-prs \"$MAX_PRS\" --max-dispatches \"$MAX_DISPATCHES\" --retry-hours \"$RETRY_HOURS\" and the GH_TOKEN chain `steps.scheduler_app_token.outputs.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token`, which always terminates at the non-empty github.token and always forwards the bounded flags, so the empty-token and unbounded-redispatch counterexamples are rejected, falsifying the hypothesis; source-line-sha256=fd12f2bb5373eedbbe5a5172dcff2bc1c19edbd2e881967182f8999cb1aacc78","outcome":"falsified"},{"path":".github/workflows/nvidia-nim-pr-review-autofix.yml","line":1,"hypothesis":"The autofix worker silently proceeds without the NVIDIA NIM credential or falls back to a non-NVIDIA model provider, violating the file-scoped NVIDIA-only contract.","attack_or_counterexample":"Dispatch nvidia-nim-pr-review-autofix with NVIDIA_NIM_API_KEY absent from secrets and observe the credential gate outcome.","evidence":"Trusted focused changed hunk at .github/workflows/nvidia-nim-pr-review-autofix.yml:1 (`name: NVIDIA NIM PR Review Autofix`) observed within the same hunk the 'Require NVIDIA NIM credential' gate `if [ -z \"${NVIDIA_API_KEY:-}\" ]; then echo \"::error::NVIDIA_NIM_API_KEY is required; no alternate model provider is permitted for this scheduler.\"; exit 1; fi` followed by `::add-mask::$NVIDIA_API_KEY`; the trace fails closed with exit code 1 and a masked secret for the missing-key counterexample, so no alternate-provider fallback path exists, falsifying the hypothesis; source-line-sha256=68e6c087fe04a2f16a85731ca6717a800497d006cb5942a254964df2b615dedc","outcome":"falsified"}],"residual_risk":"Bounded residual risk: the inlined evidence truncated the autofix workflow tail (lines ~170-403), the scheduler script body, and the full test/doc/CHANGELOG hunks, and direct file reads were unavailable in this sandbox, so the worker's OpenCode invocation details and the scheduler's internal PR-validation/retry logic were verified only through the wired --self-test step, the added tests, and the PASS coverage evidence; the two CANCELLED Strix checks were diagnosed as run-supersession artifacts with no failure output; an FYI note flags that on schedule-triggered runs without the PR_REVIEW_FIX_BASE_BRANCH variable, DEFAULT_BRANCH may resolve empty and the scheduler should be confirmed to fall back to the repository default."}- Result: APPROVE
- Reason: Visible current-head hunks, the PASS coverage evidence, the wired scheduler --self-test step, and the added focused tests affirmatively support the PR intent; no blocking defect was confirmed; the two diagnosed CANCELLED Strix checks are run-supersession artifacts (annotation: a higher-priority waiting request exists), not code failures.
- Head SHA:
7fbd38f35050410ea3d74f3236cc1bcdb8211749 - Workflow run: 30993371758
- Workflow attempt: 1
1 participant
Summary
Replace #778 with a clean two-commit stack on the exact trusted-uv and secure Strix prerequisite head from #743.
nvidia-nim-pr-maintenance.ymlwith hourly cadence23 * * * *, one dispatch per run, and a one-hour same-head retry floor;NVIDIA_NIM_API_KEYfor model inference;Exact prerequisite
Base branch:
fix/trusted-uv-lock-coverage-cleanBase SHA:
91f0e3616897f47a40029ae5ca5846f0b84a75e9Exact head:
7fbd38f35050410ea3d74f3236cc1bcdb8211749The branch is zero commits behind its prerequisite and changes exactly seven intended files. The first commit reconstructs the exact scheduler tree reviewed in #778 directly on the secure base. The second restores the prerequisite changelog entries that the old-main blob would otherwise have overwritten.
The earlier PR was closed because retargeting its diverged history left GitHub's generated pull-request merge ref and Python Security audit on the stale vulnerable
maintree. This clean branch directly inherits #743'saiohttp==3.14.3,cryptography==50.0.0, compatible PyOpenSSL, and trusted-uv materialization evidence.Merge order
mainor become active before fix(coverage): materialize trusted uv lock dependencies #743 is independently approved and merged.mainwithout changing its head tree.No predecessor-head, stale merge-ref, status-only, cancelled audit, self-authored review, or prerequisite-branch check is final merge evidence after retargeting.
Security and model-routing boundary
NVIDIA_NIM_API_KEYonly asNVIDIA_API_KEY.COPILOT_GITHUB_TOKEN, GitHub Models inference, and reviewer credentials are absent from the model process.Supersedes #778.