Skip to content

fix(review): expose cross-repository dispatch failures - #692

Open
seonghobae wants to merge 3 commits into
mainfrom
codex/opencode-dispatch-visible-failure
Open

fix(review): expose cross-repository dispatch failures#692
seonghobae wants to merge 3 commits into
mainfrom
codex/opencode-dispatch-visible-failure

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Closes #691

Summary

  • separate App-backed review/comment identity from optional commit-status and code-scanning credentials
  • upsert an App-authored exact-current-head REVIEW_TOOL_FAILURE receipt when central review cannot produce a validated approval, including when status publication is unavailable or forbidden
  • resolve an existing receipt only after validated exact-head approval evidence exists; the receipt never grants approval
  • make cross-repository github.token permission limits explicit in logs and documentation

Validation

  • python3 -m pytest -q — 800 passed
  • python3 -m coverage report --show-missing --fail-under=100 — 6450/6450, 100%
  • python3 -m interrogate --fail-under=100 --quiet . — passed
  • python3 -m ruff check scripts/ci/opencode_dispatch_status.py tests/test_opencode_agent_contract.py tests/test_opencode_security_boundaries.py — passed
  • actionlint -shellcheck= .github/workflows/opencode-review-dispatch.yml — passed
  • git diff --check — passed

Summary by CodeRabbit

  • 개선 사항
    • 교차 저장소 코드 검토와 상태 확인의 권한 처리가 강화되었습니다.
    • 현재 커밋(HEAD), 모델 결과, 검증 결과, 실행 링크를 포함한 검토 영수증을 PR 댓글에서 확인할 수 있습니다.
    • 상태 게시에 실패해도 검토 결과를 별도 댓글로 안내합니다.
    • 오래된 커밋에 대한 승인이나 상태 업데이트를 방지합니다.
    • 검토 실행 파일과 토큰 사용 검증이 강화되었습니다.
  • 문서
    • OpenCode GitHub App 토큰 권한 및 교차 저장소 검토 정책을 README에 추가했습니다.
  • 품질 개선
    • 댓글, 상태, 코드 스캐닝 권한 검증 회귀 테스트를 보강했습니다.

@coderabbitai

coderabbitai Bot commented Aug 1, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@opencode-agent[bot], you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 43def381-6a92-4777-8770-5a125a7289c3

📥 Commits

Reviewing files that changed from the base of the PR and between 9020427 and 878df54.

📒 Files selected for processing (5)
  • .github/workflows/opencode-review-dispatch.yml
  • README.md
  • scripts/ci/opencode_dispatch_status.py
  • tests/test_opencode_agent_contract.py
  • tests/test_opencode_security_boundaries.py
📝 Walkthrough

Walkthrough

OpenCode 교차 저장소 워크플로가 읽기·상태·댓글 토큰을 분리합니다. 상태 게시 실패 시 exact-head App 가시성 영수증을 생성하거나 갱신합니다. 상태 결정 스크립트와 테스트가 댓글 증거, stale-head, 토큰 권한 경계를 검증합니다.

