🔄 synced file(s) with dianlight/opencode-actions - #11
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🚨 3 · 🛠️ 1
✅ No existing threads resolved.
The || contains(..., 'opencode:awaiting-response') suffix in both new triage workflows (3 occurrences) short-circuits all preceding guard clauses (bot exclusion, author association, state check), allowing any comment — including from bots — to potentially trigger the implementation workflow without human verification.
| ) && | ||
| github.event.comment.body.length > 10 | ||
| ) || | ||
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Bot bypass via unguarded label check
The || at line 27 has lower precedence than &&, so the label check on line 28 bypasses ALL preceding guards (bot exclusion, author association, state check). Any comment on an issue with opencode:awaiting-response triggers the workflow, and if the comment body matches 'approved', 'lgtm', etc., implementation is dispatched without human review.
Fix: Wrap the label check with the same guard clauses.
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') | |
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') && | |
| github.event.issue.state == 'open' && | |
| github.event.comment.user.login != 'github-actions[bot]' && | |
| github.event.comment.user.login != 'opencode-agent[bot]' && | |
| github.event.comment.user.login != 'coderabbitai[bot]' |
| ) && | ||
| github.event.comment.body.length > 10 | ||
| ) || | ||
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Same bypass in triage-pr (review-comment branch)
Identical guard-clause bypass in the pull_request_review_comment branch.
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') | |
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') && | |
| github.event.pull_request.state == 'open' && | |
| github.event.comment.user.login != 'github-actions[bot]' && | |
| github.event.comment.user.login != 'opencode-agent[bot]' && | |
| github.event.comment.user.login != 'coderabbitai[bot]' |
| ) && | ||
| github.event.review.body.length > 10 | ||
| ) || | ||
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Same bypass in triage-pr (review branch)
Identical guard-clause bypass in the pull_request_review branch.
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') | |
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') && | |
| github.event.pull_request.state == 'open' && | |
| github.event.review.user.login != 'github-actions[bot]' && | |
| github.event.review.user.login != 'opencode-agent[bot]' && | |
| github.event.review.user.login != 'coderabbitai[bot]' |
| changed_files=$(git diff --name-only "$base"...HEAD 2>/dev/null || echo "") | ||
| if [ -z "$changed_files" ]; then | ||
| # Fallback: just check if any file changed at all | ||
| changed_files=$(git diff --name-only HEAD~1...HEAD 2>/dev/null || echo "") | ||
| fi |
There was a problem hiding this comment.
🛠️ [QUALITY] Fallback diff logic misses intermediate commits
When git diff --name-only "$base"...HEAD returns empty (edge case — e.g. invalid base SHA), the fallback HEAD~1...HEAD only captures the most recent commit's changes. For multi-commit PRs, intermediate changes are invisible. Since fetch-depth: 0 provides full history, compute the merge base explicitly and avoid the fallback entirely:
| changed_files=$(git diff --name-only "$base"...HEAD 2>/dev/null || echo "") | |
| if [ -z "$changed_files" ]; then | |
| # Fallback: just check if any file changed at all | |
| changed_files=$(git diff --name-only HEAD~1...HEAD 2>/dev/null || echo "") | |
| fi | |
| merge_base=$(git merge-base "$base" HEAD 2>/dev/null) || merge_base="$base" | |
| changed_files=$(git diff --name-only "$merge_base" HEAD 2>/dev/null || echo "") |
|
Review submitted. Verdict: REQUEST_CHANGES — 3 🚨 CRITICAL, 1 🛠️ QUALITY. Most critical finding: All three |
4c9ccd9 to
dd540f3
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds ChangesOpencode automation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Comment
participant auth.sh
participant Workflow
participant Opencode
Comment->>auth.sh: Parse /oc command
auth.sh->>Workflow: Return subcommand and arguments
Workflow->>Opencode: Run selected automation path
Opencode->>Workflow: Return outcome
Workflow->>Comment: Post reaction or result
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dd540f3 to
8ead145
Compare
There was a problem hiding this comment.
🚨 4 · 🛠️ 1
✅ 0 threads resolved — all 4 previously flagged issues remain unaddressed in the current diff. A new 🚨 YAML indentation error is also found in the new opencode-triage-issue.yaml.
Most critical finding: opencode-triage-issue.yaml:12 — debug: at column 0 (same indent as jobs:) makes it a top-level key, not a child of jobs:. This invalid YAML structure will cause a GitHub Actions workflow validation error, preventing the triage job from ever running.
| debug: # ← NUOVO JOB | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Debug auth info | ||
| run: | | ||
| echo "Comment user: ${{ github.event.comment.user.login }}" | ||
| echo "Author association: ${{ github.event.comment.author_association }}" | ||
| echo "Issue state: ${{ github.event.issue.state }}" | ||
| echo "Comment body: ${{ github.event.comment.body }}" | ||
| echo "Trigger contains /oc: $(echo '${{ github.event.comment.body }}' | grep -c '/oc' || echo '0')" | ||
|
|
There was a problem hiding this comment.
🚨 [CRITICAL] debug: job YAML indentation breaks workflow validation
The debug: key is at column 0 (same indent as jobs:), making it a top-level key instead of a child of jobs:. This will cause a GitHub Actions workflow validation error — neither debug nor triage will run.
This is also leftover development scaffolding that should not be in production. Remove it:
| debug: # ← NUOVO JOB | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Debug auth info | |
| run: | | |
| echo "Comment user: ${{ github.event.comment.user.login }}" | |
| echo "Author association: ${{ github.event.comment.author_association }}" | |
| echo "Issue state: ${{ github.event.issue.state }}" | |
| echo "Comment body: ${{ github.event.comment.body }}" | |
| echo "Trigger contains /oc: $(echo '${{ github.event.comment.body }}' | grep -c '/oc' || echo '0')" | |
| ) && | ||
| github.event.comment.body.length > 10 | ||
| ) || | ||
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Bot bypass via unguarded || label check (previously flagged, still open)
|| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') has lower precedence than all preceding && operators, so the label check bypasses ALL guards (bot exclusion, author association, state check). Any comment (including from bots) on an issue with this label triggers the workflow.
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') | |
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') && | |
| github.event.issue.state == 'open' && | |
| github.event.comment.user.login != 'github-actions[bot]' && | |
| github.event.comment.user.login != 'opencode-agent[bot]' && | |
| github.event.comment.user.login != 'coderabbitai[bot]' |
| ) && | ||
| github.event.comment.body.length > 10 | ||
| ) || | ||
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Bot bypass in pull_request_review_comment branch (previously flagged, still open)
Same ||-over-&& precedence issue — the label check on this line bypasses all preceding guard clauses.
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') | |
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') && | |
| github.event.pull_request.state == 'open' && | |
| github.event.comment.user.login != 'github-actions[bot]' && | |
| github.event.comment.user.login != 'opencode-agent[bot]' && | |
| github.event.comment.user.login != 'coderabbitai[bot]' |
| ) && | ||
| github.event.review.body.length > 10 | ||
| ) || | ||
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Bot bypass in pull_request_review branch (previously flagged, still open)
Same ||-over-&& precedence issue for review events.
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') | |
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') && | |
| github.event.pull_request.state == 'open' && | |
| github.event.review.user.login != 'github-actions[bot]' && | |
| github.event.review.user.login != 'opencode-agent[bot]' && | |
| github.event.review.user.login != 'coderabbitai[bot]' |
| run: | | ||
| base="${{ github.event.pull_request.base.sha }}" | ||
| # Get list of changed files against the base | ||
| changed_files=$(git diff --name-only "$base"...HEAD 2>/dev/null || echo "") |
There was a problem hiding this comment.
🛠️ [QUALITY] Fallback diff logic misses intermediate commits (previously flagged, still open)
When git diff --name-only "$base"...HEAD returns empty, the fallback HEAD~1...HEAD only covers the most recent commit. For multi-commit PRs, intermediate changes are invisible. Since fetch-depth: 0 provides full history, compute the merge base explicitly:
| changed_files=$(git diff --name-only "$base"...HEAD 2>/dev/null || echo "") | |
| merge_base=$(git merge-base "$base" HEAD 2>/dev/null) || merge_base="$base" | |
| changed_files=$(git diff --name-only "$merge_base" HEAD 2>/dev/null || echo "") |
|
Review submitted — REQUEST_CHANGES. Step 1: No threads resolved — all 4 previously flagged issues persist in the current diff (3 🚨 bypass in triage-issue.yaml:39, triage-pr.yaml:32, triage-pr.yaml:50; 1 🛠️ fallback in review.yaml:34). Step 2: Submitted with 5 inline comments:
|
There was a problem hiding this comment.
🚨 3 · 🛠️ 2
✅ 0 threads resolved — all previously flagged issues remain unaddressed in the current diff.
Most critical finding: All three || contains(..., 'opencode:awaiting-response') guard-clause bypasses persist (triage-issue.yaml:39, triage-pr.yaml:32, triage-pr.yaml:50). Due to &&-over-|| operator precedence, the label check short-circuits all preceding guards (bot exclusion, author association, state check), allowing any comment — including from bots — to trigger the implementation workflow without human verification.
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| debug: # ← NUOVO JOB |
There was a problem hiding this comment.
🛠️ [QUALITY] Debug job is leftover development scaffolding
The debug job (lines 12–21) prints variable values and serves no purpose in production. It runs on every issue_comment event, consuming CI minutes and cluttering logs. Remove it before shipping.
| debug: # ← NUOVO JOB | |
| triage: |
| ) && | ||
| github.event.comment.body.length > 10 | ||
| ) || | ||
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Guard-clause bypass via || operator precedence (previously flagged, still open)
|| has lower precedence than &&, so || contains(..., 'opencode:awaiting-response') on line 39 is evaluated as an alternative to ALL preceding &&-chained guards (bot exclusion at 25–27, author association at 28, state check at 29). Any commenter — including github-actions[bot], opencode-agent[bot], or coderabbitai[bot] — can bypass all checks simply by commenting on an issue with the opencode:awaiting-response label. If the comment body matches 'approved'/'lgtm', the implementation workflow is dispatched without human review.
Fix: Move the label check inside the guarded parentheses so it is subject to the same bot/author/state filters.
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') | |
| ( | |
| contains(github.event.issue.labels.*.name, 'opencode:awaiting-response') || | |
| ( | |
| ( | |
| contains(github.event.comment.body, ' /oc') || | |
| startsWith(github.event.comment.body, '/oc') || | |
| contains(github.event.comment.body, ' /opencode') || | |
| startsWith(github.event.comment.body, '/opencode') | |
| ) && | |
| github.event.comment.body.length > 10 | |
| ) | |
| ) |
| ) && | ||
| github.event.comment.body.length > 10 | ||
| ) || | ||
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Guard-clause bypass via || in pull_request_review_comment branch (previously flagged, still open)
Same ||-over-&& precedence issue. The label check on line 32 bypasses bot exclusion (lines 18–20), author association (line 21), and state check (line 22).
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') | |
| ( | |
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') || | |
| ( | |
| ( | |
| contains(github.event.comment.body, ' /oc') || | |
| startsWith(github.event.comment.body, '/oc') || | |
| contains(github.event.comment.body, ' /opencode') || | |
| startsWith(github.event.comment.body, '/opencode') | |
| ) && | |
| github.event.comment.body.length > 10 | |
| ) | |
| ) |
| ) && | ||
| github.event.review.body.length > 10 | ||
| ) || | ||
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') |
There was a problem hiding this comment.
🚨 [CRITICAL] Guard-clause bypass via || in pull_request_review branch (previously flagged, still open)
Same ||-over-&& precedence issue. The label check on line 50 bypasses bot exclusion (lines 36–38), author association (line 39), and state check (line 40).
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') | |
| ( | |
| contains(github.event.pull_request.labels.*.name, 'opencode:awaiting-response') || | |
| ( | |
| ( | |
| contains(github.event.review.body, ' /oc') || | |
| startsWith(github.event.review.body, '/oc') || | |
| contains(github.event.review.body, ' /opencode') || | |
| startsWith(github.event.review.body, '/opencode') | |
| ) && | |
| github.event.review.body.length > 10 | |
| ) | |
| ) |
| run: | | ||
| base="${{ github.event.pull_request.base.sha }}" | ||
| # Get list of changed files against the base | ||
| changed_files=$(git diff --name-only "$base"...HEAD 2>/dev/null || echo "") |
There was a problem hiding this comment.
🛠️ [QUALITY] Fallback diff logic misses intermediate commits (previously flagged, still open)
When git diff --name-only "$base"...HEAD returns empty (edge case such as an invalid base SHA), the fallback HEAD~1...HEAD only captures the most recent commit's changes. For multi-commit PRs, intermediate changes are invisible. Since fetch-depth: 0 provides full history, compute the merge base explicitly and avoid the fallback entirely:
| changed_files=$(git diff --name-only "$base"...HEAD 2>/dev/null || echo "") | |
| merge_base=$(git merge-base "$base" HEAD 2>/dev/null) || merge_base="$base" | |
| changed_files=$(git diff --name-only "$merge_base" HEAD 2>/dev/null || echo "") |
|
Review submitted successfully — REQUEST_CHANGES with 5 inline comments:
|
8ead145 to
0e8cd54
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/auth.sh:
- Around line 50-59: Replace the fixed OCAUTH_EOF delimiter in the TASK_ARGS
output block with a cryptographically unpredictable, per-invocation delimiter,
and use that same generated value for both the opening and closing markers.
Preserve the existing empty TASK_ARGS behavior and GitHub output format while
ensuring comment content cannot terminate the heredoc early.
- Line 26: Update the /oc pattern in the TRIMMED matcher to require whitespace
or end-of-line immediately after the token, preventing prefixes such as /october
from matching while preserving valid /oc comments.
In @.github/workflows/opencode-pr-comment.yml:
- Around line 100-102: Update the workflow step containing the PARENT_AUTHOR and
in_reply_to_id lookups so GitHub event fields are passed through step-level env
variables rather than interpolated directly in run commands. Define env values
for the pull request review URL and in_reply_to_id, then reference them as
quoted shell variables in the gh api and related commands.
- Around line 354-397: Update the workflow instructions for
issue_comment-triggered steps to use github.event.issue.number instead of
github.event.pull_request.number when invoking gh pr checkout, gh pr edit, and
gh pr comment; preserve the existing task execution and checklist behavior.
- Around line 119-127: Update the LAST_COMMENT_AUTHOR lookup in the bot-thread
detection block to fetch the latest comments page explicitly before selecting
the comment immediately preceding the trigger. Preserve the existing
previous-author selection and bot comparisons, ensuring threads with more than
30 comments inspect the correct latest-page entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 94d2ca7b-3963-4318-a340-a71efea176f6
📒 Files selected for processing (10)
.github/scripts/auth.sh.github/workflows/opencode-implement.yaml.github/workflows/opencode-issue-handler.yml.github/workflows/opencode-pr-comment.yml.github/workflows/opencode-pr-review.yml.github/workflows/opencode-review.yaml.github/workflows/opencode-triage-issue.yaml.github/workflows/opencode-triage-pr.yaml.github/workflows/opencode-triage.yaml.github/workflows/opencode.yml
| SUBCOMMAND="none" | ||
| TASK_ARGS="" | ||
|
|
||
| if [[ "$TRIMMED" =~ ^/oc ]]; then |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Tighten the /oc matcher.
^/oc also matches prefixes like /october, so those comments can be routed as /oc. Anchor the token to whitespace or end-of-line.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/auth.sh at line 26, Update the /oc pattern in the TRIMMED
matcher to require whitespace or end-of-line immediately after the token,
preventing prefixes such as /october from matching while preserving valid /oc
comments.
| LAST_COMMENT_AUTHOR=$(gh api \ | ||
| "/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments" \ | ||
| --jq '.[-2].user.login' 2>/dev/null || echo "") | ||
|
|
||
| if [[ "$LAST_COMMENT_AUTHOR" == "opencode-agent[bot]" ]] || \ | ||
| [[ "$LAST_COMMENT_AUTHOR" == "github-actions[bot]" ]]; then | ||
| IS_BOT_THREAD="true" | ||
| fi | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced lines
file=".github/workflows/opencode-pr-comment.yml"
wc -l "$file"
sed -n '90,150p' "$file"
# Check for any pagination / per_page handling in this workflow
rg -n --no-heading 'per_page|paginate|issues/.*/comments|LAST_COMMENT_AUTHOR|IS_BOT_THREAD' "$file"
# Gather the relevant gh api / jq behavior from local help if available
gh api --help 2>/dev/null | sed -n '1,220p' || true
gh help api 2>/dev/null | sed -n '1,220p' || trueRepository: dianlight/smartmontools-sdk
Length of output: 18761
🌐 Web query:
GitHub REST API list issue comments default order per_page 30 docs comments endpoint oldest first
💡 Result:
For the GitHub REST API "List issue comments" endpoints, the default behavior regarding pagination and ordering is as follows: Pagination: The default value for the per_page parameter is 30, with a maximum allowed value of 100 per page [1][2]. Ordering: By default, issue comments are ordered by ascending ID [3][4][5]. The API documentation explicitly states this default ordering [3][4], which typically results in the oldest comments appearing first. Some discussions within the community have noted that while ID-based ordering often corresponds to chronological creation order, the API behavior is officially documented as being based on the ID [3][4].
