From 065f5316f9bfaae7cfb007e21f13b7fde808c7fc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 19 Jul 2026 16:06:56 +0900 Subject: [PATCH 1/2] fix(review): pin current Rust coverage toolchain --- .github/workflows/opencode-review.yml | 25 ++++++++++++++++----- tests/test_opencode_agent_contract.py | 32 ++++++++++++++++++++++----- 2 files changed, 46 insertions(+), 11 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index 7010b262..eec42919 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -559,12 +559,14 @@ jobs: install -m 0644 "$trusted_ci_requirements" \ "$coverage_build_dir/requirements-opencode-review-ci-hashes.txt" cat >"$coverage_build_dir/Dockerfile" <<'DOCKERFILE' - FROM docker.io/library/ubuntu@sha256:52df9b1ee71626e0088f7d400d5c6b5f7bb916f8f0c82b474289a4ece6cf3faf + # Official Rust 1.97.1 linux/amd64 manifest. Pin the architecture + # manifest itself so the trusted build cannot drift across releases + # or platforms while retaining stable Rust 2024 support. + FROM docker.io/library/rust@sha256:389c1ae98c20fbcadca68a685482749267cec3c90893ae4671c5a37cc894c416 ENV DEBIAN_FRONTEND=noninteractive RUN apt-get update \ && apt-get install --no-install-recommends -y \ ca-certificates \ - cargo \ curl \ git \ jq \ @@ -582,10 +584,14 @@ jobs: r-base \ r-cran-covr \ r-cran-testthat \ - rustc \ util-linux \ vulkan-tools \ && rm -rf /var/lib/apt/lists/* + RUN test "$(rustc --version --verbose | sed -n 's/^release: //p')" = "1.97.1" \ + && rustup component add llvm-tools-preview \ + && rustup component list --installed | grep -Eq '^llvm-tools-' \ + && chown -R root:root /usr/local/rustup /usr/local/cargo \ + && chmod -R go-w /usr/local/rustup /usr/local/cargo RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/cargo-llvm-cov.tar.gz \ https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-unknown-linux-musl.tar.gz \ && echo '967b5cc996c29d8baa52bbb4595ef1f53af35255af8e2036ddbc6468d7b523c7 /tmp/cargo-llvm-cov.tar.gz' | sha256sum -c - \ @@ -748,7 +754,8 @@ jobs: HOME=/work/.opencode-sandbox-home \ XDG_CACHE_HOME=/work/.opencode-sandbox-cache \ CARGO_HOME=/work/.opencode-sandbox-home/.cargo \ - PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ + RUSTUP_HOME=/usr/local/rustup \ + PATH="/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ "$@" >"$log_file" 2>&1 local rc=$? set -e @@ -794,7 +801,8 @@ jobs: HOME=/work/.opencode-sandbox-home \ XDG_CACHE_HOME=/work/.opencode-sandbox-cache \ CARGO_HOME=/work/.opencode-sandbox-home/.cargo \ - PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ + RUSTUP_HOME=/usr/local/rustup \ + PATH="/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ "$@" >"$log_file" 2>&1 local rc=$? set -e @@ -1333,6 +1341,13 @@ jobs: failures=$((failures + 1)) return 1 fi + append "### Rust coverage toolchain" + append "" + append "- Result: PASS" + append "- Rust: \`$(rustc --version)\`" + append "- Cargo: \`$(cargo --version)\`" + append "- Coverage: \`$(cargo-llvm-cov --version)\`" + append "" ensure_rust_gpu_adapter ensure_rust_desktop_deps } diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index c8eb1d34..3aaa4626 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -326,10 +326,25 @@ def test_opencode_target_coverage_materializes_only_after_authorized_dispatch(): assert "member.isfile() or member.isdir()" in workflow assert 'bundle.extractall(destination, members=members, filter="data")' in workflow assert 'tar -xf "$COVERAGE_SOURCE_ARCHIVE"' not in workflow - assert "docker.io/library/ubuntu@sha256:" in measure_step + assert ( + "docker.io/library/rust@sha256:" + "389c1ae98c20fbcadca68a685482749267cec3c90893ae4671c5a37cc894c416" + in measure_step + ) + assert 'test "$(rustc --version --verbose' in measure_step + assert '= "1.97.1"' in measure_step + assert "rustup component add llvm-tools-preview" in measure_step + assert "rustup component list --installed" in measure_step + assert "chown -R root:root /usr/local/rustup /usr/local/cargo" in measure_step + assert "chmod -R go-w /usr/local/rustup /usr/local/cargo" in measure_step + assert " cargo \\\n" not in measure_step + assert " rustc \\\n" not in measure_step assert "apt-get install --no-install-recommends -y" in measure_step assert "--require-hashes" in measure_step - assert 'coverage_tool_image="opencode-coverage-tools:${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"' in measure_step + assert ( + 'coverage_tool_image="opencode-coverage-tools:${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"' + in measure_step + ) assert "The networked build context contains only this" in measure_step assert 'install -m 0644 "$trusted_ci_requirements"' in measure_step assert "docker build --pull --no-cache --network=default" in measure_step @@ -382,10 +397,15 @@ def test_opencode_target_coverage_materializes_only_after_authorized_dispatch(): assert "apt-get" not in sandbox_runtime assert "cargo install" not in sandbox_runtime assert "command -v cargo-llvm-cov" in sandbox_runtime - assert ( - 'PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"' - in measure_step - ) + assert 'append "- Rust: \\`$(rustc --version)\\`"' in sandbox_runtime + assert 'append "- Cargo: \\`$(cargo --version)\\`"' in sandbox_runtime + assert 'append "- Coverage: \\`$(cargo-llvm-cov --version)\\`"' in sandbox_runtime + trusted_runtime_path = ( + 'PATH="/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:' + '/usr/sbin:/usr/bin:/sbin:/bin"' + ) + assert measure_step.count(trusted_runtime_path) == 2 + assert measure_step.count("RUSTUP_HOME=/usr/local/rustup") == 2 assert 'PATH="/work/.opencode-sandbox-home/.cargo/bin:${PATH}"' not in measure_step assert "cargo llvm-cov --version" not in measure_step assert "emit_captured_log()" in measure_step From 137ff8be2959a9e7f5474931be71fc659704f3d6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 19 Jul 2026 19:32:22 +0900 Subject: [PATCH 2/2] fix(review): prevent model pool provider starvation --- .github/workflows/opencode-review.yml | 18 +++++++++++------- tests/test_opencode_agent_contract.py | 18 +++++++++--------- 2 files changed, 20 insertions(+), 16 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index eec42919..41050421 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -3531,15 +3531,16 @@ jobs: SHARE: "false" NPM_CONFIG_IGNORE_SCRIPTS: "true" NO_COLOR: "1" - # High-sensitivity review candidates only. DeepSeek V3 has been the - # most reliable first-pass reviewer in the org queue, then the pool - # falls through to the direct GPT-5.6 Luna slot, then the full-size - # GPT-4.1 long-context endpoint and provider-specific GPT/o3 fallbacks. + # High-sensitivity review candidates only. Start with the full-size + # GPT-4.1 long-context endpoint so one slow DeepSeek or direct-OpenAI + # request cannot consume nearly the entire bounded provider budget; + # then fall through to GPT-5.6 Luna, DeepSeek V3, and the remaining + # provider-specific GPT/o3 fallbacks. # The direct-OpenAI slot runs GPT-5.6 Luna: the newest family's # cost-efficient tier, cheaper than the legacy gpt-5 it replaced # ($1/$6 vs $1.25/$10 per 1M tokens) so the org OpenAI budget # stretches further between top-ups. - OPENCODE_MODEL_CANDIDATES: "github-models/deepseek/deepseek-v3-0324 openai/gpt-5.6-luna github-models/openai/gpt-4.1 github-models/openai/gpt-5 github-models/openai/gpt-5-chat github-models/openai/o3 github-models/deepseek/deepseek-r1-0528 github-models/deepseek/deepseek-r1" + OPENCODE_MODEL_CANDIDATES: "github-models/openai/gpt-4.1 openai/gpt-5.6-luna github-models/deepseek/deepseek-v3-0324 