[alexsoyes]

🎯 What & why

Lets the repository owner hand work to OpenCode v2 from a comment (/oc or /opencode) on an issue, a pull request or a line review, on the free opencode-go/beam-free model. Nobody else can trigger it.

🛠️ How it works

OpenCode v2 has no GitHub integration anymore (no github run command, and the anomalyco/opencode/github action is no longer published), so this workflow is the integration:

1. Guard: opencode.yml:35 checks comment.user.id, not the login, which can be renamed and reclaimed. The repo is public: without it any comment would spend the subscription and feed text to the agent.
2. Target: on a PR, its head branch (fork PRs and main/next heads refused). On an issue, chore/opencode-issue-<n> from next, reused by later requests on the same issue.
3. Prompt: built with jq from the event payload into a file: issue or PR text, the review hunk if any, then the request. No comment text is interpolated into a shell command.
4. Agent: opencode.yml:146 opencode run --standalone --format json with the latest @opencode/cli, no --auto. Per OpenCode's guidance for unattended runs, opencode.yml:119 writes explicit rules to the user config (outside the checkout, never committed): shell denied except read-only git, so CI tests the pushed commit; no access outside the checkout, which keeps OPENCODE_API_KEY out of reach; subagents denied, because the shipped explore agent re-allows shell and outside paths and agent rules outrank config. Anything left at ask is rejected. The step holds no GitHub credential.
5. Publish: opencode.yml:149 mints an aidd-bot token downscoped to contents, pull requests and issues (same app the release workflows use, so its pushes trigger CI, which GITHUB_TOKEN pushes would not). Commits, pushes, opens a PR to next for issues, and replies with the agent's last message. On failure it replies with the run link.

GITHUB_TOKEN stays contents: read + pull-requests: read. Runner ubuntu-slim, Node lts/*, actions pinned by SHA, permissions: {} at the top.

🧪 How to verify

• After merge to main (issue_comment workflows only run from the default branch): /oc fix the typo in README on a test issue. Expect a reply with a link to a new PR.
• /oc on a PR from a branch of this repo: expect a commit on that branch and a reply.
• Same comment from another account: job skipped.

⚠️ Heads-up

• Never run end to end: it can only fire once on main. The prompt builder and reply extraction were dry-run locally on sample payloads; the v2 run flags were read from the 2.2.1 source.
• @opencode/cli@latest is a deliberate exception to the global-install pin rule, declared in workflows-pin-global-installs.test.js with its reason. It floats on a CLI that ships several releases a week: a flag change breaks the run, and each release runs unreviewed. Pin a version to trade freshness back.
• beam-free is free for a limited time; when it ends, change MODEL.
• Issue text written by others reaches the prompt; the guard limits who triggers, not what the issue says. The permission rules bound what such text can make the agent do: edit files in the checkout, nothing else.
• No shell means the agent cannot run tests itself; CI runs them on the commit it pushes.
• ubuntu-slim stops jobs at 15 minutes, install included.
• The OpenCode Agent GitHub App installed on this repo is no longer used and can be uninstalled.

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.

https://claude.ai/code/session_0177LJQehsL7Fm3PciLfDcFL

---

Generated by Claude Code