ci: schedule NVIDIA OpenCode maintenance agent - #121
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughChangesPR 자동화, exact-head 소스 검증, OpenCode 유지보수, ETL 커버리지 정책, Jackson BOM 및 Docker 이미지 고정이 추가되었습니다. 시간별 OpenCode 유지보수
정확한 소스 및 PR 게이트
ETL 해시 및 커버리지 검증
의존성 및 이미지 보안
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant OpenCodeCLI
participant GitHubAPI
Scheduler->>OpenCodeCLI: 고정된 CLI와 NVIDIA 모델로 유지보수 실행
OpenCodeCLI->>GitHubAPI: PR 및 workflow 상태 조회
Scheduler->>GitHubAPI: 검증된 후보 브랜치 게시
Scheduler->>GitHubAPI: draft PR 생성 및 exact-head workflow 승인
Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
etl-service/src/test/java/com/xtrmetl/etl/documentation/HourlyOpenCodeRequiredWorkflowAuthorizationTest.java (1)
30-48: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win필수 승인 계약의 결합과 순서를 구조적으로 검증하십시오.
현재 테스트는 각 문자열을 독립적으로
contains로 검사합니다. 따라서 PR 번호와expected_head조건이 서로 다른jq블록에 있거나, ledger 기록이/approve호출보다 먼저 있어도 통과합니다. 동일한run_id선택식에 두 조건이 함께 있는지 확인하고, 성공한/approve호출 뒤에만 ledger 기록이 실행되는지 순서를 검증하십시오. 수정 후./mvnw -B test를 실행하십시오.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@etl-service/src/test/java/com/xtrmetl/etl/documentation/HourlyOpenCodeRequiredWorkflowAuthorizationTest.java` around lines 30 - 48, Strengthen waitsForEveryRequiredExactHeadWorkflow() to validate the approval contract structurally rather than through independent contains checks: assert that the same run_id jq-selection block includes both the PR-number match and .head_sha == $expected_head, and verify that ledger recording occurs only after the successful /actions/runs/${run_id}/approve call. Replace or supplement the fragmented assertions with ordering- and block-specific checks, then run ./mvnw -B test.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@etl-service/src/test/java/com/xtrmetl/etl/documentation/HourlyOpenCodeRequiredWorkflowAuthorizationTest.java`:
- Around line 30-48: Strengthen waitsForEveryRequiredExactHeadWorkflow() to
validate the approval contract structurally rather than through independent
contains checks: assert that the same run_id jq-selection block includes both
the PR-number match and .head_sha == $expected_head, and verify that ledger
recording occurs only after the successful /actions/runs/${run_id}/approve call.
Replace or supplement the fragmented assertions with ordering- and
block-specific checks, then run ./mvnw -B test.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 20ced1d6-6320-4f85-87a8-db49d1d67dc7
📒 Files selected for processing (4)
.github/workflows/hourly-opencode-maintenance.ymletl-service/src/test/java/com/xtrmetl/etl/documentation/ContainerImagePinningTest.javaetl-service/src/test/java/com/xtrmetl/etl/documentation/HourlyOpenCodeProgressPolicyTest.javaetl-service/src/test/java/com/xtrmetl/etl/documentation/HourlyOpenCodeRequiredWorkflowAuthorizationTest.java
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/hourly-opencode-maintenance.yml
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
|
Queued @cwl-noema-review ; Rejected @opencode-agent: repository is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS for PR #121 at head |
opencode-agent
Bot
added
priority: medium
2 participants
Purpose
Establish a least-privilege hourly OpenCode development loop using
NVIDIA_NIM_API_KEY, literal-source CI/SBOM controls, deterministic publication jobs, exact-head review/check authorization, branch-wide writer protections, and a work-conserving RCA→feasibility→action→proof runtime contract.Exact current identity
develop@942d164ceb7af497bb28a95f842db96429d1bdc4;ci/hourly-opencode-nvidia-nim;69b39f5e26a32d99667bc0108a50de94d7bb4c0c;14c276286af1448638806e12d2127624c89580d6;Every predecessor-head check, review, approval, thread conclusion, base snapshot or synthetic merge is historical and does not transfer.
