Skip to content

feat(review): add NVIDIA NIM provider #672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 15 commits into from
Jul 31, 2026
+589 −68
Merged

feat(review): add NVIDIA NIM provider #672

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
4076f39
feat(review): add NVIDIA NIM provider
seonghobae Jul 30, 2026
478fcde
Merge branch 'main' into fix/nvidia-nim-provider
opencode-agent[bot] Jul 30, 2026
bea8127
feat(review): route public scanners through NVIDIA NIM
seonghobae Jul 30, 2026
8d7f9f3
fix(review): preserve provider fallbacks
seonghobae Jul 30, 2026
a4cfedf
Merge branch 'main' into fix/nvidia-nim-provider
opencode-agent[bot] Jul 30, 2026
45df7d2
fix(review): propagate Strix fallback model
seonghobae Jul 30, 2026
26adf71
Merge current main into fix/nvidia-nim-provider
seonghobae Jul 31, 2026
c964964
test: enforce Strix timeout invariants
seonghobae Jul 31, 2026
5dc981b
fix: break OpenCode scheduler check cycle
seonghobae Jul 31, 2026
620d784
Merge current main and preserve public-only NIM review policy
seonghobae Jul 31, 2026
450a053
Merge latest OpenCode timeout fixes
seonghobae Jul 31, 2026
7030ed4
fix(review): ignore scheduler self-check failures
seonghobae Jul 31, 2026
346a4be
fix(review): reserve fallback budget after NIM
seonghobae Jul 31, 2026
8a8ac41
fix(review): enforce scoped NIM credentials
seonghobae Jul 31, 2026
8b58fa0
test(review): scope NIM secrets to review job
seonghobae Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/noema-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,23 @@ jobs:
echo "::add-mask::$app_token"
echo "token=$app_token" >>"$GITHUB_OUTPUT"

- name: Resolve Noema target repository visibility
if: env.PR_NUMBER != ''
id: target_visibility
env:
GH_TOKEN: ${{ secrets.NOEMA_REVIEW_TOKEN || steps.noema_github_app_token.outputs.token || steps.noema_oidc_token.outputs.token }}
run: |
set -euo pipefail
is_private="$(gh api "repos/${TARGET_REPOSITORY}" --jq '.private')"
case "$is_private" in
true | false) ;;
*)
echo "::error::Noema target repository visibility did not resolve to true or false."
exit 1
;;
esac
echo "is_private=$is_private" >>"$GITHUB_OUTPUT"

