Uh oh!
There was an error while loading. Please reload this page.
Allow AppGuardrail collector fallback in OpenCode - #285
Conversation
There was a problem hiding this comment.
Pull request overview
Extends the deterministic OpenCode “trusted automation” fallback path so it can also be used for the AppGuardrail org-security failure collector change set, and adds auditability by including a scope label in the approval body.
Changes:
- Add an additional deterministic-fallback scope for
ContextualWisdomLab/appguardrail, including its own max changed-file threshold and allowlist. - Emit a fallback scope label as a step output and include it in the deterministic-approval review body.
- Update the OpenCode workflow contract test to assert the new scope/allowlist behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
tests/test_opencode_agent_contract.py | Extends contract assertions to cover the new appguardrail deterministic-fallback scope and changed-file gating. |
.github/workflows/opencode-review.yml | Adds appguardrail allowlist + scope labeling to the deterministic fallback logic and surfaces the scope in approval output. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
bfdddb8 to
5d870abCompareThere was a problem hiding this comment.
Pull request overview
Central review-process fallback found unresolved reviewer threads and did not approve.
Findings
1. HIGH review threads:1 - Unresolved reviewer feedback blocks fallback approval
- Problem: unresolved non-outdated review feedback is present on the current pull request.
- Root cause: fallback approval is only valid after reviewer feedback is addressed, resolved, or outdated.
- Fix: address or resolve the listed review thread(s), then rerun current-head review.
- Regression test: keep central fallback approval gated on an empty unresolved-thread set.
Thread Evidence
Latest unresolved reviewer thread evidence
tests/test_opencode_agent_contract.py line 216
Latest reviewer comment: @copilot-pull-request-reviewer at 2026-07-02T04:29:28Z
Comment URL: #285 (comment)
Comment excerpt: The contract test asserts the new appguardrail fallback allowlist entries, but it currently doesn’t verify the allowlisted collector workflow file ('.github/workflows/org-security-failure-collector.yml'). Since the PR summary says the fallback scope includes the workflow+script+test, adding an assertion here will prevent regressions where the workflow file entry is accidentally removed.
Result: REQUEST_CHANGES
Head SHA:
bfdddb8d381eba325928e5ae24c8937392a3c0d5Workflow run: 28565361066
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode approved this restricted trusted-automation update through the deterministic fallback path because the model pool was intentionally skipped for a narrow, allowlisted change scope. Summary
This fallback is limited to central OpenCode/Strix review-process files and the appguardrail org-security failure collector file set. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
Central review-process fallback found unresolved reviewer threads and did not approve.
Findings
1. HIGH review threads:1 - Unresolved reviewer feedback blocks fallback approval
- Problem: unresolved non-outdated review feedback is present on the current pull request.
- Root cause: fallback approval is only valid after reviewer feedback is addressed, resolved, or outdated.
- Fix: address or resolve the listed review thread(s), then rerun current-head review.
- Regression test: keep central fallback approval gated on an empty unresolved-thread set.
Thread Evidence
Latest unresolved reviewer thread evidence
tests/test_opencode_agent_contract.py line 216
Latest reviewer comment: @copilot-pull-request-reviewer at 2026-07-02T04:29:28Z
Comment URL: #285 (comment)
Comment excerpt: The contract test asserts the new appguardrail fallback allowlist entries, but it currently doesn’t verify the allowlisted collector workflow file ('.github/workflows/org-security-failure-collector.yml'). Since the PR summary says the fallback scope includes the workflow+script+test, adding an assertion here will prevent regressions where the workflow file entry is accidentally removed.
Result: REQUEST_CHANGES
Head SHA:
5d870ab8ec58fc8ae7d1811c270b4892cab3b4f1Workflow run: 28565765356
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
There was a problem hiding this comment.
Pull request overview
Central review-process fallback found unresolved reviewer threads and did not approve.
Findings
1. HIGH review threads:1 - Unresolved reviewer feedback blocks fallback approval
- Problem: unresolved non-outdated review feedback is present on the current pull request.
- Root cause: fallback approval is only valid after reviewer feedback is addressed, resolved, or outdated.
- Fix: address or resolve the listed review thread(s), then rerun current-head review.
- Regression test: keep central fallback approval gated on an empty unresolved-thread set.
Thread Evidence
Latest unresolved reviewer thread evidence
tests/test_opencode_agent_contract.py line 216
Latest reviewer comment: @copilot-pull-request-reviewer at 2026-07-02T04:29:28Z
Comment URL: #285 (comment)
Comment excerpt: The contract test asserts the new appguardrail fallback allowlist entries, but it currently doesn’t verify the allowlisted collector workflow file ('.github/workflows/org-security-failure-collector.yml'). Since the PR summary says the fallback scope includes the workflow+script+test, adding an assertion here will prevent regressions where the workflow file entry is accidentally removed.
Result: REQUEST_CHANGES
Head SHA:
5d870ab8ec58fc8ae7d1811c270b4892cab3b4f1Workflow run: 28565756401
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
5d870ab to
fdb3991CompareThere was a problem hiding this comment.
Pull request overview
OpenCode approved this central review-process self-update through the deterministic fallback path because the model pool was intentionally skipped for a narrow trusted-review infrastructure change.
Summary
- Result: APPROVE
- Reason: changed files matched the central review-process fallback allowlist; coverage evidence passed; peer GitHub Checks passed; mergeability and unresolved review-thread gates passed.
- Changed-file count: 2
- Model path: skipped for central review-process fallback; provider delay or model-output unavailability is not review feedback.
- Head SHA:
fdb3991709662064a4e6fdcb359f7afa8a992cc4 - Workflow run: 28566198205
- Workflow attempt: 1
This fallback is limited to central OpenCode/Strix review-process files and their contract tests.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode approved this restricted trusted-automation update through the deterministic fallback path because the model pool was intentionally skipped for a narrow, allowlisted change scope.
Summary
- Result: APPROVE
- Reason: changed files matched the deterministic fallback allowlist; coverage evidence passed; peer GitHub Checks passed; mergeability and unresolved review-thread gates passed.
- Fallback scope: central OpenCode/Strix review-process
- Changed-file count: 2
- Model path: skipped for deterministic fallback; provider delay or model-output unavailability is not review feedback.
- Head SHA:
fdb3991709662064a4e6fdcb359f7afa8a992cc4 - Workflow run: 28566206841
- Workflow attempt: 1
This fallback is limited to central OpenCode/Strix review-process files and the appguardrail org-security failure collector file set.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_opencode_agent_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_opencode_agent_contract.py"]
R2 --> V2["targeted test run"]
Dismissed after the reviewer thread was addressed, resolved, and same-head deterministic OpenCode approval passed with all required checks green.
Uh oh!
There was an error while loading. Please reload this page.
Summary
Verification