From fd322b4432fd800c1d9e82d7437880a6c6555d01 Mon Sep 17 00:00:00 2001
From: Seongho Bae <seonghobae@me.com>
Date: Tue, 7 Jul 2026 22:12:25 +0900
Subject: [PATCH] opencode-review: fail fast on hung model pool (350->30 min
 step timeout)

The "Run OpenCode PR Review model pool" step routinely ran to its
multi-hour bound and hard-failed with "timed out after 350 minutes",
never producing a pass/fail judgment and blocking merges org-wide.

Root cause: run_opencode_review_model_pool.sh loops over the model
candidates indefinitely (while :;) and relies solely on this step's
timeout-minutes as its wall-clock bound, because
OPENCODE_TOTAL_RETRY_BUDGET_SECONDS is intentionally 0 (asserted by
scripts/ci/test_strix_quick_gate.sh). When candidate models hang or are
rate-limited, the pool churns until the 350-minute step timeout kills it.

Fix (minimal, in-design): lower the step timeout-minutes from 350 to 30,
tightening the bound the pool already relies on. A healthy lead model
emits a full review well within 30 minutes, so a real APPROVE /
REQUEST_CHANGES decision and the downstream publish/approve security
gates are unchanged; only a pathological hang now fails in minutes
instead of hours. Adjacent comments updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AxU2xaupAjp912oDNFuWyd
---
 .github/workflows/opencode-review.yml | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index b0f38796..8c1cdaaa 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -2335,7 +2335,16 @@ jobs:
       - name: Run OpenCode PR Review model pool
         id: opencode_review_model_pool
         if: needs.coverage-evidence.result == 'success'
-        timeout-minutes: 350
+        # Fail fast on a hung/rate-limited model pool. The pool script
+        # (run_opencode_review_model_pool.sh) loops over the model candidates
+        # indefinitely, relying on THIS step timeout as its only wall-clock
+        # bound (OPENCODE_TOTAL_RETRY_BUDGET_SECONDS is intentionally 0). At 350
+        # the step burned the whole multi-hour job budget and hard-failed with
+        # "timed out after 350 minutes", never producing a pass/fail and
+        # blocking merges org-wide. A healthy lead model emits a full review
+        # well within this window, so 30 min preserves a real review + limited
+        # fallback while capping a pathological hang at minutes, not hours.
+        timeout-minutes: 30
         env:
           STRIX_GITHUB_MODELS_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
           GITHUB_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
@@ -2357,10 +2366,11 @@ jobs:
           # the SAME model 5x let a rate-limited/hung leader consume the whole
           # step, so the pool never reached a healthy fallback model.
           OPENCODE_MODEL_ATTEMPTS: "1"
-          # 90 min per model — generous for a deep tool-using review, but bounded
-          # so a rate-limited model yields to the next one instead of eating the
-          # 350-min step. (20400s = 340min gave one model the entire budget with
-          # no fallback; 600s was too short for a proper review.)
+          # Per-model upper bound for a deep tool-using review. The step's
+          # fail-fast timeout-minutes (30) supersedes this when a model hangs, so
+          # a rate-limited model can no longer eat a multi-hour step budget.
+          # (600s was too short for a proper review; the step cap now provides
+          # the hard wall-clock bound instead of a 340min single-model budget.)
           OPENCODE_RUN_TIMEOUT_SECONDS: "5400"
           OPENCODE_EXPORT_TIMEOUT_SECONDS: "120"
           OPENCODE_TOTAL_RETRY_BUDGET_SECONDS: "0"