fix(opencode): bound free-model failover pool - #942
Conversation
|
Warning Review limit reached
Next review available in: 56 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent @cwl-noema-review review Review only the exact current head |
|
@opencode-agent review Review only exact current head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='211d976e0bd5025ea14b454c029c1ac1c152fece'
main_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
git fetch --quiet origin main
printf '%s\n' '== Commit identity =='
printf 'HEAD: '; git rev-parse HEAD
printf 'origin/main: '; git rev-parse origin/main
printf 'Expected HEAD: %s\nExpected main: %s\n' "$head_expected" "$main_expected"
printf '%s\n' '== Merge-base and changed files =='
git merge-base origin/main HEAD
git diff --name-status origin/main...HEAD
git diff --check origin/main...HEAD
printf '%s\n' '== Changed diff =='
git diff --no-ext-diff --unified=80 origin/main...HEAD
printf '%s\n' '== Candidate workflow/script/test files =='
fd -t f . | rg '(^|/)(opencode-review-dispatch\.yml|run_opencode_review_model_pool\.sh|test_opencode_agent_contract\.py)$' || true
printf '%s\n' '== All relevant alias, timeout, approval, credential, and provider references =='
rg -n -i -C 4 \
'hy3-free|minimax-m3-free|glm-5-free|kimi-k2\.5-free|qwen3\.6-plus-free|ling-3\.0-flash-free|free.*(candidate|model|timeout)|timeout.*(free|300|5400)|5400|300|APPROVE|approve|verdict|credential|token|api.?key|provider' \
.github scripts tests 2>/dev/null || trueLength of output: 181861 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Exact revisions =='
printf 'HEAD='; git rev-parse HEAD
printf 'MAIN='; git rev-parse origin/main
printf 'MERGE_BASE='; git merge-base origin/main HEAD
printf '%s\n' '== Changed files =='
git diff --name-only origin/main...HEAD
printf '%s\n' '== Focused patch =='
git diff --no-ext-diff --unified=30 origin/main...HEAD -- \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/run_opencode_review_model_pool.sh \
tests/test_opencode_agent_contract.py
printf '%s\n' '== Current pool script: candidate, timeout, result, and verdict control flow =='
nl -ba scripts/ci/run_opencode_review_model_pool.sh | \
grep -E -C 18 \
'FREE|free|CANDIDATE|candidate|TIMEOUT|timeout|5400|300|exit|verdict|approve|APPROVE|credential|token|api.?key|provider' || true
printf '%s\n' '== Current workflow: OpenCode dispatch and secret bindings =='
nl -ba .github/workflows/opencode-review-dispatch.yml | \
grep -E -C 14 \
'run_opencode_review_model_pool|FREE|free|CANDIDATE|candidate|TIMEOUT|timeout|5400|300|secret|token|api.?key|provider|approve|APPROVE|verdict' || true
printf '%s\n' '== Current contract assertions =='
nl -ba tests/test_opencode_agent_contract.py | \
grep -E -C 10 \
'hy3-free|minimax-m3-free|glm-5-free|kimi-k2\.5-free|qwen3\.6-plus-free|ling-3\.0-flash-free|300|5400|free.*candidate|candidate.*free|timeout|fail.closed|approve|verdict' || trueLength of output: 31524 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Locate runtime and outcome gates =='
grep -nE \
'OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|run_opencode_review_model_pool|MODEL_CANDIDATES|candidate|timeout|TIMEOUT|MODEL_UNAVAILABLE|verdict|VERDICT|APPROVE|approve|approval|OPENCODE_API_KEY|OPENAI_API_KEY|NVIDIA_API_KEY|OPENROUTER_API_KEY' \
scripts/ci/run_opencode_review_model_pool.sh \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/test_strix_quick_gate.sh | head -n 450
printf '%s\n' '== Pool script first 520 lines =='
sed -n '1,520p' scripts/ci/run_opencode_review_model_pool.sh
printf '%s\n' '== Workflow pool invocation and immediate outcome handling =='
pool_line=$(grep -n 'run_opencode_review_model_pool' .github/workflows/opencode-review-dispatch.yml | head -n1 | cut -d: -f1 || true)
if [ -n "$pool_line" ]; then
start=$((pool_line - 80)); [ "$start" -lt 1 ] && start=1
end=$((pool_line + 160))
sed -n "${start},${end}p" .github/workflows/opencode-review-dispatch.yml
fi
printf '%s\n' '== Workflow approval and publication gate locations =='
grep -nE 'Publish OpenCode review outcome|Run merge scheduler after approval|APPROVE|approval|verdict|model.unavailable|MODEL_UNAVAILABLE' \
.github/workflows/opencode-review-dispatch.yml | head -n 220Length of output: 70226 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Pool: approval-gate command and provider helper functions =='
sed -n '30,55p' scripts/ci/run_opencode_review_model_pool.sh
sed -n '350,450p' scripts/ci/run_opencode_review_model_pool.sh
printf '%s\n' '== Pool: model-attempt failure and timeout return path =='
sed -n '450,545p' scripts/ci/run_opencode_review_model_pool.sh
printf '%s\n' '== Pool: candidate loop and exhaustion return path =='
sed -n '545,805p' scripts/ci/run_opencode_review_model_pool.sh