Citations:
- 1: https://docs.github.com/enterprise-server@3.10/rest/issues/comments
- 2: https://docs.github.com/en/rest/issues/comments?apiVersion=2022-11-28
- 3: https://docs.github.com/en/rest/issues/comments?apiVersion=--
- 4: https://docs.github.com/en/enterprise-server@3.17/rest/issues/comments
- 5: https://docs.github.com/en/enterprise-server@3.2/rest/issues/comments
Bot-thread detection only inspects the first comments page .github/workflows/opencode-pr-comment.yml:119-127
/repos/{owner}/{repo}/issues/{n}/comments returns comments oldest-first with 30 per page, so .[-2] reads from page 1 instead of the comment immediately before the trigger. On threads with more than 30 comments, IS_BOT_THREAD can be computed from the wrong comment. Fetch the latest page explicitly before selecting the previous author.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-pr-comment.yml around lines 119 - 127, Update the
LAST_COMMENT_AUTHOR lookup in the bot-thread detection block to fetch the latest
comments page explicitly before selecting the comment immediately preceding the
trigger. Preserve the existing previous-author selection and bot comparisons,
ensuring threads with more than 30 comments inspect the correct latest-page
entry.
0e8cd54 to
01484a8
Compare
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/opencode-issue-handler.yml:
- Around line 64-83: Update the Process 4 job permissions and opencode step:
remove id-token: write from permissions and set use_github_token: true in the
opencode action’s with configuration. Keep the existing read-only contents
permission and issue-writing behavior unchanged.
- Around line 118-124: Remove the manual gh issue comment instructions and
execution steps from the issue-handling workflow, including the corresponding
block around the later response section. Configure the workflow to return the
formatted response to the pinned anomalyco/opencode/github action instead,
relying on that action to create the issue comment once.
In @.github/workflows/opencode-pr-comment.yml:
- Around line 81-89: Add a repository checkout step at the beginning of the
process-2 job’s steps, before any Opencode execution, so the job has a local git
worktree available. Use the workflow’s existing checkout action configuration
and leave the job conditions and permissions unchanged.
- Around line 215-229: Update the process-3 workflow job around the opencode
step to grant contents: write permission and enable persisted checkout
credentials instead of setting persist-credentials to false. Apply the same
contents: write permission to the process-6 job while preserving its existing
checkout authentication configuration, so both jobs can push changes.
- Around line 175-181: Remove the gh api reply instructions and shell code
blocks from the prompt blocks in the workflow, including the ## Output section
shown and all equivalent prompt sections. Have each prompt request and return
only the Markdown reply content directly, without instructing the model to post
via GitHub API or reference github.event.comment.id.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a5c51317-6d71-4180-aa44-6245b6846b8f
📒 Files selected for processing (10)
.github/scripts/auth.sh.github/workflows/opencode-implement.yaml.github/workflows/opencode-issue-handler.yml.github/workflows/opencode-pr-comment.yml.github/workflows/opencode-pr-review.yml.github/workflows/opencode-review.yaml.github/workflows/opencode-triage-issue.yaml.github/workflows/opencode-triage-pr.yaml.github/workflows/opencode-triage.yaml.github/workflows/opencode.yml
🚧 Files skipped from review as they are similar to previous changes (8)
- .github/workflows/opencode-triage-issue.yaml
- .github/workflows/opencode.yml
- .github/workflows/opencode-triage-pr.yaml
- .github/workflows/opencode-triage.yaml
- .github/workflows/opencode-review.yaml
- .github/workflows/opencode-implement.yaml
- .github/scripts/auth.sh
- .github/workflows/opencode-pr-review.yml
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| issues: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Run opencode (Process 4 — Issue Review & Refinement) | ||
| id: opencode | ||
| continue-on-error: true | ||
| uses: anomalyco/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # latest | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} | ||
| OPENCODE_TRIGGER_BODY: ${{ github.event.comment.body }} | ||
| with: | ||
| model: opencode/deepseek-v4-flash-free |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -fsSL \
https://raw.githubusercontent.com/anomalyco/opencode/77fc88c8ade8e5a620ebbe1197f3a572d29ae91a/github/action.yml |
grep -n -A8 'use_github_token'Repository: dianlight/smartmontools-sdk
Length of output: 739
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- workflow ---'
cat -n .github/workflows/opencode-issue-handler.yml | sed -n '55,90p'
echo
echo '--- local references to use_github_token ---'
rg -n "use_github_token|USE_GITHUB_TOKEN|OIDC_BASE_URL|GITHUB_TOKEN" .github/workflows . -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**'Repository: dianlight/smartmontools-sdk
Length of output: 4704
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- opencode-issue-handler around the other use_github_token occurrence ---'
cat -n .github/workflows/opencode-issue-handler.yml | sed -n '188,210p'
echo
echo '--- opencode-pr-review usage ---'
cat -n .github/workflows/opencode-pr-review.yml | sed -n '60,80p'
echo
echo '--- opencode-pr-comment usage ---'
cat -n .github/workflows/opencode-pr-comment.yml | sed -n '138,152p'Repository: dianlight/smartmontools-sdk
Length of output: 3373
Enforce Process 4’s read-only boundary with the job token. use_github_token is still at its default false, so this step uses the OIDC/App-token path instead of the job-scoped GITHUB_TOKEN. Set use_github_token: true here and remove id-token: write.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-issue-handler.yml around lines 64 - 83, Update
the Process 4 job permissions and opencode step: remove id-token: write from
permissions and set use_github_token: true in the opencode action’s with
configuration. Keep the existing read-only contents permission and issue-writing
behavior unchanged.
| process-2: | ||
| if: needs.route.outputs.process == 'process-2' | ||
| needs: route | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| pull-requests: write | ||
| steps: |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '81,145p' .github/workflows/opencode-pr-comment.ymlRepository: dianlight/smartmontools-sdk
Length of output: 2902
Checkout the repository before Process 2. Opencode runs from the local git worktree here, but this job never checks the repo out first, so the step can fail before it processes the prompt.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-pr-comment.yml around lines 81 - 89, Add a
repository checkout step at the beginning of the process-2 job’s steps, before
any Opencode execution, so the job has a local git worktree available. Use the
workflow’s existing checkout action configuration and leave the job conditions
and permissions unchanged.
| ## Output | ||
| Reply to the thread via `gh api`: | ||
| ```bash | ||
| gh api --method POST \ | ||
| /repos/${{ github.repository }}/pulls/comments/${{ github.event.comment.id }}/replies \ | ||
| -f body="Your response here" | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -fsSL \
https://raw.githubusercontent.com/anomalyco/opencode/77fc88c8ade8e5a620ebbe1197f3a572d29ae91a/packages/opencode/src/cli/cmd/github.ts |
grep -n 'createComment'Repository: dianlight/smartmontools-sdk
Length of output: 823
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow outline ==\n'
ast-grep outline .github/workflows/opencode-pr-comment.yml || true
printf '\n== workflow snippets ==\n'
sed -n '150,210p' .github/workflows/opencode-pr-comment.yml
printf '\n---\n'
sed -n '250,290p' .github/workflows/opencode-pr-comment.yml
printf '\n---\n'
sed -n '380,410p' .github/workflows/opencode-pr-comment.yml
printf '\n== github.ts around createComment ==\n'
tmp=$(mktemp)
curl -fsSL \
https://raw.githubusercontent.com/anomalyco/opencode/77fc88c8ade8e5a620ebbe1197f3a572d29ae91a/packages/opencode/src/cli/cmd/github.ts \
-o "$tmp"
sed -n '1280,1335p' "$tmp"
rm -f "$tmp"Repository: dianlight/smartmontools-sdk
Length of output: 7764
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '150,210p' .github/workflows/opencode-pr-comment.yml
printf '\n---\n'
sed -n '250,290p' .github/workflows/opencode-pr-comment.yml
printf '\n---\n'
sed -n '380,410p' .github/workflows/opencode-pr-comment.ymlRepository: dianlight/smartmontools-sdk
Length of output: 5789
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "opencode|final response|createComment|gh api|pulls/comments|issue_comment|review comment" .github/workflows/opencode-pr-comment.ymlRepository: dianlight/smartmontools-sdk
Length of output: 3780
🌐 Web query:
GitHub REST API reply to pull request review comment requires pull request review comment ID issue_comment payload comment.id review comment id
💡 Result:
To reply to a pull request review comment using the GitHub REST API, you should use the dedicated endpoint for pull request review comment replies rather than the generic issue comment endpoint [1][2][3][4]. The correct endpoint is: POST /repos/{owner}/{repo}/pulls/{pull_number}/comments/{comment_id}/replies In this path, the {comment_id} must be the unique identifier of an existing top-level pull request review comment [1][5]. The API does not support replies to replies; you cannot nest replies further than the initial response to a top-level comment [1][2][6]. Key requirements for the request: 1. Path Parameters: You must provide the correct owner, repository name, pull request number, and the ID of the top-level comment you are replying to [5][7]. 2. Body Payload: The request body must include a body field containing the text of your reply [1][6][7]. Example: {"body": "Your reply text here"}. 3. Distinction: Do not confuse this with the "issue comments" API, which manages comments on the pull request as a whole rather than specific review comments within the diff [3][4]. If you are programmatically identifying the comment to reply to, ensure you are referencing the id field of the pull request review comment object, not an issue_comment ID [1][5].
