opencode-action

Run an OpenCode agent from GitHub issue and pull request comments.

Quick start

1. Add a provider secret

In Settings → Secrets and variables → Actions, add the API key for your model provider. The example below uses OPENCODE_API_KEY.

2. Add the workflow

Create .github/workflows/opencode.yml:

---
name: OpenCode
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write
jobs:
  opencode:
    if: contains(github.event.comment.body, '/oc') || contains(github.event.comment.body, '/opencode')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Run OpenCode
        uses: dceoy/opencode-action@419cdd50ed88bd77dd429ebb683e8d18b03ac89a # v0.4.0
        env:
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          GITHUB_TOKEN: ${{ github.token }}
        with:
          model: opencode-go/kimi-k3

3. Comment on an issue or pull request

/opencode explain this issue

The shorter /oc trigger also works:

/oc fix this

The default setup exchanges the workflow OIDC token for an OpenCode GitHub App token, which requires id-token: write.

Models and secrets

Set model to a provider/model value and pass the corresponding API key:

Provider	Example model	Secret
OpenCode	opencode-go/kimi-k3	OPENCODE_API_KEY
OpenRouter	openrouter/openrouter/free	OPENROUTER_API_KEY
Anthropic	anthropic/claude-opus-5	ANTHROPIC_API_KEY
OpenAI	openai/gpt-5.6-sol	OPENAI_API_KEY
Custom provider	myprovider/my-model	Provider-specific

The provider account must have sufficient credits or quota. For providers not built into OpenCode, see Custom providers.

Inputs

Input	Default	Description
model	Required	Model in provider/model format.
agent	build	Primary agent. A slash command can override it.
prompt	Event comment	Fixed prompt to use instead of the triggering comment.
mentions	/opencode,/oc	Comma-separated trigger phrases.
variant	-	Provider-specific reasoning effort.
share	false	Share the OpenCode session.
use-github-token	false	Use the workflow token instead of the default App-token flow.
opencode-version	latest	OpenCode version to install. /review-pr requires 1.2.14+; the bundled Sakura provider's chunkTimeout needs 1.2.25+ (older pins fall back to the request timeout).
use-bundled-toolkit	true	Use the bundled agents, commands, skills, and configuration.
timeout-minutes	60	Stop OpenCode after this many minutes.
oidc-base-url	https://api.opencode.ai	OIDC exchange URL for a custom GitHub App installation.

When use-github-token: true, keep GITHUB_TOKEN in env and grant only the permissions needed for the task.

Outputs are opencode-version and cache-hit. cache-hit is empty on review-only runs (prompt: /review-pr), which always skip the cache and install fresh.

Pull request reviews

Set prompt: /review-pr to run the bundled read-only pr-review skill through its backward-compatible command wrapper. Findings are deduplicated, validated against the diff, and posted inline when they can be anchored to changed lines. Agents can also load the skill directly through OpenCode's native skill tool, but only /review-pr carries the read-only guarantees; see Pull request reviews.

The default review runs the core quality, performance, coverage, documentation, security, and correctness reviewers; specialty reviewers beyond that set are added only when the diff matches their documented concern or an aspect such as security, tests, docs, or performance explicitly requests them. Provider request and chunk timeouts and the action's timeout-minutes watchdog are safety limits; they do not replace bounded request context or guarantee that a provider gateway or inference request will remain open.

See Pull request reviews for setup, supported review aspects, submission behavior, and security guarantees.