GH#4002: Fix OpenCode AI Agent and Review Bot Gate workflows showing action_required on PRs#4012
Conversation
…us on PRs GitHub requires manual approval for workflow runs triggered by bot accounts on pull_request_review and pull_request_review_comment events. When review bots (CodeRabbit, Gemini, etc.) post reviews, both the OpenCode AI Agent and Review Bot Gate workflows fire but get stuck at action_required, creating permanent stale status checks on PRs. Fix: Add job-level 'if' conditions to skip execution when the triggering actor is a known review bot. For the Review Bot Gate, only filter on pull_request_review events (issue_comment from bots works fine and is the primary re-trigger path). For the OpenCode AI Agent, filter all bot actors since bots never post /oc or /opencode trigger commands. Also updates the opencode-github-workflow.yml template with the same fix. Closes #4002
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughAdds actor-based guard conditions to three GitHub Actions workflow files so known review bots are excluded from triggering security-check and review-gate jobs; existing behavior for non-bot actors is preserved. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request resolves a persistent issue where GitHub Actions workflows, specifically the OpenCode AI Agent, would enter an Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Mon Mar 9 20:57:56 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
configs/mcp-templates/opencode-github-workflow.yml (1)
29-33: Consider stricter trigger matching for production deployments.The template uses
contains(github.event.comment.body, '/oc')which could match unintended substrings (e.g.,/doc,/proc). The deployedopencode-agent.ymluses a stricter regex with word boundaries:/(^|\s)\/(oc|opencode)\b/m. This is acceptable for a lightweight template, but users deploying to production should consider adopting the stricter pattern from the main workflow.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@configs/mcp-templates/opencode-github-workflow.yml` around lines 29 - 33, The current trigger uses contains(github.event.comment.body, '/oc') and contains(..., '/opencode') which can match unintended substrings; replace these contains checks with a regex match using matches(github.event.comment.body, '(^|\\s)\\/(oc|opencode)\\b') (or the equivalent stricter pattern used in opencode-agent.yml) so the workflow only triggers on whole-word commands with optional leading whitespace; update the if condition to use matches(...) for both variants to tighten production deployments..github/workflows/review-bot-gate.yml (1)
76-82: Clarify the intentional divergence between if-condition bots and KNOWN_BOTS array.The
KNOWN_BOTSarray excludesgithub-actions[bot]anddependabot[bot]that are in the job-levelifcondition. This appears intentional — these bots are excluded from triggering the workflow but are not code review bots whose reviews we wait for.Consider adding a brief comment to make this distinction explicit for future maintainers:
📝 Suggested clarifying comment
# Known review bot patterns (case-insensitive matching on login) - # Add new bots here as they are configured + # Add new bots here as they are configured. + # NOTE: This list differs from the job-level if-condition which also + # excludes github-actions[bot] and dependabot[bot]. Those bots are + # excluded from triggering this workflow but are NOT code review bots + # whose reviews we wait for. KNOWN_BOTS=( "coderabbitai" "gemini-code-assist[bot]"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/review-bot-gate.yml around lines 76 - 82, Add a short clarifying comment above the KNOWN_BOTS array explaining why it intentionally omits github-actions[bot] and dependabot[bot] (these are filtered at the job-level if-condition to stop workflow triggering, whereas KNOWN_BOTS is used to identify code-review bots whose reviews we wait for); reference KNOWN_BOTS and the job-level if condition in the comment so future maintainers understand the different purposes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@configs/mcp-templates/opencode-github-workflow.yml`:
- Around line 34-38: Update the actor exclusion list to include the two missing
Augment bot variants so the conditional that checks github.actor excludes
'augment-code[bot]' and 'augmentcode[bot]' alongside the existing entries
('coderabbitai', 'gemini-code-assist[bot]', 'copilot[bot]',
'github-actions[bot]', 'dependabot[bot]'); locate the conditional block that
compares github.actor (the lines containing github.actor != ...) and add those
two strings in the same style/format so Augment reviews are treated as bots and
do not trigger action_required.
---
Nitpick comments:
In @.github/workflows/review-bot-gate.yml:
- Around line 76-82: Add a short clarifying comment above the KNOWN_BOTS array
explaining why it intentionally omits github-actions[bot] and dependabot[bot]
(these are filtered at the job-level if-condition to stop workflow triggering,
whereas KNOWN_BOTS is used to identify code-review bots whose reviews we wait
for); reference KNOWN_BOTS and the job-level if condition in the comment so
future maintainers understand the different purposes.