Citations:
- 1: https://docs.github.com/en/rest/pulls/comments
- 2: https://docs.github.com/en/rest/pulls/comments?apiVersion=2022-11-28
- 3: https://docs.github.com/en/rest/guides/working-with-comments?apiVersion=2022-11-28
- 4: https://docs.github.com/en/rest/issues/comments?apiVersion=--
- 5: https://www.withone.ai/knowledge/github/conn_mod_def%3A%3AGJ3Zv5BQNq8%3A%3ANXYCqjI3SIidnrv0RVX8XQ/md
- 6: https://docs.github.com/enterprise-server@3.10/rest/pulls/comments
- 7: https://docs.github.com/enterprise-server@3.7/rest/pulls/comments
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,85p' .github/workflows/opencode-pr-comment.yml
printf '\n---\n'
sed -n '220,310p' .github/workflows/opencode-pr-comment.yml
printf '\n---\n'
sed -n '330,440p' .github/workflows/opencode-pr-comment.ymlRepository: dianlight/smartmontools-sdk
Length of output: 11007
🌐 Web query:
anomalyco/opencode github action posts final response automatically gh api reply prompt
💡 Result:
The anomalyco/opencode GitHub Action is designed to integrate the OpenCode AI agent into your GitHub workflow [1][2]. It does not require you to manually use the GitHub API (gh api) to post responses, as the action handles this process automatically [1][3]. Key features and mechanisms: 1. Automatic Replying: When triggered by events like issue comments or pull request reviews, the OpenCode GitHub Action automatically processes the context (including existing comments) and posts its response as a comment on the corresponding GitHub issue or pull request [1][2][4]. 2. Triggering: You typically configure the action in a workflow file (e.g.,.github/workflows/opencode.yml) [1][4]. It can be configured to trigger on events such as issue_comment, pull_request_review_comment, issues, and pull_request [1][2][5]. 3. No Manual API Calls Needed: The action manages the interaction with the GitHub API internally [1][3]. It uses the provided GITHUB_TOKEN (typically supplied via secrets) to perform operations such as posting comments, creating branches, or opening pull requests [2][4][5]. 4. Advanced Automation: Recent updates have expanded the action's capabilities, allowing it to automatically extract prompts from issue titles, bodies, and labels (for example, on 'assigned' or 'opened' events), further reducing the need for manual prompt configuration or manual API interaction [3]. If you are looking to build a custom solution or need to interact with the GitHub API manually for other purposes, you can use the GitHub CLI (gh api) [6] or the actions/github-script action [7], but for standard OpenCode functionality, the anomalyco/opencode action handles these tasks for you [1][3].
Citations:
- 1: https://frank.dev.opencode.ai/docs/github/
- 2: https://github.com/anomalyco/opencode/tree/dev/github
- 3: feat(github): auto-extract issue prompt on assignment and opened events anomalyco/opencode#19934
- 4: https://github.com/anomalyco/opencode/blob/51e310c9/github/README.md
- 5: https://github.com/anomalyco/opencode/blob/dev/packages/web/src/content/docs/github.mdx
- 6: Can't seem to figure out how to use the `gh api` with POSTing objects cli/cli#3955
- 7: https://github.com/actions/github-script
🏁 Script executed:
#!/bin/bash
set -euo pipefail
tmp=$(mktemp)
curl -fsSL https://raw.githubusercontent.com/anomalyco/opencode/main/README.md -o "$tmp" || curl -fsSL https://raw.githubusercontent.com/anomalyco/opencode/master/README.md -o "$tmp"
printf '\n== README mentions GitHub action/comment behavior ==\n'
rg -n "GitHub Action|comment|reply|final response|post.*response|createComment|gh api" "$tmp" || true
printf '\n== nearby sections ==\n'
sed -n '1,260p' "$tmp" | rg -n -C 3 "GitHub Action|comment|reply|final response|post.*response|createComment|gh api" || true
rm -f "$tmp"Repository: dianlight/smartmontools-sdk
Length of output: 291
Remove the gh api reply instruction from these prompts
The action posts the model output itself, so the prompt should return the Markdown reply directly. github.event.comment.id is also wrong on issue_comment runs, where GitHub expects the top-level review-comment ID for /pulls/comments/{comment_id}/replies. Apply the same change to the other prompt blocks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-pr-comment.yml around lines 175 - 181, Remove the
gh api reply instructions and shell code blocks from the prompt blocks in the
workflow, including the ## Output section shown and all equivalent prompt
sections. Have each prompt request and return only the Markdown reply content
directly, without instructing the model to post via GitHub API or reference
github.event.comment.id.
603e384 to
e25d4f6
Compare
c2a2488 to
7effd20
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (6)
.github/workflows/opencode-pr-comment.yml (6)
90-110: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winTemplate injection persists — unquoted
github.event.comment.*fields expanded directly intorun.This is the exact pattern flagged previously (and reportedly "addressed" in a prior commit), but it's back in this version — likely reintroduced by the upstream sync. zizmor still flags Line 101 as
template-injection; the same risk applies to thein_reply_to_idexpansions on Lines 105-108. Pass these throughenv:and reference as shell variables.Proposed fix
- name: Check if this is a reply to an Opencode thread id: thread-check env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} EVENT_NAME: ${{ github.event_name }} + PR_REVIEW_URL: ${{ github.event.comment.pull_request_review_url }} + IN_REPLY_TO_ID: ${{ github.event.comment.in_reply_to_id }} run: | IS_BOT_THREAD="false" if [[ "$EVENT_NAME" == "pull_request_review_comment" ]]; then PARENT_AUTHOR=$(gh api \ - "${{ github.event.comment.pull_request_review_url }}" \ + "$PR_REVIEW_URL" \ --jq '.user.login' 2>/dev/null || echo "") - if [[ "${{ github.event.comment.in_reply_to_id }}" != "null" ]] && \ - [[ -n "${{ github.event.comment.in_reply_to_id }}" ]]; then + if [[ "$IN_REPLY_TO_ID" != "null" ]] && [[ -n "$IN_REPLY_TO_ID" ]]; then PARENT_AUTHOR=$(gh api \ - "/repos/${{ github.repository }}/pulls/comments/${{ github.event.comment.in_reply_to_id }}" \ + "/repos/${{ github.repository }}/pulls/comments/${IN_REPLY_TO_ID}" \ --jq '.user.login' 2>/dev/null || echo "$PARENT_AUTHOR") fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 90 - 110, Remove direct github.event.comment.* interpolations from the run script in the thread-check step. Expose pull_request_review_url and in_reply_to_id through the step’s env block, then reference the corresponding shell variables in the gh api calls and conditional checks while preserving the existing fallback behavior.Source: Linters/SAST tools
175-181: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDrop the
gh apireply instructions from the Process 2/3 prompts.The
anomalyco/opencode/githubaction posts the model's output as the reply itself; instructing it to callgh api .../pulls/comments/${{ github.event.comment.id }}/repliesis redundant and wrong forissue_comment-sourced runs into Process 2 (top-level comment IDs aren't valid review-comment IDs for that endpoint). Same issue flagged previously on both blocks, still present.Proposed fix
## Output - Reply to the thread via `gh api`: - ```bash - gh api --method POST \ - /repos/${{ github.repository }}/pulls/comments/${{ github.event.comment.id }}/replies \ - -f body="Your response here" - ``` + Return your reply as Markdown directly — the action posts it to the thread automatically.Apply the equivalent change to the Process 3 block (Lines 268-274).
Also applies to: 268-274
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 175 - 181, Remove the `gh api` reply instructions from both the Process 2 and Process 3 prompt blocks in the workflow. Replace each output section with guidance to return the response as Markdown directly, relying on the `anomalyco/opencode/github` action to post it automatically; do not reference the pull-request comment reply endpoint or comment ID.