- name: Run Noema LLM review and submit verdict
if: env.PR_NUMBER != ''
env:
Expand All @@ -258,6 +275,8 @@ jobs:
NOEMA_LLM_API_URL: ${{ vars.NOEMA_LLM_API_URL || '' }}
NOEMA_LLM_MODEL: ${{ vars.NOEMA_LLM_MODEL || '' }}
NOEMA_LLM_API_KEY: ${{ secrets.NOEMA_LLM_API_KEY || secrets.OPENAI_API_KEY || '' }}
NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
TARGET_REPOSITORY_PRIVATE: ${{ steps.target_visibility.outputs.is_private }}
run: |
set -euo pipefail
if [ -z "${PR_NUMBER:-}" ]; then
Expand All @@ -268,6 +287,11 @@ jobs:
echo "::error::Noema reviewer credential selection succeeded but no token was minted; review cannot submit a verdict."
exit 1
fi
if [ "$TARGET_REPOSITORY_PRIVATE" = "false" ] && [ -n "${NVIDIA_NIM_API_KEY:-}" ] && [ -z "${NOEMA_LLM_API_URL:-}" ] && [ -z "${NOEMA_LLM_MODEL:-}" ]; then
export NOEMA_LLM_API_URL="https://integrate.api.nvidia.com/v1/chat/completions"
export NOEMA_LLM_MODEL="nvidia/nemotron-3-ultra-550b-a55b"
export NOEMA_LLM_API_KEY="${NVIDIA_NIM_API_KEY:-}"
fi
if [ -z "${NOEMA_LLM_API_URL:-}" ] || [ -z "${NOEMA_LLM_MODEL:-}" ] || [ -z "${NOEMA_LLM_API_KEY:-}" ]; then
echo "::error::Noema LLM is unconfigured: NOEMA_LLM_API_URL, NOEMA_LLM_MODEL, and NOEMA_LLM_API_KEY (or OPENAI_API_KEY) are required."
exit 1
Expand Down
17 changes: 12 additions & 5 deletions .github/workflows/opencode-review-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2459,6 +2459,7 @@ jobs:
| select((.name // "") != "Required OpenCode Review")
| select((.name // "") != "OpenCode PR Review")
| select((.name // "") != "metadata-only gate evaluation")
| select((.name // "") != "scan-pr-queue")
| select((.checkSuite.workflowRun.workflow.name // "") != "OpenCode Review")
| select((.checkSuite.workflowRun.workflow.name // "") != "Required OpenCode Review")
| select((.checkSuite.workflowRun.workflow.name // "") != "OpenCode PR Review")
Expand Down Expand Up @@ -4037,6 +4038,7 @@ jobs:
# opencode.jsonc expects env NVIDIA_API_KEY for nvidia-nim/* models.
NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY || secrets.NVIDIA_API_KEY }}
OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
SHARE: "false"
NPM_CONFIG_IGNORE_SCRIPTS: "true"
NO_COLOR: "1"
Expand All @@ -4046,8 +4048,8 @@ jobs:
# may be logged, retained, or used for product/model improvement, so
# private repositories never include them. The pool then falls
# through to
# OpenCode Zen GPT-5.6 Terra, DeepSeek V3, the direct GPT-5.6 Luna
# slot, pinned PAID
# NVIDIA NIM, OpenCode Zen GPT-5.6 Terra, DeepSeek V3, the direct
# GPT-5.6 Luna slot, and pinned PAID
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
# OpenRouter coder models (free-tier candidates hit the shared
# free-models-per-day cap and hung for the full candidate timeout,
# so the OpenRouter slots use cheap paid models billed against the
Expand All @@ -4057,7 +4059,7 @@ jobs:
# cost-efficient tier, cheaper than the legacy gpt-5 it replaced
# ($1/$6 vs $1.25/$10 per 1M tokens) so the org OpenAI budget
# stretches further between top-ups.
OPENCODE_MODEL_CANDIDATES: "${{ needs.validate-pr-metadata.outputs.is_private == 'false' && 'opencode-free/nemotron-3-ultra-free opencode-free/deepseek-v4-flash-free opencode-free/north-mini-code-free opencode-free/laguna-s-2.1-free opencode-free/ling-3.0-flash-free opencode-free/big-pickle opencode-free/mimo-v2.5-free ' || '' }}nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 nvidia-nim/nvidia/llama-3.1-nemotron-ultra-253b-v1 nvidia-nim/nvidia/nemotron-3-super-120b-a12b nvidia-nim/meta/llama-3.3-70b-instruct nvidia-nim/deepseek-ai/deepseek-v4-pro nvidia-nim/mistralai/codestral-22b-instruct-v0.1 opencode/gpt-5.6-terra github-models/deepseek/deepseek-v3-0324 openai/gpt-5.6-luna openrouter/deepseek/deepseek-v3.2 openrouter/qwen/qwen3-coder github-models/openai/gpt-4.1 github-models/openai/gpt-5 github-models/openai/gpt-5-chat github-models/openai/o3 github-models/deepseek/deepseek-r1-0528 github-models/deepseek/deepseek-r1"
OPENCODE_MODEL_CANDIDATES: "${{ needs.validate-pr-metadata.outputs.is_private == 'false' && 'nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 nvidia-nim/nvidia/llama-3.1-nemotron-ultra-253b-v1 nvidia-nim/nvidia/nemotron-3-super-120b-a12b nvidia-nim/nvidia/nemotron-3-ultra-550b-a55b nvidia-nim/meta/llama-3.3-70b-instruct nvidia-nim/deepseek-ai/deepseek-v4-pro nvidia-nim/mistralai/codestral-22b-instruct-v0.1 opencode-free/nemotron-3-ultra-free opencode-free/deepseek-v4-flash-free opencode-free/north-mini-code-free opencode-free/laguna-s-2.1-free opencode-free/ling-3.0-flash-free opencode-free/big-pickle opencode-free/mimo-v2.5-free ' || '' }}opencode/gpt-5.6-terra github-models/deepseek/deepseek-v3-0324 openai/gpt-5.6-luna openrouter/deepseek/deepseek-v3.2 openrouter/qwen/qwen3-coder github-models/openai/gpt-4.1 github-models/openai/gpt-5 github-models/openai/gpt-5-chat github-models/openai/o3 github-models/deepseek/deepseek-r1-0528 github-models/deepseek/deepseek-r1"
