From fce0c0e4dadc7a35dc7d73a959bf1cd51f4f7710 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:04:40 +0900 Subject: [PATCH 01/12] chore(ci): remove orphaned OpenCode dispatch bootstrap Port only the independently verified queue-waste fix from #1489 onto current protected main. The repository_dispatch-only workflow had a required-workflow-bootstrap job that merely echoed a message, had no needs consumer, and was not the protected required-workflow bootstrap job from opencode-review.yml. Removing it saves one hosted job per OpenCode review dispatch while preserving the PR-stable cancel-in-progress concurrency and all real validation/review jobs. The two executable contracts are carried with the workflow: the orphan job must remain absent and the reviewed dispatch blob pin follows the exact replacement file. No unrelated stale #1489 branch content is transplanted. --- .../workflows/opencode-review-dispatch.yml | 10 ++------- tests/test_opencode_agent_contract.py | 22 +++++++------------ ...t_pr_review_autofix_nvidia_nim_contract.py | 2 +- 3 files changed, 11 insertions(+), 23 deletions(-) diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index cc0b84dff1..0814541a9d 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -24,12 +24,6 @@ permissions: contents: read jobs: - required-workflow-bootstrap: - name: required-workflow-bootstrap - runs-on: ubuntu-latest - steps: - - run: echo "OpenCode repository-dispatch review run materialized." - validate-pr-metadata: name: validate-pr-metadata if: github.event_name == 'repository_dispatch' @@ -7600,14 +7594,14 @@ jobs: && needs.validate-pr-metadata.outputs.target_repository != '' && needs.validate-pr-metadata.outputs.head_sha != '' env: - GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }} + GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }} GH_REPOSITORY: ${{ needs.validate-pr-metadata.outputs.target_repository }} PR_NUMBER: ${{ needs.validate-pr-metadata.outputs.pr_number }} PR_HEAD_SHA: ${{ needs.validate-pr-metadata.outputs.head_sha }} RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} OPENCODE_MODEL_POOL_OUTCOME: ${{ steps.opencode_review_model_pool.outputs.review_status }} COVERAGE_EVIDENCE_RESULT: ${{ needs.coverage-evidence.result }} - OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }} + OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }} OPENCODE_CHANGED_FILES_FILE: ${{ runner.temp }}/opencode-changed-files.txt OPENCODE_ARTIFACT_MANIFEST_SHA256: ${{ steps.seal_artifacts.outputs.manifest_sha256 }} OPENCODE_SOURCE_WORKDIR: ${{ runner.temp }}/opencode-pr-head diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index 55513c16c7..027ff2d0dc 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -469,12 +469,12 @@ def test_opencode_ignores_superseded_cancelled_rollup_checks(): def test_opencode_target_coverage_materializes_only_after_authorized_dispatch(): """Keep PR-controlled test execution off the pull_request_target path.""" workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8") - assert "required-workflow-bootstrap:" in workflow - assert "OpenCode repository-dispatch review run materialized." in workflow - bootstrap_start = workflow.index(" required-workflow-bootstrap:\n") - bootstrap_end = workflow.index("\n validate-pr-metadata:", bootstrap_start) - bootstrap_job = workflow[bootstrap_start:bootstrap_end] - assert "\n if:" not in bootstrap_job + # required-workflow-bootstrap is the trusted-source-resolution sentinel needed + # only where the org ruleset targets a pull_request_target entrypoint + # (opencode-review.yml). This repository_dispatch-only workflow is not itself + # a required-workflow path, so it must not carry a copy-pasted, need-less + # orphan of that job. + assert "required-workflow-bootstrap:" not in workflow assert ( "github.event.pull_request.head.repo.full_name == github.repository" not in workflow @@ -2399,17 +2399,11 @@ def test_opencode_runs_merge_scheduler_after_review_without_repo_local_dispatch( " - name: Dispatch Noema after current-head OpenCode approval", 1 )[0] assert ( - "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == " - "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || " + "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || " "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || " "github.token }}" ) in status_step - assert ( - "OPENCODE_STATUS_TOKEN_SOURCE: ${{ " - "needs.validate-pr-metadata.outputs.target_repository == github.repository && " - "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && " - "'PR_REVIEW_MERGE_TOKEN'" - ) in status_step + assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step assert "OPENCODE_CHANGED_FILES_FILE" in status_step assert "OPENCODE_ARTIFACT_MANIFEST_SHA256" in status_step diff --git a/tests/test_pr_review_autofix_nvidia_nim_contract.py b/tests/test_pr_review_autofix_nvidia_nim_contract.py index d10b2f1e26..ea41e46937 100644 --- a/tests/test_pr_review_autofix_nvidia_nim_contract.py +++ b/tests/test_pr_review_autofix_nvidia_nim_contract.py @@ -19,7 +19,7 @@ DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md") CHANGELOG = Path("CHANGELOG.md") REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml") -REVIEW_DISPATCH_BLOB_SHA = "cc0b84dff19195a7e209e9f78cd5ee80bfc58d53" +REVIEW_DISPATCH_BLOB_SHA = "0814541a9d79e72298fe4fea463224688bb6bd54" def _workflow_text(path: Path) -> str: From 29b731acc7cb4e3dd5ad6449e679352b35ec6528 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:31:14 +0900 Subject: [PATCH 02/12] ci: run bounded PR 1619 causal repair --- .../workflows/tmp-pr1619-causal-repair.yml | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 .github/workflows/tmp-pr1619-causal-repair.yml diff --git a/.github/workflows/tmp-pr1619-causal-repair.yml b/.github/workflows/tmp-pr1619-causal-repair.yml new file mode 100644 index 0000000000..98a397d776 --- /dev/null +++ b/.github/workflows/tmp-pr1619-causal-repair.yml @@ -0,0 +1,99 @@ +name: Temporary PR 1619 causal repair + +on: + push: + branches: + - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + paths: + - .github/workflows/tmp-pr1619-causal-repair.yml + +permissions: + contents: write + +concurrency: + group: tmp-pr1619-causal-repair + cancel-in-progress: false + +jobs: + repair: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Check out exact repair head + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + fetch-depth: 0 + + - name: Repair same-repository credential contract and remove helper + shell: bash + env: + EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + run: | + set -euo pipefail + test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" + test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" + + python - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + workflow = workflow_path.read_text(encoding='utf-8') + old_token = "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" + new_token = "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" + old_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" + new_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" + if workflow.count(old_token) != 1 or workflow.count(old_source) != 1: + raise SystemExit('unexpected dispatch workflow credential shape; refusing mutation') + workflow = workflow.replace(old_token, new_token, 1).replace(old_source, new_source, 1) + if 'required-workflow-bootstrap:' in workflow: + raise SystemExit('orphaned dispatch bootstrap unexpectedly