fix(opencode): bind coverage artifacts to workflow attempts

[seonghobae]

Summary

• binds OpenCode coverage-source evidence to an immutable artifact ID and the producer-attested GitHub workflow attempt
• downloads by artifact ID only after fail-closed identity validation
• adds a dedicated rerun-quality contract, doctoring evidence, and realistic regression tests

Lineage and identities

This clean current-main successor supersedes #812, whose donor head e5e4272701686cb11aecad3f879588cd98e71b6b diverged 59 commits ahead / 31 behind and contained a historically truncated central workflow. The successor was rebuilt from independently resolved protected main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba; no checks, reviews, or approval claims from the donor transfer to this head.

During connector publication, a size-capped local read initially truncated the central workflow in commit 308d2b8a79e1e5ba5531d4a776135fe616c76974. That defect was detected before PR creation or external consumption and repaired from GitHub's complete protected-main blob in 44e3ecc66312e2c232b8f415322d09d84983aa1a. The current branch comparison is bounded to five intended files; the central workflow is +60/-4 with its target job and terminal scheduler sentinel intact.

RED → GREEN evidence

• RED: focused contract tests fail against the unmodified protected-main workflow because immutable artifact ID and producer-attempt binding are absent.
• GREEN: 5 passed in tests/test_opencode_coverage_artifact_rerun_contract.py.
• Full validation: 982 passed plus 16 subtests passed.
• Owned production coverage: 6978/6978 statements and 2790/2790 branches (100%).
• Public API documentation: interrogate 100%.
• Compilation and diff checks passed.

Acceptance

Ready for review because the unchanged exact successor head has complete applicable CI/security evidence and current-head semantic review has no required finding. Merge still requires qualifying independent approval and repository policy; closing #811 additionally requires protected-main merge and protected-main operational rerun evidence, not source-branch success alone.

Supersedes #812.

Summary by CodeRabbit

• 개선 사항

  • 커버리지 검증 자료의 출처와 실행 시도를 확인해 이전 실행 결과가 잘못 재사용되지 않도록 했습니다.
  • 검증에 실패하거나 자료가 누락된 경우 안전하게 중단하고 복구 절차를 안내합니다.
  • 커버리지, 회귀 테스트, 문서화 및 컴파일 검증을 자동화했습니다.

• 문서

  • 커버리지 자료 재실행 계약, 보존 기간, 복구 방법 및 보안 원칙을 문서화했습니다.

• 테스트

  • 자료 업로드·검증·다운로드와 실패 시 동작을 확인하는 자동 테스트를 추가했습니다.

[coderabbitai]

📝 Walkthrough

Walkthrough

OpenCode 커버리지 source를 현재 workflow 시도와 불변 아티팩트 ID에 연결했습니다. 소비자는 다운로드 전에 실행 시도와 ID를 검증합니다. 계약 테스트, 품질 게이트, 운영 문서를 추가했습니다.

Changes

OpenCode 커버리지 재실행

Layer / File(s)	Summary
현재 시도 아티팩트 전달 .github/workflows/opencode-review-dispatch.yml	생산자가 아티팩트 ID와 github.run_attempt를 출력합니다. 소비자는 두 값을 검증한 뒤 검증된 ID로만 다운로드합니다.
전달 계약과 품질 게이트 검증 tests/test_opencode_coverage_artifact_rerun_contract.py, scripts/ci/test_strix_quick_gate.sh, .github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml	계약 테스트가 시도 귀속성, 다운로드 순서, 복구 동작, 권한 제한 및 임시 파일 부재를 검증합니다. 품질 workflow가 관련 테스트와 전체 품질 검사를 실행합니다.
운영 계약 문서화 docs/doctoring/opencode-coverage-artifact-reruns.md, CHANGELOG.md	아티팩트 보존 기간, 권한 경계, fail-closed 동작, 재실행·복구·롤백 절차를 문서화합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Dispatch as repository_dispatch
  participant Producer as coverage-source-tree
  participant Storage as Actions artifact storage
  participant Consumer as coverage-evidence
  Dispatch->>Producer: 현재 workflow 시도 실행
  Producer->>Storage: 시도별 coverage source 업로드
  Producer-->>Consumer: artifact-id 및 run_attempt 전달
  Consumer->>Consumer: 현재 시도와 ID 검증
  Consumer->>Storage: 검증된 artifact-id로 다운로드
  Consumer-->>Dispatch: 실패 시 전체 재실행 또는 새 dispatch 안내

Loading

Possibly related issues

• ContextualWisdomLab/.github issue 811 — 현재 시도에 귀속된 불변 아티팩트 전달과 재실행 안전성이라는 동일한 목표를 다룹니다.

Possibly related PRs

• ContextualWisdomLab/.github#755 — 동일한 OpenCode 커버리지 workflow와 계약 테스트를 수정하지만, LLVM 도구체인 제공에 초점을 둡니다.
• ContextualWisdomLab/.github#759 — OpenCode 커버리지 workflow와 진단 검증을 함께 수정합니다.
• ContextualWisdomLab/.github#812 — 동일한 시도별 OpenCode 커버리지 아티팩트 workflow, 테스트 및 문서를 확장합니다.

Suggested labels: needs-revision, do-not-merge

Suggested reviewers: opencode-agent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 커버리지 아티팩트를 워크플로 실행 시도에 연결하는 PR의 핵심 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml (1)

41-44: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

harden-runner 모드를 block으로 강화하는 것을 고려하십시오.

이 단계는 egress-policy: audit를 사용합니다. 이 작업은 해시 고정된 의존성만 설치합니다. block 모드와 명시적 허용 엔드포인트 목록을 사용하면 공급망 무결성을 더 강하게 보장합니다.

이 제안은 선택 사항입니다. 즉시 수정할 필요는 없습니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml around
lines 41 - 44, 선택적으로 Harden runner 단계의 egress-policy를 audit에서 block으로 변경하고, 해시
고정 의존성 설치에 필요한 엔드포인트만 명시적으로 허용하도록 설정하십시오.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml:
- Around line 41-44: 선택적으로 Harden runner 단계의 egress-policy를 audit에서 block으로
변경하고, 해시 고정 의존성 설치에 필요한 엔드포인트만 명시적으로 허용하도록 설정하십시오.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f50d49be-4c63-4c3a-b297-d848e0b50bdd

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb06cd and 498867c.

📒 Files selected for processing (6)

• .github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml
• .github/workflows/opencode-review-dispatch.yml
• CHANGELOG.md
• docs/doctoring/opencode-coverage-artifact-reruns.md
• scripts/ci/test_strix_quick_gate.sh
• tests/test_opencode_coverage_artifact_rerun_contract.py

[seonghobae]

@opencode-agent review

Evaluate exact current head 498867cf05079120aa89c05fe1d13b65b26084a4 against independently resolved live main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. All ten observed exact-head workflows are terminal-success, GitHub reports the ready head mergeable, and unresolved threads are zero. Review immutable artifact-ID selection, producer workflow-attempt attestation, and rerun-safe coverage-source binding only on this head. Submit only a current-head semantic verdict; keep automated judgment separate from qualifying independent human approval, merge authority, and protected-main operational acceptance.