opencode-run.yml

name: Reusable — opencode run

# Consumers call this via:
#
#   jobs:
#     run:
#       uses: vymalo/opencode-oauth2/.github/workflows/opencode-run.yml@v0.2.0
#       with:
#         model: miaou/glm-5
#         prompt: "Summarize the changes"
#         opencode-config-path: .opencode-ci/opencode.json
#
# Consumer must:
#   - grant `permissions: { id-token: write, contents: read }` on the caller job
#   - commit an opencode.json at `opencode-config-path` with
#     `authFlow: "jwt_bearer"` + `subjectTokenSource: { type: "github_actions" }`
#   - have an IdP that trusts GitHub Actions OIDC for the configured audience
#
# See docs/github-actions.md for end-to-end setup.

on:
  workflow_call:
    inputs:
      model:
        description: 'Model id passed to `opencode run --model` (e.g. miaou/glm-5).'
        required: true
        type: string
      prompt:
        description: 'Prompt passed to `opencode run`.'
        required: true
        type: string
      opencode-config-path:
        description: 'Path (relative to the repo root) to the opencode.json the runner should use.'
        required: false
        type: string
        default: '.opencode-ci/opencode.json'
      node-version:
        description: 'Node.js version installed on the runner.'
        required: false
        type: string
        default: '22'
      runs-on:
        description: 'Runner image. Defaults to ubuntu-latest.'
        required: false
        type: string
        default: 'ubuntu-latest'
      opencode-version:
        description: 'Pinned `opencode` version to install (npm dist-tag or semver). Empty == latest.'
        required: false
        type: string
        default: ''
      plugin-version:
        description: 'Pinned `@vymalo/opencode-oauth2` version. Empty == latest.'
        required: false
        type: string
        default: ''
    outputs:
      stdout-artifact:
        description: 'Name of the uploaded artifact containing opencode stdout.'
        value: ${{ jobs.run.outputs.stdout-artifact }}

jobs:
  run:
    name: opencode run
    runs-on: ${{ inputs.runs-on }}
    permissions:
      # OIDC token minting for federated identity (jwt_bearer / token_exchange).
      # The caller must also grant id-token: write — workflow_call inherits
      # the caller's permissions, but the caller cannot grant more than it has.
      id-token: write
      contents: read
    outputs:
      stdout-artifact: opencode-stdout-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - name: Checkout caller repo
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}

      # Resolve any mutable npm spec (dist-tag, range) to a concrete version so
      # the cache key below pins to a stable identity. Inputs are routed via
      # env: to keep them out of the shell body (no injection vector).
      - name: Resolve plugin + CLI versions
        id: resolve
        env:
          PLUGIN_SPEC: ${{ inputs.plugin-version }}
          OPENCODE_SPEC: ${{ inputs.opencode-version }}
        run: |
          set -euo pipefail
          resolve_version() {
            npm view "$1" version 2>/dev/null | tail -1 | tr -d '[:space:]'
          }
          plugin_version=$(resolve_version "@vymalo/opencode-oauth2@${PLUGIN_SPEC:-latest}")
          opencode_version=$(resolve_version "opencode@${OPENCODE_SPEC:-latest}")
          if [ -z "$plugin_version" ] || [ -z "$opencode_version" ]; then
            echo "::error::Could not resolve plugin or CLI version" >&2
            exit 1
          fi
          prefix="$HOME/.opencode-oauth2-setup"
          mkdir -p "$prefix"
          node_version=$(node --version)
          {
            echo "plugin-version=$plugin_version"
            echo "opencode-version=$opencode_version"
            echo "prefix=$prefix"
            echo "modules=$prefix/lib/node_modules"
            echo "bin=$prefix/bin"
            echo "node-version=$node_version"
          } >> "$GITHUB_OUTPUT"

      - name: Restore install cache
        id: cache
        uses: actions/cache@v4
        with:
          path: ${{ steps.resolve.outputs.prefix }}
          key: vymalo-opencode-oauth2-${{ runner.os }}-node-${{ steps.resolve.outputs.node-version }}-plugin-${{ steps.resolve.outputs.plugin-version }}-cli-opencode@${{ steps.resolve.outputs.opencode-version }}

      - name: Install opencode + plugin
        if: steps.cache.outputs.cache-hit != 'true'
        env:
          PLUGIN_VERSION: ${{ steps.resolve.outputs.plugin-version }}
          OPENCODE_VERSION: ${{ steps.resolve.outputs.opencode-version }}
          PREFIX: ${{ steps.resolve.outputs.prefix }}
        run: |
          set -euo pipefail
          npm install -g --prefix "$PREFIX" --no-audit --no-fund \
            "opencode@$OPENCODE_VERSION" \
            "@vymalo/opencode-oauth2@$PLUGIN_VERSION"

      - name: Export PATH and NODE_PATH
        env:
          MODULES: ${{ steps.resolve.outputs.modules }}
          BIN: ${{ steps.resolve.outputs.bin }}
        run: |
          echo "NODE_PATH=$MODULES" >> "$GITHUB_ENV"
          echo "$BIN" >> "$GITHUB_PATH"

      - name: Verify opencode config exists
        run: |
          set -euo pipefail
          cfg="${{ inputs.opencode-config-path }}"
          if [ ! -f "$cfg" ]; then
            echo "::error::opencode config not found at $cfg — commit one (see docs/github-actions.md)" >&2
            exit 1
          fi
          # The config dir is what OPENCODE_CONFIG_DIR points to; opencode will
          # read opencode.json from there.
          echo "OPENCODE_CONFIG_DIR=$(dirname "$cfg")" >> "$GITHUB_ENV"

      - name: opencode run
        id: run
        run: |
          set -euo pipefail
          mkdir -p /tmp/opencode-out
          opencode run \
            --model "${{ inputs.model }}" \
            "${{ inputs.prompt }}" \
            | tee /tmp/opencode-out/stdout.txt

      - name: Upload stdout as artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: opencode-stdout-${{ github.run_id }}-${{ github.run_attempt }}
          path: /tmp/opencode-out/stdout.txt
          if-no-files-found: warn