present') + workflow_path.write_text(workflow, encoding='utf-8') + + test_path = Path('tests/test_opencode_agent_contract.py') + test_text = test_path.read_text(encoding='utf-8') + old_assert = ''' assert (\n "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n''' + new_assert = ''' assert (\n "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: ${{ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && "\n "'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n''' + if test_text.count(old_assert) != 1: + raise SystemExit('unexpected OpenCode contract assertion shape; refusing mutation') + test_path.write_text(test_text.replace(old_assert, new_assert, 1), encoding='utf-8') + PY + + workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" + python - "$workflow_blob" <<'PY' + import re + import sys + from pathlib import Path + + blob = sys.argv[1] + path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') + text = path.read_text(encoding='utf-8') + text, count = re.subn( + r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', + f'REVIEW_DISPATCH_BLOB_SHA = "{blob}"', + text, + count=1, + ) + if count != 1: + raise SystemExit('unable to update exact dispatch blob contract') + path.write_text(text, encoding='utf-8') + PY + + PYTHONPATH=. python -m pytest -q \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py + git diff --check + + rm .github/workflows/tmp-pr1619-causal-repair.yml + test ! -e .github/workflows/tmp-pr1619-causal-repair.yml + git diff --check + + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + git add .github/workflows/opencode-review-dispatch.yml \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py \ + .github/workflows/tmp-pr1619-causal-repair.yml + git commit -m 'fix(opencode): preserve same-repo status authority' + git fetch origin "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + git push origin "HEAD:${EXPECTED_REF}" From 5f190b8c8b9b21c4e315eec85d5c5d977fbdc186 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:32:14 +0900 Subject: [PATCH 03/12] ci: make PR 1619 helper expression-safe --- .github/workflows/tmp-pr1619-causal-repair.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/tmp-pr1619-causal-repair.yml b/.github/workflows/tmp-pr1619-causal-repair.yml index 98a397d776..29b16b7452 100644 --- a/.github/workflows/tmp-pr1619-causal-repair.yml +++ b/.github/workflows/tmp-pr1619-causal-repair.yml @@ -36,12 +36,13 @@ jobs: python - <<'PY' from pathlib import Path + expr = '$' + '{{' workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') workflow = workflow_path.read_text(encoding='utf-8') - old_token = "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" - new_token = "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" - old_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" - new_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" + old_token = f"GH_TOKEN: {expr} secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}}}" + new_token = f"GH_TOKEN: {expr} needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}}}" + old_source = f"OPENCODE_STATUS_TOKEN_SOURCE: {expr} secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}}}" + new_source = f"OPENCODE_STATUS_TOKEN_SOURCE: {expr} needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}}}" if workflow.count(old_token) != 1 or workflow.count(old_source) != 1: raise SystemExit('unexpected dispatch workflow credential shape; refusing mutation') workflow = workflow.replace(old_token, new_token, 1).replace(old_source, new_source, 1) @@ -51,8 +52,8 @@ jobs: test_path = Path('tests/test_opencode_agent_contract.py') test_text = test_path.read_text(encoding='utf-8') - old_assert = ''' assert (\n "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n''' - new_assert = ''' assert (\n "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: ${{ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && "\n "'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n''' + old_assert = ''' assert (\n "GH_TOKEN: __OPEN__ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n'''.replace('__OPEN__', expr) + new_assert = ''' assert (\n "GH_TOKEN: __OPEN__ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: __OPEN__ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && "\n "'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n'''.replace('__OPEN__', expr) if test_text.count(old_assert) != 1: raise SystemExit('unexpected OpenCode contract assertion shape; refusing mutation') test_path.write_text(test_text.replace(old_assert, new_assert, 1), encoding='utf-8') From 84d0fc77021aff6be86f94f427ab212e0f03308a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:35:41 +0900 Subject: [PATCH 04/12] ci: reconstruct PR 1619 repair from current main --- .../workflows/tmp-pr1619-causal-repair.yml | 42 ++++++++++++------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/.github/workflows/tmp-pr1619-causal-repair.yml b/.github/workflows/tmp-pr1619-causal-repair.yml index 29b16b7452..622d1a8046 100644 --- a/.github/workflows/tmp-pr1619-causal-repair.yml +++ b/.github/workflows/tmp-pr1619-causal-repair.yml @@ -24,7 +24,7 @@ jobs: with: fetch-depth: 0 - - name: Repair same-repository credential contract and remove helper + - name: Reconstruct intended delta from live protected main and remove helper shell: bash env: EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 @@ -33,30 +33,40 @@ jobs: test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" + git fetch origin main "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + main_sha="$(git rev-parse origin/main)" + test -n "$main_sha" + + # Reconstruct the three durable files from current protected main, then + # reapply only PR #1619's still-valid semantic delta. This intentionally + # discards the stale same-repository credential regression while + # preserving every unrelated current-main change in these files. + git checkout origin/main -- \ + .github/workflows/opencode-review-dispatch.yml \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py + python - <<'PY' from pathlib import Path - expr = '$' + '{{' workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') workflow = workflow_path.read_text(encoding='utf-8') - old_token = f"GH_TOKEN: {expr} secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}}}" - new_token = f"GH_TOKEN: {expr} needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}}}" - old_source = f"OPENCODE_STATUS_TOKEN_SOURCE: {expr} secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}}}" - new_source = f"OPENCODE_STATUS_TOKEN_SOURCE: {expr} needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}}}" - if workflow.count(old_token) != 1 or workflow.count(old_source) != 1: - raise SystemExit('unexpected dispatch workflow credential shape; refusing mutation') - workflow = workflow.replace(old_token, new_token, 1).replace(old_source, new_source, 1) + bootstrap = ''' required-workflow-bootstrap:\n name: required-workflow-bootstrap\n runs-on: ubuntu-latest\n steps:\n - run: echo "OpenCode repository-dispatch review run materialized."