[Enhancement](CI) Auto refresh AI Review credential (#63431)

The OpenAI with OAuth authentication will expire but has the ability to
refresh automatically. Therefore, we ensure the refresh by storing and
accessing credentials through OSS.

.github/workflows/opencode-review-runner.yml

@@ -32,10 +32,10 @@ jobs:
         with:
           ref: ${{ inputs.head_sha }}
 
-      - name: Install ripgrep
+      - name: Install runner utilities
         run: |
           sudo apt-get update
-          sudo apt-get install -y ripgrep
+          sudo apt-get install -y ripgrep unzip
 
       - name: Install OpenCode
         run: |
@@ -50,24 +50,26 @@ jobs:
           echo "All install attempts failed"
           exit 1
 
+      - name: Install ossutil
+        run: |
+          tmp_dir="$(mktemp -d)"
+          trap 'rm -rf "$tmp_dir"' EXIT
+          curl -fsSL -o "$tmp_dir/ossutil.zip" https://gosspublic.alicdn.com/ossutil/1.7.19/ossutil-v1.7.19-linux-amd64.zip
+          unzip -q "$tmp_dir/ossutil.zip" -d "$tmp_dir"
+          sudo install -m 0755 "$tmp_dir/ossutil-v1.7.19-linux-amd64/ossutil" /usr/local/bin/ossutil
+
       - name: Configure OpenCode auth
+        id: configure-auth
+        env:
+          OSS_AK: ${{ secrets.OSS_AK }}
+          OSS_SK: ${{ secrets.OSS_SK }}
+          OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+          OSS_AUTH_OBJECT: oss://doris-community-ci/auth.json
         run: |
           mkdir -p ~/.local/share/opencode
-          cat > ~/.local/share/opencode/auth.json <<EOF
-          {
-            "openai": {
-              "type": "oauth",
-              "access": "${CODE_REVIEW_ZCLLL_OPENAI_ACCESS_KEY}",
-              "refresh": "${CODE_REVIEW_ZCLLL_OPENAI_REFRESH_KEY}",
-              "expires": 1779122093655,
-              "accountId": "${CODE_REVIEW_ZCLLL_OPENAI_ACCOUNT_ID}"
-            }
-          }
-          EOF
-        env:
-          CODE_REVIEW_ZCLLL_OPENAI_ACCESS_KEY: ${{ secrets.CODE_REVIEW_ZCLLL_OPENAI_ACCESS_KEY }}
-          CODE_REVIEW_ZCLLL_OPENAI_REFRESH_KEY: ${{ secrets.CODE_REVIEW_ZCLLL_OPENAI_REFRESH_KEY }}
-          CODE_REVIEW_ZCLLL_OPENAI_ACCOUNT_ID: ${{ secrets.CODE_REVIEW_ZCLLL_OPENAI_ACCOUNT_ID }}
+          ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f "$OSS_AUTH_OBJECT" ~/.local/share/opencode/auth.json
+          chmod 600 ~/.local/share/opencode/auth.json
+          test -s ~/.local/share/opencode/auth.json
 
       - name: Prepare review context directory
         run: |
@@ -209,7 +211,10 @@ jobs:
           status=${PIPESTATUS[0]}
           set -e
 
-          last_log_line=$(awk 'NF { line = $0 } END { print line }' "$REVIEW_CONTEXT_DIR/opencode-review.log")
+          last_log_line=$(
+            awk 'NF { line = $0 } END { print line }' "$REVIEW_CONTEXT_DIR/opencode-review.log" \
+              | perl -pe 's/\e\[[0-9;?]*[ -\/]*[@-~]//g'
+          )
 
           failure_reason=""
           if printf '%s\n' "$last_log_line" | rg -q -i '^Error:|SSE read timed out'; then
@@ -227,6 +232,23 @@ jobs:
             exit 1
           fi
 
+      - name: Persist OpenCode auth
+        if: ${{ always() && steps.configure-auth.outcome == 'success' }}
+        env:
+          OSS_AK: ${{ secrets.OSS_AK }}
+          OSS_SK: ${{ secrets.OSS_SK }}
+          OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
+          OSS_AUTH_OBJECT: oss://doris-community-ci/auth.json
+        run: |
+          if [ ! -s ~/.local/share/opencode/auth.json ]; then
+            echo "::warning::OpenCode auth file is missing or empty; skip OSS auth persistence."
+            exit 0
+          fi
+
+          if ! ossutil -i "$OSS_AK" -k "$OSS_SK" -e "$OSS_ENDPOINT" cp -f ~/.local/share/opencode/auth.json "$OSS_AUTH_OBJECT"; then
+            echo "::warning::Failed to persist OpenCode auth to OSS; continue because review already finished."
+          fi
+
       - name: Comment PR on review failure
         if: ${{ always() && steps.review.outcome != 'success' }}
         env: