feat: add reusable OpenCode runner

[xnoto]

Summary

Adds a reusable, caller-scoped OpenCode GitHub Actions workflow. It receives only a caller repository path containing canonical agents and skills plus KIMI_API_KEY; stages an isolated runner configuration; installs OpenCode 1.18.23; and invokes opencode github run with sharing disabled.

Fixes # — not applicable

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — lint passed
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed

Impact and rollout

Producer: makeitworkcloud/shared-workflows owns the reusable opencode.yml workflow interface. It accepts one required config-source-path input and one required KIMI_API_KEY secret. The workflow runs on ubuntu-24.04, checks out the caller repository, and needs caller-granted contents, pull-requests, and issues write permissions for OpenCode's existing branch/comment delivery behavior.

Existing callers do not reference opencode.yml and are unchanged. The pending charts caller in makeitworkcloud/charts#66 pins this workflow to immutable commit 73444d2177762549d8c476dc612f23811e0a2180; no existing reusable interface, ARC runner contract, OpenTofu behavior, chart artifact, GitOps desired state, or deployment changes in this PR.

The runner requires a KIMI_API_KEY Actions secret in each opt-in caller. Current tfroot-github source does not distribute it to charts; encrypted-secret provisioning is a separate confirmation- and OpenTofu-gated change.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — no caller references this workflow until a reviewed caller PR merges; revert this workflow before adopting it to disable new use

AI agent materially produced this change. Knowledge source revision consulted: 25417c8d85ca246f7afb570630bf4ca463401999. Existing caller search found only opentofu.yml and _dependabot-notify.yml consumers; neither is changed.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed