Conversation
Introduce shared `.github/scripts/auth.sh` for command parsing and three new workflows (opencode-pr-review, opencode-pr-comment, opencode-issue-handler) covering all six processes. Deprecate old workflows to no-ops and update sync configuration and documentation.
Warning Review limit reached
Next review available in:23 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe PR adds shared ChangesOpenCode automation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Commenter
participant GitHubActions
participant auth.sh
participant OpenCode
participant GitHubAPI
Commenter->>GitHubActions: Post /oc command
GitHubActions->>auth.sh: Parse comment
auth.sh-->>GitHubActions: Command and task arguments
GitHubActions->>OpenCode: Run selected process
OpenCode->>GitHubAPI: Review, comment, commit, or create PR
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 14
🧹 Nitpick comments (2)
.github/scripts/auth.sh (1)
37-37: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value
reviewregex lacks a word boundary anchor.
^/oc[[:space:]]+reviewmatches/oc reviewtaskor/oc reviewsasSUBCOMMAND="review"since there's no end anchor afterreview. While unlikely in practice, adding a boundary check would prevent misrouting:- elif [[ "$TRIMMED" =~ ^/oc[[:space:]]+review ]]; then+ elif [[ "$TRIMMED" =~ ^/oc[[:space:]]+review($|[[:space:]]) ]]; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/auth.sh at line 37, Update the /oc review pattern in the command-dispatch conditional so it requires a word boundary or valid trailing whitespace/end-of-input after “review,” preventing values such as “reviewtask” or “reviews” from being classified as the review subcommand..github/workflows/opencode-issue-handler.yml (1)
149-161: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExport
TASK_ARGSfrom theroutejob to eliminate redundant parsing.
process-5re-checks out the repo and re-runsauth.shsolely to obtainTASK_ARGS, which theroutejob already parsed. ExportingTASK_ARGSas a route job output removes the second parse step and its associated script-injection surface.♻️ Proposed refactor
In the
routejob, add the output:outputs: process: ${{ steps.route.outputs.process }} + task_args: ${{ steps.parse.outputs.TASK_ARGS }}In
process-5, remove the parse step and use the route output:- name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false - - name: Parse task arguments- id: parse- run: |- chmod +x .github/scripts/auth.sh 2>/dev/null || true- .github/scripts/auth.sh "${{ toJSON(github.event.comment.body) }}"- - name: Run opencode (Process 5 — Issue Work & PR Creation) uses: anomalyco/opencode/github@77fc88c8ade8e5a620ebbe1197f3a572d29ae91a # latest env: OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} OPENCODE_TRIGGER_BODY: ${{ github.event.comment.body }} - OPENCODE_IMPLEMENT_ARGS: ${{ steps.parse.outputs.TASK_ARGS }}+ OPENCODE_IMPLEMENT_ARGS: ${{ needs.route.outputs.task_args }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-issue-handler.yml around lines 149 - 161, Export TASK_ARGS from the route job as a job output, then update the process-5 workflow to consume that route output through OPENCODE_IMPLEMENT_ARGS. Remove the process-5 “Parse task arguments” step and its auth.sh invocation so task arguments are parsed only once.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/opencode-issue-handler.yml:
- Line 210: Update Process 5 to pass the untrusted issue title through an
environment variable instead of interpolating github.event.issue.title directly
into the generated bash prompt. Replace issue-title and PR-title interpolations
with the environment-variable reference, and update the gh issue view and gh
issue comment commands to use the existing ISSUE_NUMBER variable; apply the same
changes at the corresponding later prompt section.
- Around line 40-42: Update the auth invocation and the corresponding process-5
parse step to pass github.event.comment.body through a step environment
variable, then reference that variable in the shell command instead of
interpolating toJSON(...) directly. Preserve the complete comment body as a
single argument so /oc commands with arguments continue to parse correctly, and
apply the same safe pattern to both steps.
- Around line 56-59: Add a timeout-minutes setting to the process-4 job, using a
10–15 minute limit appropriate for read-only issue analysis and consistent with
the existing process-5 timeout configuration.
In @.github/workflows/opencode-pr-comment.yml:
- Line 281: Update all four Process 6 `gh pr` command references to use
`github.event.issue.number` instead of `github.event.pull_request.number`,
including the checkout, edit, and comment operations. Preserve the existing
command behavior while ensuring the PR number is resolved correctly for
`issue_comment` events.
- Around line 40-44: Replace direct toJSON(github.event.comment.body)
interpolation in both the “Parse command” and “Parse task arguments” steps with
an environment variable, then pass that variable to auth.sh using shell-safe
expansion. Preserve the existing script arguments and behavior while ensuring
the comment body is never interpreted as shell syntax.
