-
Notifications
You must be signed in to change notification settings - Fork 0
chore(ci): remove orphaned OpenCode dispatch bootstrap on current main #1619
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
seonghobae
merged 15 commits into
main
from
fix/current-main-remove-opencode-dispatch-bootstrap-20260902
Sep 1, 2026
Merged
Changes from 9 commits
Commits
Show all changes
15 commits
Select commit
Hold shift + click to select a range
fce0c0e
chore(ci): remove orphaned OpenCode dispatch bootstrap
seonghobae 1f0c49b
merge(main): preserve metadata integration before bootstrap cleanup
seonghobae 29b731a
ci: run bounded PR 1619 causal repair
seonghobae 5f190b8
ci: make PR 1619 helper expression-safe
seonghobae 84d0fc7
ci: reconstruct PR 1619 repair from current main
seonghobae 7dcd52f
ci(opencode): make causal repair exact-head safe
seonghobae bf18aae
chore(ci): remove failed temporary PR 1619 writer
e95a90f
ci(opencode): repair same-repo status authority on exact head
seonghobae dd5ad8e
ci: add exact-head PR 1619 restack writer
seonghobae 2e2abc8
ci(opencode): make PR 1619 restack writer self-contained
seonghobae 9bda471
chore(ci): remove failed PR 1619 restack writer
0a3ac6b
ci: rebuild PR 1619 repair from live main
seonghobae fc71c0a
fix(opencode): land verified live-main bootstrap cleanup
seonghobae c8b2fd4
fix(ci): make PR 1619 live-main repair fail-closed and exact
seonghobae 66046ec
chore(ci): reconcile PR 1619 on protected main
seonghobae File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| name: Temporary PR 1619 non-destructive restack | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 | ||
| paths: | ||
| - .github/workflows/tmp-pr1619-restack.yml | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
github-advanced-security[bot] marked this conversation as resolved.
Fixed
|
||
|
|
||
| concurrency: | ||
| group: tmp-pr1619-restack | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| restack: | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 20 | ||
| steps: | ||
| - name: Check out exact writer head | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Reconstruct intended delta on live protected main | ||
| shell: bash | ||
| env: | ||
| EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 | ||
| run: | | ||
| set -euo pipefail | ||
| test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" | ||
| test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" | ||
|
|
||
| remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" | ||
| test "$remote_head" = "$GITHUB_SHA" | ||
| git fetch origin main | ||
| main_sha="$(git rev-parse FETCH_HEAD)" | ||
| test -n "$main_sha" | ||
|
|
||
| git config user.name 'contextualwisdomlab-automation' | ||
| git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' | ||
|
|
||
| # Make the current protected-main tree authoritative. The branch history | ||
| # stays intact and is recorded as the first parent of the reconciliation | ||
| # commit; current main is the second parent. | ||
| git read-tree --reset -u "${main_sha}^{tree}" | ||
|
|
||
| python - <<'PY' | ||
| from pathlib import Path | ||
|
|
||
| workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') | ||
| workflow = workflow_path.read_text(encoding='utf-8') | ||
| bootstrap = ''' required-workflow-bootstrap:\n name: required-workflow-bootstrap\n runs-on: ubuntu-latest\n steps:\n - run: echo "OpenCode repository-dispatch review run materialized."\n\n''' | ||
| if workflow.count(bootstrap) != 1: | ||
| raise SystemExit('live protected main bootstrap shape changed; refusing mutation') | ||
| workflow = workflow.replace(bootstrap, '', 1) | ||
| if 'required-workflow-bootstrap:' in workflow: | ||
| raise SystemExit('orphaned dispatch bootstrap still present') | ||
| # Preserve the live protected-main same-repository credential policy. | ||
