A fresh runner has no `opencode auth` store and the API key prompt needs
a TTY, so the run failed with provider.no-route. Write a CI-only config
mapping opencode-go/opencode to their secret env vars (with the read-only
permission rules repeated as a second layer), and surface OpenCode error
events in run and selftest output.
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
* feat: advisory AI review of needs-human and scout PRs with OpenCode V2
A scheduled workflow runs `opencode run` (V2, pinned and checksummed)
with a read-only catalog-reviewer agent over evidence bundles for open
PRs labeled needs-human or scout and for unreviewed scout candidates.
PRs get one verdict comment and an ai-* label; confident scout accepts
get a bot PR. It never merges or closes.
The model runs in a job with no GitHub token; the agent may only read,
glob and grep inside the repository (a self-test proves it before each
run); verdicts are schema-validated and rendered by our own code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* fix(ai-review): address CodeQL and SonarCloud security findings
Enforce HTTPS on the OpenCode download, run opencode by absolute path,
escape summary cells with escapeCell, rely on HTML escaping instead of
comment-stripping regexes, validate item IDs before routing API calls,
and bound verdict parsing on runaway output.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---------
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
* feat(health): re-check V1 plugins nightly and guard the sunset removal
Listed plugins kept their classified compat forever, so a plugin that
migrated after the V1 sunset notice would still be removed on 2027-01-01.
The nightly health job now re-detects every plugin not marked v2, opens a
bot/health-compat PR for the ones now on V2, removes V1 plugins after the
sunset only when the re-check still says V1, and keeps the v1-sunset
tracking issue current (one reminder 31 days before the sunset).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
* fix(health): sanitize logged values flagged by SonarCloud
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
---------
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
Cap Retry-After waits at 20s, lower scout's npm concurrency to 4, and add job timeouts so a rate-limited weekly or nightly run fails visibly instead of running for hours.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
needs-human is a maintainer gate (e.g. a project held for using the V1 SDK); re-running triage on a push used to replace it with ready.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GitHub creates pull_request runs for PRs opened or updated by github-actions[bot] as action_required, and that run (not a workflow_dispatch run on the same commit) is what the required check on main binds to. The README workflow, openPullRequest (submissions, scout, health) and reprobe now approve the held validate run. Generated files are allowed only on PRs opened by github-actions[bot] from this repo's bot/readme-* branches.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Deploy keys are disabled for this org and GitHub Actions cannot be a ruleset bypass actor, so main is protected by requiring a passing validate check on every commit. The README workflow stages its regenerated commit on bot/readme-<sha>, dispatches validate there (allowed to touch generated files only for that bot branch), waits for success and fast-forwards main. Adds a catalog policy link to the README header and documents the branch protection.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
An inconclusive probe no longer releases a PR that a reviewer held for V1 code. All outbound requests go through a host allowlist (api.github.com, registry.npmjs.org, api.npmjs.org).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Escape backslashes as well as pipes in markdown table cells
- Decide gist/discussion/npm-page links by parsed hostname instead of substring or unanchored regex checks (README, site)
- Encode every '/' in scoped npm names; validate npm names before calling the registry
- The REST helper only calls https://api.github.com and rejects dot segments
- npm ci --ignore-scripts in every workflow (no dependency needs install scripts)
- Move write permissions to job level in issues.yml and site.yml
Co-Authored-By: Claude Opus 5.5 <[email protected]>
check-pr no longer flags repo URL changes that GitHub redirects (renames/transfers) or that only add a monorepo path, so bot rename PRs stay clean. The scout files packages built on @opencode/plugin as plugins and other @opencode/* consumers (SDK/client tools) as projects.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
site/index.html is a dependency-free page over registry.json and a fresh health.json: search, category/kind/topic/API/maintenance filters, sorting by stars or recent updates, shareable URL state, light and dark themes, phone layout. site.yml rebuilds it on every catalog change and daily.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- health.yml: rolling "Catalog health report" issue; bot PRs that follow renamed repos and remove entries archived/missing/deprecated for 30+ days, and V1-only plugins after the 2027-01-01 sunset. Inactivity alone only changes a badge.
- reprobe.yml: re-checks needs-v2 PRs nightly; unblocks and notifies the original author when the target migrates (filling kind/topics/compat on same-repo branches), closes after 60 days on V1.
- scout.yml: weekly issue ranking npm packages published since V2 that depend on @opencode/* and are not listed yet; ticking a box opens a PR (maintainers only). discovery/declined.txt suppresses candidates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The "Add an entry" issue form collects fields; issues.yml runs scripts/submit-entry.js, which validates and probes the entry, comments the result and opens a PR from submission/<issue> (updated on every issue edit). Contributors never write YAML or touch the README, the two most common rejection causes. npm run new writes a correctly formatted entry locally. Bot PRs dispatch the validate check because GITHUB_TOKEN pushes do not trigger workflows.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
validate-pr.yml now runs on every PR (README-only PRs previously got no feedback), drops tj-actions/changed-files, runs unit tests, scripts/check-pr.js and a README/registry generation dry run, and supports workflow_dispatch so bot branches get the check. New plugin entries that are V1-only are blocked; declared compat must match what is detected. triage.yml labels PRs (ready, needs-v2, needs-metadata, needs-human, category) and keeps one results comment, using base-branch code only and reading PR files as data. The README workflow uses full history and Node 24.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A single unparseable entry used to blank a whole README category and still exit 0. generate-readme and export-json now validate the whole catalog and refuse to write on any problem, check that every entry renders exactly once, and escape contributor text. Plugins are grouped by primary topic and other categories by kind; plugins show V2 / V1 only / unverified; section headers show counts; a Recently Added table comes from git history. registry.json gains kind, topics, also, compat, repoPath and npmPackage (existing fields unchanged).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Entries gain a fixed kind and 1-3 topics (replacing 374 one-off tags as the categorization axis), an OpenCode API compat field (required for plugins), and npm/path for packages and monorepo folders. repo must be a repository root; unknown fields such as install: or repository: are rejected. Cross-entry rules (one entry per repo+path, kind must fit the category, no placeholder owners or mojibake) live in scripts/utils/catalog.js, and validate.js now always loads the whole catalog and fails on unparseable YAML. Adds npm run fmt for canonical formatting and drops the unused glob dependency.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Update `generate-readme.yml` to trigger on `main` branch pushes.
- Change `generate-readme.js` exit code to 1 on errors for CI failure.
- Fix formatting in `template.js` for entry summary HTML.
- Renames the `description` field to `tagline` in schema and data files.
- Renames the `full_description` field to `description` in schema and data files.
- Updates all relevant YAML data files, documentation, and templates to reflect these changes.
- Adjusts character limits and descriptions for the new fields.
