chore(ci): remove orphaned OpenCode dispatch bootstrap on current main

[seonghobae]

Root cause

opencode-review-dispatch.yml is a trusted repository_dispatch worker, not the protected required-workflow entrypoint. Its local required-workflow-bootstrap job only echoed OpenCode repository-dispatch review run materialized., had no needs: consumer, and consumed one hosted runner slot for every OpenCode review dispatch. The actual protected bootstrap job remains in the sibling opencode-review.yml path required by branch protection.

Current-main repair

This successor ports only the independently reviewed three-file causal delta from stale #1489 onto protected main@827a6c9630eaa40ceb7146b289c0b32467fdd5ab using exact file blobs whose current-main compare is limited to:

• delete the six-line orphan bootstrap job from .github/workflows/opencode-review-dispatch.yml;
• change the OpenCode contract from positive presence to a regression guard against reintroduction;
• advance the exact dispatch-workflow blob pin in the autofix contract.

No Noema drift, product baseline drift, unrelated tests, provider route, credential, protected required check, or merge authority from #1489 is transplanted.

Verification lineage

The causal change was previously verified on #1489 with the complete repository suite (2105 passed, 1 skipped, 21 subtests), 100% scripts/ci coverage, 100% docstrings, Strix gate PASS, and YAML parsing. Those predecessor results establish the change design but do not transfer as current-head admission evidence. Exact head is fce0c0e4dadc7a35dc7d73a959bf1cd51f4f7710; fresh current-head workflows/review remain authoritative.

This is an Actions-capacity repair: it removes a provably hollow runner-consuming job rather than adding another cleanup workflow. If all current-head hosted workflows remain queued solely behind the saturated central fleet, apply the documented QUEUE_SATURATION_CHICKEN_EGG boundary after re-fetching exact head/reviews/threads/mergeability.

---

[seonghobae]

@opencode-agent Direct source repair required on the current exact head, not a review-only reply. Re-fetch main@cb38cc30284a02d0986cb55a14ff0a65ef390937 and this PR head before writing. Devin exposed that my initial exact-blob transplant accidentally carried two stale pre-#1227 credential lines from historical #1489. Preserve this PR's one intended production change (delete only the orphan top-level required-workflow-bootstrap job), but restore the current-main same-repository status publication contract exactly:

• GH_TOKEN must prefer github.token when needs.validate-pr-metadata.outputs.target_repository == github.repository, then use PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, App token, github.token for cross-repo fallback.
• OPENCODE_STATUS_TOKEN_SOURCE must report github-token for that same-repository branch and retain the exact cross-repo provenance chain.
• Restore the strong assertions in tests/test_opencode_agent_contract.py that pin both precedence and provenance; retain the new regression asserting the dispatch-only orphan bootstrap job is absent.
• Update the exact REVIEW_DISPATCH_BLOB_SHA pin after the corrected workflow file is committed.

Treat the current Devin findings as RED evidence. Run the focused OpenCode contract tests first, then the complete repository test/coverage/docstring/Strix-quality gates if capacity permits. Do not alter provider routes, review authority, permissions, or unrelated files; do not force-push. This is a source fix, not a request to merely review/comment.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7a895f51-faf7-4834-be8d-068d8a916849

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review exact current head 1f0c49ba95df08a3b6a8f8941cf9e406706e5913 specifically for the two valid same-repository credential regressions identified on .github/workflows/opencode-review-dispatch.yml: preserve current-main same-repository github.token selection for status publication and the corresponding submission/revocation path while retaining only this PR's intended removal of the orphan required-workflow-bootstrap runner job. Treat any weakened contract assertions introduced with the credential drift as defects. Do not transfer predecessor-head evidence; publish an exact-head verdict only.

[seonghobae]

@opencode-agent Repair the exact current writer branch fix/current-main-remove-opencode-dispatch-bootstrap-20260902 in place; do not open a new PR and do not force-push. Re-fetch the head before writing. Devin found that commit fce0c0e accidentally transplanted stale #1489 credential/test hunks together with the intended orphan-job deletion. Preserve the intended deletion of only the six-line required-workflow-bootstrap job, but restore protected-main same-repository status publication semantics exactly: GH_TOKEN must prefer github.token when needs.validate-pr-metadata.outputs.target_repository == github.repository, and OPENCODE_STATUS_TOKEN_SOURCE must report github-token on that same-repo path before the external credential chain. Restore the strict assertions in tests/test_opencode_agent_contract.py that pin those two exact expressions while keeping the new negative regression that the orphan bootstrap is absent. Recompute REVIEW_DISPATCH_BLOB_SHA from the repaired workflow and update only that pin. Add/retain a RED->GREEN regression for same-repo credential precedence/provenance, run the focused OpenCode contract plus relevant full repository/coverage/docstring gates, remove any temporary repair artifacts, push non-destructively, and report exact head/results here. Do not weaken the review findings or bypass them.