ci: schedule NVIDIA OpenCode maintenance agent - #121

Draft

seonghobae wants to merge 153 commits into

ci/hourly-opencode-nvidia-nim

Commits on Aug 4, 2026

docs: design hourly OpenCode maintenance agent
seonghobae
committed
e3d7707
docs: plan hourly OpenCode maintenance agent
seonghobae
committed
6e9219d
test(ci): define hourly OpenCode maintenance contract
seonghobae
committed
ec45a1b
ci: schedule NVIDIA OpenCode maintenance agent
seonghobae
committed
856667e
fix(ci): make secret handling boundary explicit
seonghobae
committed
995bfe3
docs(ci): document OpenCode maintenance operations
seonghobae
committed
ff5065e
docs(ci): record NVIDIA OpenCode maintenance loop
seonghobae
committed
7e5e047
test(ci): require direct-token git bootstrap
seonghobae
committed
844642c
fix(ci): bootstrap OpenCode direct-token git access
seonghobae
committed
c7b168d
docs(ci): explain direct-token Git bootstrap
seonghobae
committed
603a5ad
docs(ci): align plan with direct-token behavior
seonghobae
committed
b19d032
docs(ci): harden direct-token credential lifecycle
seonghobae
committed
a616fbe
docs(changelog): record direct-token Git fix
seonghobae
committed
d23fefc
test(ci): require forced OpenCode termination
seonghobae
committed
83b56c1
fix(ci): force termination after OpenCode timeout
seonghobae
committed
613a753
docs(ci): document forced OpenCode termination
seonghobae
committed
b18c859
docs(ci): specify forced timeout escalation
seonghobae
committed
ba845b8
docs(ci): align plan with timeout escalation
seonghobae
committed
cc661d3
docs(ci): cite GNU timeout behavior
seonghobae
committed
209ace0
docs(ci): cite GNU timeout design basis
seonghobae
committed
0f341d8
test(ci): require independent exact-head approval
seonghobae
committed
9437c99
fix(ci): require independent exact-head approval
seonghobae
committed
5c9f349
docs(ci): define exact-head approval gate
seonghobae
committed
671cf68
docs(changelog): record exact-head approval gate
seonghobae
committed
87fe946
test(ci): require checksum-pinned OpenCode install
seonghobae
committed
5ec2c22
test(ci): require local GitHub CLI credential helper
seonghobae
committed
0ac43ab
fix(ci): close Scorecard supply-chain findings
seonghobae
committed
5ac043e
docs(ci): document checksum and permission boundaries
seonghobae
committed
a9a9967
docs(ci): align OpenCode security design
seonghobae
committed
1ce9a27
docs(ci): update checksum-pinned implementation plan
seonghobae
committed
38a85be
docs(changelog): record OpenCode supply-chain hardening
seonghobae
committed
c1a8e79
fix(test): normalize workflow line endings
seonghobae
committed
bdf9435
test(security): require patched Jackson BOM
seonghobae
committed
432f8ac
fix(security): align Jackson to patched BOM
seonghobae
committed
b1beef8
docs(changelog): record Jackson advisory remediation
seonghobae
committed
af707e9

Commits on Aug 5, 2026

test(ci): require exact OpenCode archive membership
seonghobae
committed
751eedb
fix(ci): validate OpenCode archive members
seonghobae
committed
13c3ab9
docs(ci): explain archive extraction boundary
seonghobae
committed
f4b2a1c
docs(ci): design fail-closed archive extraction
seonghobae
committed
1ccc8c9
docs(ci): plan archive-member validation
seonghobae
committed
368ceac
docs(doctoring): record archive extraction evidence
seonghobae
committed
862bad4
docs(changelog): record archive extraction hardening
seonghobae
committed
f3da591
test(ci): require regular OpenCode archive member
seonghobae
committed
7b82a40
fix(ci): reject non-regular archive entries
seonghobae
committed
31dc60e
docs(doctoring): record regular-entry validation
seonghobae
committed
7a36304
docs(ci): document archive entry-type gate
seonghobae
committed
46fdace
docs(ci): design regular-entry validation
seonghobae
committed
cc7766e
docs(ci): align archive entry-type plan
seonghobae
committed
982a6bc
test(ci): require available free NVIDIA model
seonghobae
committed
42eb7d7
fix(ci): select available free NVIDIA model
seonghobae
committed
90c1502
docs(doctoring): record NVIDIA model selection evidence
seonghobae
committed
f0c0211
docs(ci): select available NVIDIA coding model
seonghobae
committed
5747bf8
docs(ci): design current NVIDIA model selection
seonghobae
committed
ca1dc7f
docs(ci): plan current NVIDIA model integration
seonghobae
committed
57d15c6
docs(changelog): record current NVIDIA model
seonghobae
committed
a0ad9d0
test(etl): reject empty JaCoCo coverage scopes
seonghobae
committed
d7596e4
fix(etl): make JaCoCo coverage fail closed
seonghobae
committed
2517056
test(etl): compare coverage includes deterministically
seonghobae
committed
3b25dfd
test(etl): cover durable intake validation boundaries
seonghobae
committed
bfd5114
test(etl): cover every durable intake branch
seonghobae
committed
516bc57
refactor(etl): centralize durable SHA-256 identity
seonghobae
committed
d4d8a9e
feat(etl): centralize SHA-256 digesting
seonghobae
committed
1907a48
test(etl): verify SHA-256 digest utility
seonghobae
committed
9b94b14
test(etl): include digest utility in complete coverage
seonghobae
committed
b0a5d49
test(etl): bind digest utility to complete coverage
seonghobae
committed
3106dc7
test(etl): cover empty durable batch validation
seonghobae
committed
b8fea3f
ci: expose exact JaCoCo branch diagnostics
seonghobae
committed
cae178c
test(etl): cover parser end-of-input branch
seonghobae
committed
bd2f0d0
test(ci): require default-branch-only maintenance source
seonghobae
committed
1feb650
test(ci): require diagnostics for all coverage targets
seonghobae
committed
ed30200
test(security): verify effective Jackson BOM resolution
seonghobae
committed
82de9b3
fix(ci): bind maintenance workflow to default branch
seonghobae
committed
7a682cf
fix(ci): diagnose every strict coverage target
seonghobae
committed
97b4449
fix(security): import patched Jackson BOM explicitly
seonghobae
committed
e081acd
test(security): verify Jackson BOM precedence
seonghobae
committed
75eafeb
docs: clarify OpenCode secret process scope
seonghobae
committed
e9f3a03
docs: align OpenCode extraction plan
seonghobae
committed
3a46868
docs: align OpenCode extraction design
seonghobae
committed
5f8fcdf
test(ci): require exact-head checks after agent pushes
seonghobae
committed
91d86fa
fix(ci): revalidate exact heads written by OpenCode
seonghobae
committed
1d35988
test(ci): harden exact-head run authorization
seonghobae
committed
9b63536
fix(ci): fail closed on agent policy changes
seonghobae
committed
b4ec3ba
docs(ci): record exact-head check authorization evidence
seonghobae
committed
ee6c5eb
docs(ci): document agent head revalidation
seonghobae
committed
80dd0d0
docs(changelog): record exact-head check authorization
seonghobae
committed
9852841
test(ci): isolate Actions write from the agent
seonghobae
committed
a8d1f6a
fix(ci): isolate check authorization from OpenCode
seonghobae
committed
1a56702
docs(ci): isolate exact-head authorization authority
seonghobae
committed
cc4c9e9
docs(ci): document split-job authorization
seonghobae
committed
6d23599
docs(ci): align design with split authority
seonghobae
committed
41624f3
docs(ci): align implementation plan with exact-head revalidation
seonghobae
committed
aa2ac97
test(ci): require every exact-head workflow to materialize
seonghobae
committed
015511c
fix(ci): authorize the complete exact-head workflow set
seonghobae
committed
bd017ef
docs(ci): require complete workflow-set materialization
seonghobae
committed
887a48a
docs(ci): document complete exact-head workflow authorization
seonghobae
committed
68e82f9