215-224: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winProcess 3 & 6 can't push —
contents: readplususe_github_token: true, and Process 3 also drops persisted checkout creds.Both jobs set
use_github_token: true(Lines 236, 341), which per Opencode's docs skips its own git-credential setup and relies on the job'sGITHUB_TOKEN. Withcontents: read(Lines 217, 310) that token can't push, and Process 3 additionally setspersist-credentials: false(Line 223), removing the only other credential source. Still unresolved from the prior review.Proposed fix
process-3: ... permissions: id-token: write - contents: read + contents: write pull-requests: write steps: - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: - persist-credentials: false + persist-credentials: true fetch-depth: 0process-6: ... permissions: id-token: write - contents: read + contents: write pull-requests: writeNote: keeping
persist-credentialsat its implicit defaulttrueon Process 6's checkout (Lines 313-316) also triggers zizmor'sartipackedwarning; that's an accepted trade-off here since a git credential is required to push, but worth a comment noting it's intentional.Also applies to: 304-316
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 215 - 224, Update the Process 3 and Process 6 workflow jobs to grant contents: write because their use_github_token configuration requires GITHUB_TOKEN push access. In Process 3, remove persist-credentials: false so checkout retains credentials; keep Process 6’s implicit persisted credentials and add a comment documenting that this is intentional for pushing despite the zizmor warning.Source: Linters/SAST tools
352-397: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winProcess 6 uses
github.event.pull_request.number, which is empty onissue_commentevents.Process 6 is only reachable via the
issue_commentroute (Lines 66-69), whose payload has nopull_requestobject — onlyissue.number.gh pr checkout,gh pr edit, andgh pr commentwill all run with a blank PR number. Same critical finding as the prior review, still present.Proposed fix
## Context - Repository: ${{ github.repository }} - - Pull request: #${{ github.event.pull_request.number }} + - Pull request: #${{ github.event.issue.number }} - Task arguments from the user: env var `OPENCODE_TASK_ARGS` ... ### 2. Checkout the PR branch ```bash - gh pr checkout ${{ github.event.pull_request.number }} + gh pr checkout ${{ github.event.issue.number }} ``` ... ```bash - gh pr edit ${{ github.event.pull_request.number }} \ + gh pr edit ${{ github.event.issue.number }} \ --body "<updated PR body with checked checkbox>" ``` ### 6. Post summary comment ```bash - gh pr comment ${{ github.event.pull_request.number }} \ + gh pr comment ${{ github.event.issue.number }} \ --body "✅ Task completed: <description>\nCommit: <sha>" ```🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 352 - 397, Update the issue_comment workflow instructions in the Workflow steps to use github.event.issue.number instead of github.event.pull_request.number for gh pr checkout, gh pr edit, and gh pr comment, so all operations target the pull request associated with the issue_comment event.
116-127: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winBot-thread detection still only inspects the first comments page.
/repos/{owner}/{repo}/issues/{n}/commentsreturns comments oldest-first, 30 per page by default;.[-2]reads page 1, not the comment immediately preceding the trigger. On threads with >30 comments,IS_BOT_THREADis computed from the wrong comment, silently skipping Process 2 for legitimate bot-thread replies. Unresolved from the prior review.Proposed fix
- LAST_COMMENT_AUTHOR=$(gh api \ - "/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments" \ - --jq '.[-2].user.login' 2>/dev/null || echo "") + LAST_COMMENT_AUTHOR=$(gh api --paginate \ + "/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments" \ + --jq '.[].user.login' 2>/dev/null | tail -n 2 | head -n 1 || echo "")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 116 - 127, Update the issue_comment branch’s LAST_COMMENT_AUTHOR lookup to retrieve the full/latest comments page or otherwise identify the comment immediately preceding the triggering comment, rather than assuming page 1 contains it. Preserve the existing bot-author checks for opencode-agent[bot] and github-actions[bot] so IS_BOT_THREAD reflects the actual preceding comment even when the thread exceeds 30 comments.
81-90: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winProcess 2 still has no checkout step.
Opencode operates on a local git worktree (see Process 3/6, which both checkout before invoking
anomalyco/opencode/github), but Process 2 goes straight from job setup to the thread-check step with noactions/checkout. Any fix/commit path in this prompt (Lines 156-158, 170-172) will fail before it starts. Also unaddressed from the prior review.Proposed fix
steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: true + fetch-depth: 0 + - name: Check if this is a reply to an Opencode thread🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 81 - 90, Add an actions/checkout step at the start of process-2, before “Check if this is a reply to an Opencode thread” and any Opencode invocation, so the job has a local git worktree for fix and commit operations. Match the checkout configuration already used by Process 3/6.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/opencode-issue-handler.yml:
- Around line 177-204: Remove the unused id-token: write entry from the
permissions block for the “Run opencode (Process 5 — Issue Work & PR Creation)”
job, while preserving the contents, pull-requests, and issues permissions
required by the workflow.
In @.github/workflows/opencode-pr-comment.yml:
- Around line 66-77: Avoid duplicate handling of /oc review issue comments in
the issue_comment routing logic: update the branch around SUBCOMMAND and PROCESS
in the workflow so review subcommands are excluded or otherwise prevented from
reaching this workflow, while preserving existing handling for task, bare /oc,
and non-/oc comments.
- Around line 85-88: Add issues: write to the permissions for the process-2 and
process-6 jobs in the workflow. Keep the existing id-token, contents, and
pull-requests permissions unchanged so their reaction fallback can write
reactions to top-level PR comments.
---
Duplicate comments:
In @.github/workflows/opencode-pr-comment.yml:
- Around line 90-110: Remove direct github.event.comment.* interpolations from
the run script in the thread-check step. Expose pull_request_review_url and
in_reply_to_id through the step’s env block, then reference the corresponding
shell variables in the gh api calls and conditional checks while preserving the
existing fallback behavior.
- Around line 175-181: Remove the `gh api` reply instructions from both the
Process 2 and Process 3 prompt blocks in the workflow. Replace each output
section with guidance to return the response as Markdown directly, relying on
the `anomalyco/opencode/github` action to post it automatically; do not
reference the pull-request comment reply endpoint or comment ID.
- Around line 215-224: Update the Process 3 and Process 6 workflow jobs to grant
contents: write because their use_github_token configuration requires
GITHUB_TOKEN push access. In Process 3, remove persist-credentials: false so
checkout retains credentials; keep Process 6’s implicit persisted credentials
and add a comment documenting that this is intentional for pushing despite the
zizmor warning.
- Around line 352-397: Update the issue_comment workflow instructions in the
Workflow steps to use github.event.issue.number instead of
github.event.pull_request.number for gh pr checkout, gh pr edit, and gh pr
comment, so all operations target the pull request associated with the
issue_comment event.
- Around line 116-127: Update the issue_comment branch’s LAST_COMMENT_AUTHOR
lookup to retrieve the full/latest comments page or otherwise identify the
comment immediately preceding the triggering comment, rather than assuming page
1 contains it. Preserve the existing bot-author checks for opencode-agent[bot]
and github-actions[bot] so IS_BOT_THREAD reflects the actual preceding comment
even when the thread exceeds 30 comments.
- Around line 81-90: Add an actions/checkout step at the start of process-2,
before “Check if this is a reply to an Opencode thread” and any Opencode
invocation, so the job has a local git worktree for fix and commit operations.
Match the checkout configuration already used by Process 3/6.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b359bda9-7026-4391-94eb-6343b77411c2
📒 Files selected for processing (10)
.github/scripts/auth.sh.github/workflows/opencode-implement.yaml.github/workflows/opencode-issue-handler.yml.github/workflows/opencode-pr-comment.yml.github/workflows/opencode-pr-review.yml.github/workflows/opencode-review.yaml.github/workflows/opencode-triage-issue.yaml.github/workflows/opencode-triage-pr.yaml.github/workflows/opencode-triage.yaml.github/workflows/opencode.yml
🚧 Files skipped from review as they are similar to previous changes (8)
- .github/workflows/opencode.yml
- .github/workflows/opencode-triage-issue.yaml
- .github/workflows/opencode-triage-pr.yaml
- .github/workflows/opencode-triage.yaml
- .github/workflows/opencode-review.yaml
- .github/workflows/opencode-implement.yaml
- .github/scripts/auth.sh
- .github/workflows/opencode-pr-review.yml
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| pull-requests: write | ||
| issues: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
|
|
||
| - name: Configure git identity | ||
| run: | | ||
| git config --global user.name "github-actions[bot]" | ||
| git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" | ||
|
|
||
| - name: Run opencode (Process 5 — Issue Work & PR Creation) | ||
| id: opencode | ||
| continue-on-error: true | ||
| uses: anomalyco/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # latest | ||
| env: | ||
| OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| OPENCODE_TRIGGER_BODY: ${{ github.event.comment.body }} | ||
| OPENCODE_IMPLEMENT_ARGS: ${{ needs.route.outputs.task_args }} | ||
| ISSUE_TITLE: ${{ github.event.issue.title }} | ||
| ISSUE_NUMBER: ${{ github.event.issue.number }} | ||
| with: | ||
| model: opencode/deepseek-v4-flash-free | ||
| use_github_token: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the relevant workflow section with line numbers
sed -n '160,220p' .github/workflows/opencode-issue-handler.yml | cat -n
# Locate any direct references to id-token or use_github_token in the repo
rg -n "id-token: write|use_github_token|OPENCODE_API_KEY|GITHUB_TOKEN|anomalyco/opencode/github" .github/workflows .github -S
# Check whether the repo vendors any documentation or scripts that explain the action behavior
git ls-files | rg '(^|/)(README|CHANGELOG|docs?)/|opencode|github\.ya?ml$' -nRepository: dianlight/smartmontools-sdk
Length of output: 13227
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the full process-5 job and nearby jobs for context
sed -n '160,260p' .github/workflows/opencode-issue-handler.yml | cat -n
# Show any job-level uses of id-token in this workflow to compare patterns
rg -n "id-token: write|use_github_token: true|uses: anomalyco/opencode/github" .github/workflows/opencode-issue-handler.yml -n -A4 -B4
# Look for any workflow steps in process-5 that invoke cloud/OIDC-related tools
rg -n "aws-actions|azure/login|google-github-actions|oidc|id-token|assume-role|workload identity|jwt" .github/workflows/opencode-issue-handler.yml -SRepository: dianlight/smartmontools-sdk
Length of output: 6666
Remove the unused id-token permission.
