[xnoto]

Summary

Replace the owner-rejected custom integration with the explicitly selected official OpenCode V1 GitHub action.

• 50-line reusable workflow, two action steps, no custom script steps. Checkout plus anomalyco/opencode/github, pinned to the verified v1.19.4 commit.
• Delete the custom test workflow and 344-line harness; remove generated policies, custom agents, orchestration, stream parsing, and sticky-comment plumbing from the final diff.
• Keep default-off gates, same-repository PR filtering, a 20-minute timeout, cancellation, a short advisory prompt, and upstream plan agent selection.
• Update one README row and a short guide. Final net diff is exactly three paths: workflow, README, guide.

Owner explicitly accepted the limited V1 scope after evaluation. No linked issue.

Type of change

• Feature / enhancement
• Documentation
• CI / reusable workflow

Validation

• Current-head lint/actionlint (cleanup head pending)
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; no generated caller is included.

Current head: 9717f7ad44794abb28f99f3f95541ad2b3a29e6d. Lint/actionlint passed on the preceding cleanup head in run 40419511947. The former 17 passing mock tests covered the rejected implementation and are not evidence for this replacement. No local tests, inference, or workflow dispatch were run. No bespoke replacement harness was added.

Independent completed reviews: adversarial ADVANCE, infrastructure security ADVANCE for disabled authoring only, DevOps ADVANCE after inspecting the complete replacement contract, QA GAPPED with documented runtime gaps and approval of obsolete-test removal. No unresolved Critical/High disabled-draft finding or waiver.

Runtime-contract validation found that the upstream GitHub handler ignores the action agent input. The workflow now uses the documented native inline default_agent: plan setting instead. Checkout credentials are retained, matching upstream token-mode requirements for authenticated private-repository fetches. These corrections were independently re-reviewed (adversarial/security/DevOps ADVANCE for disabled authoring only). No end-to-end provider/comment run has occurred; a caller, approved model/key, scoped enablement, and explicit pilot authorization remain required.

Static lint does not prove event gates, runtime dependencies, review quality, comment behavior, or credential isolation. A separately authorized security pilot remains mandatory before enabling.

Impact and rollout

shared-workflows / Make IT Work Cloud maintainers own the wrapper; tfroot-github owns future generated .github/workflows/opencode-review.yml callers, which must select a reviewed immutable shared commit. No caller, model choice, credential provisioning, repository setting, apply, adoption, or activation is delivered here. Existing ARC/OpenTofu workflows and lint remain unchanged. No chart release, image publication, or cluster rollout.

Accepted upstream limits: new comment per run rather than sticky; actor permission checks can reject bots/Dependabot; forks excluded; no exact-SHA stale-publication guard, chart reviewer reuse, completion parser, guaranteed failure comment, or output sanitizer. Cancellation/re-execution can leave partial or duplicate comments. Green/skipped checks are not review-completion gates.

The action source is pinned, but its installer downloads the latest CLI and its nested cache uses a tag. Repository configuration/plugins and the composite installer can encounter provider credentials. The prompt and plan agent are not a security sandbox. Security review advances only the disabled draft; trusted execution and credential boundaries must be established in an approved pilot before activation. No extra scripts are proposed to emulate missing upstream features.

Stages: authored and statically reviewed; current cleanup-head lint/actionlint pending; downstream caller selection/adoption remains unperformed; merge, apply, credential provisioning, pilot, and explicit enablement remain separately confirmation-gated. Rollback is leaving both enablement gates off; no runtime adoption occurs from this PR.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — none activated by this draft

AI-assisted implementation and independent AI review. No merge or activation is authorized.

Authorized pilot result

The owner separately authorized two PR-49-only attempts with the existing OPENAI_API_KEY secret and openai/gpt-6.1-sol, reporting the key/gate ready and then the gate corrected. Both attempts finished skipped before the review job ran any steps:

• First pilot 40419059850, head 0128fd1fbc0f2e73001d057fe23a61b58d563806.
• Separately approved second pilot 40419335274, head 3982bad03c90ff916042050fc0f76b87d492abd9.

No provider call, authenticated runtime Git fetch, selected-agent execution, or review comment is verified. Inference: the remaining repository-variable enablement condition is false/unavailable; variable metadata cannot be read through the available GitHub MCP tools, so that root cause is not independently confirmed. No gate bypass or automatic retry occurred.

The temporary caller was removed after each terminal attempt; final cleanup is 10b605ec1b08cad216bf8fd88555b43322bf732e. The final net diff is again only the 50-line reusable workflow, README row, and guide. Both default-off controls remain; there is no installed caller. Further credentialed execution needs a verified gate and fresh owner authorization. This implementation is statically CI-validated, not end-to-end validated.

Third separately authorized pilot

After the owner explicitly confirmed the gate verified and authorized one more attempt, run 40420031353 at 3f0083dbff54490d2a25a99581ebe90578c3daef also completed skipped, with no steps in pilot / review. The temporary caller was removed at 9717f7ad44794abb28f99f3f95541ad2b3a29e6d; the source tree matches the preceding cleanup tree. No inference or review comment was verified.

The gate-variable explanation above remains only a hypothesis, not a confirmed root cause; the owner reports it configured. Repeating the identical credentialed pilot is not justified. A credential-free diagnostic of the evaluated conditions is the next proposed investigation, not yet implemented or authorized here. No gate bypass, automatic retry, merge, or distributed adoption occurred.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed