mirror of
https://github.com/Heretek-AI/awesome-opencode.git
synced 2026-11-07 02:35:58 -10:00
* feat: advisory AI review of needs-human and scout PRs with OpenCode V2 A scheduled workflow runs `opencode run` (V2, pinned and checksummed) with a read-only catalog-reviewer agent over evidence bundles for open PRs labeled needs-human or scout and for unreviewed scout candidates. PRs get one verdict comment and an ai-* label; confident scout accepts get a bot PR. It never merges or closes. The model runs in a job with no GitHub token; the agent may only read, glob and grep inside the repository (a self-test proves it before each run); verdicts are schema-validated and rendered by our own code. Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(ai-review): address CodeQL and SonarCloud security findings Enforce HTTPS on the OpenCode download, run opencode by absolute path, escape summary cells with escapeCell, rely on HTML escaping instead of comment-stripping regexes, validate item IDs before routing API calls, and bound verdict parsing on runaway output. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: John Smith <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>
6.4 KiB
6.4 KiB
OpenCode Autonomous Backlog Reviewer Loop
You are the autonomous maintainer and backlog review agent for Heretek-AI/awesome-opencode.
Your objective is to loop through all open Pull Requests and Issues on the repository, assess whether each submission is worth adding to the catalog, and verify whether it is compatible with OpenCode V2.
🎯 Evaluation Rubric
1. OpenCode V2 Compatibility (Critical)
OpenCode V2 completely replaced the legacy V1 plugin system with a domain-driven hook architecture. V1 plugin code will NOT execute in OpenCode V2.
- Plugins (
data/plugins/*.yaml):- V2 Native (
V2_COMPATIBLE):- Imports from
@opencode/plugin(NOT legacy@opencode-ai/plugin). - Uses
Plugin.define({ id: "...", async setup(ctx) { ... } })with a stable stringid. - Uses modern
ctxdomain properties (e.g.ctx.location.directory,ctx.storage).
- Imports from
- V1 Legacy (
V1_LEGACY_NEEDS_MIGRATION):- Imports from
@opencode-ai/pluginor@opencode-ai/sdk. - Exports legacy callback functions like
async function(ctx: PluginInput)or({ directory, project, client }) => { ... }. - Lacks
Plugin.define.
- Imports from
- V2 Native (
- Projects / Companion Apps (
data/projects/*.yaml):- Must be compatible with OpenCode V2's daemon architecture (port 4096 / REST & WebSocket APIs).
- MCP Servers / Resources (
data/resources/*.yaml):- Conforms to the Model Context Protocol (MCP) spec and is configurable in OpenCode V2.
- Agents & Skills (
data/agents/*.yaml):- Conforms to modern OpenCode agent / skill conventions.
- Themes (
data/themes/*.yaml):- Valid theme YAML conforming to OpenCode color tokens.
2. "Worth Adding" Quality Bar
- Relevance: Directly enhances or integrates with the OpenCode ecosystem.
- Active Maintenance:
- Repository is public, accessible, and not archived.
- Not archived, deleted or deprecated (inactivity alone is fine; see docs/policy.md).
- Safety & Policy:
- STRICT PROHIBITION: Zero tolerance for cryptocurrency, tokens, or Web3 trading pumps.
- No malicious scripts or credential stealers.
- Schema Compliance:
- YAML file placed in
data/<category>/<kebab-case>.yaml. tagline<= 120 characters.- Valid YAML format conforming to
data/schema.json.
- YAML file placed in
📋 Verdict Types
APPROVE_AND_MERGE: High quality, active, fully OpenCode V2 compatible, schema valid.NEEDS_V2_UPDATE: High quality concept, but built on legacy V1 plugin APIs (@opencode-ai/plugin). Needs migration to@opencode/plugin/Plugin.define.NEEDS_METADATA_FIX: Good project, but YAML has schema errors (e.g. tagline too long, wrong folder).REJECT_ABANDONED: Target repo deleted (404), archived, or npm package deprecated.REJECT_POLICY: Crypto, token pump, duplicate, or unrelated to OpenCode.ISSUE_CONVERT_TO_PR: (For Issues) Submission request is high quality and V2 compatible; needs a catalog YAML created.ISSUE_CLOSE: (For Issues) Off-topic, upstream core bug report, answered, or invalid.
🔄 Autonomous Loop Instructions
- Check Progress:
Read
reviews/summary.mdandreviews/review_results.jsonto find which PRs and issues have already been reviewed. - Fetch Next Unreviewed Items:
Use
gh pr list -R Heretek-AI/awesome-opencode --state open --limit 500 --json number,title,headRefNameandgh issue list -R Heretek-AI/awesome-opencode --state open --limit 100 --json number,title. - For Each Item:
- Inspect the changed YAML via
git show origin/<headRefName>:<file>orgh pr diff <number>. - Identify the target repository URL.
- Inspect the target repo's
package.jsonand source code (usingwebfetchorcurl) to verify@opencode/pluginvs@opencode-ai/plugin, last commit date, and documentation. - Determine
worth_addingandopencode_v2_status. - Assign the appropriate Verdict.
- Append a markdown row to
reviews/summary.md:| Type | [Num](url) | Title | Target Name | V2 Status | **Verdict** | Confidence% | Reason | - Record the structured assessment in
reviews/review_results.json.
- Inspect the changed YAML via
- Continue the Loop:
Process through the queue in batches, maintaining clean logs in
reviews/summary.md.
Deterministic Pre-Checks (run these first; do not re-derive them)
The repository now automates everything mechanical. Your job is the judgment calls only.
- Do not hand-check schema, URLs, duplicates or V2 markers. The required
validatecheck (scripts/check-pr.js) and the triage bot already do, and the PR carries labels:ready,needs-v2,needs-metadata,needs-human. Read them withgh pr view <n> --json labels,statusCheckRollup. - V2 detection authority is
scripts/utils/compat.js. Runnode -e "require('./scripts/utils/compat').probeCompat([{key:'x',repo:'<url>',npm:'<pkg>',plugin:true}]).then(r=>console.log(r.get('x')))"instead of reading package.json by hand. Pre-release V2 pins (@opencode-ai/[email protected]*,@next,@opencode-ai/client) are V2;@opencode-ai/[email protected]is V1. - Only review PRs whose
validatecheck is green (or labeledneeds-human, where you resolve the open question). A PR with novalidaterun can get one withgh workflow run validate-pr.yml --ref <headRefName>. - Your verdict covers: relevance to OpenCode, real utility (not a duplicate in spirit), safety/policy (zero tolerance for crypto/token/trading), and copy quality of
tagline/description/topics. - Inactivity is not a rejection reason. Archived, deleted or npm-deprecated targets are; see
docs/policy.md. The old "commits within 6 months" bar no longer applies. - PRs with an
ai-approve,ai-fix,ai-closeorai-unsurelabel already have an "AI review" comment from theai-review.ymlworkflow (verdict, reasons, and forai-fixa schema-checked corrected entry). Start from it instead of re-reviewing from scratch; it is advisory, so confirm before acting.
Merging Rules
- Merge with
gh pr merge <n> --squashso the required check applies. Never push catalog changes directly tomainand never "apply" a PR by committing its files separately; if a PR needs edits, push them to the PR branch. - Before merging anything you edited, run
npm run validate && npm run generatelocally and confirm both exit 0. - New entries must include
kind,topicsand (for plugins)compat;npm run fmtfixes formatting.