From 90036353d34792fdf59a87307cab9ea96bcbfa44 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Wed, 2 Sep 2026 10:08:47 -0600 Subject: [PATCH 1/4] feat(ci): add isolated OpenCode GitHub runner --- .github/opencode/AGENTS.md | 27 +++++++++++++++++ .github/opencode/opencode.json | 19 ++++++++++++ .github/workflows/opencode.yml | 53 ++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+) create mode 100644 .github/opencode/AGENTS.md create mode 100644 .github/opencode/opencode.json create mode 100644 .github/workflows/opencode.yml diff --git a/.github/opencode/AGENTS.md b/.github/opencode/AGENTS.md new file mode 100644 index 0000000..b6876cf --- /dev/null +++ b/.github/opencode/AGENTS.md @@ -0,0 +1,27 @@ +# GitHub Actions OpenCode runner instructions + +You are running in an ephemeral GitHub Actions runner with a checkout of the +repository that triggered this workflow. Apply that repository's `AGENTS.md` +and task-relevant documentation before editing files. + +## Runner boundary + +- The production OpenCode server's Kubernetes MCP proxies are intentionally not + configured here. Do not assume cluster, AWS, Argo CD, Grafana, Kubernetes, + or SSH access. +- Treat secrets, tokens, decrypted values, private keys, kubeconfigs, state, + and sensitive plan output as unavailable. Never add them to repository files, + logs, issues, pull requests, or comments. +- Do not deploy, publish, merge, dispatch another workflow, or mutate a live + system. Propose such work for explicit confirmation. +- Make changes only in the checked-out repository. Do not create, push, or + open pull requests manually: `opencode github run` handles branch and pull + request delivery after the session completes. +- The workflow supplies GitHub event context and authentication. Do not claim + that an unavailable GitHub MCP or other MCP integration was used. + +## Validation and reporting + +Use the repository's authoritative CI and guidance. Report only checks and +outcomes actually available from the workflow; distinguish authored changes +from validation, publication, deployment, and functional verification. diff --git a/.github/opencode/opencode.json b/.github/opencode/opencode.json new file mode 100644 index 0000000..b9215e5 --- /dev/null +++ b/.github/opencode/opencode.json @@ -0,0 +1,19 @@ +{ + "$schema": "https://opencode.ai/config.json", + "autoupdate": false, + "model": "kimi-for-coding/k3", + "default_agent": "makeitwork", + "enabled_providers": ["kimi-for-coding"], + "provider": { + "kimi-for-coding": { + "options": { + "apiKey": "{env:KIMI_API_KEY}" + } + } + }, + "mcp": {}, + "permission": { + "question": "deny", + "external_directory": "deny" + } +} diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml new file mode 100644 index 0000000..a8107a5 --- /dev/null +++ b/.github/workflows/opencode.yml @@ -0,0 +1,53 @@ +name: opencode + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + +permissions: + contents: write + pull-requests: write + issues: write + +jobs: + opencode: + if: >- + contains(github.event.comment.body, '/oc') || + contains(github.event.comment.body, '/opencode') + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 1 + persist-credentials: false + + - name: Stage OpenCode runner configuration + env: + CONFIG_DIR: ${{ runner.temp }}/opencode-config + run: | + set -euo pipefail + rm -rf "$CONFIG_DIR" + mkdir -p "$CONFIG_DIR" + cp .github/opencode/opencode.json .github/opencode/AGENTS.md "$CONFIG_DIR"/ + cp -R opencode-server/files/agents opencode-server/files/skills "$CONFIG_DIR"/ + printf 'OPENCODE_CONFIG_DIR=%s\n' "$CONFIG_DIR" >> "$GITHUB_ENV" + + - name: Install pinned OpenCode runtime + run: | + set -euo pipefail + curl -fsSL https://raw.githubusercontent.com/anomalyco/opencode/ef2880f379129aa048be9e9353e30aa168d42c17/install | + bash -s -- --version 1.18.23 --no-modify-path + printf '%s\n' "$HOME/.opencode/bin" >> "$GITHUB_PATH" + + - name: Run OpenCode + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }} + MODEL: kimi-for-coding/k3 + MENTIONS: /opencode,/oc + SHARE: "false" + USE_GITHUB_TOKEN: "true" + run: opencode github run From 3819a776dc683ffae5d65d2a485e2fc0dabd233c Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Wed, 2 Sep 2026 10:35:54 -0600 Subject: [PATCH 2/4] refactor(ci): centralize OpenCode runner --- .github/opencode/AGENTS.md | 27 --------------------------- 1 file changed, 27 deletions(-) delete mode 100644 .github/opencode/AGENTS.md diff --git a/.github/opencode/AGENTS.md b/.github/opencode/AGENTS.md deleted file mode 100644 index b6876cf..0000000 --- a/.github/opencode/AGENTS.md +++ /dev/null @@ -1,27 +0,0 @@ -# GitHub Actions OpenCode runner instructions - -You are running in an ephemeral GitHub Actions runner with a checkout of the -repository that triggered this workflow. Apply that repository's `AGENTS.md` -and task-relevant documentation before editing files. - -## Runner boundary - -- The production OpenCode server's Kubernetes MCP proxies are intentionally not - configured here. Do not assume cluster, AWS, Argo CD, Grafana, Kubernetes, - or SSH access. -- Treat secrets, tokens, decrypted values, private keys, kubeconfigs, state, - and sensitive plan output as unavailable. Never add them to repository files, - logs, issues, pull requests, or comments. -- Do not deploy, publish, merge, dispatch another workflow, or mutate a live - system. Propose such work for explicit confirmation. -- Make changes only in the checked-out repository. Do not create, push, or - open pull requests manually: `opencode github run` handles branch and pull - request delivery after the session completes. -- The workflow supplies GitHub event context and authentication. Do not claim - that an unavailable GitHub MCP or other MCP integration was used. - -## Validation and reporting - -Use the repository's authoritative CI and guidance. Report only checks and -outcomes actually available from the workflow; distinguish authored changes -from validation, publication, deployment, and functional verification. From 268b424343c8d047b588b3f62431df2fffbbbbc0 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Wed, 2 Sep 2026 10:36:03 -0600 Subject: [PATCH 3/4] refactor(ci): centralize OpenCode runner --- .github/opencode/opencode.json | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 .github/opencode/opencode.json diff --git a/.github/opencode/opencode.json b/.github/opencode/opencode.json deleted file mode 100644 index b9215e5..0000000 --- a/.github/opencode/opencode.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "$schema": "https://opencode.ai/config.json", - "autoupdate": false, - "model": "kimi-for-coding/k3", - "default_agent": "makeitwork", - "enabled_providers": ["kimi-for-coding"], - "provider": { - "kimi-for-coding": { - "options": { - "apiKey": "{env:KIMI_API_KEY}" - } - } - }, - "mcp": {}, - "permission": { - "question": "deny", - "external_directory": "deny" - } -} From b303fe66a43cdb5005e02e0923af31ecffb87949 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Wed, 2 Sep 2026 10:36:15 -0600 Subject: [PATCH 4/4] refactor(ci): call shared OpenCode runner --- .github/workflows/opencode.yml | 40 +++++----------------------------- 1 file changed, 5 insertions(+), 35 deletions(-) diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml index a8107a5..3f655a2 100644 --- a/.github/workflows/opencode.yml +++ b/.github/workflows/opencode.yml @@ -16,38 +16,8 @@ jobs: if: >- contains(github.event.comment.body, '/oc') || contains(github.event.comment.body, '/opencode') - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 1 - persist-credentials: false - - - name: Stage OpenCode runner configuration - env: - CONFIG_DIR: ${{ runner.temp }}/opencode-config - run: | - set -euo pipefail - rm -rf "$CONFIG_DIR" - mkdir -p "$CONFIG_DIR" - cp .github/opencode/opencode.json .github/opencode/AGENTS.md "$CONFIG_DIR"/ - cp -R opencode-server/files/agents opencode-server/files/skills "$CONFIG_DIR"/ - printf 'OPENCODE_CONFIG_DIR=%s\n' "$CONFIG_DIR" >> "$GITHUB_ENV" - - - name: Install pinned OpenCode runtime - run: | - set -euo pipefail - curl -fsSL https://raw.githubusercontent.com/anomalyco/opencode/ef2880f379129aa048be9e9353e30aa168d42c17/install | - bash -s -- --version 1.18.23 --no-modify-path - printf '%s\n' "$HOME/.opencode/bin" >> "$GITHUB_PATH" - - - name: Run OpenCode - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }} - MODEL: kimi-for-coding/k3 - MENTIONS: /opencode,/oc - SHARE: "false" - USE_GITHUB_TOKEN: "true" - run: opencode github run + uses: makeitworkcloud/shared-workflows/.github/workflows/opencode.yml@73444d2177762549d8c476dc612f23811e0a2180 + with: + config-source-path: opencode-server/files + secrets: + KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}