process-5 only uses GITHUB_TOKEN via use_github_token: true, so id-token: write just broadens the job’s privileges without a matching need.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 183-184: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-issue-handler.yml around lines 177 - 204, Remove
the unused id-token: write entry from the permissions block for the “Run
opencode (Process 5 — Issue Work & PR Creation)” job, while preserving the
contents, pull-requests, and issues permissions required by the workflow.
| elif [[ "$EVENT_NAME" == "issue_comment" ]]; then | ||
| # Top-level PR comment | ||
| if [[ "$SUBCOMMAND" == "task" ]]; then | ||
| PROCESS="process-6" | ||
| elif [[ "$IS_OC" == "true" ]]; then | ||
| # Bare /oc on PR without subcommand — Process 2 if in bot thread | ||
| PROCESS="process-2" | ||
| else | ||
| # Non-/oc comment — only Process 2 if replying to bot thread | ||
| PROCESS="process-2" | ||
| fi | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
fd -e yml -e yaml . .github/workflows | xargs rg -n "issue_comment|SUBCOMMAND|review" 2>/dev/null
cat .github/workflows/opencode-pr-review.yml 2>/dev/null | head -80Repository: dianlight/smartmontools-sdk
Length of output: 7102
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- opencode-pr-comment.yml (relevant sections) ---'
sed -n '1,220p' .github/workflows/opencode-pr-comment.yml
echo
echo '--- opencode-pr-review.yml (job gate and parse section) ---'
sed -n '1,140p' .github/workflows/opencode-pr-review.yml
echo
echo '--- auth.sh ---'
sed -n '1,220p' .github/scripts/auth.shRepository: dianlight/smartmontools-sdk
Length of output: 15704
🏁 Script executed:
#!/bin/bash
set -euo pipefail
nl -ba .github/workflows/opencode-pr-comment.yml | sed -n '1,220p'
echo
nl -ba .github/workflows/opencode-pr-review.yml | sed -n '1,120p'
echo
nl -ba .github/scripts/auth.sh | sed -n '1,220p'Repository: dianlight/smartmontools-sdk
Length of output: 205
Avoid double-processing /oc review comments. Both opencode-pr-review.yml and .github/workflows/opencode-pr-comment.yml:66-77 handle issue_comment /oc review events, so the same comment can run twice. Exclude /oc review here or narrow the review workflow trigger.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-pr-comment.yml around lines 66 - 77, Avoid
duplicate handling of /oc review issue comments in the issue_comment routing
logic: update the branch around SUBCOMMAND and PROCESS in the workflow so review
subcommands are excluded or otherwise prevented from reaching this workflow,
while preserving existing handling for task, bare /oc, and non-/oc comments.
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| pull-requests: write |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the workflow file and inspect the relevant region.
wc -l .github/workflows/opencode-pr-comment.yml
sed -n '1,220p' .github/workflows/opencode-pr-comment.yml
# Find the job names and any reaction-related calls.
rg -n "process-2|process-6|reactions|issue_comment|pull_request|permissions" .github/workflows/opencode-pr-comment.ymlRepository: dianlight/smartmontools-sdk
Length of output: 11755
🌐 Web query:
GitHub REST API reactions endpoint permissions issues comments pull request review comments
💡 Result:
The GitHub REST API provides dedicated endpoints to manage reactions on pull request review comments [1][2]. These endpoints allow you to list, create, and delete reactions [1][3]. Endpoints for Pull Request Review Comment Reactions: List reactions: GET /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions [1][2] Create a reaction: POST /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions [1][2] Delete a reaction: DELETE /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions/{reaction_id} [1] Permissions and Troubleshooting: Access to these endpoints depends on the repository's visibility and the authentication method used (e.g., Personal Access Tokens or GitHub Apps) [4][5]. If you encounter permission issues when interacting with these endpoints, you can determine the exact required permissions by checking the X-Accepted-GitHub-Permissions header in the API response [4][6]. This header is returned by the GitHub API to indicate which permissions are necessary for a given request, serving as an authoritative guide for troubleshooting authorization errors [4][5]. For private repositories, appropriate repository-level permissions (typically read for listing and write for creating/deleting) are generally required [4][5]. Always verify that your token or app has the necessary scope to interact with the specific repository [4][5].
Citations:
- 1: https://docs.github.com/en/rest/reactions/reactions
- 2: https://docs.github.com/en/enterprise-server@3.20/rest/reactions/reactions
- 3: https://github.apidog.io/api-3489481
- 4: https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2026-03-10
- 5: https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps
- 6: https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow context around the referenced jobs and any reaction handling.
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/opencode-pr-comment.yml')
text = p.read_text()
lines = text.splitlines()
for start in [1, 70, 280, 300]:
end = min(len(lines), start + 40)
print(f"\n--- lines {start}-{end} ---")
for i in range(start-1, end):
print(f"{i+1:4d}: {lines[i]}")
PY
# Locate comments/reactions usage in the workflow.
rg -n "issues/comments/.*/reactions|pulls/comments/.*/reactions|issue_comment|process-2|process-6|permissions:" .github/workflows/opencode-pr-comment.ymlRepository: dianlight/smartmontools-sdk
Length of output: 9015
🌐 Web query:
GitHub REST API create reaction issue comment requires issues write fine-grained token pull request review comment requires pull-requests write
💡 Result:
When using fine-grained personal access tokens (PATs) with the GitHub REST API, the required permissions for creating reactions can be nuanced. For creating a reaction to an issue comment (POST /repos/{owner}/{repo}/issues/comments/{comment_id}/reactions), the official documentation and API references indicate that the Issues repository permission (write) is required [1][2]. However, some users have reported that the Pull requests repository permission (write) also functions for this endpoint [1]. For creating a reaction to a pull request review comment (POST /repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions), while the endpoint is often categorized under Pull requests, users have reported issues where standard write permissions do not always behave as documented, leading to "Insufficient scopes" errors (HTTP 403) [3]. To troubleshoot or verify the exact permissions required for your specific repository or fine-grained token configuration, you should check the X-Accepted-GitHub-Permissions header returned in the response when you make a request to the endpoint [4][5]. This header explicitly lists the permissions needed for that specific request [4]. If you encounter unexpected access errors, it is recommended to ensure your token has the necessary repository permissions (typically Issues or Pull requests set to Write) and to rely on the X-Accepted-GitHub-Permissions header for confirmation [4].
Citations:
- 1:
POST /repos/{owner}/{repo}/issues/comments/{id}/reactionsincomplete ACL github/docs#43843 - 2: https://docs.github.com/en/enterprise-server@3.19/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28
- 3: adding reactions to a "pull request review comment" does not work with listed token github/docs#36899
- 4: https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens
- 5: https://docs.github.com/en/rest/authentication/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2026-03-10
Add issues: write to process-2 and process-6. Their reaction fallback posts to /issues/comments/{id}/reactions for top-level PR comments, so pull-requests: write alone leaves the emoji step skipped behind || true.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-pr-comment.yml around lines 85 - 88, Add issues:
write to the permissions for the process-2 and process-6 jobs in the workflow.
Keep the existing id-token, contents, and pull-requests permissions unchanged so
their reaction fallback can write reactions to top-level PR comments.
7effd20 to
8d38dab
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (10)
.github/workflows/opencode-pr-comment.yml (8)
81-96: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winProcess 2 never checks out the repository before running opencode.
Unlike Process 3 and Process 6, this job has no checkout step; the opencode step (Line 136) executes against whatever ambient working directory the runner has, which can fail before the prompt is even processed if the action or agent expects a local git worktree.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 81 - 96, Update the process-2 job to add a repository checkout step before the opencode execution step, matching the checkout behavior used by process-3 and process-6. Ensure the checkout runs before any steps that require a local git worktree.
