fix(ci): register OpenCode Zen catalog credential

[seonghobae]

Root cause

The protected hourly catalog workflow transported five provider credentials after discovery added OpenCode Zen as a sixth required source. Run 32945020378 therefore failed before discovery. The same run also exposed its generated run-scoped KV passphrase in the Actions environment preamble because it was exported before being masked.

Fix

• transport OPENCODE_ZEN_API_KEY into the one-shot KV bootstrap
• derive the workflow inventory from the same explicit six-name contract
• mask the generated run-scoped passphrase before writing it to GITHUB_ENV
• document and test the complete inventory

The previously shown passphrase was generated for an ephemeral PostgreSQL service destroyed with that workflow run; it is not a reusable production credential.

Verification

• 38 focused provider bootstrap/catalog tests passed
• actionlint passed
• git diff --check passed

---

Summary by CodeRabbit

• 새 기능

  • OpenCode Zen API 자격 증명을 provider catalog 동기화에 추가했습니다.
  • 실행 범위 KV passphrase를 후속 워크플로 단계로 전달할 때 자동으로 마스킹합니다.

• 버그 수정

  • 자격 증명 누락 및 민감 정보 노출을 검증하는 자동화 검사를 강화했습니다.

• 문서

  • 추가된 자격 증명과 변경된 provider bootstrap 구성을 문서화했습니다.

[coderabbitai]

Warning

Review limit reached

Next included review available in 21 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: da8e2667-4381-40a3-b625-ac4af84806f5

📥 Commits

Reviewing files that changed from the base of the PR and between af68d63 and 93e81e8.

📒 Files selected for processing (6)

• AGENTS.md
• CHANGELOG.md
• contextual_orchestrator/model_discovery.py
• docs/doctoring/current-main-provider-bootstrap.md
• docs/kv-credentials.md
• docs/planning/adrs/0015-durable-provider-catalog.md

📝 Walkthrough

Walkthrough

워크플로가 run-scoped KV passphrase를 로그에 마스킹한 뒤 export합니다. OPENCODE_ZEN_API_KEY를 credential 환경 변수와 검증 목록에 추가합니다. 테스트와 bootstrap 문서 및 변경 기록을 갱신합니다.

Changes

Provider catalog 동기화

Layer / File(s)	Summary
워크플로 credential 및 passphrase 처리 .github/workflows/provider-catalog-sync.yml	생성된 passphrase를 ::add-mask::로 등록하고 RUN_SCOPED_KV_PASSPHRASE에 기록합니다. OPENCODE_ZEN_API_KEY를 환경 변수, credential 검증 집합, 누출 검사 목록에 추가합니다.
검증 및 bootstrap 기록 tests/test_provider_bootstrap_secret_normalization.py, docs/doctoring/current-main-provider-bootstrap.md, CHANGELOG.md	passphrase 마스킹과 전체 credential 등록을 검증하는 회귀 테스트를 추가합니다. 운영 credential 수와 변경 기록을 갱신합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to af68d

The workflow now requires six provider credentials, but the operator documentation still lists only five and omits OPENCODE_ZEN_API_KEY; following that documentation could make catalog bootstrap fail. The PR is otherwise mergeable with explicit owner awareness or a documentation follow-up.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 OpenCode Zen 자격 증명을 provider catalog에 등록하는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (3 skipped: 3 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/provider-catalog-opencode-zen-secret

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 0 new potential issues.

[devin-ai-integration]

Devin Review found 0 new potential issues.

[seonghobae]

Superseded by PR #868. Exact comparison against #868 head ba718c3c showed the OpenCode Zen workflow transport and complete provider inventory were already implemented and tested in 1bbda718. The one unique stronger change in this PR—masking the generated run-scoped KV passphrase before exporting it, plus the stricter workflow inventory assertions—was preserved in #868 as 8abc4b45 (focused tests: 9 passed; actionlint passed). The remaining #869 changes are older provider-count/gateway documentation that would overwrite the current six-account plus configured-gateway contract. Closing unmerged; the branch is retained.