Handle optional Strix workflow in OpenCode gate

[seonghobae]

Summary

• Roll out the OpenCode gate fix for repositories that do not have strix.yml.
• Treat a missing Strix workflow as empty supplemental Strix evidence instead of a statusCheckRollup lookup failure.
• Preserve fail-closed behavior for non-404 workflow/API errors.

Evidence

• PR 🛡️ Sentinel: Add organization-wide default security policy #2 manual OpenCode re-run 27922082445 reached a valid V3 fallback output but posted REQUEST_CHANGES because this repo has no strix.yml and the gate retried the 404 five times.

Validation

• bash -n scripts/ci/collect_failed_check_evidence.sh
• bash -n scripts/ci/opencode_review_approve_gate.sh
• bash -n scripts/ci/validate_opencode_failed_check_review.sh
• python3 -m py_compile scripts/ci/opencode_review_normalize_output.py
• actionlint -shellcheck= -pyflakes= .github/workflows/opencode-review.yml .github/workflows/pr-review-merge-scheduler.yml
• git diff --check

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head evidence but could not publish a valid approval.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - OpenCode review evidence was missing or invalid

• Problem: OpenCode review evidence was missing or invalid.

• Root cause: GitHub Checks statusCheckRollup could not be read after OpenCode model output failure.

• Fix: Re-run the OpenCode review after the current-head evidence and control block are available.

• Regression test: Keep the OpenCode approval gate validating current-head sentinel and control JSON before approval.

• Reason: GitHub Checks statusCheckRollup could not be read after OpenCode model output failure.

• Head SHA: 8ec56e7cf2ae9d1625225cb4ffb5631a4c53b53a

• Workflow run: 27922787179

• Workflow attempt: 1

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8ec56e7cf2ae9d1625225cb4ffb5631a4c53b53a
• Workflow run: 27922787179
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head evidence but could not publish a valid approval.

Findings

1. HIGH .github/workflows/opencode-review.yml:1 - OpenCode review evidence was missing or invalid

• Problem: OpenCode review evidence was missing or invalid.

• Root cause: GitHub Checks statusCheckRollup could not be read after OpenCode model output failure.

• Fix: Re-run the OpenCode review after the current-head evidence and control block are available.

• Regression test: Keep the OpenCode approval gate validating current-head sentinel and control JSON before approval.

• Reason: GitHub Checks statusCheckRollup could not be read after OpenCode model output failure.

• Head SHA: 8ec56e7cf2ae9d1625225cb4ffb5631a4c53b53a

• Workflow run: 27922787179

• Workflow attempt: 1

Risk Graph

flowchart LR
Change[Changed surface] --> Risk[Main risk]
Risk --> Fix[Smallest fix]
Fix --> Verify[Verification]

Loading