175-181: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPrompts instruct a manual
gh api ... /repliespost, duplicating the action's own reply and using a wrong comment ID onissue_commentruns.The action already posts the model's response; the
## Outputblock telling the agent togh api --method POST /repos/.../pulls/comments/${{ github.event.comment.id }}/repliescauses a duplicate reply, andgithub.event.comment.idis not a valid top-level review-comment ID when the trigger came fromissue_comment. Remove these instructions from both Process 2's and Process 3's prompts and let the action return the Markdown reply directly.Also applies to: 268-274
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 175 - 181, Remove the manual gh api reply instructions from the ## Output sections of both Process 2 and Process 3 prompts. Have each prompt instruct the model to return the Markdown response directly, without posting it, while leaving the action responsible for submitting the reply.
98-110: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDirect
github.event.comment.*expansion inrun:— template-injection risk (zizmor flags Line 101).
pull_request_review_urlandin_reply_to_idare interpolated straight into the shell command instead of viaenv:. A crafted value in these fields could inject shell code. This exact fix was proposed previously and marked addressed, but the vulnerable pattern is back in this synced file.🔒 Proposed fix
- name: Check if this is a reply to an Opencode thread id: thread-check env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} EVENT_NAME: ${{ github.event_name }} + PR_REVIEW_URL: ${{ github.event.comment.pull_request_review_url }} + IN_REPLY_TO_ID: ${{ github.event.comment.in_reply_to_id }} run: | IS_BOT_THREAD="false" if [[ "$EVENT_NAME" == "pull_request_review_comment" ]]; then PARENT_AUTHOR=$(gh api \ - "${{ github.event.comment.pull_request_review_url }}" \ + "$PR_REVIEW_URL" \ --jq '.user.login' 2>/dev/null || echo "") - if [[ "${{ github.event.comment.in_reply_to_id }}" != "null" ]] && \ - [[ -n "${{ github.event.comment.in_reply_to_id }}" ]]; then + if [[ "$IN_REPLY_TO_ID" != "null" ]] && [[ -n "$IN_REPLY_TO_ID" ]]; then PARENT_AUTHOR=$(gh api \ - "/repos/${{ github.repository }}/pulls/comments/${{ github.event.comment.in_reply_to_id }}" \ + "/repos/${{ github.repository }}/pulls/comments/${IN_REPLY_TO_ID}" \ --jq '.user.login' 2>/dev/null || echo "$PARENT_AUTHOR") fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 98 - 110, Remove direct github.event.comment.* expressions from the run shell commands in the pull_request_review_comment branch. Pass pull_request_review_url and in_reply_to_id through the step’s env mapping, then reference those environment variables in the gh api URL and conditional checks while preserving the existing parent-author fallback behavior.Source: Linters/SAST tools
85-88: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winProcess 2 and Process 6 are missing
issues: write, so the reaction fallback for top-level PR comments silently no-ops.The reaction steps (e.g. Lines 188-193, 410-415) try
/repos/.../issues/comments/{id}/reactionsfirst, which needsissues: write; both jobs only grantpull-requests: write, so that call 403s and falls through to the|| trueon every top-level comment.Also applies to: 304-311
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 85 - 88, Add issues: write to the permissions blocks for Process 2 and Process 6 in the workflow, preserving the existing id-token, contents, and pull-requests permissions. Ensure the reaction steps in those jobs can access the issue-comment reactions endpoint without changing their fallback behavior.
66-77: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
/oc reviewcomments can be double-processed by this workflow and the dedicated PR-review workflow.For
issue_commentevents, a bare/oc reviewfalls through to theIS_OC == truebranch (Lines 70-72) and routes to Process 2, whileopencode-pr-review.ymlalso listens for/oc reviewonissue_comment. The same comment can trigger both workflows unless the subcommand is excluded here or the review workflow's trigger is narrowed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 66 - 77, Exclude the review subcommand from the issue_comment routing in the workflow’s conditional block so `/oc review` is not assigned to Process 2 by this workflow. Preserve the existing routing for `/oc task`, bare `/oc`, and non-/oc comments, while leaving review handling to the dedicated PR-review workflow.
352-397: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick winProcess 6's prompt uses
github.event.pull_request.number, which is empty on theissue_commentevent that triggers this job.Process 6 is only reached via the
issue_commentbranch of the route job (Line 68-69:SUBCOMMAND == "task"), where GitHub populatesgithub.event.issue, notgithub.event.pull_request.gh pr checkout ${{ github.event.pull_request.number }}(Line 368),gh pr edit ${{ github.event.pull_request.number }}(Line 389), andgh pr comment ${{ github.event.pull_request.number }}(Line 395) will all receive a blank/invalid number and fail. Usegithub.event.issue.numberthroughout this job's context and commands.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 352 - 397, The workflow instructions for the task process use the unavailable pull_request event context. Replace github.event.pull_request.number with github.event.issue.number in the checkout, PR body update, and summary comment commands, and in the surrounding context text, while preserving the existing task workflow.
116-127: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winBot-thread detection only inspects the first comments page.
/repos/{owner}/{repo}/issues/{n}/commentsreturns comments ordered ascending by ID with a default page size of 30 — confirmed by GitHub's docs, which state comments are ordered by ascending ID..jq '.[-2]'therefore reads the wrong element on any thread exceeding 30 comments, computingIS_BOT_THREADfrom a stale comment rather than the one immediately preceding the trigger.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 116 - 127, Update the issue_comment branch’s LAST_COMMENT_AUTHOR lookup to retrieve the complete or appropriately paginated comment history before selecting the comment immediately preceding the trigger. Preserve the existing author checks for opencode-agent[bot] and github-actions[bot], ensuring IS_BOT_THREAD reflects the actual preceding comment even when the thread exceeds the default API page size.
215-224: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winProcess 3 and Process 6 lack write access to push commits.
Both set
use_github_token: true(Lines 236, 341) so the action relies on the job's ownGITHUB_TOKEN, butpermissions.contentsis stillreadfor both jobs (Lines 217, 310).git pushin the agent's workflow (Line 380 for Process 6; commit/push in Process 3's prompt) will fail with a 403. Process 3 additionally disablespersist-credentials(Line 223) while Process 6's checkout (Lines 313-317) omits it entirely (also flagged by zizmor as artipacked) — align both tocontents: writeand restore/keep checkout credentials consistent with which auth path the action actually uses.🔒 Proposed fix
process-3: permissions: id-token: write - contents: read + contents: write pull-requests: write @@ process-6: permissions: id-token: write - contents: read + contents: write pull-requests: writeAlso applies to: 304-317
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-pr-comment.yml around lines 215 - 224, Update the Process 3 and Process 6 job permission blocks to grant contents: write because both use use_github_token: true and must push commits. Align their actions/checkout configurations so credential persistence matches that token-based authentication path, removing the inconsistent persist-credentials: false in Process 3 and explicitly setting the same behavior for Process 6..github/workflows/opencode-issue-handler.yml (2)
118-124: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winManual
gh issue commentsteps duplicate the action's own auto-posted response.The pinned
anomalyco/opencode/githubaction already posts the model's final reply as an issue comment; instructing the agent to additionally rungh issue comment ... --body-file /tmp/response.md(Lines 121-124) andgh issue comment "$ISSUE_NUMBER" --body "..."(Lines 313-315) causes duplicate comments on the issue timeline. This was raised on a prior commit and marked addressed, but the pattern is present again in this synced version.Also applies to: 310-315
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-issue-handler.yml around lines 118 - 124, Remove the manual gh issue comment commands from the workflow instructions, including the command in the “Post your response” section and the corresponding command near the later response-posting steps. Rely on the pinned anomalyco/opencode/github action to publish the model’s final reply once, while preserving the surrounding response-generation guidance.
172-204: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
id-token: writeis unused, and the checkout step lackspersist-credentials: false(zizmor: artipacked).Process 5 sets
use_github_token: true(Line 204), so it only relies onGITHUB_TOKEN;id-token: write(Line 178) grants unused OIDC privilege. Separately, the checkout at Lines 183-185 omitspersist-credentials: false, unlike the other checkout steps in this file — though note that withuse_github_token: true, the checked-out credential may be the mechanism the agent's latergit pushrelies on, so verify before blindly disabling persistence.🔒 Proposed fix (id-token only; verify push behavior before removing persisted credentials)
permissions: - id-token: write contents: write pull-requests: write issues: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-issue-handler.yml around lines 172 - 204, Remove the unused id-token write permission from the process-5 job permissions. Review the Checkout repository step and determine whether the later git push depends on persisted checkout credentials when use_github_token is enabled; disable credential persistence if push remains functional through the configured GitHub token, otherwise preserve it.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/opencode-issue-handler.yml:
- Around line 64-84: Update the opencode step identified by id "opencode" to set
use_github_token to true in its with configuration, ensuring it uses the
job-scoped GITHUB_TOKEN. Remove the unnecessary id-token: write permission from
the workflow permissions while preserving the existing contents: read and
issues: write permissions.