printf '%s\n' '== Workflow: generated anonymous free-provider configuration =='
sed -n '3570,3795p' .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== Workflow: outer pool invocation and failure capture =='
sed -n '4285,4320p' .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== Workflow: model-output-unavailable and existing-approval gate =='
sed -n '7000,7285p' .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== Workflow: final control-result dispatch =='
sed -n '7435,7525p' .github/workflows/opencode-review-dispatch.ymlLength of output: 56601 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Stale alias references in the current head =='
grep -RInE \
'hy3-free|minimax-m3-free|glm-5-free|kimi-k2\.5-free|qwen3\.6-plus-free' \
--exclude-dir=.git . || true
printf '%s\n' '== Exact current free-candidate count from the workflow candidate string =='
python3 - <<'PY'
from pathlib import Path
import re
text = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
match = re.search(r'OPENCODE_MODEL_CANDIDATES: "([^"]+)"', text)
assert match, "candidate string not found"
free = re.findall(r'\bopencode-free/[^ \']+', match.group(1))
print("count=", len(free))
for candidate in free:
print(candidate)
PY
printf '%s\n' '== Remaining changed-file patch =='
git diff --no-ext-diff --unified=50 origin/main...HEAD -- scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Whitespace errors =='
git diff --check origin/main...HEADLength of output: 18619
No blocking findings.
I applied the existing current-head-only evidence guidance during this review. I did not run repository tests in the sandbox. 🧠 Learnings used
|
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='211d976e0bd5025ea14b454c029c1ac1c152fece'
main_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr='942'
git fetch --quiet origin main
printf '%s\n' '== Revision identity =='
printf 'HEAD='; git rev-parse HEAD
printf 'origin/main='; git rev-parse origin/main
printf 'merge-base='; git merge-base origin/main HEAD
printf 'expected-head=%s\nexpected-main=%s\n' "$head_expected" "$main_expected"
printf '%s\n' '== Changed files and whitespace =='
git diff --name-status origin/main...HEAD
git diff --check origin/main...HEAD
printf '%s\n' '== Focused patch =='
git diff --no-ext-diff --unified=45 origin/main...HEAD -- \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/run_opencode_review_model_pool.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_opencode_agent_contract.py
printf '%s\n' '== Target file structure =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all || true
ast-grep outline tests/test_opencode_agent_contract.py --items all || true
printf '%s\n' '== Alias and candidate definitions =='
rg -n -C 5 \
'hy3-free|minimax-m3-free|glm-5-free|kimi-k2\.5-free|qwen3\.6-plus-free|OPENCODE_MODEL_CANDIDATES|opencode-free/' \
.github/workflows/opencode-review-dispatch.yml scripts/ci/run_opencode_review_model_pool.sh tests/test_opencode_agent_contract.py
printf '%s\n' '== Timeout, failover, verdict, and approval control flow =='
rg -n -C 8 \
'OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|timeout |timeout\(|TIMEOUT|300|5400|candidate|MODEL_UNAVAILABLE|approve|APPROVE|verdict|exit [0-9]+' \
scripts/ci/run_opencode_review_model_pool.sh \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Current-head workflow runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head_expected}&per_page=100" \
--jq '.workflow_runs[] | [.id,.name,.status,.conclusion,.event,.head_sha,.run_started_at,.updated_at,.html_url] | `@tsv`'
printf '%s\n' '== Current-head check runs =='
gh api "repos/${repo}/commits/${head_expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.started_at,.completed_at,.details_url] | `@tsv`'
printf '%s\n' '== Current-head Linux timeout evidence in OpenCode-related run logs =='
run_ids=$(gh api "repos/${repo}/actions/runs?head_sha=${head_expected}&per_page=100" \
--jq '.workflow_runs[] | select(.name | test("OpenCode|Strix"; "i")) | .id')
for run_id in $run_ids; do
echo "-- run ${run_id} --"
gh api "repos/${repo}/actions/runs/${run_id}/jobs?per_page=100" \
--jq '.jobs[] | [.id,.name,.status,.conclusion,.runner_name,.labels[]?] | `@tsv`'
gh run view "$run_id" --repo "$repo" --log 2>/dev/null | \
rg -n -i -C 3 'GNU timeout|timeout --version|coreutils|OPENCODE_FREE_RUN_TIMEOUT_SECONDS|timeout 300|timeout.*300|run_opencode_review_model_pool' || true
doneLength of output: 197563 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='211d976e0bd5025ea14b454c029c1ac1c152fece'
log='/tmp/coderabbit-shell-logs/shell-output-RYMahs'
job='93996585280'
run='31558764608'
printf '%s\n' '== First inspection: revision, changed files, and diff result =='
rg -n -A20 -B2 '^== Revision identity ==|^== Changed files and whitespace ==|^== Focused patch ==' "$log" | head -n 220
