Skip to content

[aw-failures] Migrate daily-security-red-team.md and daily-reliability-review.md off removed opencode engine #50735

Description

@github-actions

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Migrate both workflows off engine: opencode now — they fail 100% of scheduled runs since the engine was removed.

Problem

daily-security-red-team.md and daily-reliability-review.md both declare engine: { id: opencode } (and import shared/opencode.md), but the opencode engine was removed as an intentional, already-shipped breaking change per CHANGELOG.md: "Removed the experimental opencode engine... Workflows using engine: opencode must migrate to copilot, claude, codex, gemini, antigravity, or pi. The runner no longer restores opencode.jsonc or .opencode/ configuration." Both workflows were never updated, so every job (agent, detection, evals) in both workflows now fails immediately at the "Verify OpenCode CLI installation" step.

Affected workflows and runs

  • .github/workflows/daily-reliability-review.mddaily-reliability-review.lock.yml§31055598155, fails at "Verify OpenCode CLI installation" in all 3 jobs (agent, detection, evals)
  • .github/workflows/daily-security-red-team.mddaily-security-red-team.lock.yml§31057366689, identical failure signature across all 3 jobs

Probable root cause

The runner no longer installs/restores the opencode CLI or its config directory, so the harness's "Verify OpenCode CLI installation" step fails immediately in every job of any workflow still declaring engine: { id: opencode }. These two workflows were missed when the engine was removed — issue #50531 (opencode compat audit) only covered external downstream repos lacking a migration codemod, not gh-aw's own scheduled workflows.

Proposed remediation

  1. In both daily-reliability-review.md and daily-security-red-team.md, change engine: { id: opencode } to a supported engine (claude is the closest fit given existing prompt/tool conventions elsewhere in the repo).
  2. Remove the - shared/opencode.md import from each file and add the equivalent shared config for the replacement engine.
  3. Run gh aw compile to regenerate both .lock.yml files, then trigger a manual workflow_dispatch run of each to confirm the engine-installation step passes before the next scheduled trigger.

Success criteria

  • grep -rl opencode .github/workflows/daily-reliability-review.lock.yml .github/workflows/daily-security-red-team.lock.yml returns nothing.
  • The next scheduled run of each workflow completes the agent, detection, and evals jobs without an engine-installation failure.
  • No further "Verify OpenCode CLI installation" failures for these two workflows appear in subsequent 6h failure-investigator windows.

Parent: #50734
Related to #50734

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 146.7 AIC · ⊞ 5.2K ·

  • expires on Aug 12, 2026, 5:23 PM UTC-08:00

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions