anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Why is opencode github app requesting permission to read secrets? #1476

New Issue
Closed
opened 2026-02-16 17:31:09 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 17:31:09 -05:00
Owner
Copy Link
Copy Source

Originally created by @joshuacc on GitHub (Aug 24, 2025).

Originally assigned to: @fwang on GitHub.

Does the app really need these permissions?

This sort of request makes my spidey sense go off.

image

Originally created by @joshuacc on GitHub (Aug 24, 2025). Originally assigned to: @fwang on GitHub. Does the app really need these permissions? This sort of request makes my spidey sense go off. ![image](https://github.com/user-attachments/assets/0c1d8236-1eb1-4ed2-bcaa-8ca635cbd496)
yindo closed this issue 2026-02-16 17:31:09 -05:00
yindo commented 2026-02-16 17:31:09 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Aug 24, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #1687: Similar security concerns about the opencode GitHub app and avoiding its use due to security considerations

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Aug 24, 2025): This issue might be a duplicate of existing issues. Please check: - #1687: Similar security concerns about the opencode GitHub app and avoiding its use due to security considerations Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:31:09 -05:00
Author
Owner
Copy Link
Copy Source

@fwang commented on GitHub (Aug 24, 2025):

We are making the opencode github install command automatically add the model provider's api key to GitHub secrets. Currently this had to be done manually.

Despite the permission says read and write, GitHub api actually never reveals the secret values.

@fwang commented on GitHub (Aug 24, 2025): We are making the `opencode github install` command automatically add the model provider's api key to GitHub secrets. Currently this had to be done manually. Despite the permission says `read and write`, GitHub api actually never reveals the secret values.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#1476
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?