ci(review): add OpenCode pull request workflow

.github/workflows/code-review.yml

@@ -0,0 +1,64 @@
+name: Code review
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+
+concurrency:
+  group: code-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    name: OpenCode review
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Run code review
+        env:
+          AUTO_APPROVE_ON_CLEAN_REVIEW: "true"
+          GIT_PLATFORM_TYPE: github
+          GIT_REPO_URL: ${{ github.server_url }}/${{ github.repository }}.git
+          GIT_REPO_TOKEN: ${{ secrets.CODE_REVIEW_GITHUB_TOKEN || github.token }}
+          LOG_LEVEL: DEBUG
+          OPENCODE_UPSTREAM_ENDPOINT: ${{ vars.OPENCODE_UPSTREAM_ENDPOINT }}
+          OPENCODE_UPSTREAM_API_KEY: ${{ secrets.OPENCODE_UPSTREAM_API_KEY }}
+          OPENCODE_MODEL: ${{ vars.OPENCODE_MODEL }}
+        run: |
+          set -euo pipefail
+
+          for name in \
+            OPENCODE_UPSTREAM_ENDPOINT \
+            OPENCODE_UPSTREAM_API_KEY \
+            OPENCODE_MODEL
+          do
+            if [ -z "${!name:-}" ]; then
+              echo "::error::Missing GitHub Actions configuration: ${name}"
+              exit 1
+            fi
+          done
+
+          docker run --rm \
+            -e AUTO_APPROVE_ON_CLEAN_REVIEW \
+            -e GIT_PLATFORM_TYPE \
+            -e GIT_REPO_URL \
+            -e GIT_REPO_TOKEN \
+            -e LOG_LEVEL \
+            -e OPENCODE_UPSTREAM_ENDPOINT \
+            -e OPENCODE_UPSTREAM_API_KEY \
+            -e OPENCODE_MODEL \
+            whhe/code-review-bot:opencode \
+            --cr-id "${{ github.event.pull_request.number }}"

AGENTS.md

@@ -148,3 +148,14 @@ commands; the bot does not enumerate agent instruction files. Git clone and fetc
 credential helper so tokens are never embedded in workspace URLs or Git metadata. The agent
 factory explicitly forwards only the required OpenCode runtime environment through ACP's filtered
 subprocess environment. Existing global config files are left untouched.
+
+`.github/workflows/code-review.yml` runs `whhe/code-review-bot:opencode` for non-draft,
+same-repository pull requests targeting `main` and skips fork pull requests. Dependabot pull
+requests are allowed to run, but GitHub does not provide Actions secrets and grants the built-in
+`GITHUB_TOKEN` read-only permissions for those runs. The workflow therefore prefers an optional
+`CODE_REVIEW_GITHUB_TOKEN` secret and falls back to the built-in token; Dependabot reviews require
+same-named Dependabot secrets for that write-capable token and `OPENCODE_UPSTREAM_API_KEY`. The
+workflow uses repository variables for `OPENCODE_UPSTREAM_ENDPOINT` and `OPENCODE_MODEL`.
+It enables clean-review approval with `AUTO_APPROVE_ON_CLEAN_REVIEW=true` and debug logging with
+`LOG_LEVEL=DEBUG`; the repository must allow GitHub Actions to create and approve pull requests for
+the built-in token to approve a clean review.

docker/README.md

@@ -173,6 +173,39 @@ The image `ENTRYPOINT` runs bootstrap setup then `exec`s the job command. GitLab
 `GITLAB_TOKEN` and `ANTHROPIC_API_KEY` as masked CI/CD variables in that project's settings.
 Optionally set `ANTHROPIC_MODEL`.
 
+### GitHub Actions
+
+The repository includes `.github/workflows/code-review.yml`, which reviews pull requests targeting
+`main` with `whhe/code-review-bot:opencode`. Configure these values under **Settings → Secrets and
+variables → Actions** before enabling the workflow:
+
+| Type | Name | Description |
+|---|---|---|
+| Repository variable | `OPENCODE_UPSTREAM_ENDPOINT` | OpenAI-compatible API base URL |
+| Repository variable | `OPENCODE_MODEL` | Upstream model ID |
+| Repository secret | `OPENCODE_UPSTREAM_API_KEY` | Upstream API credential |
+
+The workflow sets `AUTO_APPROVE_ON_CLEAN_REVIEW=true` and `LOG_LEVEL=DEBUG`. Under **Settings →
+Actions → General → Workflow permissions**, enable **Allow GitHub Actions to create and approve
+pull requests** so clean reviews can be approved with the built-in `GITHUB_TOKEN`.
+
+The workflow runs for opened, updated, reopened, and ready-for-review pull requests. It uses the
+built-in `GITHUB_TOKEN` with `contents: read` and `pull-requests: write`. The workflow itself does
+not check out or directly execute the pull-request branch, and it skips draft and fork pull
+requests. Fork pull requests are skipped because GitHub does not expose repository secrets to
+their `pull_request` workflows; branches inside the repository should therefore be limited to
+trusted collaborators. Dependabot pull requests are not skipped, but GitHub supplies Dependabot
+secrets instead of Actions secrets and gives the built-in `GITHUB_TOKEN` read-only permissions for
+those runs. To review them, add these values under **Settings → Secrets and variables →
+Dependabot**:
+
+| Name | Description |
+|---|---|
+| `OPENCODE_UPSTREAM_API_KEY` | The same upstream API credential used by regular reviews |
+| `CODE_REVIEW_GITHUB_TOKEN` | Fine-grained token limited to this repository, with Contents read and Pull requests write permissions |
+
+Regular pull requests use the built-in `GITHUB_TOKEN` when `CODE_REVIEW_GITHUB_TOKEN` is absent.
+
 ### Other platforms
 
 Adapt the example above to your platform's workflow syntax. Any CI environment that can run a