| required_token = "needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN" | ||
| required_source = "needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN" | ||
| if required_token not in workflow or required_source not in workflow: | ||
| raise SystemExit('live protected-main credential contract changed; refusing mutation') | ||
| workflow_path.write_text(workflow, encoding='utf-8') | ||
|
|
||
| test_path = Path('tests/test_opencode_agent_contract.py') | ||
| text = test_path.read_text(encoding='utf-8') | ||
| old = ''' assert "required-workflow-bootstrap:" in workflow\n assert "OpenCode repository-dispatch review run materialized." in workflow\n bootstrap_start = workflow.index(" required-workflow-bootstrap:\\n")\n bootstrap_end = workflow.index("\\n validate-pr-metadata:", bootstrap_start)\n bootstrap_job = workflow[bootstrap_start:bootstrap_end]\n assert "\\n if:" not in bootstrap_job\n''' | ||
| new = ''' # required-workflow-bootstrap is the trusted-source-resolution sentinel needed\n # only where the org ruleset targets a pull_request_target entrypoint\n # (opencode-review.yml). This repository_dispatch-only workflow is not itself\n # a required-workflow path, so it must not carry a copy-pasted, need-less\n # orphan of that job.\n assert "required-workflow-bootstrap:" not in workflow\n''' | ||
| if text.count(old) != 1: | ||
| raise SystemExit('live protected-main bootstrap test shape changed; refusing mutation') | ||
| text = text.replace(old, new, 1) | ||
| test_path.write_text(text, encoding='utf-8') | ||
| PY | ||
|
|
||
| workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" | ||
| python - "$workflow_blob" <<'PY' | ||
| import re | ||
| import sys | ||
| from pathlib import Path | ||
|
|
||
| blob = sys.argv[1] | ||
| path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') | ||
| text = path.read_text(encoding='utf-8') | ||
| text, count = re.subn( | ||
| r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', | ||
| f'REVIEW_DISPATCH_BLOB_SHA = "{blob}"', | ||
| text, | ||
| count=1, | ||
| ) | ||
| if count != 1: | ||
| raise SystemExit('unable to update exact dispatch blob contract') | ||
| path.write_text(text, encoding='utf-8') | ||
| PY | ||
|
|
||
| PYTHONPATH=. python -m pytest -q \ | ||
| tests/test_opencode_agent_contract.py \ | ||
| tests/test_pr_review_autofix_nvidia_nim_contract.py | ||
| git diff --check | ||
|
|
||
| # The temporary writer is absent from the protected-main baseline and | ||
| # therefore absent from the reconstructed tree by construction. | ||
| test ! -e .github/workflows/tmp-pr1619-restack.yml | ||
|
|
||
| git add -A | ||
| tree_sha="$(git write-tree)" | ||
| commit_sha="$(printf '%s\n' 'fix(opencode): restack bootstrap cleanup on protected main' | git commit-tree "$tree_sha" -p "$GITHUB_SHA" -p "$main_sha")" | ||
|
|
||
| remote_head="$(git ls-remote --heads origin "refs/heads/${EXPECTED_REF}" | awk '{print $1}')" | ||
| test "$remote_head" = "$GITHUB_SHA" | ||
| git push origin "${commit_sha}:refs/heads/${EXPECTED_REF}" | ||
107 changes: 107 additions & 0 deletions
107
.github/workflows/tmp-pr1619-status-authority-repair.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| name: Temporary PR 1619 status authority repair | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - fix/current-main-remove-opencode-dispatch-bootstrap-20260902 | ||
| paths: | ||
| - .github/workflows/tmp-pr1619-status-authority-repair.yml | ||
|
|
||
| permissions: {} | ||
|
|
||
| concurrency: | ||
| group: tmp-pr1619-status-authority-repair | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| repair: | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 20 | ||
| permissions: | ||
| contents: write | ||
|
github-advanced-security[bot] marked this conversation as resolved.
