Harden OpenCode compatibility CI and watcher

2026-07-18 23:07:50 -07:00
parent 84c0d80b76
commit 105550a8b4
19 changed files with 1906 additions and 139 deletions
--- a/.github/workflows/candidate.yml
+++ b/.github/workflows/candidate.yml
@@ -6,65 +6,197 @@ on:
  pull_request:
    branches: [main]
  workflow_dispatch:
-    inputs:
-      opencode_ruby_ref:
-        description: Candidate opencode-ruby ref; blank uses the manifest
-        required: false
-        type: string
+
+permissions:
+  contents: read

 jobs:
  repository:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
        with:
          ruby-version: "3.4"
-      - run: ruby test/repository_test.rb && ruby test/runtime_tuple_promoter_test.rb && ruby test/exact_live_contract_test.rb
+      - run: |
+          ruby test/repository_test.rb
+          ruby test/runtime_tuple_promoter_test.rb
+          ruby test/exact_live_contract_test.rb
+          ruby test/watcher_test.rb
+          ruby test/lockstep_client_contract_test.rb
+          ruby test/matrix_json_test.rb
+          ruby test/image_contract_evidence_test.rb

  prepare:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.matrix.outputs.value }}
-      client_ref: ${{ steps.client.outputs.value }}
+      ruby_ref: ${{ steps.clients.outputs.ruby_ref }}
+      ruby_version: ${{ steps.clients.outputs.ruby_version }}
+      ruby_tag: ${{ steps.clients.outputs.ruby_tag }}
+      ruby_tag_object: ${{ steps.clients.outputs.ruby_tag_object }}
+      rails_ref: ${{ steps.clients.outputs.rails_ref }}
+      rails_version: ${{ steps.clients.outputs.rails_version }}
+      rails_tag: ${{ steps.clients.outputs.rails_tag }}
+      rails_tag_object: ${{ steps.clients.outputs.rails_tag_object }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - id: matrix
        run: echo "value=$(ruby scripts/matrix_json.rb)" >> "$GITHUB_OUTPUT"
-      - id: client
-        env:
-          INPUT_REF: ${{ inputs.opencode_ruby_ref }}
+      - id: clients
        run: |
-          if [ -n "$INPUT_REF" ]; then
-            echo "value=$INPUT_REF" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=$(jq -r .ref manifests/client-candidate.json)" >> "$GITHUB_OUTPUT"
+          ruby_ref="$(jq -r '.clients["opencode-ruby"].ref' manifests/client-candidate.json)"
+          ruby_version="$(jq -r '.clients["opencode-ruby"].version' manifests/client-candidate.json)"
+          ruby_tag="$(jq -r '.clients["opencode-ruby"].tag_provenance.tag' manifests/client-candidate.json)"
+          ruby_tag_object="$(jq -r '.clients["opencode-ruby"].tag_provenance.annotated_tag_object' manifests/client-candidate.json)"
+          rails_ref="$(jq -r '.clients["opencode-rails"].ref' manifests/client-candidate.json)"
+          rails_version="$(jq -r '.clients["opencode-rails"].version' manifests/client-candidate.json)"
+          rails_tag="$(jq -r '.clients["opencode-rails"].tag_provenance.tag' manifests/client-candidate.json)"
+          rails_tag_object="$(jq -r '.clients["opencode-rails"].tag_provenance.annotated_tag_object' manifests/client-candidate.json)"
+          if ! [[ "$ruby_ref" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "opencode-ruby candidate ref must be a full 40-hex commit" >&2
+            exit 2
          fi
+          if ! [[ "$rails_ref" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "opencode-rails candidate ref must be a full 40-hex commit" >&2
+            exit 2
+          fi
+          if ! [[ "$ruby_tag_object" =~ ^[0-9a-f]{40}$ && "$rails_tag_object" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "candidate annotated tag objects must be full 40-hex object IDs" >&2
+            exit 2
+          fi
+          test "$ruby_tag" = "v$ruby_version"
+          test "$rails_tag" = "v$rails_version"
+          test "$ruby_version" = "$rails_version"
+          echo "ruby_ref=$ruby_ref" >> "$GITHUB_OUTPUT"
+          echo "ruby_version=$ruby_version" >> "$GITHUB_OUTPUT"
+          echo "ruby_tag=$ruby_tag" >> "$GITHUB_OUTPUT"
+          echo "ruby_tag_object=$ruby_tag_object" >> "$GITHUB_OUTPUT"
+          echo "rails_ref=$rails_ref" >> "$GITHUB_OUTPUT"
+          echo "rails_version=$rails_version" >> "$GITHUB_OUTPUT"
+          echo "rails_tag=$rails_tag" >> "$GITHUB_OUTPUT"
+          echo "rails_tag_object=$rails_tag_object" >> "$GITHUB_OUTPUT"

  fixture-contract:
    needs: prepare
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ajaynomics/opencode-ruby
-          ref: ${{ needs.prepare.outputs.client_ref }}
-          path: client
-      - uses: ruby/setup-ruby@v1
+          ref: ${{ needs.prepare.outputs.ruby_ref }}
+          path: ruby-client
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
        with:
          ruby-version: "3.4"
          bundler-cache: true
-          working-directory: client
+          working-directory: ruby-client
+      - id: client-sha
+        name: Verify immutable Ruby candidate checkout
+        env:
+          EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
+        run: |
+          actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
+          test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
+          echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
      - name: Candidate unit tests
-        working-directory: client
+        working-directory: ruby-client
        run: bundle exec rake test
      - name: Shared fixture contract
-        working-directory: client
+        working-directory: ruby-client
        env:
-          OPENCODE_RUBY_PATH: ${{ github.workspace }}/client
-          OPENCODE_RUBY_COMMIT: ${{ needs.prepare.outputs.client_ref }}
-        run: bundle exec ruby ../ruby/opencode_ruby_fixture_contract.rb
+          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
+          OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
+          OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/ruby-fixtures.json
+          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
+          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
+          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
+          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
+          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          mkdir -p ../.compat-evidence
+          bundle exec ruby ../ruby/opencode_ruby_fixture_contract.rb
+      - name: Upload fixture evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ruby-fixtures-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .compat-evidence/ruby-fixtures.json
+          include-hidden-files: true
+          if-no-files-found: warn
+          retention-days: 30
+
+  lockstep-client-contract:
+    needs: prepare
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.2", "3.3", "3.4"]
+    name: lockstep clients Ruby ${{ matrix.ruby }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: ajaynomics/opencode-ruby
+          ref: ${{ needs.prepare.outputs.ruby_ref }}
+          path: ruby-client
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: ajaynomics/opencode-rails
+          ref: ${{ needs.prepare.outputs.rails_ref }}
+          path: rails-client
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+          working-directory: rails-client
+      - name: Verify immutable candidate checkouts
+        env:
+          EXPECTED_RUBY_SHA: ${{ needs.prepare.outputs.ruby_ref }}
+          EXPECTED_RAILS_SHA: ${{ needs.prepare.outputs.rails_ref }}
+        run: |
+          test "$(git -C ruby-client rev-parse HEAD)" = "$EXPECTED_RUBY_SHA"
+          test "$(git -C rails-client rev-parse HEAD)" = "$EXPECTED_RAILS_SHA"
+      - name: Rails candidate unit tests
+        working-directory: rails-client
+        run: bundle exec rake test
+      - name: Lockstep client provenance contract
+        working-directory: rails-client
+        env:
+          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
+          OPENCODE_RAILS_PATH: ${{ github.workspace }}/rails-client
+          OPENCODE_RUBY_COMMIT: ${{ needs.prepare.outputs.ruby_ref }}
+          OPENCODE_RUBY_TAG: ${{ needs.prepare.outputs.ruby_tag }}
+          OPENCODE_RUBY_TAG_OBJECT: ${{ needs.prepare.outputs.ruby_tag_object }}
+          OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
+          OPENCODE_RAILS_TAG: ${{ needs.prepare.outputs.rails_tag }}
+          OPENCODE_RAILS_TAG_OBJECT: ${{ needs.prepare.outputs.rails_tag_object }}
+          OPENCODE_RUBY_VERSION: ${{ needs.prepare.outputs.ruby_version }}
+          OPENCODE_RAILS_VERSION: ${{ needs.prepare.outputs.rails_version }}
+          OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/lockstep-ruby-${{ matrix.ruby }}.json
+          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
+          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
+          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
+          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
+          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          mkdir -p ../.compat-evidence
+          bundle exec ruby ../ruby/lockstep_client_contract.rb
+      - name: Upload lockstep evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: lockstep-ruby-${{ matrix.ruby }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .compat-evidence/lockstep-ruby-${{ matrix.ruby }}.json
+          include-hidden-files: true
+          if-no-files-found: warn
+          retention-days: 30

  exact-image-contract:
    needs: prepare
@@ -74,20 +206,56 @@ jobs:
      matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
    name: image ${{ matrix.id }}
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: ajaynomics/opencode-ruby
-          ref: ${{ needs.prepare.outputs.client_ref }}
-          path: client
-      - uses: ruby/setup-ruby@v1
+          ref: ${{ needs.prepare.outputs.ruby_ref }}
+          path: ruby-client
+      - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
        with:
          ruby-version: "3.4"
-          bundler-cache: true
-          working-directory: client
+      - name: Install candidate dependencies outside the checkout
+        working-directory: ruby-client
+        env:
+          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
+          BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
+        run: bundle install --jobs 4 --retry 3
+      - id: client-sha
+        name: Verify immutable Ruby candidate checkout
+        env:
+          EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
+        run: |
+          actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
