Repository navigation
Allow bash for impact-analyzer so it does not hang unattended - #4
Merged
Merged
Conversation
impact-analyzer sets bash "*": "ask". That agent only ever runs
headless, launched by the SDLC Trigger Impact Analyzer job template via
the OpenCode server API, so there is nobody to answer the prompt. On
tenant 8vjv7 the run stopped 86s in on
evaluated permission=bash pattern="echo \"$GITLAB_URL\" \"$GITLAB_PAT\""
action.pattern=* action.action=ask
and never produced a merge request. The AAP job still reported
successful, because it starts the agent asynchronously -- so the whole
chain looks green while nothing happens.
The chart already sets a top-level "permission": "allow" for exactly
this reason, but agent-level permission wins over the global one and
/app/opencode.json is loaded after OPENCODE_CONFIG_CONTENT, so the
chart cannot reach it.
mr-verifier already uses "*": "allow"; this brings impact-analyzer in
line. The explicit gitlab_api.py entries stay as documentation of the
calls the agent is expected to make. Containment stays with the
per-tenant sandbox namespace and RBAC, not with the bash prompt.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
impact-analyzeris configured withbash: { "*": "ask" }, but that agent only ever runs headless — theSDLC Trigger Impact Analyzerjob template starts it through the OpenCode server API and returns immediately. There is nobody to answer the prompt.Reproduced on a live tenant (
8vjv7) today. The remediation chain ran perfectly up to the agent:jackson-databind:2.18.0.rhlw-00010SDLC Start OrchestratorSDLC Query TPAwire-transfer-svcSDLC Trigger Impact Analyzerimpact-analyzerBecause the job template starts the agent asynchronously, AAP reports
successfuland the whole pipeline looks green while nothing happens.Why the chart can't fix it
bootstrap-tenantalready sets a top-level"permission": "allow"viaOPENCODE_CONFIG_CONTENTfor precisely this reason. It has no effect here: agent-level permission overrides the global one, and/app/opencode.jsonis loaded after the env config.Change
One line —
impact-analyzer'sbash."*"fromasktoallow, matchingmr-verifier, which already uses"*": "allow"and does not hang.The explicit
gitlab_api.pyentries are left in place as documentation of the calls the agent is expected to make. Containment for this agent stays where it actually is: the per-tenant sandbox namespace and its RBAC.