\n\n''' + if workflow.count(bootstrap) != 1: + raise SystemExit('current main bootstrap shape changed; refusing lossy mutation') + workflow = workflow.replace(bootstrap, '', 1) if 'required-workflow-bootstrap:' in workflow: - raise SystemExit('orphaned dispatch bootstrap unexpectedly present') + raise SystemExit('orphaned dispatch bootstrap still present') workflow_path.write_text(workflow, encoding='utf-8') test_path = Path('tests/test_opencode_agent_contract.py') test_text = test_path.read_text(encoding='utf-8') - old_assert = ''' assert (\n "GH_TOKEN: __OPEN__ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n'''.replace('__OPEN__', expr) - new_assert = ''' assert (\n "GH_TOKEN: __OPEN__ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: __OPEN__ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && "\n "'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n'''.replace('__OPEN__', expr) - if test_text.count(old_assert) != 1: - raise SystemExit('unexpected OpenCode contract assertion shape; refusing mutation') - test_path.write_text(test_text.replace(old_assert, new_assert, 1), encoding='utf-8') + old = ''' assert "required-workflow-bootstrap:" in workflow\n assert "OpenCode repository-dispatch review run materialized." in workflow\n bootstrap_start = workflow.index(" required-workflow-bootstrap:\\n")\n bootstrap_end = workflow.index("\\n validate-pr-metadata:", bootstrap_start)\n bootstrap_job = workflow[bootstrap_start:bootstrap_end]\n assert "\\n if:" not in bootstrap_job\n''' + new = ''' # This repository_dispatch-only workflow is not the org-required\n # pull_request_target entrypoint, so an unconditional bootstrap job here only\n # consumes Actions capacity without providing authoritative review evidence.\n assert "required-workflow-bootstrap:" not in workflow\n''' + if test_text.count(old) != 1: + raise SystemExit('current main bootstrap contract test shape changed; refusing mutation') + test_path.write_text(test_text.replace(old, new, 1), encoding='utf-8') PY workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" @@ -94,7 +104,7 @@ jobs: tests/test_opencode_agent_contract.py \ tests/test_pr_review_autofix_nvidia_nim_contract.py \ .github/workflows/tmp-pr1619-causal-repair.yml - git commit -m 'fix(opencode): preserve same-repo status authority' + git commit -m 'fix(opencode): reconstruct bootstrap removal from current main' git fetch origin "${EXPECTED_REF}" test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" git push origin "HEAD:${EXPECTED_REF}" From 7dcd52febe85f0626cd9aae8e1a9734c87232aab Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:37:35 +0900 Subject: [PATCH 05/12] ci(opencode): make causal repair exact-head safe --- .../workflows/tmp-pr1619-causal-repair.yml | 44 ++++++++++++++----- 1 file changed, 34 insertions(+), 10 deletions(-) diff --git a/.github/workflows/tmp-pr1619-causal-repair.yml b/.github/workflows/tmp-pr1619-causal-repair.yml index 622d1a8046..5d477fe821 100644 --- a/.github/workflows/tmp-pr1619-causal-repair.yml +++ b/.github/workflows/tmp-pr1619-causal-repair.yml @@ -7,8 +7,7 @@ on: paths: - .github/workflows/tmp-pr1619-causal-repair.yml -permissions: - contents: write +permissions: {} concurrency: group: tmp-pr1619-causal-repair @@ -18,6 +17,8 @@ jobs: repair: runs-on: ubuntu-24.04 timeout-minutes: 20 + permissions: + contents: write steps: - name: Check out exact repair head uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 @@ -30,19 +31,42 @@ jobs: EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 run: | set -euo pipefail + cleanup_on_failure() { + rc="$?" + if [ "$rc" -ne 0 ]; then + trap - EXIT + git reset --hard "${GITHUB_SHA}" + rm -f .github/workflows/tmp-pr1619-causal-repair.yml + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + git add .github/workflows/tmp-pr1619-causal-repair.yml + if ! git diff --cached --quiet; then + git commit -m 'chore(ci): remove failed temporary PR 1619 writer' + git fetch origin "${EXPECTED_REF}" + if [ "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" ]; then + git push origin "HEAD:${EXPECTED_REF}" + else + echo '::error::Writer branch moved; refusing cleanup push.' + fi + fi + fi + exit "$rc" + } + trap cleanup_on_failure EXIT + test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - git fetch origin main "${EXPECTED_REF}" - test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" - main_sha="$(git rev-parse origin/main)" + git fetch origin main + main_sha="$(git rev-parse FETCH_HEAD)" test -n "$main_sha" + git fetch origin "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" - # Reconstruct the three durable files from current protected main, then - # reapply only PR #1619's still-valid semantic delta. This intentionally - # discards the stale same-repository credential regression while - # preserving every unrelated current-main change in these files. - git checkout origin/main -- \ + # Reconstruct the durable files from current protected main, then + # reapply only PR #1619's still-valid semantic delta. This discards the + # stale same-repository credential regression while preserving current main. + git checkout "$main_sha" -- \ .github/workflows/opencode-review-dispatch.yml \ tests/test_opencode_agent_contract.py \ tests/test_pr_review_autofix_nvidia_nim_contract.py From bf18aaee0f753e227befa53676203c7c47105f91 Mon Sep 17 00:00:00 2001 From: contextualwisdomlab-automation Date: Tue, 1 Sep 2026 16:39:30 +0000 Subject: [PATCH 06/12] chore(ci): remove failed temporary PR 1619 writer --- .../workflows/tmp-pr1619-causal-repair.yml | 134 ------------------ 1 file changed, 134 deletions(-) delete mode 100644 .github/workflows/tmp-pr1619-causal-repair.yml diff --git a/.github/workflows/tmp-pr1619-causal-repair.yml b/.github/workflows/tmp-pr1619-causal-repair.yml deleted file mode 100644 index 5d477fe821..0000000000 --- a/.github/workflows/tmp-pr1619-causal-repair.yml +++ /dev/null @@ -1,134 +0,0 @@ -name: Temporary PR 1619 causal repair - -on: - push: - branches: - - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 - paths: - - .github/workflows/tmp-pr1619-causal-repair.yml - -permissions: {} - -concurrency: - group: tmp-pr1619-causal-repair - cancel-in-progress: false - -jobs: - repair: - runs-on: ubuntu-24.04 - timeout-minutes: 20 - permissions: - contents: write - steps: - - name: Check out exact repair head - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - with: - fetch-depth: 0 - - - name: Reconstruct intended delta from live protected main and remove helper - shell: bash - env: - EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 - run: | - set -euo pipefail - cleanup_on_failure() { - rc="$?" - if [ "$rc" -ne 0 ]; then - trap - EXIT - git reset --hard "${GITHUB_SHA}" - rm -f .github/workflows/tmp-pr1619-causal-repair.yml - git config user.name 'contextualwisdomlab-automation' - git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - git add .github/workflows/tmp-pr1619-causal-repair.yml - if ! git diff --cached --quiet; then - git commit -m 'chore(ci): remove failed temporary PR 1619 writer' - git fetch origin "${EXPECTED_REF}" - if [ "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" ]; then - git push origin "HEAD:${EXPECTED_REF}" - else - echo '::error::Writer branch moved; refusing cleanup push.' - fi - fi - fi - exit "$rc" - } - trap cleanup_on_failure EXIT - - test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" - test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - - git fetch origin main - main_sha="$(git rev-parse FETCH_HEAD)" - test -n "$main_sha" - git fetch origin "${EXPECTED_REF}" - test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" - - # Reconstruct the durable files from current protected main, then - # reapply only PR #1619's still-valid semantic delta. This discards the - # stale same-repository credential regression while preserving current main. - git checkout "$main_sha" -- \ - .github/workflows/opencode-review-dispatch.yml \ - tests/test_opencode_agent_contract.py \ - tests/test_pr_review_autofix_nvidia_nim_contract.py - - python - <<'PY' - from pathlib import Path - - workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') - workflow = workflow_path.read_text(encoding='utf-8') - bootstrap = ''' required-workflow-bootstrap:\n name: required-workflow-bootstrap\n runs-on: ubuntu-latest\n steps:\n - run: echo "OpenCode repository-dispatch review run materialized."