printf '%s\n' '== Current candidate string and governed free definitions =='
sed -n '3550,3810p' .github/workflows/opencode-review-dispatch.yml
python3 - <<'PY'
from pathlib import Path
import re
p = Path(".github/workflows/opencode-review-dispatch.yml")
s = p.read_text()
m = re.search(r'OPENCODE_MODEL_CANDIDATES: "([^"]+)"', s)
if not m:
raise SystemExit("candidate string not found")
candidates = re.findall(r'opencode-free/[^\s"]+', m.group(1))
print("candidate-count:", len(candidates))
for x in candidates:
alias = x.removeprefix("opencode-free/")
defined = bool(re.search(rf'(?m)^\s*{re.escape(alias)}:\s*$', s))
print(f"{x}\tgoverned-definition={defined}")
for stale in ("hy3-free","minimax-m3-free","glm-5-free","kimi-k2.5-free","qwen3.6-plus-free"):
print(f"{stale}\tpresent={stale in s}")
PY
printf '%s\n' '== Pool timeout selection, command execution, and result loop =='
rg -n -C 18 \
'OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|timeout --|timeout |run_timeout|candidate.*timeout|timeout.*candidate|MODEL_UNAVAILABLE|opencode_review_approve_gate|for candidate|while .*candidate|return [0-9]+' \
scripts/ci/run_opencode_review_model_pool.sh
printf '%s\n' '== Workflow invocation, runtime platform, and approval/publication gates =='
rg -n -C 14 \
'runs-on:|run_opencode_review_model_pool|OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|MODEL_UNAVAILABLE|existing.*approval|approve|APPROVE|verdict|merge' \
.github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== Contract assertions for aliases, free count, timeout, and fail-closed behavior =='
rg -n -C 12 \
'hy3-free|minimax-m3-free|glm-5-free|kimi-k2\.5-free|qwen3\.6-plus-free|seven|7|300|5400|timeout|MODEL_UNAVAILABLE|approve|verdict' \
tests/test_opencode_agent_contract.py
printf '%s\n' '== Exact current-head OpenCode job metadata and steps =='
gh api "repos/${repo}/actions/jobs/${job}" \
--jq '{id,name,status,conclusion,started_at,completed_at,runner_name,labels,steps:[.steps[]|{number,name,status,conclusion,started_at,completed_at}]}'
printf '%s\n' '== Exact current-head OpenCode job log: invocation, timeout, and skip evidence =='
gh run view "$run" --repo "$repo" --log --job "$job" 2>&1 | \
rg -n -i -C 8 \
'run_opencode_review_model_pool|OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|timeout|GNU|coreutils|candidate|skipp|condition|MODEL_UNAVAILABLE|opencode-review' || true
printf '%s\n' '== Exact current-head workflow YAML timeout precondition =='
rg -n -C 8 'timeout --version|command -v timeout|GNU timeout|coreutils|ubuntu-latest|ubuntu-24.04' \
.github/workflows/opencode-review-dispatch.yml scripts/ci/run_opencode_review_model_pool.sh tests/test_opencode_agent_contract.pyLength of output: 155705
Static review found no blocking defect:
The exact-head OpenCode check ran on Ubuntu 24.04.4. However, it was a stub job. Its only executable step was: echo "Review approval remains a separate current-head PR review requirement produced by the authenticated dispatch workflow."It did not execute The static contract checks cover the configured timeout values and control flow. They do not replace execution evidence for GNU I used the existing current-head-only evidence guidance. I did not modify, approve, merge, release, or change credentials or protections. 🧠 Learnings usedYou are interacting with an AI system. |
|
Exact-current-head review request for Review the bounded three-file pool repair: remove five stale free-provider aliases, retain the seven governed free candidates, cap free-candidate failover at 300 seconds, and preserve the 5,400-second paid/large-review budget and fail-closed verdict semantics. Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation are terminal-success on this exact head; no review thread exists. Keep the head unchanged. Do not update the branch, synthesize author approval, merge, release, treat a timeout as approval, or weaken provider/security gates. @coderabbitai review |
Rate Limit Exceeded
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head source review for 211d976e0bd5025ea14b454c029c1ac1c152fece against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The three-file diff removes five ungoverned free aliases from both provider configuration and candidate order, while retaining the seven configured free candidates and every paid/NVIDIA/GitHub Models fallback. The launcher already applies provider-specific caps through cap_model_run_timeout; this head changes only the opencode-free/* environment cap from 3600s to 300s. Normal paid/large-review OPENCODE_RUN_TIMEOUT_SECONDS=5400, NVIDIA's 180s per-candidate/900s combined budget, GitHub GPT-5's 45s cap, attempt ceiling, control-schema validation, and fail-closed exhausted-pool result remain unchanged. Timeout advances to another configured provider but cannot create an approval.
