* feat: advisory AI review of needs-human and scout PRs with OpenCode V2
A scheduled workflow runs `opencode run` (V2, pinned and checksummed)
with a read-only catalog-reviewer agent over evidence bundles for open
PRs labeled needs-human or scout and for unreviewed scout candidates.
PRs get one verdict comment and an ai-* label; confident scout accepts
get a bot PR. It never merges or closes.
The model runs in a job with no GitHub token; the agent may only read,
glob and grep inside the repository (a self-test proves it before each
run); verdicts are schema-validated and rendered by our own code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* fix(ai-review): address CodeQL and SonarCloud security findings
Enforce HTTPS on the OpenCode download, run opencode by absolute path,
escape summary cells with escapeCell, rely on HTML escaping instead of
comment-stripping regexes, validate item IDs before routing API calls,
and bound verdict parsing on runaway output.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---------
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
Cap Retry-After waits at 20s, lower scout's npm concurrency to 4, and add job timeouts so a rate-limited weekly or nightly run fails visibly instead of running for hours.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
check-pr no longer flags repo URL changes that GitHub redirects (renames/transfers) or that only add a monorepo path, so bot rename PRs stay clean. The scout files packages built on @opencode/plugin as plugins and other @opencode/* consumers (SDK/client tools) as projects.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- health.yml: rolling "Catalog health report" issue; bot PRs that follow renamed repos and remove entries archived/missing/deprecated for 30+ days, and V1-only plugins after the 2027-01-01 sunset. Inactivity alone only changes a badge.
- reprobe.yml: re-checks needs-v2 PRs nightly; unblocks and notifies the original author when the target migrates (filling kind/topics/compat on same-repo branches), closes after 60 days on V1.
- scout.yml: weekly issue ranking npm packages published since V2 that depend on @opencode/* and are not listed yet; ticking a box opens a PR (maintainers only). discovery/declined.txt suppresses candidates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