In `@configs/mcp-templates/opencode-github-workflow.yml`:
- Around line 29-33: The current trigger uses
contains(github.event.comment.body, '/oc') and contains(..., '/opencode') which
can match unintended substrings; replace these contains checks with a regex
match using matches(github.event.comment.body, '(^|\\s)\\/(oc|opencode)\\b') (or
the equivalent stricter pattern used in opencode-agent.yml) so the workflow only
triggers on whole-word commands with optional leading whitespace; update the if
condition to use matches(...) for both variants to tighten production
deployments.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a6f5ba0e-a3bc-41d6-8a38-b9d06e9b0b75
📒 Files selected for processing (3)
.github/workflows/opencode-agent.yml.github/workflows/review-bot-gate.ymlconfigs/mcp-templates/opencode-github-workflow.yml
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to fix an issue where workflows get stuck in an action_required state when triggered by bot comments by adding conditions to the opencode job to skip execution for known bot actors. No security vulnerabilities were found. My review includes suggestions to improve the maintainability of the bot filtering logic and to include a bot that was mentioned in the description but was missed in the implementation.
| github.actor != 'coderabbitai' && | ||
| github.actor != 'gemini-code-assist[bot]' && | ||
| github.actor != 'copilot[bot]' && | ||
| github.actor != 'github-actions[bot]' && | ||
| github.actor != 'dependabot[bot]' |
There was a problem hiding this comment.
The PR description mentions filtering out the 'Augment' bot, but it's missing from this list. Its actor name is likely augment-dev[bot].
For better maintainability, you can generalize the bot filter. Most bot actors use the [bot] suffix. You can simplify the condition to catch these, with a special case for coderabbitai. This would also cover augment-dev[bot] and any future bots following the convention.
!endsWith(github.actor, '[bot]') &&
github.actor != 'coderabbitai'
…NOWN_BOTS - Add augment-code[bot] and augmentcode[bot] to opencode-github-workflow.yml template to match the deployed opencode-agent.yml bot exclusion list - Add clarifying comment to review-bot-gate.yml explaining why KNOWN_BOTS array intentionally differs from the job-level if-condition (trigger exclusion vs review-bot identification serve different purposes)
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Mon Mar 9 21:16:48 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
|
@coderabbitai review All CHANGES_REQUESTED items have been addressed in commit b676bc2. The Augment bot variants are now included in the template, and the KNOWN_BOTS clarifying comment has been added. Please re-review. |
|
🧠 Learnings used✅ Actions performedFull review triggered. |
|
Cannot auto-merge: PR modifies .github/workflows/ files but the current token lacks the PR is otherwise ready: CI passing, APPROVED review, 1 unresolved bot suggestion (minor). |
|
Dispatching worker to address CodeRabbit suggestion.
|
2 participants
Summary
ifconditions to skip workflow execution when the triggering actor is a known review bot (CodeRabbit, Gemini Code Assist, Augment, Copilot, GitHub Actions, Dependabot)pull_request_reviewevents from bots (theissue_commentpath from bots works fine and is the primary re-trigger mechanism)opencode-github-workflow.ymltemplate with the same fixProblem
GitHub requires manual approval for workflow runs triggered by bot accounts on
pull_request_reviewandpull_request_review_commentevents. When review bots post reviews, both workflows fire but get stuck ataction_required, creating 87 stale status checks across PRs. This causes the pulse to report PRs as FAIL/PENDING even when the code is mergeable.Root Cause
The
github.actorfor bot-triggered events is the bot account (e.g.,gemini-code-assist[bot]). GitHub's security model requires manual approval for workflow runs from accounts without write access. The workflows had no actor filtering, so every bot review comment triggered a workflow run that immediately got stuck.Verification
issue_commentevents from bots do NOT causeaction_required(confirmed: 0 action_required runs from issue_comment events)pull_request_reviewandpull_request_review_commentevents from bots DO causeaction_required(confirmed: 87 stale runs, all from these event types)issue_commenttrigger path from bots, ensuring the gate still re-evaluates when bots post their reviews as commentsCloses #4002
Summary by CodeRabbit