Uh oh!
There was an error while loading. Please reload this page.
Fix backport workflow opencode permission and surface AI failures - #1936
Merged
Conversation
The previous `OPENCODE_PERMISSION` value (`{"allow":["*"]}`) was the
wrong shape for opencode's permission config and was silently falling
through to defaults. Notably `external_directory` defaults to "ask",
which auto-rejects in non-interactive `opencode run` — causing the
`write` tool to fail when the AI tried to create the decision file
under `/tmp/`. Use the documented form (`"allow"` as the entire
permission config) and also move the decision/diff/prompt files into
the working directory so opencode doesn't need `external_directory`
permission at all.
Additionally, treat any opencode/AI Gateway failure (auth error,
rejected tool call, missing or malformed decision file) as a hard job
failure rather than silently defaulting to "no backport". A previous
expired AI Gateway key produced a green job that simply skipped the
backport without any indication of the underlying infra problem.Contributor
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 1 step💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 10 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 25 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 50 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 10 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 25 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express workflow with 50 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro Stream Benchmarks(includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) stream pipeline with 5 transform steps (1MB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) 10 parallel streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) fan-out fan-in 10 streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
|
|
Contributor
🧪 E2E Test Results✅ All tests passed Summary
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the automated stable backport workflow after failed runs showed that opencode permissions were misconfigured and AI decision failures could be silently treated as “no backport”. It updates the GitHub Actions workflow that decides whether a merged main commit should be backported and, when needed, uses AI to help resolve cherry-pick conflicts.
Changes:
- Fixes the
OPENCODE_PERMISSIONvalue used by the AI-backed backport steps. - Moves the AI decision artifacts into the repo working directory and makes missing/invalid AI decision output fail the job.
- Keeps the conflict-resolution AI step aligned with the updated opencode permission configuration.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+209
to
+223
| git show --format='' "$SHA" > .backport-commit-diff.patch | ||
| DIFF_SIZE=$(wc -c < .backport-commit-diff.patch) | ||
| MAX_DIFF_BYTES=200000 | ||
| if [ "$DIFF_SIZE" -gt "$MAX_DIFF_BYTES" ]; then | ||
| head -c "$MAX_DIFF_BYTES" /tmp/commit-diff.patch > /tmp/commit-diff-truncated.patch | ||
| echo "" >> /tmp/commit-diff-truncated.patch | ||
| echo "[... diff truncated at ${MAX_DIFF_BYTES} bytes; full size was ${DIFF_SIZE} bytes ...]" >> /tmp/commit-diff-truncated.patch | ||
| mv /tmp/commit-diff-truncated.patch /tmp/commit-diff.patch | ||
| head -c "$MAX_DIFF_BYTES" .backport-commit-diff.patch > .backport-commit-diff-truncated.patch | ||
| echo "" >> .backport-commit-diff-truncated.patch | ||
| echo "[... diff truncated at ${MAX_DIFF_BYTES} bytes; full size was ${DIFF_SIZE} bytes ...]" >> .backport-commit-diff-truncated.patch | ||
| mv .backport-commit-diff-truncated.patch .backport-commit-diff.patch | ||
| fi | ||
| # Decision file lives inside the working directory for the same | ||
| # reason: opencode's `write` tool treats anything outside its cwd as | ||
| # an `external_directory` access, which auto-rejects in headless | ||
| # mode unless explicitly allowed. | ||
| DECISION_FILE=".backport-decision.json" |
Comment on lines
+311
to
+316
| DECISION=$(jq -r '.decision' "$DECISION_FILE") | ||
| REASONING=$(jq -r '.reasoning' "$DECISION_FILE") | ||
| if [ "$DECISION" != "yes" ] && [ "$DECISION" != "no" ]; then | ||
| echo "::warning::AI returned invalid decision '$DECISION'; defaulting to no backport." | ||
| DECISION="no" | ||
| REASONING="AI returned an unrecognized decision value. Original reasoning: $REASONING" | ||
| echo "::error::AI returned invalid decision '$DECISION' (expected 'yes' or 'no'). Reasoning: $REASONING" | ||
| exit 1 |
Comment on lines
+174
to
+179
| # Allow opencode tools to run without prompting. The value is the | ||
| # entire `permission` config (see https://opencode.ai/docs/permissions/); | ||
| # the bare string "allow" applies allow-everything to every scope, | ||
| # including `external_directory` (which defaults to "ask" and would | ||
| # otherwise auto-reject in non-interactive `opencode run`). | ||
| OPENCODE_PERMISSION: '"allow"' |
Comment on lines
+428
to
+430
| # Allow opencode tools to run without prompting. See the matching | ||
| # comment on the `Decide whether to backport` step for details. | ||
| OPENCODE_PERMISSION: '"allow"' |
Contributor
No backport to This commit only modifies To override, add the |
pranaygp added a commit
that referenced
this pull request
May 5, 2026
* origin/main: feat: serializable AbortController/AbortSignal (#1301) Auto-remove workflow packages from serverExternalPackages (#1481) Add missing changeset for Zod 4.4.x compatibility fix in @workflow/world (#1939) Push backport branch via GraphQL createCommitOnBranch for signed commits (#1937) Fix backport workflow opencode permission and surface AI failures (#1936) Restructure backport workflow with AI-driven decisions (#1934)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related issues from the failed backport run on
b1fc9adfa(the merge of #1934 itself):1. Wrong
OPENCODE_PERMISSIONshapeThe value we were passing —
{"allow":["*"]}— is not the documented shape for opencode's permission config. The actual schema is keyed by tool/scope name with values"allow" | "ask" | "deny", and a bare string sets every scope at once. So our config was silently falling through to defaults, whereexternal_directorydefaults to"ask"— which auto-rejects in non-interactiveopencode run. That's why the second run (after the AI Gateway key was rotated) hit:Fix:
OPENCODE_PERMISSION: '"allow"'(the entire permission config = the bare string"allow", allowing every scope includingexternal_directory)./tmp/into the repo working directory (.backport-decision.json,.backport-commit-diff.patch,.backport-decision-prompt.txt), so opencode doesn't needexternal_directorypermission at all. Same fix applied to both AI steps (decision + conflict resolution).2. AI failures silently masquerading as "no backport"
The first run (with the expired AI Gateway key) emitted
Error: AI Gateway authentication failed: Invalid API keybutopencode runexited 0 anyway. The workflow then saw the missing decision file, emitted a::warning::, and defaulted todecision=no— producing a green workflow run that simply didn't backport anything. There was no signal that the AI was completely broken.Fix: in the
Decide whether to backportstep,set -euo pipefailand treat any of (a) missing decision file, (b) malformed JSON, or (c) decision value other thanyes/noas a hard job failure with::error::annotations. A "no backport" outcome now requires AI to explicitly sayno.The conflict-resolution step is unchanged in this regard — it still uses
continue-on-error: truebecause failure to resolve conflicts is an expected outcome that we comment on the source PR for.