fix(opencode-review): native OpenAI backend as lead review model (unblock org-wide merge freeze)

[seonghobae]

Org-wide merge freeze

The required opencode-review check is failing 100% of recent runs across all repos. 12+ open PRs (3 repos) are stuck at REVIEW_REQUIRED, and every review run hangs to the 350-minute step timeout. No PR in the org can merge.

Root cause

The embedded OpenCode config in .github/workflows/opencode-review.yml routed every model in the pool through the single github-models provider:

"apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}"   // https://models.github.ai/inference

GitHub Models rate-limits (Too many requests) and caps request bodies at ~4000 tokens (413 tokens_limit_reached). So no model in the candidate pool ever produced a review verdict — the pool churned through every fallback and exhausted the whole step without approving. The gate never opens.

Fix

Give the reviewer a working, un-throttled backend by adding a native OpenAI provider (hits api.openai.com directly using the org OPENAI_API_KEY secret) and making it the lead of the model pool. GitHub Models entries are kept unchanged as fallbacks.

• opencode.jsonc config: added provider.openai — npm: @ai-sdk/openai, baseURL: https://api.openai.com/v1, apiKey: {env:OPENAI_API_KEY}, with gpt-5 and gpt-5-mini (reasoning: true, reasoningEffort: high, matching assert_opencode_reasoning_effort.py). Added "openai" to enabled_providers.
• OPENCODE_MODEL_CANDIDATES: prepended openai/gpt-5 openai/gpt-5-mini as the lead candidates. The pool passes --model explicitly per attempt, so candidate order is the real lead — not the config model default. The full github-models list follows unchanged.
• Secret exposure: added OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} to both env blocks that invoke opencode with this config (the model-pool step and the approve / failed-check-diagnosis step) so {env:OPENAI_API_KEY} resolves.

Why the config model/small_model defaults were left on github-models/deepseek

They are overridden at runtime by the pool's explicit --model, and static self-tests pin those exact strings. Changing them would break tests for zero runtime benefit. The "lead" is controlled entirely by the candidate list, which is what this PR reorders.

Does not weaken the gate

This only changes which backend the reviewer talks to — the review contract, approve gate, agents, and permissions are untouched. If OPENAI_API_KEY is absent or a direct call fails, the pool falls through to the existing github-models candidates exactly as today (at worst one wasted lead attempt before fallback).

Cost implication

PR reviews will now consume the org OpenAI API key (billed to api.openai.com) for the lead gpt-5 / gpt-5-mini attempts on every reviewed PR, instead of the free-but-broken GitHub Models quota. This is the tradeoff that makes reviews actually complete. Reviewers should confirm this billing is acceptable before merge.

Validation

• python3 -c "import yaml; yaml.safe_load(...)" → yaml ok
• Extracted the embedded jq-generated config and ran it through python3 -m json.tool → valid JSON; provider.openai present with correct baseURL/apiKey/models; enabled_providers = [openai, github-models].
• assert_opencode_reasoning_effort.py → all candidates pass (incl. openai/gpt-5, openai/gpt-5-mini).
• No regression to test_strix_quick_gate.sh: every substring it pins that was already passing still passes; the full-order candidate asserts it "fails" on were already failing on the pre-change file (that test is out of sync and is not the merge gate).

Needs review before merge

This gates all org merges. Please verify: (1) the org OPENAI_API_KEY secret is available to this workflow's pull_request_target context, (2) the OpenAI billing cost is acceptable, and (3) gpt-5/gpt-5-mini are the intended model ids for the org's OpenAI account. Do not merge until confirmed.

🤖 Generated with Claude Code