Changes

OpenCode 상태 가시성

Layer / File(s) Summary
가시성 영수증 결정
scripts/ci/opencode_dispatch_status.py, tests/test_opencode_security_boundaries.py
댓글 marker와 App 작성자를 검증합니다. 현재 head, 모델 결과, coverage, 실행 URL을 포함한 RESOLVED 또는 REVIEW_TOOL_FAILURE 영수증을 생성합니다. CLI가 댓글 evidence를 읽고 배열 형식을 검증합니다.
토큰 분리와 상태 게시
.github/workflows/opencode-review-dispatch.yml, README.md
코드 스캐닝에 교차 저장소 github.token을 사용하지 않도록 중단 조건을 추가합니다. 읽기·상태·댓글 토큰을 분리합니다. PR·리뷰·댓글과 현재 head를 검증한 뒤 상태 게시와 App 댓글 처리를 수행합니다. 권한 정책을 README에 기록합니다.
권한·실행 경계 검증
.github/workflows/opencode-review-dispatch.yml, tests/test_opencode_agent_contract.py, tests/test_opencode_security_boundaries.py
런처의 심볼릭 링크와 실제 경로를 검증합니다. 역할별 토큰 사용과 App 토큰의 상태 게시 제한을 검증합니다. 403 처리, 댓글 식별, stale-head 거부, 실패 영수증 갱신, 성공 시 기존 영수증 해소, 잘못된 SHA와 CLI 입력을 테스트합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant 중앙 워크플로
  participant 대상 저장소 GitHub API
  participant opencode_dispatch_status.py
  participant 대상 PR 댓글
  중앙 워크플로->>대상 저장소 GitHub API: PR·리뷰·댓글·현재 head 조회
  대상 저장소 GitHub API-->>중앙 워크플로: 검증 증거 반환
  중앙 워크플로->>opencode_dispatch_status.py: 상태 결과와 댓글 evidence 전달
  opencode_dispatch_status.py-->>중앙 워크플로: 상태 결정과 visibility 영수증 반환
  중앙 워크플로->>대상 저장소 GitHub API: 커밋 상태 게시 시도
  중앙 워크플로->>대상 PR 댓글: exact-head 영수증 생성 또는 갱신
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Linked Issues check ✅ Passed 변경 사항은 [#691]의 토큰 권한 분리, 정확한 HEAD 영수증, 실패 노출, 실패 폐쇄 동작, 테스트 및 문서 요구를 충족합니다.
Out of Scope Changes check ✅ Passed 워크플로, 상태 처리기, 테스트 및 README 변경은 모두 [#691]의 검토 실패 노출과 권한 경계 요구에 직접 관련됩니다.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 교차 저장소 디스패치 실패를 노출하는 변경의 핵심 목적을 정확하고 간결하게 설명합니다.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/opencode-dispatch-visible-failure

Comment @coderabbitai help to get the list of available commands.

@seonghobae seonghobae moved this from Todo to In Progress in naruon Platform Roadmap Aug 1, 2026
@seonghobae
seonghobae enabled auto-merge (squash) August 1, 2026 03:14

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 36-39: Update the README description of receipt publication to
match add_visibility_receipt in opencode_dispatch_status.py: receipts are
published when the status is not successful or when comment_id is present,
including failed outcomes even if status publication succeeds. Remove the claim
that receipts are only upserted when the optional status capability is
unavailable.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 121c618c-0781-4895-898c-26b53ca7d496

📥 Commits

Reviewing files that changed from the base of the PR and between 2a83043 and b0c8a34.

📒 Files selected for processing (5)
  • .github/workflows/opencode-review-dispatch.yml
  • README.md
  • scripts/ci/opencode_dispatch_status.py
  • tests/test_opencode_agent_contract.py
  • tests/test_opencode_security_boundaries.py

Comment thread README.md Outdated

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@opencode-agent
opencode-agent Bot force-pushed the codex/opencode-dispatch-visible-failure branch from 9020427 to f92f0cb Compare August 3, 2026 05:17
@opencode-agent
opencode-agent Bot force-pushed the codex/opencode-dispatch-visible-failure branch from f92f0cb to 878df54 Compare August 3, 2026 17:21

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 878df54b7547eea0e9a140cb2ff2f3f9a480f02f.

  • Head SHA: 878df54b7547eea0e9a140cb2ff2f3f9a480f02f

  • Workflow run: 30837150166

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: README.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: README.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["CI script: opencode_dispatch_status.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: opencode_dispatch_status.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (2 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (2 files)"]
  R4 --> V4["targeted test run"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 878df54b7547eea0e9a140cb2ff2f3f9a480f02f
  • Workflow run: 30837150166
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 878df54b7547eea0e9a140cb2ff2f3f9a480f02f.

  • Head SHA: 878df54b7547eea0e9a140cb2ff2f3f9a480f02f

  • Workflow run: 30837150166

  • Workflow attempt: 1

Coverage evidence

Coverage Decision

  • Result: FAIL
  • Test evidence: not proven passing
  • Docstring evidence: not proven passing when configured
  • Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: README.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: README.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["CI script: opencode_dispatch_status.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: opencode_dispatch_status.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (2 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (2 files)"]
  R4 --> V4["targeted test run"]
Loading

@opencode-agent
opencode-agent Bot disabled auto-merge August 3, 2026 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

OpenCode: expose cross-repository review failure when App status publication is forbidden

1 participant