The exact-head Strix quality run checked out this literal SHA, ran 977 tests plus 16 subtests and the bounded shell regression suite successfully; all nine directly observed hosted workflows are terminal-success and no inline thread exists. The remaining uncertainty is operational rather than a source blocker: the next live review runs should confirm provider throughput and may justify a later data-driven cap adjustment without restoring hour-long free-candidate stalls.
A qualifying independent reviewer must still submit formal approval on this unchanged head. Do not update the branch, restore stale aliases without live catalog evidence, synthesize author approval, or bypass protection.
Document the 300s free-candidate cap so hung aliases cannot consume the paid/NIM review budget. Cite NIST SP 800-53 Rev. 5. Isolate Darwin installer tests on the linux x86_64 path.
|
Reviewed current head. No unresolved review threads. Added CHANGELOG + APA 7th doctoring for the 300s free-tier failover cap. Local suite 977 passed x2, coverage 100%. Auto-merge armed; not waiting. |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
fb24aecffa887975d4b34a8c914337c2d95fc378. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343218/job/94501966744)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716342838/job/94501913701)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343142/job/94501915391)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343142/job/94501915391)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343218/job/94501915818)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343970/job/94501918639)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343069/job/94501916248)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343069/job/94501916299)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343218/job/94501966744)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343218/job/94501915818)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343218/job/94501966588)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343231/job/94501915676)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343165/job/94501915575)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343299/job/94501916010)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343299/job/94501916010)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343128/job/94501914529)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916262)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916202)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916147)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916378)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343231/job/94501915676)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343083/job/94501915342)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343069/job/94501916248)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343069/job/94501916299)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716342838/job/94501913701)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343098/job/94501973186)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916262)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343083/job/94501915342)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343165/job/94501915575)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343128/job/94501914529)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343970/job/94501918639)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916202)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343218/job/94501966588)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343098/job/94501915452)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916147)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716343141/job/94501916378)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-free-failover-budget.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-free-failover-budget.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-free-failover-budget.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-free-failover-budget.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
|
Returned to Draft because the exact current tree mixes the bounded free-model failover repair with an unrelated trusted-uv materializer branch. The useful slice is clear: remove demonstrably stale aliases, keep the governed catalog, apply a 300-second free-candidate budget while preserving the normal 5,400-second budget, and fail closed when the pool exhausts. Head Rebuild from protected |
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head_expected='56e1e7a6804037c9752728b712e4bb1f54f94430'
main_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