Commits on Aug 6, 2026

test(ci): require agent authority separation and PR-bound checks
seonghobae
committed
df61d97
fix(ci): isolate agent PR authority and bind checks to PR
seonghobae
committed
e689499
docs(ci): record model and PR authority separation
seonghobae
committed
c115a4a
docs(doctoring): prove PR authority and run association boundaries
seonghobae
committed
8d34b7c
docs(design): separate model, publisher, and run authorizer
seonghobae
committed
28b56bb
docs(plan): complete authority-separated OpenCode workflow plan
seonghobae
committed
f3d6861
test(ci): assert semantic workflow authorization contract
seonghobae
committed
a5f0972
test(ci): guard jq branch candidate scope
seonghobae
committed
7974905
fix(ci): capture branch name before jq array lookup
seonghobae
committed
ed88fc8
test(ci): require existing PR policy-file guard
seonghobae
committed
75bdc19
fix(ci): guard policy changes on updated PRs
seonghobae
committed
91533ad
docs(ci): document updated PR policy guard
seonghobae
committed
6b698be
docs(changelog): record existing PR policy guard
seonghobae
committed
2f37444

Commits on Aug 7, 2026

test(ci): expose synthetic merge workflow evidence
seonghobae
committed
9bbd20b
fix(ci): execute quality gates on exact source head
seonghobae
committed
4ce080a
fix(sbom): bind inventory generation to exact source head
seonghobae
committed
91f6dcb
docs(ci): record exact-head source evidence boundary
seonghobae
committed
16ebda4
docs(changelog): record exact-head CI and SBOM evidence
seonghobae
committed
b24bed9
test(ci): require exact dependency review refs
seonghobae
committed
077340a
fix(ci): bind dependency review to exact PR refs
seonghobae
committed
0b947a6
docs(ci): record exact dependency review evidence
seonghobae
committed
3185f26
test(ci): reject ignored dependency review ref overrides
seonghobae
committed
cd706f2
docs(changelog): record exact dependency review binding
seonghobae
committed
4c30a17
fix(ci): rely on pull-request dependency review refs
seonghobae
committed
3358b40
docs(ci): correct dependency review endpoint evidence
seonghobae
committed
6b6afb9
docs(changelog): correct dependency review event semantics
seonghobae
committed
d1cae11
test: require read-only issue permission
seonghobae
committed
7efcca2
fix: restrict maintenance issue access
seonghobae
committed
171e0a8
docs: document read-only issue authority
seonghobae
committed
c7ef4a8
docs: record least-privilege issue access
seonghobae
committed
c2ecc34
test(ci): require isolated branch writer
seonghobae
committed
727e7ca
fix(ci): isolate model from repository writes
seonghobae
committed
2079a01
test(ci): bind policy guard to isolated publisher
seonghobae
committed
327d1e4

Commits on Aug 8, 2026

test(security): require immutable container base images
seonghobae
committed
b6efb1f
fix(security): pin container base image digests
seonghobae
committed
f8cdcf7
docs(security): record container image pinning evidence
seonghobae
committed
832061b
docs(changelog): record immutable base image pins
seonghobae
committed
699d3f2
test(ci): specify nonblocking maintenance progress contract
seonghobae
committed
7ae7dcc
docs(agents): keep scheduled maintenance productive during external waits
seonghobae
committed
8bac86c
docs(doctoring): record nonblocking scheduler progress contract
seonghobae
committed
6d5101c
docs(changelog): record nonblocking scheduled progress
seonghobae
committed
3c22841
fix(changelog): preserve exact legacy config alias scope
seonghobae
committed
29b373f
test(ci): compare scheduler policy independent of Markdown wrapping
seonghobae
committed
06f49cc
test(ci): require RCA feasibility loop in scheduler
seonghobae
committed
dba0af6
fix(ci): require RCA and feasible action selection
seonghobae
committed
ab3d5b2
fix(ci): restore exact-head authorization dependency
seonghobae
committed
36c8752
docs(agents): require RCA feasibility before action
seonghobae
committed
5efb68e
docs(doctoring): record RCA feasibility contract
seonghobae
committed
1b90dbc
docs(changelog): record RCA feasibility scheduler
seonghobae
committed
427ce2b
test(docs): require current OpenCode authority topology
seonghobae
committed
b1afefd
docs(security): align OpenCode authority evidence
seonghobae
committed
75265fa

Commits on Aug 11, 2026

fix(automation): complete work-conserving runtime contract
seonghobae
committed
69b39f5

Commits on Aug 14, 2026

test(automation): pin current review contracts
seonghobae
committed
d22e7d2