From 11386833369bbe6f31411a44f62b164ef1d630d1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 12 Jul 2026 01:31:53 +0900 Subject: [PATCH] fix(ci): prefer merge token for OpenCode review publication --- .github/workflows/opencode-review.yml | 2 +- tests/test_opencode_agent_contract.py | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index f4b448e8..d92ed64e 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -3060,7 +3060,7 @@ jobs: always() && steps.opencode_review_model_pool.outputs.review_status == 'success' env: - GH_TOKEN: ${{ steps.opencode_app_token.outputs.token || secrets.OPENCODE_APPROVE_TOKEN || github.token }} + GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }} GH_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }} PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }} HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.inputs.pr_head_sha }} diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index 872f3eb5..a7eff223 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -652,6 +652,19 @@ def test_opencode_pending_peer_checks_hold_approval_without_failing_required_wor assert "build_waiting_for_checks_body" not in workflow +def test_opencode_review_publication_prefers_merge_token_before_app_token(): + """Use the less-contended merge token before the OpenCode app token.""" + workflow = Path(".github/workflows/opencode-review.yml").read_text( + encoding="utf-8" + ) + + assert ( + "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || " + "secrets.OPENCODE_APPROVE_TOKEN || " + "steps.opencode_app_token.outputs.token || github.token }}" + ) in workflow + + def test_opencode_approve_review_publication_failure_fails_closed(): """APPROVE gates must not pass without a matching GitHub pull review.""" workflow = Path(".github/workflows/opencode-review.yml").read_text(