\n\n''' - if workflow.count(bootstrap) != 1: - raise SystemExit('current main bootstrap shape changed; refusing lossy mutation') - workflow = workflow.replace(bootstrap, '', 1) - if 'required-workflow-bootstrap:' in workflow: - raise SystemExit('orphaned dispatch bootstrap still present') - workflow_path.write_text(workflow, encoding='utf-8') - - test_path = Path('tests/test_opencode_agent_contract.py') - test_text = test_path.read_text(encoding='utf-8') - old = ''' assert "required-workflow-bootstrap:" in workflow\n assert "OpenCode repository-dispatch review run materialized." in workflow\n bootstrap_start = workflow.index(" required-workflow-bootstrap:\\n")\n bootstrap_end = workflow.index("\\n validate-pr-metadata:", bootstrap_start)\n bootstrap_job = workflow[bootstrap_start:bootstrap_end]\n assert "\\n if:" not in bootstrap_job\n''' - new = ''' # This repository_dispatch-only workflow is not the org-required\n # pull_request_target entrypoint, so an unconditional bootstrap job here only\n # consumes Actions capacity without providing authoritative review evidence.\n assert "required-workflow-bootstrap:" not in workflow\n''' - if test_text.count(old) != 1: - raise SystemExit('current main bootstrap contract test shape changed; refusing mutation') - test_path.write_text(test_text.replace(old, new, 1), encoding='utf-8') - PY - - workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" - python - "$workflow_blob" <<'PY' - import re - import sys - from pathlib import Path - - blob = sys.argv[1] - path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') - text = path.read_text(encoding='utf-8') - text, count = re.subn( - r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', - f'REVIEW_DISPATCH_BLOB_SHA = "{blob}"', - text, - count=1, - ) - if count != 1: - raise SystemExit('unable to update exact dispatch blob contract') - path.write_text(text, encoding='utf-8') - PY - - PYTHONPATH=. python -m pytest -q \ - tests/test_opencode_agent_contract.py \ - tests/test_pr_review_autofix_nvidia_nim_contract.py - git diff --check - - rm .github/workflows/tmp-pr1619-causal-repair.yml - test ! -e .github/workflows/tmp-pr1619-causal-repair.yml - git diff --check - - git config user.name 'contextualwisdomlab-automation' - git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - git add .github/workflows/opencode-review-dispatch.yml \ - tests/test_opencode_agent_contract.py \ - tests/test_pr_review_autofix_nvidia_nim_contract.py \ - .github/workflows/tmp-pr1619-causal-repair.yml - git commit -m 'fix(opencode): reconstruct bootstrap removal from current main' - git fetch origin "${EXPECTED_REF}" - test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" - git push origin "HEAD:${EXPECTED_REF}" From e95a90fa0ae891b1d15e968420ed4c1313421fcb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:41:30 +0900 Subject: [PATCH 07/12] ci(opencode): repair same-repo status authority on exact head --- .../tmp-pr1619-status-authority-repair.yml | 107 ++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 .github/workflows/tmp-pr1619-status-authority-repair.yml diff --git a/.github/workflows/tmp-pr1619-status-authority-repair.yml b/.github/workflows/tmp-pr1619-status-authority-repair.yml new file mode 100644 index 0000000000..6813bbef97 --- /dev/null +++ b/.github/workflows/tmp-pr1619-status-authority-repair.yml @@ -0,0 +1,107 @@ +name: Temporary PR 1619 status authority repair + +on: + push: + branches: + - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + paths: + - .github/workflows/tmp-pr1619-status-authority-repair.yml + +permissions: {} + +concurrency: + group: tmp-pr1619-status-authority-repair + cancel-in-progress: false + +jobs: + repair: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + permissions: + contents: write + steps: + - name: Check out exact repair head + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + fetch-depth: 0 + + - name: Repair status authority and delete this one-shot writer + shell: bash + env: + EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + run: | + set -euo pipefail + cleanup_on_failure() { + rc="$?" + if [ "$rc" -ne 0 ]; then + trap - EXIT + git reset --hard "${GITHUB_SHA}" + rm -f .github/workflows/tmp-pr1619-status-authority-repair.yml + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + git add .github/workflows/tmp-pr1619-status-authority-repair.yml + if ! git diff --cached --quiet; then + git commit -m 'chore(ci): remove failed PR 1619 status repair writer' + git fetch origin "${EXPECTED_REF}" + if [ "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" ]; then + git push origin "HEAD:${EXPECTED_REF}" + fi + fi + fi + exit "$rc" + } + trap cleanup_on_failure EXIT + + test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" + test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" + git fetch origin "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + + python3 - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + test_path = Path('tests/test_opencode_agent_contract.py') + workflow = workflow_path.read_text(encoding='utf-8') + tests = test_path.read_text(encoding='utf-8') + + old_token = "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" + new_token = "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" + old_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" + new_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" + if workflow.count(old_token) != 1 or workflow.count(old_source) != 1: + raise SystemExit('exact status credential expression changed; refusing stale repair') + workflow = workflow.replace(old_token, new_token, 1).replace(old_source, new_source, 1) + workflow_path.write_text(workflow, encoding='utf-8') + + old_assert = ''' assert (\n "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step\n''' + new_assert = ''' assert (\n "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: ${{ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step\n''' + if tests.count(old_assert) != 1: + raise SystemExit('exact status contract test changed; refusing stale repair') + test_path.write_text(tests.replace(old_assert, new_assert, 1), encoding='utf-8') + PY + + workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" + python3 - "$workflow_blob" <<'PY' + import re, sys + from pathlib import Path + path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') + text = path.read_text(encoding='utf-8') + text, count = re.subn(r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', text, count=1) + if count != 1: + raise SystemExit('dispatch blob pin contract changed; refusing stale repair') + path.write_text(text, encoding='utf-8') + PY + + PYTHONPATH=. python -m pytest -q tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py + git diff --check + rm .github/workflows/tmp-pr1619-status-authority-repair.yml + git add .github/workflows/opencode-review-dispatch.yml tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py .github/workflows/tmp-pr1619-status-authority-repair.yml + git diff --cached --check + + git fetch origin "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + git commit -m 'fix(opencode): preserve same-repository status authority' + git push origin "HEAD:${EXPECTED_REF}" From dd5ad8e578e037f8213f7406b4ab23fff3c79f13 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:41:42 +0900 Subject: [PATCH 08/12] ci: add exact-head PR 1619 restack writer --- .github/workflows/tmp-pr1619-restack.yml | 113 +++++++++++++++++++++++ 1 file changed, 113 insertions(+) create mode 100644 .github/workflows/tmp-pr1619-restack.yml diff --git a/.github/workflows/tmp-pr1619-restack.yml b/.github/workflows/tmp-pr1619-restack.yml new file mode 100644 index 0000000000..18f17d7d8d --- /dev/null +++ b/.github/workflows/tmp-pr1619-restack.yml @@ -0,0 +1,113 @@ +name: Temporary PR 1619 non-destructive restack + +on: + push: + branches: + - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + paths: + - .github/workflows/tmp-pr1619-restack.yml + +permissions: + contents: write + +concurrency: + group: tmp-pr1619-restack + cancel-in-progress: false + +jobs: + restack: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Check out exact writer head + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + fetch-depth: 0 + + - name: Reconstruct intended delta on live protected main + shell: bash + env: + EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + run: | + set -euo pipefail + test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" + test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" + + remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" + test "$remote_head" = "$GITHUB_SHA" + git fetch origin main + main_sha="$(git rev-parse FETCH_HEAD)" + test -n "$main_sha" + + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + + # Make the current protected-main tree authoritative. The branch history + # stays intact and is recorded as the first parent of the reconciliation + # commit; current main is the second parent. + git read-tree --reset -u "${main_sha}^{tree}" + + python - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + workflow = workflow_path.read_text(encoding='utf-8') + bootstrap = ''' required-workflow-bootstrap:\n name: required-workflow-bootstrap\n runs-on: ubuntu-latest\n steps:\n - run: echo "OpenCode repository-dispatch review run materialized."\n\n''' + if workflow.count(bootstrap) != 1: + raise SystemExit('live protected main bootstrap shape changed; refusing mutation') + workflow = workflow.replace(bootstrap, '', 1) + if 'required-workflow-bootstrap:' in workflow: + raise SystemExit('orphaned dispatch bootstrap still present') + # Preserve the live protected-main same-repository credential policy. + required_token = "needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN" + required_source = "needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN" + if required_token not in workflow or required_source not in workflow: + raise SystemExit('live protected-main credential contract changed; refusing mutation') + workflow_path.write_text(workflow, encoding='utf-8') + + test_path = Path('tests/test_opencode_agent_contract.py') + text = test_path.read_text(encoding='utf-8') + old = ''' assert "required-workflow-bootstrap:" in workflow\n assert "OpenCode repository-dispatch review run materialized." in workflow\n bootstrap_start = workflow.index(" required-workflow-bootstrap:\\n")\n bootstrap_end = workflow.index("\\n validate-pr-metadata:", bootstrap_start)\n bootstrap_job = workflow[bootstrap_start:bootstrap_end]\n assert "\\n if:" not in bootstrap_job\n''' + new = ''' # required-workflow-bootstrap is the trusted-source-resolution sentinel needed\n # only where the org ruleset targets a pull_request_target entrypoint\n # (opencode-review.yml). This repository_dispatch-only workflow is not itself\n # a required-workflow path, so it must not carry a copy-pasted, need-less\n # orphan of that job.\n assert "required-workflow-bootstrap:" not in workflow\n''' + if text.count(old) != 1: + raise SystemExit('live protected-main bootstrap test shape changed; refusing mutation') + text = text.replace(old, new, 1) + test_path.write_text(text, encoding='utf-8') + PY + + workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" + python - "$workflow_blob" <<'PY' + import re + import sys + from pathlib import Path + + blob = sys.argv[1] + path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') + text = path.read_text(encoding='utf-8') + text, count = re.subn( + r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', + f'REVIEW_DISPATCH_BLOB_SHA = "{blob}"', + text, + count=1, + ) + if count != 1: + raise SystemExit('unable to update exact dispatch blob contract') + path.write_text(text, encoding='utf-8') + PY + + PYTHONPATH=. python -m pytest -q \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py + git diff --check + + # The temporary writer is absent from the protected-main baseline and + # therefore absent from the reconstructed tree by construction. + test ! -e .github/workflows/tmp-pr1619-restack.yml + + git add -A + tree_sha="$(git write-tree)" + commit_sha="$(printf '%s\n' 'fix(opencode): restack bootstrap cleanup on protected main' | git commit-tree "$tree_sha" -p "$GITHUB_SHA" -p "$main_sha")" + + remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" + test "$remote_head" = "$GITHUB_SHA" + git push origin "${commit_sha}:refs/heads/${EXPECTED_REF}" From 2e2abc84d6502e99d084c09a8bf04018f81e25df Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:44:18 +0900 Subject: [PATCH 09/12] ci(opencode): make PR 1619 restack writer self-contained --- .github/workflows/tmp-pr1619-restack.yml | 57 +++++++++++++++++------- 1 file changed, 41 insertions(+), 16 deletions(-) diff --git a/.github/workflows/tmp-pr1619-restack.yml b/.github/workflows/tmp-pr1619-restack.yml index 18f17d7d8d..94219f3639 100644 --- a/.github/workflows/tmp-pr1619-restack.yml +++ b/.github/workflows/tmp-pr1619-restack.yml @@ -7,8 +7,7 @@ on: paths: - .github/workflows/tmp-pr1619-restack.yml -permissions: - contents: write +permissions: {} concurrency: group: tmp-pr1619-restack @@ -18,21 +17,50 @@ jobs: restack: runs-on: ubuntu-24.04 timeout-minutes: 20 + permissions: + contents: write steps: - name: Check out exact writer head uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 with: fetch-depth: 0 + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + with: + python-version: "3.14" + - name: Reconstruct intended delta on live protected main shell: bash env: EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 run: | set -euo pipefail + cleanup_on_failure() { + rc="$?" + if [ "$rc" -ne 0 ]; then + trap - EXIT + git reset --hard "${GITHUB_SHA}" + rm -f .github/workflows/tmp-pr1619-restack.yml + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + git add .github/workflows/tmp-pr1619-restack.yml + if ! git diff --cached --quiet; then + git commit -m 'chore(ci): remove failed PR 1619 restack writer' + remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" + if [ "$remote_head" = "$GITHUB_SHA" ]; then + git push origin "HEAD:${EXPECTED_REF}" + else + echo '::error::Writer branch moved; refusing cleanup push.' + fi + fi + fi + exit "$rc" + } + trap cleanup_on_failure EXIT + test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" test "$remote_head" = "$GITHUB_SHA" git fetch origin main @@ -42,9 +70,6 @@ jobs: git config user.name 'contextualwisdomlab-automation' git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - # Make