feat: add opencode configuration #11
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughAdds a new GitHub Actions workflow Changes
Sequence Diagram(s)sequenceDiagram
participant User as Actor (comment/review/issue)
participant GitHub as GitHub Events
participant Actions as GitHub Actions
participant Repo as Checkout
participant Opencode as sst/opencode/github@latest
User->>GitHub: Create comment/review/issue containing `/oc-codex`
GitHub->>Actions: Emit event (issue_comment / pr_review_comment / pr_review / issues)
Note right of Actions #DDEBF7: Conditional check: content contains `/oc-codex`\nand author_association is OWNER/MEMBER/COLLABORATOR
Actions-->>Repo: checkout repository
Actions-->>Opencode: run action with secret `OPENAI_API_KEY_FOR_OPENCODE` and model `openai/gpt-5-codex`
Opencode-->>Actions: action completes (success/failure)
Actions-->>GitHub: post workflow status
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🔇 Additional comments (3)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/opencode-gpt-5-codex.yml (3)
23-23: Pin the action to a specific version instead of@latest.Using
@lateston actions in production workflows introduces non-deterministic behavior and makes workflows harder to audit and test. If the sst/opencode action receives an update that introduces breaking changes or security issues, your workflow could break unexpectedly.Apply this diff to pin to a specific version:
- uses: sst/opencode/github@latest + uses: sst/opencode/github@v1 # Replace v1 with the latest stable versionCheck the sst/opencode action releases to find the latest stable version number.
10-13: Consider refining the trigger condition to avoid false positives.The
contains()check will match comments like "I think /oc-gpt-5-codex is a bad idea" or "Check out /oc-gpt-5-codex documentation". This could lead to unintended workflow invocations.Consider stricter patterns:
- Require the token at the start of a line or after specific delimiters
- Add a more explicit sentinel (e.g., require exact phrase like
@oc-gpt-5-codex reviewor similar)if: | - contains(github.event.comment.body, ' /oc-gpt-5-codex') || - startsWith(github.event.comment.body, '/oc-gpt-5-codex') || - contains(github.event.comment.body, ' /opencode-gpt-5-codex') || - startsWith(github.event.comment.body, '/opencode-gpt-5-codex') + (startsWith(github.event.comment.body, '/oc-gpt-5-codex') && !contains(github.event.comment.body, 'do not')) || + (startsWith(github.event.comment.body, '/opencode-gpt-5-codex') && !contains(github.event.comment.body, 'do not'))Or use regex if the action supports it.
1-27: Add concurrency control and documentation.To prevent duplicate or conflicting autonomous code changes, consider adding:
- Concurrency group to serialize workflow runs
- Inline comments explaining the workflow's purpose and safety considerations
- Reference to OpenCode documentation (already noted in PR objectives, but could be in the file for maintainers)
Apply this diff to add concurrency and documentation:
name: opencode-gpt-5-codex +# This workflow enables autonomous code review and generation via OpenCode agent. +# See: https://opencode.ai/docs/github/#usage-examples +# WARNING: Ensure access control restrictions are in place (see 'if' condition below). on: issue_comment: types: [created] +concurrency: + group: opencode-${{ github.issue.number || github.ref }} + cancel-in-progress: true + jobs:This ensures that only one OpenCode invocation runs per issue/PR, canceling any previous in-progress runs.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/opencode-gpt-5-codex.yml (1)
24-27: Verify the model identifier and API key scope.Confirm that:
openai/gpt-5-codexis a valid model identifier (GPT-5 availability and naming should be verified against current OpenAI API documentation)- The
OPENAI_API_KEY_FOR_OPENCODEsecret has appropriate scope and permissions (e.g., not full write access to all resources)- The secret is rotated regularly and has usage limits in the OpenAI dashboard
Verify these details against the OpenAI API documentation and your platform.openai.com configuration.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/opencode-gpt-5-codex.yml (1)
15-15: Minor: Fix typo in inline comment."accomodate" should be "accommodate".
- timeout-minutes: 30 # to accomodate Codex's ability to run for extended periods + timeout-minutes: 30 # to accommodate Codex's ability to run for extended periods
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🔇 Additional comments (4)
.github/workflows/opencode-gpt-5-codex.yml (4)
19-40: Security restrictions properly implemented. ✓The conditional logic correctly restricts workflow triggers to OWNER/MEMBER/COLLABORATOR contributors across all four event types (issue_comment, pull_request_review_comment, pull_request_review, and issues). Null checks are appropriately placed (lines 30, 36) to prevent runtime errors. This successfully addresses the critical security concern from the previous review.
3-11: Event triggers are appropriately specific. ✓Using typed event triggers (
types: [created],types: [opened, edited], etc.) is safer than triggering on all events and filtering in the condition. The multi-event approach aligns with the flexible trigger goals.