Authority boundaries
maintain-repositorychecks out source and runs OpenCode with repository-read-only GitHub authority. It may inspect/test/create local commits but cannot publish a ref, create/update a pull request, authorize a run, approve, merge or release.publish-agent-branchhas the isolated job-scopedcontents: writeneeded for one non-forced same-repository feature-ref publication. It receives no model credential and verifies bundle digest, exact predecessor/live base, ancestry, commit/file/path bounds, policy-file exclusion, Git integrity and post-write SHA.publish-agent-pull-requestalone haspull-requests: write, receives no model credential and may create or identify only one validated Draft PR.authorize-exact-head-checksalone hasactions: write, receives no model credential and may authorize only unchanged-head pull-request runs in waiting/action-required states. It cannot approve or merge.COPILOT_GITHUB_TOKENis not a development-model credential.Scorecard write-permission observations remain factually true where GitHub-native bounded publication/authorization requires them; resolved historical threads are compensating-control dispositions, not evidence that those capabilities disappeared.
Current literal-source evidence
All exposed workflow aggregates associated with exact current source
69b39f5e26a32d99667bc0108a50de94d7bb4c0care terminal-success:31453761683;31453761704;31453761677;31453761678;31453761681.CI macOS job
93663255843explicitly checked out and verified literal source69b39f5e26a32d99667bc0108a50de94d7bb4c0c; Ubuntu and Windows jobs also report the exact-source checkout/verification steps as successful. The macOS full reactor completedBUILD SUCCESS, with 321 ETL tests, 111 CDC tests and 3 gateway tests green. JaCoCo analyzed 9 ETL classes rather than a zero-class bundle on this branch; this remains selected-scope evidence, not repository-wide 100% owned-production statement/branch coverage authority tracked by #205.The conditional self-hosted job is skipped and is not positive evidence.
Current review state and valid remaining findings
There is no qualifying independent non-author formal
APPROVEDreview on the exact current head. Current formal reviews areCOMMENTEDor older-head evidence.Fresh review-thread validation on this exact head found still-current findings, including:
publish-agent-branchtopology;HourlyOpenCodeIssuePermissionWorkflowTestscopes its maintenance-job substring throughpublish-agent-pull-requestinstead of stopping atpublish-agent-branch, weakening the job-local permission assertion.A current-head CodeRabbit review also identifies a structural test-hardening gap in
HourlyOpenCodeRequiredWorkflowAuthorizationTest: the production workflow already selects runs by both exact head and PR number and records approval only after the successful approval POST, but the existing test verifies those fragments independently rather than structurally pinning their shared selection block and ordering. This is a preventive contract-test gap, not evidence that the current production authorization order is wrong.Do not resolve any of these findings as addressed until the exact branch contains the corresponding repair and current evidence is rerun.
Stack and movement constraint
This PR is the live root predecessor for the repaired durable-job stack #143→#148. Moving this head invalidates exact-predecessor ancestry and all downstream evidence until every affected boundary is repaired non-destructively. Therefore wording-only changes must not move #121. Issue #154 owns the later embedded-prompt alignment, and the remaining current review hardening should be batched only with an unavoidable #121 head movement that can also repair the downstream stack safely.
Non-passing merge gates
Keep the manual merge hold. Current aggregate-green checks are not sufficient merge authority because:
APPROVEDreview exists;Queued, pending, skipped-required, neutral-required, absent, cancelled, failed, stale-head, predecessor-head, status-only, author-only and synthetic-only evidence remain non-passing for the gate they fail to prove.
Merge policy
Merge only on an unchanged exact head after every current CI/security/SBOM/provenance/dependency/coverage gate is accepted, every valid current finding is addressed, live-base/stack integrity is revalidated, and qualifying independent non-author formal exact-head approval exists. Never bypass protection, synthesize approval, weaken tests or scanner policy, reuse stale evidence, race a writer, or rewrite stack history.