ci: Add opencode #421
ci: Add opencode #421
Conversation
Enables the `opencode` job to run on demand when an issue comment contains `/oc` or `/opencode`. This provides a convenient way to trigger the Opencode tool directly from GitHub issues, facilitating interactive code analysis or generation.
Removes `commitlint`, `uv-check`, and `trunk-check-pre-push` from the active list of enabled Trunk actions. This change streamlines the pre-commit workflow by deactivating checks that are not currently required or desired.
|
Review these changes at https://app.gitnotebooks.com/AlphaSphereDotAI/chattr/pull/421 |
Reviewer's GuideAdds an interactive 'opencode' GitHub Actions job triggered via issue comments in ci_tools.yaml and prunes obsolete linters and checks from the trunk.yaml configuration. Sequence diagram for triggering the 'opencode' job via issue commentsequenceDiagram
actor User
participant GitHub
participant "CI Tools Workflow"
participant "Opencode Job"
User->>GitHub: Create issue comment with '/oc' or '/opencode'
GitHub->>"CI Tools Workflow": Trigger workflow on issue_comment event
"CI Tools Workflow"->>"Opencode Job": Start job if comment matches
"Opencode Job"->>"Checkout Repository": Checkout code
"Opencode Job"->>"sst/opencode/github Action": Run opencode with API key and model
Class diagram for updated trunk.yaml configurationclassDiagram
class Lint {
enabled: [email protected]
enabled: [email protected]
enabled: [email protected]
enabled: [email protected]
enabled: [email protected]
}
class Actions {
enabled: commitizen
enabled: trufflehog-pre-commit
enabled: uv-lock
enabled: uv-sync
enabled: trunk-announce
enabled: trunk-fmt-pre-commit
enabled: trunk-upgrade-available
enabled: trunk-check-pre-commit
}
%% Removed: [email protected] from Lint
%% Removed: commented-out actions from Actions
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @MH0386, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on refining the continuous integration setup by cleaning up the Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Here's the code health analysis summary for commits Analysis Summary
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
General comments:
- Consider simplifying the issue_comment filter by using a single
matchesexpression or regex so you don’t need separatecontainsandstartsWithchecks for/ocand/opencode. - If this runner is only meant for pull request contexts, narrow the trigger to PR comments or otherwise guard against running on every new issue comment.
- You may want to clean up or remove the commented-out entries in
.trunk/trunk.yamlto keep the config concise, or add a note explaining why they’re retained.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider simplifying the issue_comment filter by using a single `matches` expression or regex so you don’t need separate `contains` and `startsWith` checks for `/oc` and `/opencode`.
- If this runner is only meant for pull request contexts, narrow the trigger to PR comments or otherwise guard against running on every new issue comment.
- You may want to clean up or remove the commented-out entries in `.trunk/trunk.yaml` to keep the config concise, or add a note explaining why they’re retained.
## Individual Comments
### Comment 1
<location> `.github/workflows/ci_tools.yaml:64` </location>
<code_context>
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ - name: Run opencode
+ uses: sst/opencode/github@latest
+ env:
+ OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
</code_context>
<issue_to_address>
**suggestion:** Pin the opencode action to a specific version for reproducibility.
Referencing '@latest' can lead to unpredictable builds if the action changes upstream. Please use a specific version or commit hash for reliability.
Suggested implementation:
```
- name: Run opencode
uses: sst/opencode/[email protected]
env:
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
with:
model: opencode/grok-code
```
Replace `v1.2.3` with the actual version or commit hash you want to pin to, based on the opencode action's releases or tags.
</issue_to_address>
### Comment 2
<location> `.github/workflows/ci_tools.yaml:64` </location>
<code_context>
uses: sst/opencode/github@latest
</code_context>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .trunk/trunk.yaml configuration. It removes the pre-commit-hooks linter and cleans up several commented-out actions. While the cleanup is beneficial, removing pre-commit-hooks might have unintended side effects on code quality, as it provides several useful generic checks. I've added a comment to seek clarification on this change. Furthermore, the PR title 'ci: Add opencode' seems to conflict with the changes, which are primarily removals. I recommend updating the title and adding a description to accurately reflect the PR's intent.
🧪 CI InsightsHere's what we observed from your CI run for 331a8a5. 🟢 All jobs passed!But CI Insights is watching 👀 |
🔍 Vulnerabilities of
|
| digest | sha256:295695feea192495eb31161833bf3093087bc0799f0707e2a16f209c50620ce2 |
| vulnerabilities |     |
| platform | linux/amd64 |
| size | 325 MB |
| packages | 500 |
# Dockerfile (30:30)
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /home/nonroot/.local/ /home/nonroot/.local/
Description
| ||||||||||||
# Dockerfile (30:30)
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /home/nonroot/.local/ /home/nonroot/.local/
Description
| ||||||||||||
# Dockerfile (30:30)
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /home/nonroot/.local/ /home/nonroot/.local/
Description
|
Extends the `issue_comment` trigger to include `edited` events, ensuring the workflow reacts to modifications of comments. Removes the workflow-level concurrency group, preventing new runs from canceling existing ones. This allows multiple instances of the workflow to run concurrently without interruption.
|
|
Thank you for your contribution @MH0386! Your pull request has been merged. |
Summary by Sourcery
Integrate Opencode as a comment-triggered CI job and streamline trunk lint settings
New Features:
Enhancements:
CI:
opencodejob in the CI Tools workflow using sst/opencode/github@latest