+          test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
+          echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
      - name: Exercise complete REST and SSE turn
        env:
-          BUNDLE_GEMFILE: ${{ github.workspace }}/client/Gemfile
+          BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile
+          BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
+          BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
          OPENCODE_IMAGE: ${{ matrix.image }}
-          OPENCODE_RUBY_PATH: ${{ github.workspace }}/client
-        run: bundle exec scripts/run_image_contract.sh
+          OPENCODE_EXPECTED_VERSION: ${{ matrix.version }}
+          OPENCODE_MATRIX_ID: ${{ matrix.id }}
+          OPENCODE_REQUIRED_CONSUMER_PROFILES: ${{ toJSON(matrix.required_consumer_profiles) }}
+          OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
+          OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
+          OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
+          OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/${{ matrix.id }}.json
+          OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
+          OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
+          OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
+          OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
+          OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          mkdir -p .compat-evidence
+          bundle exec scripts/run_image_contract.sh
+      - name: Upload exact-image evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: image-${{ matrix.id }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .compat-evidence/${{ matrix.id }}.json
+          include-hidden-files: true
+          if-no-files-found: warn
+          retention-days: 30
--- a/.github/workflows/watch-upstream.yml
+++ b/.github/workflows/watch-upstream.yml
@@ -17,7 +17,7 @@ jobs:
  open-compatibility-pr:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - name: Resolve latest release
@@ -27,55 +27,153 @@ jobs:
        run: |
          release="$(gh api repos/anomalyco/opencode/releases/latest)"
          tag="$(jq -r .tag_name <<<"$release")"
+          digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${tag#v}" --format '{{json .Manifest}}' | jq -r .digest)"
+          image="ghcr.io/anomalyco/opencode@$digest"
+          published_at="$(jq -r .published_at <<<"$release")"
+          release_url="$(jq -r .html_url <<<"$release")"
          current="$(jq -r .release_tag manifests/upstream.json)"
+          current_image="$(jq -r .image manifests/upstream.json)"
+          current_image_count="$(
+            jq \
+              --arg image "$image" \
+              '[.public_ci[]? | select(.image == $image)] | length' \
+              manifests/image-matrix.json
+          )"
+          ruby scripts/upstream_branch_name.rb "$tag" "$digest" >/dev/null
+          ruby -rtime -e 'Time.iso8601(ARGV.fetch(0))' "$published_at"
+          test "$release_url" = "https://github.com/anomalyco/opencode/releases/tag/$tag"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "published_at=$(jq -r .published_at <<<"$release")" >> "$GITHUB_OUTPUT"
-          echo "release_url=$(jq -r .html_url <<<"$release")" >> "$GITHUB_OUTPUT"
-          if [ "$tag" = "$current" ]; then
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+          echo "published_at=$published_at" >> "$GITHUB_OUTPUT"
+          echo "release_url=$release_url" >> "$GITHUB_OUTPUT"
+          if [ "$tag" = "$current" ] && [ "$image" != "$current_image" ]; then
+            echo "same_tag_digest_changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "same_tag_digest_changed=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [ "$tag" = "$current" ] && [ "$image" = "$current_image" ] && [ "$current_image_count" -eq 1 ]; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi
-      - name: Stop when a PR already exists
+      - name: Resolve collision-safe compatibility branch
        if: steps.release.outputs.changed == 'true'
-        id: existing
+        id: branch
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.release.outputs.tag }}
+          DIGEST: ${{ steps.release.outputs.digest }}
        run: |
-          branch="compat/upstream-${TAG#v}"
-          count="$(gh pr list --state open --head "$branch" --json number --jq length)"
-          echo "branch=$branch" >> "$GITHUB_OUTPUT"
-          if [ "$count" -gt 0 ]; then
+          base_branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST")"
+          expected_image="ghcr.io/anomalyco/opencode@$DIGEST"
+          open_branch=""
+          open_prs="$(
+            gh pr list --state open --base main --limit 1000 \
+              --json baseRefName,headRefName,headRefOid,headRepository,headRepositoryOwner,isCrossRepository
+          )"
+          while IFS=$'\t' read -r candidate_branch head_oid; do
+            [ -n "$candidate_branch" ] || continue
+            if ! candidate_upstream="$(
+              gh api \
+                -H "Accept: application/vnd.github.raw+json" \
+                "repos/$GITHUB_REPOSITORY/contents/manifests/upstream.json?ref=$head_oid" 2>/dev/null
+            )"; then
+              continue
+            fi
