ci(opencode): authenticate git before first opencode push

[tonythethompson]

Summary

Adds the GitHub token http.https://github.com/.extraheader auth config at the start of the Run opencode step, before the first opencode github run attempt.

• actions/checkout uses persist-credentials: false, so the agent had no credentials when it tried to push and failed with fatal: could not read Username for 'https://github.com': No such device or address.
• The same auth setup was already present in the salvage/retry path; this change ensures it is available on the first attempt as well.

Test plan

• Re-run an /oc fix on a PR and confirm the opencode run pushes without the username prompt error.

Generated with Devin

[github-actions]

Review: PR #136 — ci(opencode): authenticate git before first opencode push

Verdict: Approve. The change is correct, minimal, and well-scoped.

Analysis

The diff adds the same http.https://github.com/.extraheader git config that already exists in the salvage/retry block (line 297-298) at the start of the run step, before the first opencode github run attempt. This fixes the fatal: could not read Username for 'https://github.com' failure that occurs because actions/checkout uses persist-credentials: false.

Key points verified:

1. GH_TOKEN is in the step env (.github/workflows/opencode.yml:243), so the base64 expansion at the new line 266 will resolve. The token is the same one reused in the salvage path.

2. set -u is active (line 255). GH_TOKEN is defined, so no unbound-variable failure. The new line intentionally omits the 2>/dev/null || true guard that the salvage copy uses — this is the right call: if auth setup fails on the first attempt, failing loudly is better than proceeding to a guaranteed-to-fail push.

3. The auth line uses git config --local, which writes to the checkout's .git/config rather than --global. This is consistent with the salvage block and avoids leaking the token into the global config. The --global user.name/user.email lines above it are fine as global since identity is not secret.

4. base64 -w 0 is GNU base64, correct for the Ubuntu runners used by this workflow. If this job were ever ported to macOS/Windows runners, the -w 0 flag would need adjustment (macOS base64 has no -w), but the rest of the workflow already assumes GNU tooling, so this is not a new risk.

5. The comment is accurate and points to the reuse in the salvage block, which helps future maintainers understand why the line isn't redundant.

Minor observations (non-blocking)

• The first-attempt and salvage auth lines are now duplicated. A future cleanup could extract a small shell function (e.g. set_git_auth()) to avoid drift, but that's out of scope for this hotfix and the duplication is harmless since the value is static.
• The PR body test plan ("Re-run an /oc fix on a PR") is the right way to validate; there's no unit-testable surface here.

No changes requested.

opencode session  |  github run

[tonythethompson]

/oc fix

[github-actions]

The fix for PR #136 is already in place and correct. Verified:

• bc807d0 on fix/opencode-push-auth adds exactly the +6 lines the PR describes, with a clean tree.
• The auth config at .github/workflows/opencode.yml:265-266 runs under set -u with GH_TOKEN defined (line 243), writes to local git config (no global token leak), and uses GNU base64 -w 0 matching the ubuntu-latest runner.
• It mirrors the salvage-block auth (lines 297-298) but fails loudly on the first attempt rather than masking errors — correct, since proceeding without credentials would guarantee the could not read Username push failure.
• The underlying push is git-CLI-driven (that's what produced the original fatal: could not read Username error), so the extraheader takes effect for opencode's own pushes.

No further code changes needed — the change matches the PR intent and the review approval.

opencode session  |  github run

[tonythethompson]

/oc fix failing tests

[github-actions]

fatal: could not read Username for 'https://github.com': No such device or address

opencode session  |  github run