fix(ci): install pinned OpenCode runtime binary

[seonghobae]

Root cause

The hourly maintenance workflow deliberately installed the pinned npm dependency with lifecycle scripts disabled, but then invoked OpenCode without running its required pinned postinstall. Scheduled run 32945907828 therefore failed before any maintenance request with opencode-ai postinstall script was not run.

Fix

Keep generic npm lifecycle scripts disabled, then invoke only the exact locked opencode-ai postinstall entrypoint explicitly.

Evidence

• Hourly workflow contract: 1 passed
• actionlint: clean
• Locked install + explicit postinstall: OpenCode 1.18.22 starts
• npm audit: 0 vulnerabilities

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 38 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 32ba5a9c-5ab4-4132-90b8-1145039416bd

📥 Commits

Reviewing files that changed from the base of the PR and between 5a01759 and 73a5510.

📒 Files selected for processing (4)

• .github/opencode/hourly-loop-prompt.md
• .github/workflows/opencode-hourly-loop.yml
• scripts/ci/install_locked_opencode.mjs
• tests/test_hourly_opencode_loop_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Supply-chain audit found the upstream postinstall.mjs can run an out-of-lockfile npm install fallback when its optional binary is absent. Exact fix: the workflow now runs scripts/ci/install_locked_opencode.mjs, which only resolves the platform package installed by integrity-checked npm ci, requires the exact version declared by opencode-ai, copies that binary, and fails closed without network/package-manager subprocesses. Local evidence: real CLI 1.18.22; contract 1 passed; actionlint and diff-check clean.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Exact-head runtime dispatch 32986962178 proves the locked install boundary: npm ci --ignore-scripts, the checked-in installer, and OpenCode startup all completed on 73a5510f; the agent reached build · orchestrator/auto. The later run failure is a separate gateway request-contract result (400 invalid_tools: OpenCode emitted a tool description above the gateway 1024-character boundary), not an installer failure. The always-.exe target is verified against pinned opencode-ai@1.18.22 package metadata and its declared bin path; informational thread resolved.