git fetch --quiet origin main
printf '%s\n' '== Revision identity =='
printf 'HEAD='; git rev-parse HEAD
printf 'origin/main='; git rev-parse origin/main
printf 'merge-base='; git merge-base origin/main HEAD
printf 'expected-head=%s\nexpected-main=%s\n' "$head_expected" "$main_expected"
printf '%s\n' '== Changed files and whitespace =='
git diff --name-status "origin/main...${head_expected}"
git diff --check "origin/main...${head_expected}"
printf '%s\n' '== Exact patch =='
git diff --no-ext-diff --unified=50 "origin/main...${head_expected}" -- \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/run_opencode_review_model_pool.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_opencode_agent_contract.py \
CHANGELOG.md AGENTS.md
printf '%s\n' '== Candidate definitions and stale aliases =='
python3 - <<'PY'
from pathlib import Path
import re
path = Path(".github/workflows/opencode-review-dispatch.yml")
text = path.read_text(encoding="utf-8")
match = re.search(r'OPENCODE_MODEL_CANDIDATES: "([^"]+)"', text)
if not match:
raise SystemExit("OPENCODE_MODEL_CANDIDATES not found")
candidates = re.findall(r'opencode-free/[^\s"]+', match.group(1))
print(f"free-candidate-count={len(candidates)}")
for candidate in candidates:
alias = candidate.split("/", 1)[1]
defined = bool(re.search(rf'(?m)^\s*{re.escape(alias)}:\s*$', text))
print(f"{candidate}\tgoverned-definition={defined}")
for alias in ("hy3-free", "minimax-m3-free", "glm-5-free", "kimi-k2.5-free", "qwen3.6-plus-free"):
print(f"{alias}\tpresent-in-workflow={alias in text}")
PY
printf '%s\n' '== Pool timeout, candidate, approval, and exhaustion control flow =='
rg -n -C 14 \
'OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|timeout |timeout\(|FREE|opencode-free/|MODEL_OUTPUT_UNAVAILABLE|MODEL_UNAVAILABLE|opencode_review_approve_gate|APPROVE|approve|verdict|return [0-9]+|exit [0-9]+' \
scripts/ci/run_opencode_review_model_pool.sh \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py \
scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Exact-head check and workflow status =='
gh api "repos/${repo}/commits/${head_expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.started_at,.completed_at,.details_url] | `@tsv`'
gh api "repos/${repo}/actions/runs?head_sha=${head_expected}&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.event,.run_started_at,.updated_at,.html_url] | `@tsv`'Length of output: 203137 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='56e1e7a6804037c9752728b712e4bb1f54f94430'
main='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
log='/tmp/coderabbit-shell-logs/shell-output-ssriHn'
printf '%s\n' '== First-script compact evidence =='
rg -n -A30 -B2 \
'^== Revision identity ==|^== Changed files and whitespace ==|^== Exact patch ==|^== Candidate definitions and stale aliases ==|^free-candidate-count=|^== Exact-head check and workflow status ==' \
"$log" | head -n 260
printf '%s\n' '== Exact revision and changed paths =='
printf 'HEAD='; git rev-parse HEAD
printf 'origin/main='; git rev-parse origin/main
printf 'merge-base='; git merge-base "origin/main" HEAD
git diff --name-status "origin/main...${head}"
git diff --check "origin/main...${head}"
printf '%s\n' '== Pool structure and focused source ranges =='
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all || true
rg -n \
'OPENCODE_FREE_RUN_TIMEOUT_SECONDS|OPENCODE_RUN_TIMEOUT_SECONDS|opencode-free/|run_timeout|timeout --kill-after|for candidate|MODEL_OUTPUT_UNAVAILABLE|opencode_review_approve_gate' \
scripts/ci/run_opencode_review_model_pool.sh
for range in 360,520 520,720 720,850; do
start=${range%,*}; end=${range#*,}
printf '\n== scripts/ci/run_opencode_review_model_pool.sh:%s-%s ==\n' "$start" "$end"
sed -n "${start},${end}p" scripts/ci/run_opencode_review_model_pool.sh
done
printf '%s\n' '== Workflow candidate configuration and invocation =='
rg -n -C 8 \
'OPENCODE_MODEL_CANDIDATES:|OPENCODE_FREE_RUN_TIMEOUT_SECONDS:|OPENCODE_RUN_TIMEOUT_SECONDS:|run_opencode_review_model_pool\.sh' \
.github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== Current PR review-thread state =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number=942 \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { path line } } }
}
}
}
}' \
--jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select((.isResolved | not) and (.isOutdated | not))] | length'Length of output: 46685 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='56e1e7a6804037c9752728b712e4bb1f54f94430'
printf '%s\n' '== Unrelated materializer test patch with line numbers =='
git diff --no-ext-diff --unified=30 "origin/main...${head}" -- \
tests/test_materialize_base_python_requirements.py
nl -ba tests/test_materialize_base_python_requirements.py | sed -n '1,260p'
