From 056cacc921940c4edea9d873d326f662c342cc37 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 09:21:17 +0900 Subject: [PATCH 1/4] fix(opencode): install system llvm tools for cargo-llvm-cov coverage The trusted coverage sandbox image ships cargo-llvm-cov but only apt cargo/rustc without rustup llvm-tools-preview. cargo-llvm-cov then fails with "failed to find llvm-tools-preview" on Rust workspaces (e.g. TEPP), blocking OpenCode approval despite green repository CI. Install the Debian llvm package, symlink llvm-cov/llvm-profdata into PATH, export LLVM_COV/LLVM_PROFDATA, and teach ensure_rust_toolchain to prefer those tools when rustup components are absent. --- .../workflows/opencode-review-dispatch.yml | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index 83f6830d5..f4c183e2c 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -646,6 +646,7 @@ jobs: libcurl4-openssl-dev \ libssl-dev \ libxml2-dev \ + llvm \ mesa-vulkan-drivers \ libvulkan1 \ pkg-config \ @@ -656,7 +657,14 @@ jobs: util-linux \ vulkan-tools \ xz-utils \ - && rm -rf /var/lib/apt/lists/* + && rm -rf /var/lib/apt/lists/* \ + && LLVM_COV_BIN="$(command -v llvm-cov || ls /usr/bin/llvm-cov-* 2>/dev/null | sort -V | tail -n1)" \ + && LLVM_PROFDATA_BIN="$(command -v llvm-profdata || ls /usr/bin/llvm-profdata-* 2>/dev/null | sort -V | tail -n1)" \ + && test -n "$LLVM_COV_BIN" && test -n "$LLVM_PROFDATA_BIN" \ + && ln -sf "$LLVM_COV_BIN" /usr/local/bin/llvm-cov \ + && ln -sf "$LLVM_PROFDATA_BIN" /usr/local/bin/llvm-profdata + ENV LLVM_COV=/usr/local/bin/llvm-cov \ + LLVM_PROFDATA=/usr/local/bin/llvm-profdata RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \ https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \ && echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742 /tmp/node-linux-x64.tar.xz' | sha256sum -c - \ @@ -1709,6 +1717,15 @@ jobs: } ensure_rust_toolchain() { + # Prefer rustup llvm-tools-preview when present; otherwise use system + # llvm-cov/llvm-profdata installed in the trusted coverage image so + # cargo-llvm-cov can measure line coverage without rustup components. + if [ -z "${LLVM_COV:-}" ] && command -v llvm-cov >/dev/null 2>&1; then + export LLVM_COV="$(command -v llvm-cov)" + fi + if [ -z "${LLVM_PROFDATA:-}" ] && command -v llvm-profdata >/dev/null 2>&1; then + export LLVM_PROFDATA="$(command -v llvm-profdata)" + fi if ! command -v cargo >/dev/null 2>&1; then append "### Rust coverage toolchain" append "" From 2247f3ecc6fd0731b9b52a98a61d0d625cd3d0e0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 14:55:27 +0900 Subject: [PATCH 2/4] ci: re-queue OpenCode after hung model-pool cancel Coverage-evidence already green; model-pool job hung 31m+. New head frees concurrency so primary APPROVE can complete for llvm bake (unblocks TEPP#46). From a077375ce12244c1f5b0fcd0701181c71a9bdb8b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 16:53:03 +0900 Subject: [PATCH 3/4] ci: re-queue OpenCode after model-pool hang (25m+) Coverage-evidence green on this head. Cancel hung model pool and re-trigger exact-head review so primary APPROVE can complete (unblocks TEPP#46). From 05790fe637dc572a68180014b76426a39456bb3e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 19 Aug 2026 16:45:14 +0900 Subject: [PATCH 4/4] fix(opencode): verify LLVM coverage tool compatibility --- .github/workflows/opencode-review-dispatch.yml | 6 ++++++ tests/test_opencode_agent_contract.py | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index f4c183e2c..4f2c5740e 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -661,6 +661,12 @@ jobs: && LLVM_COV_BIN="$(command -v llvm-cov || ls /usr/bin/llvm-cov-* 2>/dev/null | sort -V | tail -n1)" \ && LLVM_PROFDATA_BIN="$(command -v llvm-profdata || ls /usr/bin/llvm-profdata-* 2>/dev/null | sort -V | tail -n1)" \ && test -n "$LLVM_COV_BIN" && test -n "$LLVM_PROFDATA_BIN" \ + && RUSTC_LLVM_VERSION="$(rustc -vV | sed -n 's/^LLVM version: //p')" \ + && LLVM_COV_VERSION="$(llvm-cov --version | sed -n 's/^LLVM version //p')" \ + && LLVM_PROFDATA_VERSION="$(llvm-profdata --version | sed -n 's/^LLVM version //p')" \ + && test -n "$RUSTC_LLVM_VERSION" \ + && test "$RUSTC_LLVM_VERSION" = "$LLVM_COV_VERSION" \ + && test "$RUSTC_LLVM_VERSION" = "$LLVM_PROFDATA_VERSION" \ && ln -sf "$LLVM_COV_BIN" /usr/local/bin/llvm-cov \ && ln -sf "$LLVM_PROFDATA_BIN" /usr/local/bin/llvm-profdata ENV LLVM_COV=/usr/local/bin/llvm-cov \ diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index a57adb695..6c00292ca 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -2169,6 +2169,11 @@ def test_opencode_privileged_review_security_boundaries_are_fail_closed(): "967b5cc996c29d8baa52bbb4595ef1f53af35255af8e2036ddbc6468d7b523c7" in coverage_job ) + assert 'rustc -vV | sed -n \'s/^LLVM version: //p\'' in coverage_job + assert 'llvm-cov --version | sed -n \'s/^LLVM version //p\'' in coverage_job + assert 'llvm-profdata --version | sed -n \'s/^LLVM version //p\'' in coverage_job + assert 'test "$RUSTC_LLVM_VERSION" = "$LLVM_COV_VERSION"' in coverage_job + assert 'test "$RUSTC_LLVM_VERSION" = "$LLVM_PROFDATA_VERSION"' in coverage_job assert "sha256sum -c -" in coverage_job assert "install.packages(" not in coverage_job