- Around line 113-122: Update the LAST_BOT_COMMENT query in the issue_comment
branch to inspect only the latest comment before the current event, excluding
the current comment, and determine whether that comment’s author is
opencode-agent[bot]. Preserve IS_BOT_THREAD=true only when that immediately
preceding comment was authored by the bot, rather than when any historical bot
comment exists.
- Around line 20-25: Update the route job’s if condition to require either a
non-issue_comment event or a truthy github.event.issue.pull_request value, while
preserving the existing bot exclusions and authorization checks. This must
prevent issue comments on non-PR issues from reaching the PR-specific process
routing.
- Around line 78-86: Update the permissions for the process-2 job to grant
contents: write instead of contents: read, while preserving the existing
id-token and pull-request permissions so fix requests can commit and push
through GITHUB_TOKEN.
In @.github/workflows/opencode-pr-review.yml:
- Around line 39-43: Update the “Parse command” step to pass
github.event.comment.body through an env variable, then invoke
.github/scripts/auth.sh with the quoted variable instead of interpolating
toJSON(...) directly in run; preserve the existing script permission handling
and ensure comment contents are never evaluated by the shell.
- Around line 16-26: Restrict the workflow trigger condition to the documented
`/oc` and `/oc review` commands instead of any `/oc` prefix, while preserving
the existing authorization, bot-user, open-issue, and pull-request checks.
Update the job condition in the workflow’s `if` expression, using
command-boundary-aware matching so unrecognized subcommands and commands handled
by `opencode-pr-comment.yml` do not run this workflow.
In @.github/workflows/WORKFLOWS.md:
- Around line 32-44: The Process 1 trigger documentation must match the broader
condition in opencode-pr-review.yml. Update the “Trigger” description to state
that any comment beginning with /oc triggers the process except /oc task and /oc
implement, and preserve the existing authorization and draft constraints.
- Around line 184-190: The Token Strategy section in WORKFLOWS.md does not match
the configured workflow values. Cross-reference opencode-pr-review.yml and
opencode-pr-comment.yml, then update the documentation to accurately describe
which steps use use_github_token: true versus the OpenCode App token, preserving
the distinction between read-only operations and privileged label or dispatch
actions.
In `@config/workflow-task-map.yaml`:
- Around line 7-9: Update the opencode-issue-handler mapping in
workflow-task-map.yaml to support job-level distinctions, so process-4 remains
mapped to issue-triage while process-5’s issue-implementation path receives its
correct task label. Adjust the mapping structure consumed by workflow_task_map
in the maintenance logic without changing the existing opencode-pr-review or
opencode-pr-comment mappings.
In `@README.md`:
- Around line 62-63: Regenerate the audit block in README.md so its summary
matches the current generated source output: update the workflow count to 4 and
the OpenCode step count to 4, preserving the existing audit block format.
---
Nitpick comments:
In @.github/scripts/auth.sh:
- Line 37: Update the /oc review pattern in the command-dispatch conditional so
it requires a word boundary or valid trailing whitespace/end-of-input after
“review,” preventing values such as “reviewtask” or “reviews” from being
classified as the review subcommand.
In @.github/workflows/opencode-issue-handler.yml:
- Around line 149-161: Export TASK_ARGS from the route job as a job output, then
update the process-5 workflow to consume that route output through
OPENCODE_IMPLEMENT_ARGS. Remove the process-5 “Parse task arguments” step and
its auth.sh invocation so task arguments are parsed only once.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ebbaf072-6c8c-41c9-bb6d-b25d8200eb26
📒 Files selected for processing (15)
.github/scripts/auth.sh.github/sync.yml.github/workflows/WORKFLOWS.md.github/workflows/opencode-implement.yaml.github/workflows/opencode-issue-handler.yml.github/workflows/opencode-pr-comment.yml.github/workflows/opencode-pr-review.yml.github/workflows/opencode-review.yaml.github/workflows/opencode-triage-issue.yaml.github/workflows/opencode-triage-pr.yaml.github/workflows/opencode-triage.yaml.github/workflows/opencode.ymlREADME.mdRUNBOOK.mdconfig/workflow-task-map.yaml
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Prevent `/oc reviewtask` from matching the review regex. Add a PR guard to prevent issue comments from triggering the PR workflow. Pass comment body and issue metadata via env vars to prevent shell injection. Improve bot thread detection to check only the immediately preceding comment.
new workflow to test
Summary by CodeRabbit
New Features
/ocautomation for issue reviews, implementation requests, PR reviews, discussion threads, and targeted PR tasks.Documentation
Deprecation