In @.github/workflows/opencode-triage.yaml:
- Around line 19-22: Update the “Deprecation notice” step in the workflow to
also direct pull-request users to opencode-pr-comment.yml, while retaining the
existing opencode-issue-handler.yml guidance for issue events.
---
Duplicate comments:
In @.github/workflows/opencode-issue-handler.yml:
- Around line 118-124: Remove the manual gh issue comment commands from the
workflow instructions, including the command in the “Post your response” section
and the corresponding command near the later response-posting steps. Rely on the
pinned anomalyco/opencode/github action to publish the model’s final reply once,
while preserving the surrounding response-generation guidance.
- Around line 172-204: Remove the unused id-token write permission from the
process-5 job permissions. Review the Checkout repository step and determine
whether the later git push depends on persisted checkout credentials when
use_github_token is enabled; disable credential persistence if push remains
functional through the configured GitHub token, otherwise preserve it.
In @.github/workflows/opencode-pr-comment.yml:
- Around line 81-96: Update the process-2 job to add a repository checkout step
before the opencode execution step, matching the checkout behavior used by
process-3 and process-6. Ensure the checkout runs before any steps that require
a local git worktree.
- Around line 175-181: Remove the manual gh api reply instructions from the ##
Output sections of both Process 2 and Process 3 prompts. Have each prompt
instruct the model to return the Markdown response directly, without posting it,
while leaving the action responsible for submitting the reply.
- Around line 98-110: Remove direct github.event.comment.* expressions from the
run shell commands in the pull_request_review_comment branch. Pass
pull_request_review_url and in_reply_to_id through the step’s env mapping, then
reference those environment variables in the gh api URL and conditional checks
while preserving the existing parent-author fallback behavior.
- Around line 85-88: Add issues: write to the permissions blocks for Process 2
and Process 6 in the workflow, preserving the existing id-token, contents, and
pull-requests permissions. Ensure the reaction steps in those jobs can access
the issue-comment reactions endpoint without changing their fallback behavior.
- Around line 66-77: Exclude the review subcommand from the issue_comment
routing in the workflow’s conditional block so `/oc review` is not assigned to
Process 2 by this workflow. Preserve the existing routing for `/oc task`, bare
`/oc`, and non-/oc comments, while leaving review handling to the dedicated
PR-review workflow.
- Around line 352-397: The workflow instructions for the task process use the
unavailable pull_request event context. Replace github.event.pull_request.number
with github.event.issue.number in the checkout, PR body update, and summary
comment commands, and in the surrounding context text, while preserving the
existing task workflow.
- Around line 116-127: Update the issue_comment branch’s LAST_COMMENT_AUTHOR
lookup to retrieve the complete or appropriately paginated comment history
before selecting the comment immediately preceding the trigger. Preserve the
existing author checks for opencode-agent[bot] and github-actions[bot], ensuring
IS_BOT_THREAD reflects the actual preceding comment even when the thread exceeds
the default API page size.
- Around line 215-224: Update the Process 3 and Process 6 job permission blocks
to grant contents: write because both use use_github_token: true and must push
commits. Align their actions/checkout configurations so credential persistence
matches that token-based authentication path, removing the inconsistent
persist-credentials: false in Process 3 and explicitly setting the same behavior
for Process 6.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8105ab74-c785-4d40-9744-d8b13deabca9
📒 Files selected for processing (10)
.github/scripts/auth.sh.github/workflows/opencode-implement.yaml.github/workflows/opencode-issue-handler.yml.github/workflows/opencode-pr-comment.yml.github/workflows/opencode-pr-review.yml.github/workflows/opencode-review.yaml.github/workflows/opencode-triage-issue.yaml.github/workflows/opencode-triage-pr.yaml.github/workflows/opencode-triage.yaml.github/workflows/opencode.yml
🚧 Files skipped from review as they are similar to previous changes (5)
- .github/workflows/opencode-triage-pr.yaml
- .github/workflows/opencode-triage-issue.yaml
- .github/workflows/opencode-implement.yaml
- .github/workflows/opencode-pr-review.yml
- .github/scripts/auth.sh
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| issues: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Run opencode (Process 4 — Issue Review & Refinement) | ||
| id: opencode | ||
| continue-on-error: true | ||
| uses: anomalyco/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # latest | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} | ||
| OPENCODE_TRIGGER_BODY: ${{ github.event.comment.body }} | ||
| with: | ||
| model: opencode/qwen3.7-plus | ||
| prompt: | |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
use_github_token still defaults to false; Process 4's "read-only" boundary isn't enforced by the job token.
Permissions still grant id-token: write (Line 65) and the with: block for the opencode step has no use_github_token: true, so the action authenticates via its own OIDC-issued App token rather than this job's scoped GITHUB_TOKEN. The prompt's "read-only" instructions are then only a soft constraint — the actual credential used may have broader repo write access than the job declares.
🔒 Proposed fix
permissions:
- id-token: write
contents: read
issues: write
steps:
@@
with:
model: opencode/qwen3.7-plus
+ use_github_token: true
prompt: |This mirrors a still-open comment from a prior review round on this exact block.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-issue-handler.yml around lines 64 - 84, Update
the opencode step identified by id "opencode" to set use_github_token to true in
its with configuration, ensuring it uses the job-scoped GITHUB_TOKEN. Remove the
unnecessary id-token: write permission from the workflow permissions while
preserving the existing contents: read and issues: write permissions.
| - name: Deprecation notice | ||
| run: | | ||
| echo "This workflow is deprecated and performs no operations." | ||
| echo "Use opencode-issue-handler.yml instead." |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Point PR users to the PR replacement too.
opencode-issue-handler.yml explicitly excludes pull requests, while the retired workflow also handled PR comment/review events. Include opencode-pr-comment.yml in this notice so the migration path is not misleading.
Proposed fix
- echo "Use opencode-issue-handler.yml instead."
+ echo "Use opencode-issue-handler.yml for issues or opencode-pr-comment.yml for pull requests instead."📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Deprecation notice | |
| run: | | |
| echo "This workflow is deprecated and performs no operations." | |
| echo "Use opencode-issue-handler.yml instead." | |
| - name: Deprecation notice | |
| run: | | |
| echo "This workflow is deprecated and performs no operations." | |
| echo "Use opencode-issue-handler.yml for issues or opencode-pr-comment.yml for pull requests instead." |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/opencode-triage.yaml around lines 19 - 22, Update the
“Deprecation notice” step in the workflow to also direct pull-request users to
opencode-pr-comment.yml, while retaining the existing opencode-issue-handler.yml
guidance for issue events.
968f90f to
bcda533
Compare
f2743d7 to
f881054
Compare
…e '.github/workflows/opencode-pr-review.yml'
…te '.github/workflows/opencode-pr-comment.yml'
…emote '.github/workflows/opencode-issue-handler.yml'
…ub/scripts/resolve-model.sh'
…workflows/opencode.yml'
….github/workflows/opencode-triage.yaml'
…te '.github/workflows/opencode-triage-pr.yaml'
…emote '.github/workflows/opencode-triage-issue.yaml'
…e '.github/workflows/opencode-implement.yaml'
….github/workflows/opencode-review.yaml'
f881054 to
dacf6de
Compare
1 participant
synced local file(s) with dianlight/opencode-actions.
Changed files
.github/workflows/opencode-pr-review.ymlfrom remote.github/workflows/opencode-pr-review.yml.github/workflows/opencode-pr-comment.ymlfrom remote.github/workflows/opencode-pr-comment.yml.github/workflows/opencode-issue-handler.ymlfrom remote.github/workflows/opencode-issue-handler.yml.github/scripts/auth.shfrom remote.github/scripts/auth.sh.github/scripts/resolve-model.shfrom remote.github/scripts/resolve-model.sh.github/workflows/opencode.ymlwith remote.github/workflows/opencode.yml.github/workflows/opencode-triage.yamlwith remote.github/workflows/opencode-triage.yaml.github/workflows/opencode-triage-pr.yamlfrom remote.github/workflows/opencode-triage-pr.yaml.github/workflows/opencode-triage-issue.yamlfrom remote.github/workflows/opencode-triage-issue.yaml.github/workflows/opencode-implement.yamlwith remote.github/workflows/opencode-implement.yaml.github/workflows/opencode-review.yamlwith remote.github/workflows/opencode-review.yamlThis PR was created automatically by the repo-file-sync-action workflow run #31084509917