fix(dispatch): parse the trusted-dispatcher allowlist identically in all three consumers (#1929)

[seonghobae]

Closes nothing by itself — the variable still needs an owner decision. See #1929.

Why

Two trusted workflows send the opencode-review repository_dispatch:

dispatcher	token	sender
opencode-review.yml	OpenCode GitHub App (since #1497, 4a5dfd82)	opencode-agent[bot]
pr-review-merge-scheduler.yml	its own token chain (:211, :487)	github-actions[bot]

The gate in opencode-review-dispatch.yml compared both actor and sender against the single-valued vars.OPENCODE_REPOSITORY_DISPATCH_ACTOR, which still names only github-actions[bot] (last set 2026-07-16). Every app-token dispatch has therefore failed at the first job:

opencode-review-dispatch.yml lifetime:  success 466 / failure 9611   (95.4%)
failure sample n=40:  27 opencode-agent[bot]  · 11 github-actions[bot]  · 2 manual
open non-draft PRs with a successful opencode-review run on their current head:  0 / 99

Replacing the value would flip the problem onto the scheduler path. The gate has to be able to hold more than one identity.

What changes

vars.OPENCODE_REPOSITORY_DISPATCH_ACTOR is read by three workflows, and all three now parse it the same way — as a comma-separated list, exactly like the adjacent ALLOWED_DISPATCH_TARGETS block:

consumer	gate	before
opencode-review-dispatch.yml	:127	exact match
codeql-scan-dispatch.yml	:155	exact match (byte-identical block)
pr-review-fix-scheduler.yml	:156	exact match (same conditions, its own error line, kept)

Widening only the first would have left codeql-scan-dispatch rejecting the App identity once #1925's toJSON fix lets it reach the gate, and the scheduler too. Three consumers of one variable with two parsers is the next drift. Everything else is preserved:

• actor and sender must both equal the same listed identity — a dispatch whose actor and sender are two different listed identities is still rejected
• an empty allowlist admits nothing
• a single-valued variable keeps working unchanged

The variable is not modified. Which identities belong on the list is an authorization decision for the repository owner; this PR only makes the gate capable of expressing it.

Verification

• Contract tests extended in place for all three consumers (test_opencode_agent_contract.py, test_codeql_scan_dispatch_workflow_contract.py, test_pr_review_fix_hourly_contract.py): each listed identity passes, whitespace around commas tolerated; unlisted identity rejected; actor/sender that are two different listed identities rejected.
• Negative control: every extended test fails against the unmodified gates on origin/main, so they discriminate.
• REVIEW_DISPATCH_BLOB_SHA recomputed via git hash-object (ade10b37… → 26e85559…).
• No open PR touches any of the three gates: opencode-review-dispatch lines 100–140 clear across fix(opencode): retain adversarial fallback scope #1273 fix(ci): apply unambiguous OpenRouter ZDR evidence #1382 fix(coverage): prefetch locked Rust dependencies for offline evidence #1391 fix(coverage): trust validated Python head locks #1398 fix(coverage): install npm workspaces from root lock #1411 chore: refresh org SBOM inventory #1678 fix(ci): protect current review evidence from stale runs #1899; codeql-scan-dispatch only fix(codeql): serialise the dispatched scan matrix with toJSON #1926 at 146–152; pr-review-fix-scheduler only fix(control-plane): refresh CO pin and gap baseline #1741 at 210–217. (fix(opencode): retain adversarial fallback scope #1273/fix(coverage): prefetch locked Rust dependencies for offline evidence #1391/fix(coverage): trust validated Python head locks #1398 share the first file without line overlap and will need a rebase if this lands first.)
• No blob-SHA pin references the two newly edited workflows; REVIEW_DISPATCH_BLOB_SHA recomputed for the first.
• coverage run -m pytest tests → 2891 passed, 1 skipped · coverage 100% · interrogate 100%.

Not claimed

Cause A is dominant but not sole. Failures from github-actions[bot] — an identity that matches the current allowlist — reach later steps and are attributed to #1883's pre-merge coverage gate (B, likely resolved) and to base-SHA drift during queue wait (C, #1931, structural). Fixing A is also the diagnostic that reveals how much of C remains.

This PR does not touch noema-review. That workflow never goes through the dispatch gate — it calls the contextual-orchestrator sidecar gateway directly — and its recent failures are gateway 502/429 after 3–44 minutes with attempts=1 (7 of 8 sampled), not authorization rejections. Restoring opencode-review verdicts is what this PR does; noema-review needs its own fix at the gateway layer.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1deef1fc-c68e-43ba-af8c-ec3984dfd2b8

📥 Commits

Reviewing files that changed from the base of the PR and between f250638 and d44aa07.

📒 Files selected for processing (7)

• .github/workflows/codeql-scan-dispatch.yml
• .github/workflows/opencode-review-dispatch.yml
• .github/workflows/pr-review-fix-scheduler.yml
• tests/test_codeql_scan_dispatch_workflow_contract.py
• tests/test_opencode_agent_contract.py
• tests/test_pr_review_autofix_nvidia_nim_contract.py
• tests/test_pr_review_fix_hourly_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}