Fixed
|
||
| steps: | ||
| - name: Check out exact repair head | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Repair status authority and delete this one-shot writer | ||
| shell: bash | ||
| env: | ||
| EXPECTED_REF: fix/current-main-remove-opencode-dispatch-bootstrap-20260902 | ||
| run: | | ||
| set -euo pipefail | ||
| cleanup_on_failure() { | ||
| rc="$?" | ||
| if [ "$rc" -ne 0 ]; then | ||
| trap - EXIT | ||
| git reset --hard "${GITHUB_SHA}" | ||
| rm -f .github/workflows/tmp-pr1619-status-authority-repair.yml | ||
| git config user.name 'contextualwisdomlab-automation' | ||
| git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' | ||
| git add .github/workflows/tmp-pr1619-status-authority-repair.yml | ||
| if ! git diff --cached --quiet; then | ||
| git commit -m 'chore(ci): remove failed PR 1619 status repair writer' | ||
| git fetch origin "${EXPECTED_REF}" | ||
| if [ "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" ]; then | ||
| git push origin "HEAD:${EXPECTED_REF}" | ||
| fi | ||
| fi | ||
| fi | ||
| exit "$rc" | ||
| } | ||
| trap cleanup_on_failure EXIT | ||
|
|
||
| test "${GITHUB_REF_NAME}" = "${EXPECTED_REF}" | ||
| test "$(git rev-parse HEAD)" = "${GITHUB_SHA}" | ||
| git fetch origin "${EXPECTED_REF}" | ||
| test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" | ||
|
|
||
| python3 - <<'PY' | ||
| from pathlib import Path | ||
|
|
||
| workflow_path = Path('.github/workflows/opencode-review-dispatch.yml') | ||
| test_path = Path('tests/test_opencode_agent_contract.py') | ||
| workflow = workflow_path.read_text(encoding='utf-8') | ||
| tests = test_path.read_text(encoding='utf-8') | ||
|
|
||
| old_token = "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" | ||
| new_token = "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}" | ||
| old_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" | ||
| new_source = "OPENCODE_STATUS_TOKEN_SOURCE: ${{ needs.validate-pr-metadata.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}" | ||
| if workflow.count(old_token) != 1 or workflow.count(old_source) != 1: | ||
| raise SystemExit('exact status credential expression changed; refusing stale repair') | ||
| workflow = workflow.replace(old_token, new_token, 1).replace(old_source, new_source, 1) | ||
| workflow_path.write_text(workflow, encoding='utf-8') | ||
|
|
||
| old_assert = ''' assert (\n "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step\n assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step\n''' | ||
| new_assert = ''' assert (\n "GH_TOKEN: ${{ needs.validate-pr-metadata.outputs.target_repository == "\n "github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || "\n "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "\n "github.token }}"\n ) in status_step\n assert (\n "OPENCODE_STATUS_TOKEN_SOURCE: ${{ "\n "needs.validate-pr-metadata.outputs.target_repository == github.repository && "\n "'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN'"\n ) in status_step\n assert "steps.opencode_app_token.outputs.available == 'true' && 'opencode-app'" in status_step\n''' | ||
| if tests.count(old_assert) != 1: | ||
| raise SystemExit('exact status contract test changed; refusing stale repair') | ||
| test_path.write_text(tests.replace(old_assert, new_assert, 1), encoding='utf-8') | ||
| PY | ||
|
|
||
| workflow_blob="$(git hash-object .github/workflows/opencode-review-dispatch.yml)" | ||
| python3 - "$workflow_blob" <<'PY' | ||
| import re, sys | ||
| from pathlib import Path | ||
| path = Path('tests/test_pr_review_autofix_nvidia_nim_contract.py') | ||
| text = path.read_text(encoding='utf-8') | ||
| text, count = re.subn(r'REVIEW_DISPATCH_BLOB_SHA = "[0-9a-f]{40}"', f'REVIEW_DISPATCH_BLOB_SHA = "{sys.argv[1]}"', text, count=1) | ||
| if count != 1: | ||
| raise SystemExit('dispatch blob pin contract changed; refusing stale repair') | ||
| path.write_text(text, encoding='utf-8') | ||
| PY | ||
|
|
||
| PYTHONPATH=. python -m pytest -q tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py | ||
| git diff --check | ||
| rm .github/workflows/tmp-pr1619-status-authority-repair.yml | ||
| git add .github/workflows/opencode-review-dispatch.yml tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py .github/workflows/tmp-pr1619-status-authority-repair.yml | ||
| git diff --cached --check | ||
|
|
||
| git fetch origin "${EXPECTED_REF}" | ||
| test "$(git rev-parse FETCH_HEAD)" = "${GITHUB_SHA}" | ||
| git config user.name 'contextualwisdomlab-automation' | ||
| git config user.email 'contextualwisdomlab-automation@users.noreply.github.com' | ||
| git commit -m 'fix(opencode): preserve same-repository status authority' | ||
| git push origin "HEAD:${EXPECTED_REF}" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.