fix: use review credentials for agent dispatch - #1162
Conversation
|
@opencode-agent Review-only request for exact current head 3284911; verify credential isolation, repository_dispatch authorization, concurrency syntax, and required Checks. Do not mutate the branch or merge. |
|
Warning Review limit reached
Next review available in: 41 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Hosted quality identified one stale assertion in tests/test_agent_mention_downstream_idempotency.py after the credential-boundary change. Updated it in current head af07a15; focused contract tests 8 passed, actionlint and diff checks passed. Re-running the full hosted suite on this exact head. |
|
@opencode-agent Review-only request for exact current head af07a15; validate current changed files, terminal required Checks, and protected-merge readiness. Do not mutate the branch or merge. |
|
Integrated the current main branch normally at 144da19. The PR remains scoped to the dispatch-credential workflow and its contract tests; 58 focused tests passed, actionlint, ruff, and diff checks passed. Please review and validate this exact current HEAD. @OpenCode review this exact HEAD and report only current-head findings. |
|
@opencode-agent review this exact current HEAD. Use the current commit SHA, current Checks, and current diff; do not reuse prior approvals or prior-head evidence. |
|
Hosted router runs exposed the remaining root cause: central dispatch was durable, but a target-repository acknowledgement comment returned HTTP 403 and escaped the cosmetic-failure boundary. Fixed at 29fba30: acknowledgement comment failures now warn and leave the durable ledger retryable; added regression coverage. Focused router suite: 15 passed; ruff, actionlint, and diff checks passed. Re-review this exact HEAD. @opencode-agent review this exact HEAD and report only current-head findings. |
|
The hosted full quality suite caught a stale recovery assertion that still expected target comment HTTP 403 to fail the job. Updated the contract test at c64e0e8 to match the repaired durable-dispatch behavior. Exact hosted-equivalent proof: 1,235 tests + 16 subtests; all 7,844 statements / 3,046 branches at 100%; interrogate 100%; compileall and diff checks passed. Re-run Checks and review this exact HEAD. @opencode-agent review this exact HEAD and report only current-head findings. |
|
Current-head review request for #1162. HEAD: c64e0e8 This exact HEAD isolates agent-mention dispatch credential and queue behavior: privileged dispatch uses the established review credential chain, comment-id keyed concurrency prevents cross-comment cancellation, missing acknowledgement is warning-only while durable dispatch remains retryable, and tests cover idempotency and recovery. This is the separate responsibility referenced by .github#1143. Review current Checks and active ruleset; do not reuse stale approvals or bypass protected merge gates. |
|
Fixed the independent Ruff finding on the current branch: removed the unused |
|
Current-head review completed for the dispatch-credential change:
Evidence at head |
|
@opencode-agent Please review exact current PR head e530ef1. Re-check changed-file scope, current-head findings, unresolved threads, mergeability, and all required checks. Do not approve a stale head. |
|
Exact-head status: e530ef1 has 29 terminal-success Checks and no terminal failures. Review-only scheduler dispatch was sent again with auto-merge and branch updates disabled. No formal approval or protected merge is claimed. |
|
Current-head review (2026-08-21):
|
Exact-head review disposition
This is a central review-dispatch credential repair. The diff is bounded to the trusted router workflow, router behavior, its contract tests, and the invocation documentation. It uses the configured review credential for repository dispatch, retains the job-scoped token for target metadata/acknowledgement, keeps local mentions independently queued, and preserves durable dispatch state when acknowledgement publication fails. No direct protected-branch write, force push, fake status, or ruleset change is present. Local exact-head evidence for
Hosted exact-head state at observation: no failed check conclusion, but 16 checks remain nonterminal; required workflow, security, review-provider, and queue evidence are not terminal. No formal APPROVED review exists for this exact head; the existing Devin comments are on predecessor commits. The source is not proven broken, but normal required gates remain incomplete. This is not a D1-D5 deadlock finding, so no bypass or force merge is authorized. Please publish a substantive independent review or approval for this exact head after the current Checks settle. |
Current-head conflict repair verification
The conflict repair is not merge evidence by itself. Hosted Checks for this exact merged tree are queued; keep the normal protected auto-merge request and re-evaluate only after terminal current-head Checks and qualifying approval. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
📝 Info: Acknowledgement comment failure is now retryable rather than fatal
Posting the target acknowledgement comment is now wrapped in try/except and only sets ledger_artifact_cache[acknowledgement_cache_key] when it actually publishes (agent_mention_router.py). Because the durable receipt marker is written inside that comment, a failed post leaves no receipt, so a later sweep re-runs parse_event (which would otherwise filter processed comment ids at :182) and heals the missing acknowledgement without re-dispatching (the ledger claim already exists). This is the intended behavior and does not cause duplicate acknowledgement comments once a receipt is visible.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
| TARGET_REPOSITORY_SOURCE="${TARGET_REPOSITORY_TOKEN:+installation}" | ||
| fi | ||
| export TARGET_REPOSITORY_TOKEN | ||
| export AGENT_DISPATCH_TOKEN="$TARGET_REPOSITORY_TOKEN" |
There was a problem hiding this comment.
