diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index e2b9eacd5..b1f46b5ad 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -3532,6 +3532,22 @@ jobs: fi rm -f "$gh_error_file" "$review_payload_file" update_review_overview "$event" "$body" || true + if [ "$event" = "APPROVE" ]; then + if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then + { + printf '## OpenCode approve review publication skipped\n\n' + printf 'OpenCode produced a source-backed current-head APPROVE gate result, but GitHub rejected the pull review publication.\n\n' + printf -- "- Result: \`APPROVE_PUBLICATION_SKIPPED\`\n" + printf -- "- Head SHA: \`%s\`\n" "$HEAD_SHA" + printf -- '- Workflow run: %s\n' "$RUN_ID" + printf -- '- Workflow attempt: %s\n' "$RUN_ATTEMPT" + printf -- '- Review state: unchanged because GitHub rejected the review API write.\n' + printf -- '- Branch protection: remains authoritative for required reviews and peer checks.\n\n' + } >>"$GITHUB_STEP_SUMMARY" + fi + printf '::notice::OpenCode approve review publication skipped after successful gate; keeping the successful approval gate result for head %s. Branch protection remains authoritative for required reviews and peer checks.\n' "$HEAD_SHA" + return 0 + fi printf '::error::OpenCode could not publish the pull review for head %s, so the review state was not changed.\n' "$HEAD_SHA" case "$event" in REQUEST_CHANGES | INLINE_COMMENT_PUBLISH_FAILED) echo "::endgroup::" ;; diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 0f0c7bfd0..ab7c9a645 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -861,9 +861,10 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() { assert_file_contains "$workflow_file" 'warn_gh_publication_failure "pull review with fallback review token"' "opencode approval explains fallback review publication failures" assert_file_contains "$workflow_file" 'OpenCode could not publish the pull review for head %s, so the review state was not changed.' "opencode approval fails closed when review publication fails" assert_file_contains "$workflow_file" 'REQUEST_CHANGES | INLINE_COMMENT_PUBLISH_FAILED) echo "::endgroup::" ;;' "opencode only closes a review-body log group for events that opened one" - assert_file_not_contains "$workflow_file" 'OpenCode approve review publication skipped' "opencode approval does not report skipped approval publication as success" - assert_file_not_contains "$workflow_file" 'keeping the successful approval gate result' "opencode approval does not soft-pass without publishing an approving review" - assert_file_not_contains "$workflow_file" 'gh_error_is_rate_limited()' "opencode approval does not soft-pass rate-limited approval publication failures" + assert_file_contains "$workflow_file" '[ "$event" = "APPROVE" ]' "opencode approval soft-passes only APPROVE review publication failures" + assert_file_contains "$workflow_file" 'OpenCode approve review publication skipped after successful gate; keeping the successful approval gate result' "opencode approval preserves successful approval gates when GitHub rejects the review write" + assert_file_contains "$workflow_file" 'Branch protection remains authoritative for required reviews and peer checks.' "opencode approval logs that branch protection remains authoritative after review write failure" + assert_file_not_contains "$workflow_file" 'gh_error_is_rate_limited()' "opencode approval soft-pass is event-scoped rather than rate-limit-specific" assert_file_contains "$workflow_file" 'warn_gh_publication_failure "review overview comment"' "opencode approval soft-fails permission-denied overview publication" assert_file_not_contains "$workflow_file" 'gh api -X DELETE "repos/${GH_REPOSITORY}/issues/comments/${comment_id}"' "opencode review must not delete Review Overview gate evidence" assert_file_not_contains "$workflow_file" '--file "$OPENCODE_EVIDENCE_FILE"' "opencode review must not attach evidence content to GitHub Models requests"