Skip to content

ci: map OpenCode NIM through NVIDIA_NIM_API_KEY #542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cursor wants to merge 2 commits into from
Closed

ci: map OpenCode NIM through NVIDIA_NIM_API_KEY #542

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5cd0ab8
ci: switch OpenCode from GitHub Models to NVIDIA NIM only
cursoragent Aug 16, 2026
850cde4
ci: map OpenCode NIM through NVIDIA_NIM_API_KEY
cursoragent Aug 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 38 additions & 42 deletions .github/workflows/opencode-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,9 +292,9 @@ jobs:

jq -n --arg workspace "$GITHUB_WORKSPACE" '{
"$schema": "https://opencode.ai/config.json",
"model": "github-models/openai/gpt-5",
"small_model": "github-models/deepseek/deepseek-v3-0324",
"enabled_providers": ["github-models"],
"model": "nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5",
"small_model": "nvidia-nim/meta/llama-3.3-70b-instruct",
"enabled_providers": ["nvidia-nim"],
"mcp": {
"codegraph": {
"type": "local",
Expand Down Expand Up @@ -396,37 +396,37 @@ jobs:
}
},
"provider": {
"github-models": {
"nvidia-nim": {
"npm": "@ai-sdk/openai-compatible",
"name": "GitHub Models",
"name": "NVIDIA NIM",
"options": {
"baseURL": "https://models.github.ai/inference",
"apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"
"baseURL": "https://integrate.api.nvidia.com/v1",
"apiKey": "{env:NVIDIA_API_KEY}"
},
"models": {
"openai/gpt-5": {
"name": "OpenAI GPT-5",
"nvidia/llama-3.3-nemotron-super-49b-v1.5": {
"name": "NVIDIA Llama 3.3 Nemotron Super 49B v1.5",
"tool_call": true,
"reasoning": true,
"limit": {
"context": 200000,
"output": 100000
"context": 131072,
"output": 8192
}
},
"deepseek/deepseek-r1-0528": {
"name": "DeepSeek R1 0528",
"meta/llama-3.3-70b-instruct": {
"name": "Meta Llama 3.3 70B Instruct (NIM)",
"tool_call": true,
"reasoning": true,
"limit": {
"context": 128000,
"output": 4096
"context": 131072,
"output": 8192
}
},
"deepseek/deepseek-v3-0324": {
"name": "DeepSeek V3 0324",
"mistralai/codestral-22b-instruct-v0.1": {
"name": "Codestral 22B Instruct (NIM)",
"tool_call": true,
"limit": {
"context": 128000,
"output": 4096
"context": 32768,
"output": 8192
}
}
}
Expand All @@ -436,14 +436,13 @@ jobs:

printf 'Prepared isolated OpenCode review workspace: %s\n' "$OPENCODE_REVIEW_WORKDIR"

- name: Run OpenCode PR Review (GPT-5)
- name: Run OpenCode PR Review (NVIDIA NIM)
id: opencode_review_primary
timeout-minutes: 60
env:
STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN }}
NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
MODEL: github-models/openai/gpt-5
USE_GITHUB_TOKEN: "true"
MODEL: nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5
SHARE: "false"
NPM_CONFIG_IGNORE_SCRIPTS: "true"
NO_COLOR: "1"
Expand Down Expand Up @@ -543,15 +542,14 @@ jobs:
fi
record_review_status "success"

- name: Run OpenCode PR Review fallback (DeepSeek R1)
- name: Run OpenCode PR Review fallback (Llama 3.3 70B)
id: opencode_review_fallback
if: steps.opencode_review_primary.outputs.review_status != 'success'
timeout-minutes: 60
env:
STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN }}
NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
MODEL: github-models/deepseek/deepseek-r1-0528
USE_GITHUB_TOKEN: "true"
MODEL: nvidia-nim/meta/llama-3.3-70b-instruct
SHARE: "false"
NPM_CONFIG_IGNORE_SCRIPTS: "true"
NO_COLOR: "1"
Expand All @@ -569,7 +567,7 @@ jobs:
}
prompt_file="${RUNNER_TEMP}/opencode-review-prompt.md"
cat >"$prompt_file" <<EOF
GPT-5 failed; review PR #${PR_NUMBER} in ${GITHUB_WORKSPACE} with DeepSeek R1-0528. Be general-purpose and meticulous: use CodeGraph MCP for structural checks, DeepWiki for repo docs, Context7 for current library/API docs, and web_search for bounded external lookups when needed. Inspect changed files and focused hunks directly when MCP evidence is insufficient.
NVIDIA NIM Nemotron Super failed; review PR #${PR_NUMBER} in ${GITHUB_WORKSPACE} with Llama 3.3 70B Instruct. Be general-purpose and meticulous: use CodeGraph MCP for structural checks, DeepWiki for repo docs, Context7 for current library/API docs, and web_search for bounded external lookups when needed. Inspect changed files and focused hunks directly when MCP evidence is insufficient.
Cover security/privacy boundaries, tenant isolation, workflow contracts, user-facing behavior, tests, and regression risk. Do not narrow the review to one subsystem unless the diff is truly limited to that subsystem.
If bounded failed GitHub Check evidence is present, treat it as a blocker until diagnosed. For Strix or other GitHub Checks, use the failed log excerpt and annotations to identify the exact local file line that must change, then provide a concrete from/to fix and suggested diff. When Strix evidence contains multiple model vulnerability reports, include every model-reported vulnerability as a separate evidence-backed finding, preserving each report's model name, title, severity, endpoint, and Code Locations/path:line evidence when present. One Strix model vulnerability report requires one distinct finding; do not combine duplicate titles or matching locations from different models into one finding. Do not request changes with only a check URL, workflow name, or generic failure summary.
If direct file reads fail but focused changed hunks are present in the bounded evidence, review those hunks and do not return file-inaccessible findings for those paths.
Expand Down Expand Up @@ -604,7 +602,7 @@ jobs:
opencode_run_status=$?
set -e
if [ "$opencode_run_status" -ne 0 ]; then
echo "OpenCode DeepSeek R1 review attempt did not complete; next fallback review will run."
echo "OpenCode Llama 3.3 70B review attempt did not complete; next fallback review will run."
record_review_status "failed"
exit 0
fi
Expand Down Expand Up @@ -651,15 +649,14 @@ jobs:
fi
record_review_status "success"

