From e91db7a910556a4c2964afa1ffb9ddd7267134b2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 08:33:33 +0900
Subject: [PATCH 1/2] fix: authenticate OpenCode coverage fetch

---
 .github/workflows/opencode-review.yml        | 2 +-
 tests/test_opencode_agent_contract.py        | 2 ++
 tests/test_opencode_workflow_shell_syntax.py | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index afa2f417..1572536d 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -108,7 +108,7 @@ jobs:
           git init "$fetch_dir"
           git -C "$fetch_dir" remote add origin "${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git"
           git -C "$fetch_dir" \
-            -c http."${GITHUB_SERVER_URL}/".extraheader="AUTHORIZATION: bearer ${GH_TOKEN}" \
+            -c http.extraheader="AUTHORIZATION: bearer ${GH_TOKEN}" \
             fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA" "$PR_HEAD_SHA"
           git -C "$fetch_dir" checkout --detach "$PR_BASE_SHA"
           git -C "$fetch_dir" config user.name "github-actions[bot]"
diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py
index 1b908e77..f0571255 100644
--- a/tests/test_opencode_agent_contract.py
+++ b/tests/test_opencode_agent_contract.py
@@ -158,6 +158,8 @@ def test_opencode_target_coverage_materializes_merge_tree_without_checkout_actio
     assert "uses: actions/checkout" not in step
     assert "refs/pull/${{ github.event.pull_request.number }}/merge" not in step
     assert "TARGET_REPOSITORY:" in step
+    assert '-c http.extraheader="AUTHORIZATION: bearer ${GH_TOKEN}"' in step
+    assert 'http."${GITHUB_SERVER_URL}/".extraheader' not in step
     assert 'fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA" "$PR_HEAD_SHA"' in step
     assert 'merge --no-ff --no-edit "$PR_HEAD_SHA"' in step
     assert 'Coverage merge tree could not be materialized' in step
diff --git a/tests/test_opencode_workflow_shell_syntax.py b/tests/test_opencode_workflow_shell_syntax.py
index 30485823..15f65136 100644
--- a/tests/test_opencode_workflow_shell_syntax.py
+++ b/tests/test_opencode_workflow_shell_syntax.py
@@ -40,6 +40,7 @@ def test_opencode_review_run_blocks_are_valid_bash():
         return
 
     for step_name in (
+        "Materialize pull request merge tree for coverage measurement",
         "Prepare bounded OpenCode review evidence",
         "Publish OpenCode review outcome",
     ):

From 9782408cde93f36524842fd45bb642421397fc4b Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Fri, 10 Jul 2026 08:57:03 +0900
Subject: [PATCH 2/2] fix: use basic auth for coverage fetch

---
 .github/workflows/opencode-review.yml | 10 +++++++---
 tests/test_opencode_agent_contract.py |  5 ++++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index 1572536d..7d7f325c 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -107,9 +107,13 @@ jobs:
           rm -rf "$fetch_dir" "$COVERAGE_SOURCE_WORKDIR"
           git init "$fetch_dir"
           git -C "$fetch_dir" remote add origin "${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git"
-          git -C "$fetch_dir" \
-            -c http.extraheader="AUTHORIZATION: bearer ${GH_TOKEN}" \
-            fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA" "$PR_HEAD_SHA"
+          auth_header="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\n')"
+          if ! git -C "$fetch_dir" \
+            -c "http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: basic ${auth_header}" \
+            fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA" "$PR_HEAD_SHA"; then
+            echo "::error::Coverage fetch could not authenticate to ${TARGET_REPOSITORY} or read base/head SHAs ${PR_BASE_SHA}/${PR_HEAD_SHA}; check token permissions, target repository access, and SHA visibility."
+            exit 1
+          fi
           git -C "$fetch_dir" checkout --detach "$PR_BASE_SHA"
           git -C "$fetch_dir" config user.name "github-actions[bot]"
           git -C "$fetch_dir" config user.email "41898282+github-actions[bot]@users.noreply.github.com"
diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py
index f0571255..7e11bacc 100644
--- a/tests/test_opencode_agent_contract.py
+++ b/tests/test_opencode_agent_contract.py
@@ -158,9 +158,12 @@ def test_opencode_target_coverage_materializes_merge_tree_without_checkout_actio
     assert "uses: actions/checkout" not in step
     assert "refs/pull/${{ github.event.pull_request.number }}/merge" not in step
     assert "TARGET_REPOSITORY:" in step
-    assert '-c http.extraheader="AUTHORIZATION: bearer ${GH_TOKEN}"' in step
+    assert "x-access-token:%s" in step
+    assert "AUTHORIZATION: basic ${auth_header}" in step
+    assert "AUTHORIZATION: bearer" not in step
     assert 'http."${GITHUB_SERVER_URL}/".extraheader' not in step
     assert 'fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA" "$PR_HEAD_SHA"' in step
+    assert "Coverage fetch could not authenticate" in step
     assert 'merge --no-ff --no-edit "$PR_HEAD_SHA"' in step
     assert 'Coverage merge tree could not be materialized' in step
     assert "PR_HEAD_SHA:" in step