ci: switch OpenCode to NVIDIA NIM only - #540
Conversation
Point local and CI OpenCode configs at nvidia-nim with NVIDIA_API_KEY, defaulting to llama-3.3-nemotron-super-49b-v1.5. Remove GitHub Models provider ids, STRIX_GITHUB_MODELS_TOKEN, and COPILOT_GITHUB_TOKEN from OpenCode review. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
REQUEST_CHANGES on 5cd0ab8.
The NIM-only OpenCode rewrite is the right cutover: opencode.jsonc and the isolated review workspace now use nvidia-nim at https://integrate.api.nvidia.com/v1, enabled_providers is NIM-only, GitHub Models / USE_GITHUB_TOKEN / STRIX_GITHUB_MODELS_TOKEN are gone from the OpenCode path, and Strix still uses its own GitHub Models credentials. Do not undo that split.
The merge blocker is the CI secret name. OpenCode's client binding must stay {env:NVIDIA_API_KEY}. The organization secret is NVIDIA_NIM_API_KEY. This head injects secrets.NVIDIA_API_KEY in all four review/approval blocks and then locks that wrong name in test_strix_quick_gate.sh. GitHub will leave process NVIDIA_API_KEY empty, so primary/fallback review and failed-check diagnosis will not authenticate.
Required next action: land the mapping on the successor, then close this PR.
Landing vehicle: #542 (850cde4). It keeps the local {env:NVIDIA_API_KEY} binding, maps NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }} in CI, locks the split in the Strix gate, and documents it in AGENTS.md. Local verification on that head: test_strix_quick_gate.sh PASS; 6 Strix source-regression tests PASS.
Do not merge this PR. Do not rename the local OpenCode binding. Do not retarget Strix secrets. Do not introduce COPILOT_GITHUB_TOKEN.
Sent by Cursor Automation: Fix Issues
| timeout-minutes: 60 | ||
| env: | ||
| STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN }} | ||
| NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }} |
There was a problem hiding this comment.
Map the org secret onto the existing OpenCode process env. Keep {env:NVIDIA_API_KEY} in the isolated opencode.jsonc above; change only the GitHub secret name:
NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}The same mapping is required at the Llama fallback, Codestral fallback, and approval/diagnosis steps (currently lines 550, 657, and 919). secrets.NVIDIA_API_KEY is not the organization credential, so these steps will run with an empty key and run_failed_check_diagnosis will skip at the empty-key guard.
Fixed on #542. Close this PR after that successor is check-clean.
| assert_file_contains "$workflow_file" "MODEL: nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5" "opencode review uses NVIDIA NIM Nemotron Super as the default model" | ||
| assert_file_contains "$workflow_file" "MODEL: nvidia-nim/meta/llama-3.3-70b-instruct" "opencode review falls back to NVIDIA NIM Llama 3.3 70B Instruct" | ||
| assert_file_contains "$workflow_file" "MODEL: nvidia-nim/mistralai/codestral-22b-instruct-v0.1" "opencode review has a second NVIDIA NIM Codestral fallback model" | ||
| assert_file_contains "$workflow_file" 'NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}' "opencode review uses the NVIDIA NIM API key secret" |
There was a problem hiding this comment.
This assertion locks the broken secret name and will fail a correct fix. The message says “NVIDIA NIM API key secret” while requiring secrets.NVIDIA_API_KEY.
Replace with an explicit split:
assert_file_contains "$workflow_file" 'NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}' \
"opencode CI maps secrets.NVIDIA_NIM_API_KEY onto process NVIDIA_API_KEY"
assert_file_not_contains "$workflow_file" 'secrets.NVIDIA_API_KEY' \
"opencode CI must not read a GitHub secret named NVIDIA_API_KEY"secrets.NVIDIA_API_KEY is not a substring of secrets.NVIDIA_NIM_API_KEY, so the negative check is safe. Keep the local {env:NVIDIA_API_KEY} assertion on opencode.jsonc.
Fixed and locked on #542.
|
Superseded by #543 after fresh protected- |
2 participants
ContextualWisdomLab no longer uses GitHub Models for OpenCode. This PR rewrites local and CI OpenCode config to NVIDIA NIM only.
Changes
opencode.jsoncnow uses providernvidia-nimathttps://integrate.api.nvidia.com/v1withapiKey: {env:NVIDIA_API_KEY}.nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5.enabled_providersis["nvidia-nim"]only.MODELenv vars use the same NIM provider and key.meta/llama-3.3-70b-instruct,mistralai/codestral-22b-instruct-v0.1).github-models,openai/gpt-5,STRIX_GITHUB_MODELS_TOKEN,USE_GITHUB_TOKEN, and anyCOPILOT_GITHUB_TOKENpath from OpenCode config/review.Strix scan provider policy is unchanged.
Verification
python3JSON parse ofopencode.jsoncpassed.bash scripts/ci/test_strix_quick_gate.shpassed.