- name: Run OpenCode PR Review fallback (DeepSeek V3)
- name: Run OpenCode PR Review fallback (Codestral)
id: opencode_review_second_fallback
if: steps.opencode_review_primary.outputs.review_status != 'success' && steps.opencode_review_fallback.outputs.review_status != 'success'
timeout-minutes: 60
env:
STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN }}
NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
MODEL: github-models/deepseek/deepseek-v3-0324
USE_GITHUB_TOKEN: "true"
MODEL: nvidia-nim/mistralai/codestral-22b-instruct-v0.1
SHARE: "false"
NPM_CONFIG_IGNORE_SCRIPTS: "true"
NO_COLOR: "1"
Expand All @@ -677,7 +674,7 @@ jobs:
}
prompt_file="${RUNNER_TEMP}/opencode-review-prompt.md"
cat >"$prompt_file" <<EOF
GPT-5 and DeepSeek R1-0528 failed; review PR #${PR_NUMBER} in ${GITHUB_WORKSPACE} with DeepSeek V3-0324. Be general-purpose and meticulous: use CodeGraph MCP for structural checks, DeepWiki for repo docs, Context7 for current library/API docs, and web_search for bounded external lookups when needed. Inspect changed files and focused hunks directly when MCP evidence is insufficient.
NVIDIA NIM Nemotron Super and Llama 3.3 70B failed; review PR #${PR_NUMBER} in ${GITHUB_WORKSPACE} with Codestral. Be general-purpose and meticulous: use CodeGraph MCP for structural checks, DeepWiki for repo docs, Context7 for current library/API docs, and web_search for bounded external lookups when needed. Inspect changed files and focused hunks directly when MCP evidence is insufficient.
Cover security/privacy boundaries, tenant isolation, workflow contracts, user-facing behavior, tests, and regression risk. Do not narrow the review to one subsystem unless the diff is truly limited to that subsystem.
If bounded failed GitHub Check evidence is present, treat it as a blocker until diagnosed. For Strix or other GitHub Checks, use the failed log excerpt and annotations to identify the exact local file line that must change, then provide a concrete from/to fix and suggested diff. When Strix evidence contains multiple model vulnerability reports, include every model-reported vulnerability as a separate evidence-backed finding, preserving each report's model name, title, severity, endpoint, and Code Locations/path:line evidence when present. One Strix model vulnerability report requires one distinct finding; do not combine duplicate titles or matching locations from different models into one finding. Do not request changes with only a check URL, workflow name, or generic failure summary.
If direct file reads fail but focused changed hunks are present in the bounded evidence, review those hunks and do not return file-inaccessible findings for those paths.
Expand Down Expand Up @@ -712,7 +709,7 @@ jobs:
opencode_run_status=$?
set -e
if [ "$opencode_run_status" -ne 0 ]; then
echo "OpenCode DeepSeek V3 review attempt did not complete."
echo "OpenCode Codestral review attempt did not complete."
record_review_status "failed"
exit 0
fi
Expand Down Expand Up @@ -919,14 +916,13 @@ jobs:
env:
GH_TOKEN: ${{ steps.opencode_app_token.outputs.token || secrets.OPENCODE_APPROVE_TOKEN || secrets.GITHUB_TOKEN }}
GH_REPOSITORY: ${{ github.repository }}
STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN }}
NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
OPENCODE_APP_TOKEN: ${{ steps.opencode_app_token.outputs.token }}
OPENCODE_EVIDENCE_FILE: ${{ runner.temp }}/opencode-review-evidence.md
OPENCODE_FAILED_CHECK_EVIDENCE_FILE: ${{ runner.temp }}/opencode-failed-check-evidence.md
OPENCODE_FAILED_CHECK_DIAGNOSIS_FILE: ${{ runner.temp }}/opencode-failed-check-diagnosis.md
OPENCODE_REVIEW_WORKDIR: ${{ runner.temp }}/opencode-review-project
MODEL: github-models/openai/gpt-5
USE_GITHUB_TOKEN: "true"
MODEL: nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5
NPM_CONFIG_IGNORE_SCRIPTS: "true"
NO_COLOR: "1"
PR_NUMBER: ${{ github.event.pull_request.number }}
Expand Down Expand Up @@ -1129,8 +1125,8 @@ jobs:
".github/workflows/strix.yml" \
"scripts/ci/test_strix_quick_gate.sh"
emit_known_missing_string_finding \
"MODEL: github-models/openai/gpt-5" \
"OpenCode review must try GitHub Models GPT-5 first" \
"MODEL: nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5" \
"OpenCode review must try NVIDIA NIM Nemotron Super first" \
".github/workflows/opencode-review.yml" \
"scripts/ci/test_strix_quick_gate.sh"