printf '%s\n' '== Seven candidate definitions in generated OpenCode configuration =='
python3 - <<'PY'
from pathlib import Path
import json
import re
text = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
candidates_match = re.search(r'OPENCODE_MODEL_CANDIDATES: "([^"]+)"', text)
if not candidates_match:
raise SystemExit("candidate string not found")
candidates = re.findall(r'opencode-free/[^\s"]+', candidates_match.group(1))
for candidate in candidates:
alias = candidate.split("/", 1)[1]
pattern = rf'"{re.escape(alias)}"\s*:\s*\{{'
print(f"{candidate}\tdefined={bool(re.search(pattern, text))}")
for alias in ("hy3-free", "minimax-m3-free", "glm-5-free", "kimi-k2.5-free", "qwen3.6-plus-free"):
print(f"{alias}\tpresent-anywhere={alias in text}")
PY
printf '%s\n' '== Contract test patch =='
git diff --no-ext-diff --unified=25 "origin/main...${head}" -- \
tests/test_opencode_agent_contract.py \
scripts/ci/test_strix_quick_gate.sh \
CHANGELOG.md \
docs/doctoring/opencode-free-failover-budget.mdLength of output: 9641
HIGH — Remove the unrelated trusted-uv test delta
The change adds Restore Static review otherwise confirms the five stale aliases are absent, the pool lists seven free candidates, the free-candidate cap is Exact-head checks are queued, in progress, or cancelled. They are not acceptance evidence. I could not complete the final structured model-definition parse because the sandbox lacks
|
|
Exact-current-head read-only review request for The bounded five-file repair removes five stale free-provider aliases, retains the seven governed candidates, applies a 300-second free-tier candidate budget without changing the 5,400-second paid/large-review budget, keeps timeout as failover-only rather than success, and removes unrelated installer-test drift. Recheck provider-scoped credentials, current-head evidence, model-output validation, #830 compatibility, and unchanged review/merge authority. Submit a verdict for this unchanged head only. Treat predecessor checks/reviews as historical. Do not mutate or merge the branch, synthesize author approval, or weaken protection. @opencode-agent review |
Rate Limit Exceeded
|
1 participant
Problem and root cause
The central OpenCode review pool still advertised five stale free-provider aliases that fail with provider/auth errors, while one free candidate could consume up to 3,600 seconds. An observed
ling-3.0-flash-freeattempt occupied the full hour before the catalog exhausted without a verdict.The root cause is twofold: a stale governed candidate catalog and a per-candidate timeout designed for paid/large models being reused for zero-cost failover. Merely retrying the stale aliases or turning timeout exhaustion into success would not change either cause.
Bounded repair
hy3-free,minimax-m3-free,glm-5-free,kimi-k2.5-free, andqwen3.6-plus-freedefinitions and candidates;PR #830 owns the broader private-repository trusted-base opt-in, public-equivalent data classification, catalog provenance, and provider credential governance. This PR does not duplicate or weaken that boundary; after either branch integrates, reconcile the remaining unique timeout/catalog delta once against protected
main.Exact identity and scope
main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;44a302d283e2032f8b220d8f70a0acaae557bfa1;.github/workflows/opencode-review-dispatch.yml,scripts/ci/test_strix_quick_gate.sh,tests/test_opencode_agent_contract.py, focused doctoring, andCHANGELOG.md.A cross-platform trusted-uv installer-test change had remained in the branch despite an earlier cleanup attempt. The current ordinary forward commit restores that file to protected-main content. No force-push, rebase, history rewrite, predecessor evidence transfer, or gate weakening was used.
Every check, review, benchmark, or comment bound to an earlier head is historical only.
Verification lineage
Earlier local evidence reported:
uv run pytest tests/test_opencode_agent_contract.py -q— 40 passed;Those results prove predecessor trees only. The current head must regenerate the complete exact-head quality, model-pool, security, SAST, dependency/SBOM, supply-chain, and semantic-review cycle. GNU
timeoutexecution on the hosted Linux runner remains the authoritative behavioral gate.Merge gate
Merge or auto-merge only after the unchanged current head has terminal-success required gates, zero valid unresolved findings, a qualifying current-head semantic verdict, the independent non-author approvals and last-push approval required by live protection, a compatible live base, and ordinary expected-head merge authority. Pending, queued, skipped, cancelled, stale, predecessor-head, self/author, status-only, synthetic, local-only, or model-only evidence is not acceptance. No administrative bypass or self-approval is requested.