Comment thread
coderabbitai[bot] marked this conversation as resolved.
# One attempt per model, then fall through to the next model. Retrying
# the SAME model 5x let a rate-limited/hung leader consume the whole
# step, so the pool never reached a healthy fallback model.
Expand Down Expand Up @@ -4089,6 +4091,8 @@ jobs:
OPENCODE_DYNAMIC_RUN_TIMEOUT_CAP_SECONDS: "5400"
OPENCODE_DYNAMIC_TOTAL_BUDGET_CAP_SECONDS: "11700"
OPENCODE_DYNAMIC_MAX_CYCLES_CAP: "1"
OPENCODE_NVIDIA_NIM_RUN_TIMEOUT_SECONDS: "180"
OPENCODE_NVIDIA_NIM_TOTAL_BUDGET_SECONDS: "900"
OPENCODE_FREE_RUN_TIMEOUT_SECONDS: "3600"
# This installation currently reports a 4k request-body limit for
# GitHub Models GPT-5 endpoints even though the public catalog is
Expand Down Expand Up @@ -4456,7 +4460,7 @@ jobs:
self_check_filter='
def self_check:
(.name // "") as $n
| ["opencode-review", "coverage-evidence", "coverage-source-tree", "required-workflow-bootstrap", "metadata-only gate evaluation"] | index($n);
| ["opencode-review", "coverage-evidence", "coverage-source-tree", "required-workflow-bootstrap", "metadata-only gate evaluation", "scan-pr-queue"] | index($n);
def latest_peer_checks:
[
(.check_runs // [])[]
Expand Down Expand Up @@ -6269,6 +6273,7 @@ jobs:
| select(((.name // "" | ascii_downcase) as $n | ["opencode-review","coverage-evidence","metadata-only gate evaluation"] | index($n)) | not)
| select((.status // "") == "completed")
| select((.conclusion // "" | ascii_upcase) as $c | ["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"] | index($c))
| select((.name // "") != "scan-pr-queue")
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and ((.name // "") | contains("$" + "{{"))) | not)
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and (.name // "") == "noema-review") | not)
| "- " + (if (.name // "") == "strix" then "Strix Security Scan/strix" else ((.name // "check") + " check run") end) + ": " + (.conclusion // "unknown") + (if (.details_url // .html_url // "") != "" then " (" + (.details_url // .html_url) + ")" else "" end)
Expand All @@ -6282,6 +6287,7 @@ jobs:
| map(last)
| .[]?
| select(((.name // "" | ascii_downcase) as $n | ["opencode-review","coverage-evidence","metadata-only gate evaluation"] | index($n)) | not)
| select((.name // "") != "scan-pr-queue")
| select((.status // "") != "completed")
| "- " + (if (.name // "") == "strix" then "Strix Security Scan/strix" else ((.name // "check") + " check run") end) + ": " + (.status // "unknown") + (if (.details_url // .html_url // "") != "" then " (" + (.details_url // .html_url) + ")" else "" end)
'
Expand Down Expand Up @@ -6581,7 +6587,7 @@ jobs:
| select((.conclusion // "" | ascii_upcase) as $c | ["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"] | index($c))
| select((.name // "") != "metadata-only gate evaluation")
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and ((.isRequired // false) | not) and (.workflow // "") == "CodeQL") | not)
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and (.name // "") == "scan-pr-queue" and ((.workflow // "") == "PR Review Merge Scheduler" or (.workflow // "") == "Required PR Review Merge Scheduler")) | not)
| select((.name // "") != "scan-pr-queue")
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and ((.name // "") | contains("$" + "{{"))) | not)
| select(((.conclusion // "" | ascii_downcase) == "cancelled" and (.name // "") == "noema-review" and ((.workflow // "") == "Noema Review" or (.workflow // "") == "Required Noema Review")) | not)
| "- " + (.label // "check") + ": " + (.conclusion // "unknown") + (if (.detailsUrl // "") != "" then " (" + .detailsUrl + ")" else "" end)
Expand Down Expand Up @@ -6713,6 +6719,7 @@ jobs:
| select((.workflow // "") != "Required OpenCode Review")
| select((.workflow // "") != "OpenCode PR Review")
| select((.name // "") != "metadata-only gate evaluation")
| select((.name // "") != "scan-pr-queue")
| select((.status // "") != "COMPLETED")
| "- " + (.label // "check") + ": " + (.status // "unknown") + (if (.detailsUrl // "") != "" then " (" + .detailsUrl + ")" else "" end)
elif .kind == "status" then
Expand Down
Loading
Loading