🔍 Sweep dispatch now uses the cross-repo/app credential instead of github.token
The sweep job removed the job-level AGENT_DISPATCH_TOKEN: ${{ github.token }} and now exports AGENT_DISPATCH_TOKEN="$TARGET_REPOSITORY_TOKEN" (agent-mention-router.yml), so the central repos/.github/dispatches call uses PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or the exchanged OpenCode app installation token. When the installation-token path is selected, the OpenCode app must have contents:write on ContextualWisdomLab/.github for the dispatch to succeed; otherwise the dispatch will fail closed. This is consistent with the PR's stated intent but depends on the app installation's permissions on the central repo.
Was this helpful? React with 👍 or 👎 to provide feedback.
| if [ -z "${AGENT_DISPATCH_TOKEN:-}" ]; then | ||
| echo "::warning::No configured review dispatch credential; the mention remains available for the scheduled sweep." | ||
| exit 0 | ||
| fi | ||
| python3 scripts/ci/agent_mention_router.py --event-path "${RUNNER_TEMP}/agent-mention-event.json" |
There was a problem hiding this comment.
📝 Info: Local path defers to sweep when review secret absent
When AGENT_DISPATCH_TOKEN is empty the local step exits 0 with a warning (agent-mention-router.yml) rather than dispatching. This is not a dropped request: the scheduled sweep enumerates all org repos including .github, so the mention is still processed within the sweep window.
Was this helpful? React with 👍 or 👎 to provide feedback.
| GH_TOKEN: ${{ github.token }} | ||
| TARGET_REPOSITORY_TOKEN: ${{ github.token }} | ||
| AGENT_DISPATCH_TOKEN: ${{ github.token }} | ||
| AGENT_DISPATCH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }} |
There was a problem hiding this comment.
🔍 Dispatch credential now also gates the artifact-ledger reads
For the local fast path, AGENT_DISPATCH_TOKEN changed from github.token to secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN. In main() (agent_mention_router.py) this token becomes the dispatch_client, which is used not only for repos/ContextualWisdomLab/.github/dispatches (needs contents:write) but also for the durable ledger reads in dispatched_agents -> repos/.../actions/artifacts (needs Actions read). Previously these reads succeeded under the job's actions: read github.token; now they run under the review credential. If PR_REVIEW_MERGE_TOKEN / OPENCODE_APPROVE_TOKEN lack Actions read on the central repo, _artifact_records will surface a 403 and the whole route fails. A classic repo-scoped PAT includes Actions read, so this likely works, but it is worth confirming the token scopes since the ledger read is now on the critical path.
Was this helpful? React with 👍 or 👎 to provide feedback.
opencode-agent
Bot
added
merge: urgent-review
1 participant
Root cause
The trusted mention router used the repository-scoped GITHUB_TOKEN for repository_dispatch. GitHub rejected the dispatch with HTTP 403 Resource not accessible by integration, so @opencode-agent review requests never reached the existing reviewer.
Change
Current-head validation
908e9232057bcbe5458a57e183402146eeba7ec9uv run pytest -q— 1,284 passed, 16 subtests passeduv run coverage run -m pytest -q && uv run coverage report --fail-under=100— 8,071 statements, 3,128 branches, 100%uv run interrogate --fail-under=100 scripts/ci/agent_mention_router.py scripts/ci/agent_mention_sweep.py— passedgit diff --checkpassedHosted Agent Mention Router Quality CI is terminal success for this exact head; the eight required security workflows remain queued. Prior-head results do not transfer. The documentation matches the privileged
repository_dispatchcredential boundary. No reviewer credential names or merge behavior were changed. Current review submissions are COMMENTED only; no qualifying APPROVE is present.