+            if ! candidate_matrix="$(
+              gh api \
+                -H "Accept: application/vnd.github.raw+json" \
+                "repos/$GITHUB_REPOSITORY/contents/manifests/image-matrix.json?ref=$head_oid" 2>/dev/null
+            )"; then
+              continue
+            fi
+            if jq -e \
+                --arg tag "$TAG" \
+                --arg image "$expected_image" \
+                '.release_tag == $tag and .image == $image' \
+                >/dev/null <<<"$candidate_upstream" &&
+              jq -e \
+                --arg image "$expected_image" \
+                '([.public_ci[]? | select(.image == $image)] | length) == 1' \
+                >/dev/null <<<"$candidate_matrix"; then
+              open_branch="$candidate_branch"
+              break
+            fi
+          done < <(
+            jq -r \
+              --arg base "$base_branch" \
+              --arg owner "${GITHUB_REPOSITORY%%/*}" \
+              --arg repository "${GITHUB_REPOSITORY#*/}" \
+              '.[] | select(
+                .baseRefName == "main" and
+                .isCrossRepository == false and
+                .headRepositoryOwner.login == $owner and
+                .headRepository.name == $repository and
+                (.headRefName == $base or (.headRefName | startswith($base + "-r")))
+              ) | [.headRefName, .headRefOid] | @tsv' \
+              <<<"$open_prs"
+          )
+          if [ -n "$open_branch" ]; then
+            echo "branch=$open_branch" >> "$GITHUB_OUTPUT"
            echo "skip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "skip=false" >> "$GITHUB_OUTPUT"
+            exit 0
          fi
+
+          branch="$base_branch"
+          existing_count="$(
+            gh pr list --state all --base main --head "$base_branch" --limit 1000 \
+              --json baseRefName,headRepository,headRepositoryOwner,isCrossRepository |
+              jq \
+                --arg owner "${GITHUB_REPOSITORY%%/*}" \
+                --arg repository "${GITHUB_REPOSITORY#*/}" \
+                '[.[] | select(
+                  .baseRefName == "main" and
+                  .isCrossRepository == false and
+                  .headRepositoryOwner.login == $owner and
+                  .headRepository.name == $repository
+                )] | length'
+          )"
+          if [ "$existing_count" -gt 0 ] || git ls-remote --exit-code --heads origin "$base_branch" >/dev/null 2>&1; then
+            branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST" "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}")"
+          fi
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
      - name: Resolve immutable image and update manifests
-        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
+        if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
        env:
          TAG: ${{ steps.release.outputs.tag }}
          PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
          RELEASE_URL: ${{ steps.release.outputs.release_url }}
+          DIGEST: ${{ steps.release.outputs.digest }}
        run: |
-          digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${TAG#v}" --format '{{json .Manifest}}' | jq -r .digest)"
-          ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$digest"
+          ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$DIGEST"
          ruby test/repository_test.rb
+          ruby test/watcher_test.rb
      - name: Open compatibility PR
-        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
+        if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.release.outputs.tag }}
-          BRANCH: ${{ steps.existing.outputs.branch }}
+          DIGEST: ${{ steps.release.outputs.digest }}
+          BRANCH: ${{ steps.branch.outputs.branch }}
+          SAME_TAG_DIGEST_CHANGED: ${{ steps.release.outputs.same_tag_digest_changed }}
        run: |
          git config user.name "opencode-compat-bot"
          git config user.email "opencode-compat-bot@users.noreply.github.com"
+          short_digest="${DIGEST#sha256:}"
+          short_digest="${short_digest:0:12}"
          git switch -c "$BRANCH"
          git add manifests/image-matrix.json manifests/upstream.json
-          git commit -m "Test OpenCode ${TAG} compatibility"
+          git commit -m "Test OpenCode ${TAG} compatibility (${short_digest})"
          git push --set-upstream origin "$BRANCH"
+          title="Test OpenCode ${TAG} compatibility (${short_digest})"
+          notice="Upstream watcher resolved ${TAG} to immutable OCI digest ${DIGEST}."
+          if [ "$SAME_TAG_DIGEST_CHANGED" = "true" ]; then
+            title="Review changed OCI digest for existing OpenCode ${TAG} (${short_digest})"
+            notice="Security-sensitive change: existing release ${TAG} now resolves to a different OCI digest, ${DIGEST}."
+          fi
          gh pr create \
            --base main \
            --head "$BRANCH" \
-            --title "Test OpenCode ${TAG} compatibility" \
-            --body "Upstream watcher detected ${TAG}, resolved its immutable OCI digest, and added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."
+            --title "$title" \
+            --body "${notice} The watcher added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."