PR review run committed and pushed a generated file

[dceoy]

Facts

• A /review-pr run can execute repository-local commands that modify the worktree indirectly, including formatters, linters with fix/write options, generators, and QA scripts.
• opencode github run can detect the resulting dirty worktree, commit the changes, and push them to the pull-request branch.
• The OpenCode GitHub App token can have contents: write, so the caller workflow's contents: read permission does not prevent that push.
• The previously merged review-only implementation was reverted.
• PR Restore retained command dispatch and review correctness improvements #30 restored command dispatch, review head pinning, structured inline submission, and proposal-only /review-pr simplify, but explicitly did not restore the review-only execution boundary.

Remaining issues

• Review agents and subagents can still execute commands that modify the worktree.
• Indirect mutations through repository-controlled scripts and tools are not prevented.
• A dirty worktree produced during review can still be committed and pushed by opencode github run.
• The action does not enforce a review-only, no-commit, or no-push boundary.
• Repository-controlled OpenCode configuration, plugins, agents, or commands are not isolated for review runs.

[opencode-agent]

PROMPT input is required for issues events

github run