github-models/openai/gpt-5 github-models/openai/gpt-5-chat github-models/openai/o3 github-models/deepseek/deepseek-r1-0528 github-models/deepseek/deepseek-r1" # One attempt per model, then fall through to the next model. Retrying # the SAME model 5x let a rate-limited/hung leader consume the whole # step, so the pool never reached a healthy fallback model. @@ -3579,8 +3580,11 @@ jobs: OPENCODE_DYNAMIC_MAX_CYCLES: "0" CENTRAL_REVIEW_PROCESS_FALLBACK_ELIGIBLE: ${{ steps.central_review_process_fallback_scope.outputs.eligible || 'false' }} CENTRAL_REVIEW_PROCESS_FALLBACK_SCOPE_LABEL: ${{ steps.central_review_process_fallback_scope.outputs.scope_label || 'unsupported' }} - OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "5400" - OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "11700" + # Central review-process changes are capped at three files above. A + # 15-minute candidate cap and one-hour pool budget keep one unavailable + # provider from starving every later real-model reviewer. + OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "900" + OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "3600" OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_MAX_CYCLES: "1" OPENCODE_BACKOFF_INITIAL_SECONDS: "30" OPENCODE_BACKOFF_MAX_SECONDS: "30" diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index 3aaa4626..45b0a026 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -103,9 +103,9 @@ def test_opencode_model_pool_sets_high_effort_for_capable_candidates(): assert candidate_pairs assert candidate_pairs == [ - ["github-models", "deepseek/deepseek-v3-0324"], - ["openai", "gpt-5.6-luna"], ["github-models", "openai/gpt-4.1"], + ["openai", "gpt-5.6-luna"], + ["github-models", "deepseek/deepseek-v3-0324"], ["github-models", "openai/gpt-5"], ["github-models", "openai/gpt-5-chat"], ["github-models", "openai/o3"], @@ -115,8 +115,8 @@ def test_opencode_model_pool_sets_high_effort_for_capable_candidates(): assert direct_openai_models == ["gpt-5.6-luna"] assert set(github_candidate_models).issubset(set(github_models)) assert github_candidate_models == [ - "deepseek/deepseek-v3-0324", "openai/gpt-4.1", + "deepseek/deepseek-v3-0324", "openai/gpt-5", "openai/gpt-5-chat", "openai/o3", @@ -993,11 +993,11 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent(): assert "CENTRAL_REVIEW_PROCESS_FALLBACK_ELIGIBLE" in workflow assert "CENTRAL_REVIEW_PROCESS_FALLBACK_SCOPE_LABEL" in workflow assert ( - 'OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "5400"' + 'OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_RUN_TIMEOUT_SECONDS: "900"' in workflow ) assert ( - 'OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "11700"' + 'OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_TOTAL_BUDGET_SECONDS: "3600"' in workflow ) assert 'OPENCODE_CENTRAL_REVIEW_PROCESS_FALLBACK_MAX_CYCLES: "1"' in workflow @@ -1110,9 +1110,9 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent(): in workflow ) assert ( - 'OPENCODE_MODEL_CANDIDATES: "github-models/deepseek/deepseek-v3-0324 ' + 'OPENCODE_MODEL_CANDIDATES: "github-models/openai/gpt-4.1 ' "openai/gpt-5.6-luna " - "github-models/openai/gpt-4.1 " + "github-models/deepseek/deepseek-v3-0324 " "github-models/openai/gpt-5 " "github-models/openai/gpt-5-chat " "github-models/openai/o3 " @@ -1233,9 +1233,9 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent(): 'OPENCODE_MODEL_CANDIDATES: "github-models/openai/gpt-5-nano"' not in workflow ) assert ( - 'OPENCODE_MODEL_CANDIDATES: "github-models/deepseek/deepseek-v3-0324 ' + 'OPENCODE_MODEL_CANDIDATES: "github-models/openai/gpt-4.1 ' "openai/gpt-5.6-luna " - "github-models/openai/gpt-4.1 " + "github-models/deepseek/deepseek-v3-0324 " "github-models/openai/gpt-5 " "github-models/openai/gpt-5-chat " "github-models/openai/o3 "