15-18: Timeout and concurrency configuration is sound. ✓30-minute timeout accommodates Codex's extended processing needs. Concurrency grouping by
event_name, issue/PR number, and run_id prevents parallel runs for the same context while allowing independent concurrent runs across different events and issues, which is appropriate.
42-44: Minimal permissions are correctly configured. ✓The workflow adheres to the principle of least privilege:
contents: readfor repository access andid-token: writefor OIDC token signing if needed by the action.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/opencode-gpt-5-codex.yml (1)
50-51: Monitor sst/opencode version for stability.The decision to pin to
@latestrather than a specific version acknowledges rapid release cycles. This is pragmatic but creates implicit dependency risk. Consider establishing a monitoring cadence (weekly/monthly) to review release notes and detect breaking changes.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/opencode-gpt-5-codex.yml (2)
19-40: ✓ Security restrictions properly implemented.The access controls match the Claude workflow pattern from release 1.2.0:
- Author association check restricts execution to OWNER, MEMBER, or COLLABORATOR across all trigger events
- Defensive null checks for optional event fields (review.body, issue.body)
- Event-specific trigger filtering prevents accidental execution
The concurrency group and timeout controls (lines 15-18) further enhance safety and cost management.
52-55: API key parameter handling is correct—no changes needed.Per the sst/opencode action documentation, provider API keys like OPENAI_API_KEY should be supplied via environment variables, and the
modelparameter belongs in the "with" section. The current configuration correctly places the OPENAI_API_KEY inenvand the model inwith.
ryderstorm
force-pushed
the
feat/setup-opencode-on-github
branch
from
4c5f541 to
4b4232c
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/opencode-gpt-5-codex.yml (1)
22-22: Consider adding word-boundary checks to trigger tokens to reduce false positives.The current implementation uses
contains(github.event.comment.body, '/oc-codex')andcontains(..., '/oc-codex'), which may match unintended strings like "soc-codex" or "doc-codex" if they appear in comments or issue bodies.To match the Claude workflow pattern from release 1.2.0 (as referenced in the past review), add word-boundary checks:
- contains(github.event.comment.body, '/oc-codex') && + (contains(github.event.comment.body, ' /oc-codex') || startsWith(github.event.comment.body, '/oc-codex')) &&Apply this pattern to lines 26, 31, and 36-37 for consistency across all event types.
Also applies to: 26-26, 31-31, 36-37
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/opencode-gpt-5-codex.yml (2)
19-40: ✓ Security restrictions properly applied across all event types.The compound if condition correctly enforces author_association checks (OWNER, MEMBER, COLLABORATOR) for all four event types: issue_comment, pull_request_review_comment, pull_request_review, and issues. This aligns with the security fixes applied to the Claude workflow and prevents unauthorized users from triggering the autonomous agent.
52-53: Clarify API key parameter location:env:vs.with:.The OPENAI_API_KEY is currently passed via
env:(lines 52-53). According to the past review feedback from the Claude bot, secrets should be passed viawith:for better encapsulation. Verify whether thesst/opencode/github@latestaction expects the API key inenv:orwith:, and adjust accordingly:- env: - OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY_FOR_OPENCODE }} with: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY_FOR_OPENCODE }} model: openai/gpt-5-codexPlease consult the sst/opencode action documentation or repository to confirm the correct parameter location for the API key.
Add author association checks to ensure only repository owners, members, and collaborators can trigger the opencode workflow. This prevents unauthorized users from triggering potentially expensive operations. Changes: - Check comment.author_association before evaluating commands - Require OWNER, MEMBER, or COLLABORATOR status - Use consistent pattern with claude.yml workflow 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Expand opencode workflow to support multiple trigger events, add timeout/concurrency controls, and simplify command syntax. This brings the workflow to parity with the claude.yml pattern. Changes: - Add pull_request_review_comment, issues, and pull_request_review triggers - Add 30-minute timeout to accommodate extended Codex runs - Add concurrency grouping to prevent duplicate runs - Expand authorization checks to handle all event types with null checks - Simplify command from /oc-gpt-5-codex to /oc-codex - Add version pinning documentation comment 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
ryderstorm
force-pushed
the
feat/setup-opencode-on-github
branch
from
4b4232c to
67f005f
Compare
Why?
To enable an additional autonomous coding agent to this repo for testing, similar to
@claudeWhat Changed?
Added a GitHub Actions workflow config to enable the OpenCode agent. See https://opencode.ai/docs/github/#usage-examples for docs.
Additional Notes
Powered by a newly created
GitHub-Workflows-OpenCodeAPI key under the Innovation Team project on https://platform.openai.com/api-keysSummary by CodeRabbit
New Features
Chores