Why is opencode github app requesting permission to read secrets?

[joshuacc]

Does the app really need these permissions?

This sort of request makes my spidey sense go off.

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Add support for running opencode github action without using the opencode-hosted github app #1687: Similar security concerns about the opencode GitHub app and avoiding its use due to security considerations

Feel free to ignore if none of these address your specific case.

[fwang]

We are making the opencode github install command automatically add the model provider's api key to GitHub secrets. Currently this had to be done manually.

Despite the permission says read and write, GitHub api actually never reveals the secret values.