Expand Down Expand Up @@ -1268,7 +1264,7 @@ jobs:
if [ ! -s "$evidence_file" ] || [ ! -d "$OPENCODE_REVIEW_WORKDIR" ]; then
return 1
fi
if [ -z "${STRIX_GITHUB_MODELS_TOKEN:-}" ]; then
if [ -z "${NVIDIA_API_KEY:-}" ]; then
return 1
fi

Expand Down
9 changes: 9 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,15 @@

## CI / security workflow notes

- OpenCode review uses NVIDIA NIM only. Keep the local client binding
`{env:NVIDIA_API_KEY}` in `opencode.jsonc`. The organization secret is
`NVIDIA_NIM_API_KEY`. CI must map
`NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}` and must not read a
GitHub secret named `NVIDIA_API_KEY`. Do not introduce
`COPILOT_GITHUB_TOKEN` or restore `github-models` on the OpenCode path.
- Strix scan provider policy is independent and still uses GitHub Models /
`STRIX_GITHUB_MODELS_TOKEN`. Do not retarget Strix credentials when
changing OpenCode.
- Keep Strix and companion SCA workflows development-only; do not add runtime dependencies.
- Treat Strix as a repository scan target for this static app, not as
a Kubernetes deployment blocker.
Expand Down
39 changes: 19 additions & 20 deletions opencode.jsonc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
{
"$schema": "https://opencode.ai/config.json",
"model": "github-models/openai/gpt-5",
"small_model": "github-models/deepseek/deepseek-v3-0324",
"enabled_providers": ["github-models"],
"model": "nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5",
"small_model": "nvidia-nim/meta/llama-3.3-70b-instruct",
"enabled_providers": ["nvidia-nim"],
"mcp": {
"codegraph": {
"type": "local",
Expand Down Expand Up @@ -37,38 +37,37 @@
}
},
"provider": {
"github-models": {
"nvidia-nim": {
"npm": "@ai-sdk/openai-compatible",
"name": "GitHub Models",
"name": "NVIDIA NIM",
"options": {
"baseURL": "https://models.github.ai/inference",
"apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"
"baseURL": "https://integrate.api.nvidia.com/v1",
"apiKey": "{env:NVIDIA_API_KEY}"
},
"models": {
"openai/gpt-5": {
"name": "OpenAI GPT-5",
"nvidia/llama-3.3-nemotron-super-49b-v1.5": {
"name": "NVIDIA Llama 3.3 Nemotron Super 49B v1.5",
"tool_call": true,
"reasoning": true,
"limit": {
"context": 200000,
"output": 100000
"context": 131072,
"output": 8192
}
},
"deepseek/deepseek-r1-0528": {
"name": "DeepSeek R1 0528",
"meta/llama-3.3-70b-instruct": {
"name": "Meta Llama 3.3 70B Instruct (NIM)",
"tool_call": true,
"reasoning": true,
"limit": {
"context": 128000,
"output": 4096
"context": 131072,
"output": 8192
}
},
"deepseek/deepseek-v3-0324": {
"name": "DeepSeek V3 0324",
"mistralai/codestral-22b-instruct-v0.1": {
"name": "Codestral 22B Instruct (NIM)",
"tool_call": true,
"limit": {
"context": 128000,
"output": 4096
"context": 32768,
"output": 8192
}
}
}
Expand Down
4 changes: 2 additions & 2 deletions scripts/ci/emit_opencode_failed_check_fallback_findings.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -420,8 +420,8 @@ emit_known_missing_string_finding \
"scripts/ci/test_strix_quick_gate.sh"
emit_known_missing_string_finding \
"$EVIDENCE_FILE" \
"MODEL: github-models/openai/gpt-5" \
"OpenCode review must try GitHub Models GPT-5 first" \
"MODEL: nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5" \
"OpenCode review must try NVIDIA NIM Nemotron Super first" \
".github/workflows/opencode-review.yml" \
"scripts/ci/test_strix_quick_gate.sh"

Expand Down
Loading
Loading