fix(opencode): split review surfaces, give NIM two hours, and remove GitHub Models

.github/workflows/codeql-pr.yml

@@ -89,7 +89,44 @@ jobs:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
 
+      - name: Wait for GitHub API before CodeQL init
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          attempt=1
+          max_attempts=8
+          sleep_seconds=15
+          while [ "$attempt" -le "$max_attempts" ]; do
+            if gh api rate_limit --jq '.resources.core.limit' >/dev/null; then
+              echo "GitHub API is reachable on attempt ${attempt}."
+              exit 0
+            fi
+            echo "GitHub API was unavailable on attempt ${attempt}; retrying in ${sleep_seconds}s."
+            sleep "$sleep_seconds"
+            attempt=$((attempt + 1))
+          done
+          echo "::error::GitHub API stayed unavailable; CodeQL init cannot determine feature enablement."
+          exit 1
+
       - name: Initialize CodeQL
+        id: codeql_init
+        continue-on-error: true
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Wait after CodeQL feature-enablement outage
+        if: steps.codeql_init.outcome == 'failure'
+        run: |
+          set -euo pipefail
+          echo "CodeQL init failed; waiting before one retry for GitHub API outages."
+          rm -rf "$RUNNER_TEMP/codeql_databases" "$GITHUB_WORKSPACE/.codeql" || true
+          sleep 30
+
+      - name: Retry Initialize CodeQL
+        if: steps.codeql_init.outcome == 'failure'
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
@@ -196,7 +233,44 @@ jobs:
           persist-credentials: false
           ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
 
+      - name: Wait for GitHub API before CodeQL init
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          attempt=1
+          max_attempts=8
+          sleep_seconds=15
+          while [ "$attempt" -le "$max_attempts" ]; do
+            if gh api rate_limit --jq '.resources.core.limit' >/dev/null; then
+              echo "GitHub API is reachable on attempt ${attempt}."
+              exit 0
+            fi
+            echo "GitHub API was unavailable on attempt ${attempt}; retrying in ${sleep_seconds}s."
+            sleep "$sleep_seconds"
+            attempt=$((attempt + 1))
+          done
+          echo "::error::GitHub API stayed unavailable; CodeQL init cannot determine feature enablement."
+          exit 1
+
       - name: Initialize CodeQL
+        id: codeql_init
+        continue-on-error: true
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Wait after CodeQL feature-enablement outage
+        if: steps.codeql_init.outcome == 'failure'
+        run: |
+          set -euo pipefail
+          echo "CodeQL init failed; waiting before one retry for GitHub API outages."
+          rm -rf "$RUNNER_TEMP/codeql_databases" "$GITHUB_WORKSPACE/.codeql" || true
+          sleep 30
+
+      - name: Retry Initialize CodeQL
+        if: steps.codeql_init.outcome == 'failure'
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}

.github/workflows/noema-review.yml

@@ -287,15 +287,27 @@ jobs:
             echo "::error::Noema reviewer credential selection succeeded but no token was minted; review cannot submit a verdict."
             exit 1
           fi
-          if [ "$TARGET_REPOSITORY_PRIVATE" = "false" ] && [ -n "${NVIDIA_NIM_API_KEY:-}" ] && [ -z "${NOEMA_LLM_API_URL:-}" ] && [ -z "${NOEMA_LLM_MODEL:-}" ]; then
-            export NOEMA_LLM_API_URL="https://integrate.api.nvidia.com/v1/chat/completions"
-            export NOEMA_LLM_MODEL="nvidia/nemotron-3-ultra-550b-a55b"
-            export NOEMA_LLM_API_KEY="${NVIDIA_NIM_API_KEY:-}"
-          fi
-          if [ -z "${NOEMA_LLM_API_URL:-}" ] || [ -z "${NOEMA_LLM_MODEL:-}" ] || [ -z "${NOEMA_LLM_API_KEY:-}" ]; then
-            echo "::error::Noema LLM is unconfigured: NOEMA_LLM_API_URL, NOEMA_LLM_MODEL, and NOEMA_LLM_API_KEY (or OPENAI_API_KEY) are required."
-            exit 1
-          fi
+          case "$TARGET_REPOSITORY_PRIVATE" in
+            false)
+              if [ -z "${NVIDIA_NIM_API_KEY:-}" ]; then
+                echo "::error::Noema LLM is unconfigured: NVIDIA_NIM_API_KEY is required so a green public-repository Noema check is a real NIM review."
+                exit 1
+              fi
+              export NOEMA_LLM_API_URL="https://integrate.api.nvidia.com/v1/chat/completions"
+              export NOEMA_LLM_MODEL="nvidia/nemotron-3-ultra-550b-a55b"
+              export NOEMA_LLM_API_KEY="${NVIDIA_NIM_API_KEY}"
+              ;;
+            true)
+              if [ -z "${NOEMA_LLM_API_URL:-}" ] || [ -z "${NOEMA_LLM_MODEL:-}" ] || [ -z "${NOEMA_LLM_API_KEY:-}" ]; then
+                echo "::error::Noema LLM is unconfigured: a private repository requires an explicitly configured trusted NOEMA_LLM_API_URL, NOEMA_LLM_MODEL, and NOEMA_LLM_API_KEY. Private diff evidence is not sent to the hosted NVIDIA NIM endpoint."
+                exit 1
+              fi
+              ;;
+            *)
+              echo "::error::Noema target repository visibility was missing or invalid; failing closed."
+              exit 1
+              ;;
+          esac
           python3 scripts/ci/noema_review_gate.py \
             --repo "$TARGET_REPOSITORY" \
             --pr-number "$PR_NUMBER"