the current protected-main tree authoritative. The branch history - # stays intact and is recorded as the first parent of the reconciliation - # commit; current main is the second parent. git read-tree --reset -u "${main_sha}^{tree}" python - <<'PY' @@ -58,7 +83,6 @@ jobs: workflow = workflow.replace(bootstrap, '', 1) if 'required-workflow-bootstrap:' in workflow: raise SystemExit('orphaned dispatch bootstrap still present') - # Preserve the live protected-main same-repository credential policy. required_token = "needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN" required_source = "needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN" if required_token not in workflow or required_source not in workflow: @@ -81,12 +105,11 @@ jobs: import sys from pathlib import Path - blob = sys.argv[1] path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') text = path.read_text(encoding='utf-8') text, count = re.subn( r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', - f'REVIEW_DISPATCH_BLOB_SHA = "{blob}"', + f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', text, count=1, ) @@ -95,19 +118,21 @@ jobs: path.write_text(text, encoding='utf-8') PY - PYTHONPATH=. python -m pytest -q \ - tests/test_opencode_agent_contract.py \ - tests/test_pr_review_autofix_nvidia_nim_contract.py + cat >"${RUNNER_TEMP}/pytest-lock.txt" <<'EOF' + iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760 + packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e + pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746 + pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176 + pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c + EOF + python -m pip install --disable-pip-version-check --only-binary=:all: --require-hashes -r "${RUNNER_TEMP}/pytest-lock.txt" + PYTHONPATH=. python -m pytest -q tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py git diff --check - - # The temporary writer is absent from the protected-main baseline and - # therefore absent from the reconstructed tree by construction. test ! -e .github/workflows/tmp-pr1619-restack.yml git add -A tree_sha="$(git write-tree)" commit_sha="$(printf '%s\n' 'fix(opencode): restack bootstrap cleanup on protected main' | git commit-tree "$tree_sha" -p "$GITHUB_SHA" -p "$main_sha")" - remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" test "$remote_head" = "$GITHUB_SHA" git push origin "${commit_sha}:refs/heads/${EXPECTED_REF}" From 9bda471bf081e48da10e4993845b02cb77d56ea8 Mon Sep 17 00:00:00 2001 From: contextualwisdomlab-automation Date: Tue, 1 Sep 2026 16:48:16 +0000 Subject: [PATCH 10/12] chore(ci): remove failed PR 1619 restack writer --- .github/workflows/tmp-pr1619-restack.yml | 138 ----------------------- 1 file changed, 138 deletions(-) delete mode 100644 .github/workflows/tmp-pr1619-restack.yml diff --git a/.github/workflows/tmp-pr1619-restack.yml b/.github/workflows/tmp-pr1619-restack.yml deleted file mode 100644 index 94219f3639..0000000000 --- a/.github/workflows/tmp-pr1619-restack.yml +++ /dev/null @@ -1,138 +0,0 @@ -name: Temporary PR 1619 non-destructive restack - -on: - push: - branches: - - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 - paths: - - .github/workflows/tmp-pr1619-restack.yml - -permissions: {} - -concurrency: - group: tmp-pr1619-restack - cancel-in-progress: false - -jobs: - restack: - runs-on: ubuntu-24.04 - timeout-minutes: 20 - permissions: - contents: write - steps: - - name: Check out exact writer head - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - with: - fetch-depth: 0 - - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 - with: - python-version: "3.14" - - - name: Reconstruct intended delta on live protected main - shell: bash - env: - EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 - run: | - set -euo pipefail - cleanup_on_failure() { - rc="$?" - if [ "$rc" -ne 0 ]; then - trap - EXIT - git reset --hard "${GITHUB_SHA}" - rm -f .github/workflows/tmp-pr1619-restack.yml - git config user.name 'contextualwisdomlab-automation' - git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - git add .github/workflows/tmp-pr1619-restack.yml - if ! git diff --cached --quiet; then - git commit -m 'chore(ci): remove failed PR 1619 restack writer' - remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" - if [ "$remote_head" = "$GITHUB_SHA" ]; then - git push origin "HEAD:${EXPECTED_REF}" - else - echo '::error::Writer branch moved; refusing cleanup push.' - fi - fi - fi - exit "$rc" - } - trap cleanup_on_failure EXIT - - test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" - test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" - test "$remote_head" = "$GITHUB_SHA" - git fetch origin main - main_sha="$(git rev-parse FETCH_HEAD)" - test -n "$main_sha" - - git config user.name 'contextualwisdomlab-automation' - git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - - git read-tree --reset -u "${main_sha}^{tree}" - - python - <<'PY' - from pathlib import Path - - workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') - workflow = workflow_path.read_text(encoding='utf-8') - bootstrap = ''' required-workflow-bootstrap:\n name: required-workflow-bootstrap\n runs-on: ubuntu-latest\n steps:\n - run: echo "OpenCode repository-dispatch review run materialized."\n\n''' - if workflow.count(bootstrap) != 1: - raise SystemExit('live protected main bootstrap shape changed; refusing mutation') - workflow = workflow.replace(bootstrap, '', 1) - if 'required-workflow-bootstrap:' in workflow: - raise SystemExit('orphaned dispatch bootstrap still present') - required_token = "needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN" - required_source = "needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN" - if required_token not in workflow or required_source not in workflow: - raise SystemExit('live protected-main credential contract changed; refusing mutation') - workflow_path.write_text(workflow, encoding='utf-8') - - test_path = Path('tests/test_opencode_agent_contract.py') - text = test_path.read_text(encoding='utf-8') - old = ''' assert "required-workflow-bootstrap:" in workflow\n assert "OpenCode repository-dispatch review run materialized." in workflow\n bootstrap_start = workflow.index(" required-workflow-bootstrap:\\n")\n bootstrap_end = workflow.index("\\n validate-pr-metadata:", bootstrap_start)\n bootstrap_job = workflow[bootstrap_start:bootstrap_end]\n assert "\\n if:" not in bootstrap_job\n''' - new = ''' # required-workflow-bootstrap is the trusted-source-resolution sentinel needed\n # only where the org ruleset targets a pull_request_target entrypoint\n # (opencode-review.yml). This repository_dispatch-only workflow is not itself\n # a required-workflow path, so it must not carry a copy-pasted, need-less\n # orphan of that job.\n assert "required-workflow-bootstrap:" not in workflow\n''' - if text.count(old) != 1: - raise SystemExit('live protected-main bootstrap test shape changed; refusing mutation') - text = text.replace(old, new, 1) - test_path.write_text(text, encoding='utf-8') - PY - - workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" - python - "$workflow_blob" <<'PY' - import re - import sys - from pathlib import Path - - path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') - text = path.read_text(encoding='utf-8') - text, count = re.subn( - r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', - f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', - text, - count=1, - ) - if count != 1: - raise SystemExit('unable to update exact dispatch blob contract') - path.write_text(text, encoding='utf-8') - PY - - cat >"${RUNNER_TEMP}/pytest-lock.txt" <<'EOF' - iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760 - packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e - pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746 - pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176 - pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c - EOF - python -m pip install --disable-pip-version-check --only-binary=:all: --require-hashes -r "${RUNNER_TEMP}/pytest-lock.txt" - PYTHONPATH=. python -m pytest -q tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py - git diff --check - test ! -e .github/workflows/tmp-pr1619-restack.yml - - git add -A - tree_sha="$(git write-tree)" - commit_sha="$(printf '%s\n' 'fix(opencode): restack bootstrap cleanup on protected main' | git commit-tree "$tree_sha" -p "$GITHUB_SHA" -p "$main_sha")" - remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" - test "$remote_head" = "$GITHUB_SHA" - git push origin "${commit_sha}:refs/heads/${EXPECTED_REF}" From 0a3ac6b24b5483b2f98749285b7aa5722ecc5737 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 01:59:18 +0900 Subject: [PATCH 11/12] ci: rebuild PR 1619 repair from live main --- .../tmp-pr1619-status-authority-repair.yml | 131 ++++++++++-------- 1 file changed, 77 insertions(+), 54 deletions(-) diff --git a/.github/workflows/tmp-pr1619-status-authority-repair.yml b/.github/workflows/tmp-pr1619-status-authority-repair.yml index 6813bbef97..665321db3e 100644 --- a/.github/workflows/tmp-pr1619-status-authority-repair.yml +++ b/.github/workflows/tmp-pr1619-status-authority-repair.yml @@ -1,4 +1,4 @@ -name: Temporary PR 1619 status authority repair +name: Temporary PR 1619 live-main reconstruction on: push: @@ -10,11 +10,11 @@ on: permissions: {} concurrency: - group: tmp-pr1619-status-authority-repair - cancel-in-progress: false + group: tmp-pr1619-live-main-reconstruction + cancel-in-progress: true jobs: - repair: + reconstruct: runs-on: ubuntu-24.04 timeout-minutes: 20 permissions: @@ -25,39 +25,25 @@ jobs: with: fetch-depth: 0 - - name: Repair status authority and delete this one-shot writer + - name: Reconstruct intended delta from protected main shell: bash env: EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 run: | set -euo pipefail - cleanup_on_failure() { - rc="$?" - if [ "$rc" -ne 0 ]; then - trap - EXIT - git reset --hard "${GITHUB_SHA}" - rm -f .github/workflows/tmp-pr1619-status-authority-repair.yml - git config user.name 'contextualwisdomlab-automation' - git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - git add .github/workflows/tmp-pr1619-status-authority-repair.yml - if ! git diff --cached --quiet; then - git commit -m 'chore(ci): remove failed PR 1619 status repair writer' - git fetch origin "${EXPECTED_REF}" - if [ "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" ]; then - git push origin "HEAD:${EXPECTED_REF}" - fi - fi - fi - exit "$rc" - } - trap cleanup_on_failure EXIT - test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" - git fetch origin "${EXPECTED_REF}" - test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + git fetch origin "${EXPECTED_REF}" main + test "$(git rev-parse "origin/${EXPECTED_REF}")" = "${GITHUB_SHA}" + MAIN_SHA="$(git rev-parse origin/main)" + + # Protected main is the content baseline. The resulting commit keeps + # both the current PR head and current main as parents, so concurrent + # work is preserved without a force push or destructive rebase. + git read-tree --reset -u "${MAIN_SHA}" python3 - <<'PY' + import re from pathlib import Path workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') @@ -65,43 +51,80 @@ jobs: workflow = workflow_path.read_text(encoding='utf-8') tests = test_path.read_text(encoding='utf-8') - old_token = "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" - new_token = "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" - old_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" - new_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" - if workflow.count(old_token) != 1 or workflow.count(old_source) != 1: - raise SystemExit('exact status credential expression changed; refusing stale repair') - workflow = workflow.replace(old_token, new_token, 1).replace(old_source, new_source, 1) - workflow_path.write_text(workflow, encoding='utf-8') - - old_assert = ''' assert (\n "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step\n''' - new_assert = ''' assert (\n "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: ${{ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step\n''' - if tests.count(old_assert) != 1: - raise SystemExit('exact status contract test changed; refusing stale repair') - test_path.write_text(tests.replace(old_assert, new_assert, 1), encoding='utf-8') + dead_job = ''' required-workflow-bootstrap: + name: required-workflow-bootstrap + runs-on: ubuntu-latest + steps: + - run: echo "OpenCode repository-dispatch review run materialized." + + '''.replace(' ', '') + if workflow.count(dead_job) != 1: + raise SystemExit('protected-main orphan bootstrap shape changed; refusing reconstruction') + workflow_path.write_text(workflow.replace(dead_job, '', 1), encoding='utf-8') + + bootstrap_contract = re.compile( + r' assert "required-workflow-bootstrap:" in workflow\n' + r' assert "OpenCode repository-dispatch review run materialized\\\." in workflow\n' + r' bootstrap_start = workflow\.index\(" required-workflow-bootstrap:\\\\n"\)\n' + r' bootstrap_end = workflow\.index\("\\\\n validate-pr-metadata:", bootstrap_start\)\n' + r' bootstrap_job = workflow\[bootstrap_start:bootstrap_end\]\n' + r' assert "\\\\n if:" not in bootstrap_job\n' + ) + replacement = ( + ' assert "required-workflow-bootstrap:" not in workflow\n' + ' assert "OpenCode repository-dispatch review run materialized." not in workflow\n' + ) + tests, count = bootstrap_contract.subn(replacement, tests, count=1) + if count != 1: + raise SystemExit('protected-main bootstrap regression contract changed; refusing reconstruction') + test_path.write_text(tests, encoding='utf-8') PY workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" - python3 - "$workflow_blob" <<'PY' - import re, sys + python3 - "${workflow_blob}" <<'PY' + import re + import sys from pathlib import Path + path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') text = path.read_text(encoding='utf-8') - text, count = re.subn(r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', text, count=1) + text, count = re.subn( + r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', + f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', + text, + count=1, + ) if count != 1: - raise SystemExit('dispatch blob pin contract changed; refusing stale repair') + raise SystemExit('dispatch blob pin contract changed; refusing reconstruction') path.write_text(text, encoding='utf-8') PY - PYTHONPATH=. python -m pytest -q tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py + PYTHONPATH=. python -m pytest -q \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py git diff --check - rm .github/workflows/tmp-pr1619-status-authority-repair.yml - git add .github/workflows/opencode-review-dispatch.yml tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py .github/workflows/tmp-pr1619-status-authority-repair.yml - git diff --cached --check - git fetch origin "${EXPECTED_REF}" - test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + git add \ + .github/workflows/opencode-review-dispatch.yml \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py + + actual_paths="$(git diff --cached --name-only "${MAIN_SHA}" | LC_ALL=C sort)" + expected_paths="$(printf '%s\n' \ + '.github/workflows/opencode-review-dispatch.yml' \ + 'tests/test_opencode_agent_contract.py' \ + 'tests/test_pr_review_autofix_nvidia_nim_contract.py' | LC_ALL=C sort)" + test "${actual_paths}" = "${expected_paths}" + git diff --cached --check "${MAIN_SHA}" + + tree_sha="$(git write-tree)" git config user.name 'contextualwisdomlab-automation' git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' - git commit -m 'fix(opencode): preserve same-repository status authority' - git push origin "HEAD:${EXPECTED_REF}" + commit_sha="$(printf '%s\n\n%s\n' \ + 'chore(ci): reconstruct OpenCode bootstrap cleanup on live main' \ + 'Preserve current protected-main status authority and all concurrent changes while removing only the orphan repository-dispatch bootstrap job and updating its executable contracts.' \ + | git commit-tree "${tree_sha}" -p "${GITHUB_SHA}" -p "${MAIN_SHA}")" + + git fetch origin "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + git push origin "${commit_sha}:refs/heads/${EXPECTED_REF}" From c8b2fd4fd0e5b7c36f20cb43ee48cfe9de44662f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 02:01:15 +0900 Subject: [PATCH 12/12] fix(ci): make PR 1619 live-main repair fail-closed and exact --- .../tmp-pr1619-status-authority-repair.yml | 146 ++++++++++++++++++ 1 file changed, 146 insertions(+) create mode 100644 .github/workflows/tmp-pr1619-status-authority-repair.yml diff --git a/.github/workflows/tmp-pr1619-status-authority-repair.yml b/.github/workflows/tmp-pr1619-status-authority-repair.yml new file mode 100644 index 0000000000..cb4356024a --- /dev/null +++ b/.github/workflows/tmp-pr1619-status-authority-repair.yml @@ -0,0 +1,146 @@ +name: Temporary PR 1619 live-main reconstruction + +on: + push: + branches: + - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + paths: + - .github/workflows/tmp-pr1619-status-authority-repair.yml + +permissions: {} + +concurrency: + group: tmp-pr1619-live-main-reconstruction + cancel-in-progress: true + +jobs: + reconstruct: + runs-on: ubuntu-24.04 + timeout-minutes: 20 + permissions: + contents: write + steps: + - name: Check out exact repair head + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + fetch-depth: 0 + + - name: Reconstruct intended delta from protected main + shell: bash + env: + EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 + run: | + set -euo pipefail + test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" + test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" + git fetch origin "${EXPECTED_REF}" main + test "$(git rev-parse "origin/${EXPECTED_REF}")" = "${GITHUB_SHA}" + MAIN_SHA="$(git rev-parse origin/main)" + + # Protected main is the authoritative content baseline. Reset the + # working tree to that exact tree, then reapply only the intended + # three-file semantic delta. Because this temporary workflow does not + # exist on protected main, the resulting reconciliation tree retires + # it automatically. + git read-tree --reset -u "${MAIN_SHA}" + + python3 - <<'PY' + from pathlib import Path + + workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') + test_path = Path('tests/test_opencode_agent_contract.py') + workflow = workflow_path.read_text(encoding='utf-8') + tests = test_path.read_text(encoding='utf-8') + + dead_job = ''' required-workflow-bootstrap: + name: required-workflow-bootstrap + runs-on: ubuntu-latest + steps: + - run: echo "OpenCode repository-dispatch review run materialized." + + '''.replace(' ', '') + if workflow.count(dead_job) != 1: + raise SystemExit('protected-main orphan bootstrap shape changed; refusing reconstruction') + workflow = workflow.replace(dead_job, '', 1) + + old_contract = ''' assert "required-workflow-bootstrap:" in workflow + assert "OpenCode repository-dispatch review run materialized." in workflow + bootstrap_start = workflow.index(" required-workflow-bootstrap:\\n") + bootstrap_end = workflow.index("\\n validate-pr-metadata:", bootstrap_start) + bootstrap_job = workflow[bootstrap_start:bootstrap_end] + assert "\\n if:" not in bootstrap_job + '''.replace(' ', '') + new_contract = ''' assert "required-workflow-bootstrap:" not in workflow + assert "OpenCode repository-dispatch review run materialized." not in workflow + '''.replace(' ', '') + if tests.count(old_contract) != 1: + raise SystemExit('protected-main bootstrap regression contract changed; refusing reconstruction') + tests = tests.replace(old_contract, new_contract, 1) + + # Guard the substantive review finding directly: same-repository + # publication must retain github.token authority from protected main. + same_repo_token = ( + "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == " + "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || " + "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" + ) + same_repo_source = ( + "OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == " + "github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && " + "'PR_REVIEW_MERGE_TOKEN'" + ) + if same_repo_token not in workflow or same_repo_source not in workflow: + raise SystemExit('protected-main same-repository status authority changed; refusing reconstruction') + + workflow_path.write_text(workflow, encoding='utf-8') + test_path.write_text(tests, encoding='utf-8') + PY + + workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" + python3 - "${workflow_blob}" <<'PY' + import re + import sys + from pathlib import Path + + path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') + text = path.read_text(encoding='utf-8') + text, count = re.subn( + r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', + f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', + text, + count=1, + ) + if count != 1: + raise SystemExit('dispatch blob pin contract changed; refusing reconstruction') + path.write_text(text, encoding='utf-8') + PY + + PYTHONPATH=. python -m pytest -q \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py + git diff --check + + git add \ + .github/workflows/opencode-review-dispatch.yml \ + tests/test_opencode_agent_contract.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py + + actual_paths="$(git diff --cached --name-only "${MAIN_SHA}" | LC_ALL=C sort)" + expected_paths="$(printf '%s\n' \ + '.github/workflows/opencode-review-dispatch.yml' \ + 'tests/test_opencode_agent_contract.py' \ + 'tests/test_pr_review_autofix_nvidia_nim_contract.py' | LC_ALL=C sort)" + test "${actual_paths}" = "${expected_paths}" + git diff --cached --check "${MAIN_SHA}" + + tree_sha="$(git write-tree)" + git config user.name 'contextualwisdomlab-automation' + git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' + commit_sha="$(printf '%s\n\n%s\n' \ + 'chore(ci): reconstruct OpenCode bootstrap cleanup on live main' \ + 'Preserve current protected-main status authority and all concurrent changes while removing only the orphan repository-dispatch bootstrap job and updating its executable contracts.' \ + | git commit-tree "${tree_sha}" -p "${GITHUB_SHA}" -p "${MAIN_SHA}")" + + git fetch origin "${EXPECTED_REF}" + test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" + git push origin "${commit_sha}:refs/heads/${EXPECTED_REF}"