From e1e1780cddf9e41bcd6c35d03dfee018989cd7aa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 29 Aug 2026 23:04:44 +0900 Subject: [PATCH 1/2] fix(opencode): remove redundant bootstrap event guard --- .github/workflows/opencode-review.yml | 1 - CHANGELOG.md | 3 +++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index f3e3c2499..d66979d40 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -197,7 +197,6 @@ jobs: fi - name: Enforce Cloudflare Pingora edge policy - if: ${{ github.event_name == 'pull_request_target' }} env: GITHUB_TOKEN: ${{ github.token }} TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.repository }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 3eab104fc..92b25a1fb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,9 @@ this file. The format follows Keep a Changelog, and versioned releases follow Semantic Versioning where the repository publishes a release. ## [Unreleased] +- Keep the required OpenCode bootstrap's Pingora policy step unconditional + within its pull-request-only workflow, so the static bootstrap contract does + not depend on event payload fields. - Skip trusted base Python lock materialization for exact-head reviews with no Python source or dependency-manifest changes, while preserving the fail-closed wheel-only path when Python coverage is relevant. From 67570210e123e1f6e60b84ad26e2af4a85703769 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 29 Aug 2026 23:08:22 +0900 Subject: [PATCH 2/2] test(pingora): align bootstrap contract with static trigger --- tests/test_pingora_edge_workflow_contract.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/test_pingora_edge_workflow_contract.py b/tests/test_pingora_edge_workflow_contract.py index 82a85986a..ad0667cc6 100644 --- a/tests/test_pingora_edge_workflow_contract.py +++ b/tests/test_pingora_edge_workflow_contract.py @@ -40,7 +40,8 @@ def test_required_workflow_enforces_pingora_without_executing_pr_content() -> No assert '[ -L "$trusted_source_dir/$EXPECTED_FILE" ]' in text assert '[ ! -f "$trusted_source_dir/scripts/ci/pingora_edge_policy.py" ]' in text assert '[ -L "$trusted_source_dir/scripts/ci/pingora_edge_policy.py" ]' in text - assert "if: ${{ github.event_name == 'pull_request_target' }}" in text + assert "pull_request_target:" in text + assert "if: ${{ github.event_name == 'pull_request_target' }}" not in text assert text.index("Verify immutable central policy source") < text.index( "Enforce Cloudflare Pingora edge policy" )