opencode-bot.yml

---
name: OpenCode bot
on:
  workflow_call:
    inputs:
      model:
        required: true
        type: string
        description: Model to use with OpenCode
      agent:
        required: false
        type: string
        description: Primary agent to use
        default: build
      share:
        required: false
        type: boolean
        description: Share the OpenCode session
        default: false
      prompt:
        required: false
        type: string
        description: Custom prompt to override the event comment
        default: ''
      use-github-token:
        required: false
        type: boolean
        description: Use GITHUB_TOKEN directly instead of OpenCode App token exchange
        default: false
      mentions:
        required: false
        type: string
        description: Comma-separated list of trigger phrases
        default: /opencode,/oc
      variant:
        required: false
        type: string
        description: Provider-specific model variant
        default: ''
      oidc-base-url:
        required: false
        type: string
        description: Base URL for OIDC token exchange
        default: https://api.opencode.ai
      opencode-version:
        required: false
        type: string
        description: OpenCode version to install
        default: latest
      use-bundled-toolkit:
        required: false
        type: boolean
        description: Use the action's bundled OpenCode toolkit
        default: true
      timeout-minutes:
        required: false
        type: number
        description: Maximum minutes to let OpenCode run
        default: 60
      runs-on:
        required: false
        type: string
        description: Runner to use
        default: ubuntu-latest
    secrets:
      ANTHROPIC_API_KEY:
        required: false
        description: Anthropic API key
      OPENAI_API_KEY:
        required: false
        description: OpenAI API key
      OPENROUTER_API_KEY:
        required: false
        description: OpenRouter API key
      OPENCODE_API_KEY:
        required: false
        description: OpenCode API key
      SAKURA_AI_ENGINE_API_KEY:
        required: false
        description: Sakura AI Engine API key
      GOOGLE_GENERATIVE_AI_API_KEY:
        required: false
        description: Google Generative AI API key
      DEEPSEEK_API_KEY:
        required: false
        description: DeepSeek API key
      XAI_API_KEY:
        required: false
        description: xAI API key
      GROQ_API_KEY:
        required: false
        description: Groq API key
      CEREBRAS_API_KEY:
        required: false
        description: Cerebras API key
      MOONSHOT_API_KEY:
        required: false
        description: Moonshot AI API key
      GH_TOKEN:
        required: false
        description: GitHub token for repository access
  workflow_dispatch:  # checkov:skip=CKV_GHA_7: Parameterized manual dispatch is an intentional trusted-operator interface.
    inputs:
      model:
        required: true
        type: string
        description: Model to use with OpenCode
      agent:
        required: false
        type: string
        description: Primary agent to use
        default: build
      share:
        required: false
        type: boolean
        description: Share the OpenCode session
        default: false
      prompt:
        required: false
        type: string
        description: Custom prompt to override the event comment
        default: ''
      use-github-token:
        required: false
        type: boolean
        description: Use GITHUB_TOKEN directly instead of OpenCode App token exchange
        default: false
      mentions:
        required: false
        type: string
        description: Comma-separated list of trigger phrases
        default: /opencode,/oc
      variant:
        required: false
        type: string
        description: Provider-specific model variant
        default: ''
      oidc-base-url:
        required: false
        type: string
        description: Base URL for OIDC token exchange
        default: https://api.opencode.ai
      opencode-version:
        required: false
        type: string
        description: OpenCode version to install
        default: latest
      use-bundled-toolkit:
        required: false
        type: boolean
        description: Use the action's bundled OpenCode toolkit
        default: true
      timeout-minutes:
        required: false
        type: number
        description: Maximum minutes to let OpenCode run
        default: 60
      runs-on:
        required: false
        type: string
        description: Runner to use
        default: ubuntu-latest
  issue_comment:
    types:
      - created
  pull_request_review_comment:
    types:
      - created
permissions:
  contents: read
  pull-requests: write
  issues: write
  id-token: write
  actions: read
jobs:
  opencode-bot:
    if: >
      (
        (github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment')
        && github.event.comment.user.type != 'Bot'
        && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
        && (
          inputs.model != ''
          || startsWith(github.event.comment.body, '/oc')
          || contains(github.event.comment.body, ' /oc')
          || startsWith(github.event.comment.body, '/opencode')
          || contains(github.event.comment.body, ' /opencode')
        )
      ) || (
        github.event_name != 'issue_comment'
        && github.event_name != 'pull_request_review_comment'
        && inputs.prompt != ''
      )
    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 1
          token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
          persist-credentials: ${{ inputs.use-github-token }}
      - name: Configure Git identity
        if: inputs.use-github-token
        run: |
          git config --local user.name 'opencode-agent[bot]'
          git config --local user.email 'opencode-agent[bot]@users.noreply.github.com'
      - name: Run OpenCode
        uses: $/.
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          SAKURA_AI_ENGINE_API_KEY: ${{ secrets.SAKURA_AI_ENGINE_API_KEY }}
          GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
          CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
        with:
          model: ${{ inputs.model || 'openrouter/stealth/union-alpha' }}
          agent: ${{ inputs.agent || 'build' }}
          share: ${{ inputs.share }}
          prompt: ${{ inputs.prompt }}
          use-github-token: ${{ inputs.use-github-token }}
          mentions: ${{ inputs.mentions || '/opencode,/oc' }}
          variant: ${{ inputs.variant }}
          oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
          opencode-version: ${{ inputs.opencode-version || 'latest' }}
          use-bundled-toolkit: ${{ inputs.model == '' || inputs.use-bundled-toolkit }}
          timeout-minutes: ${{ inputs.timeout-minutes || 60 }}