Feat: add a self hosted photon service for the dawarich instance #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| name: OpenCode | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| concurrency: | |
| group: opencode-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| jobs: | |
| authorize: | |
| if: >- | |
| (github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR') && | |
| (startsWith(github.event.comment.body, '/oc ') || | |
| startsWith(github.event.comment.body, '/opencode ')) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| issues: read | |
| pull-requests: read | |
| outputs: | |
| mode: ${{ steps.command.outputs.mode }} | |
| model: ${{ steps.command.outputs.model }} | |
| prompt: ${{ steps.command.outputs.prompt }} | |
| target_type: ${{ steps.target.outputs.target_type }} | |
| target_number: ${{ steps.target.outputs.target_number }} | |
| target_state: ${{ steps.target.outputs.target_state }} | |
| target_updated_at: ${{ steps.target.outputs.target_updated_at }} | |
| base_ref: ${{ steps.target.outputs.base_ref }} | |
| head_ref: ${{ steps.target.outputs.head_ref }} | |
| head_sha: ${{ steps.target.outputs.head_sha }} | |
| head_repo: ${{ steps.target.outputs.head_repo }} | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Parse and authorize command | |
| id: command | |
| run: node .github/scripts/opencode-command.mjs | |
| - name: Require repository write access | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| MODE: ${{ steps.command.outputs.mode }} | |
| GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }} | |
| run: node .github/scripts/opencode-authorize-actor.mjs | |
| - name: Authorize target | |
| id: target | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| MODE: ${{ steps.command.outputs.mode }} | |
| run: node .github/scripts/opencode-target.mjs | |
| plan: | |
| if: needs.authorize.outputs.mode == 'plan' | |
| needs: authorize | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| environment: opencode-plan | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Install pinned OpenCode | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/opencode-linux-x64.tar.gz" | |
| install_dir="$RUNNER_TEMP/opencode" | |
| mkdir -p "$install_dir" | |
| curl --fail --location --proto '=https' --tlsv1.2 \ | |
| --output "$archive" \ | |
| https://github.com/anomalyco/opencode/releases/download/v1.18.4/opencode-linux-x64.tar.gz | |
| printf '%s %s\n' \ | |
| bab463c3fb3224d388bb7cfad63f38703df9cf0be2cfd2ce8cb49d886b53a174 \ | |
| "$archive" | sha256sum --check --strict | |
| tar -xzf "$archive" -C "$install_dir" | |
| "$install_dir/opencode" --version | |
| printf '%s\n' "$install_dir" >> "$GITHUB_PATH" | |
| - name: Configure OpenCode OAuth | |
| env: | |
| OPENAI_OAUTH_ACCESS_TOKEN: ${{ secrets.OPENAI_OAUTH_ACCESS_TOKEN }} | |
| OPENAI_OAUTH_REFRESH_TOKEN: ${{ secrets.OPENAI_OAUTH_REFRESH_TOKEN }} | |
| OPENAI_OAUTH_EXPIRES: ${{ secrets.OPENAI_OAUTH_EXPIRES }} | |
| OPENAI_OAUTH_ACCOUNT_ID: ${{ secrets.OPENAI_OAUTH_ACCOUNT_ID }} | |
| run: node .github/scripts/opencode-auth.mjs | |
| - name: Run read-only OpenCode plan | |
| env: | |
| MODEL: ${{ needs.authorize.outputs.model }} | |
| OPENCODE_CONFIG_CONTENT: >- | |
| {"share":"disabled","default_agent":"github-plan","small_model":"openai/gpt-5.6-luna","enabled_providers":["openai"],"provider":{"openai":{"whitelist":["gpt-5.6-sol","gpt-5.6-terra","gpt-5.6-luna"]}},"formatter":false,"lsp":false} | |
| PROMPT: ${{ needs.authorize.outputs.prompt }} | |
| SHARE: 'false' | |
| run: opencode github run | |
| build: | |
| if: >- | |
| needs.authorize.outputs.mode == 'build' && | |
| vars.OPENCODE_BUILD_ENABLED == 'true' | |
| needs: authorize | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| environment: opencode-build | |
| permissions: | |
| contents: read | |
| issues: read | |
| pull-requests: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.repository.default_branch }} | |
| - name: Install pinned OpenCode | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| archive="$RUNNER_TEMP/opencode-linux-x64.tar.gz" | |
| install_dir="$RUNNER_TEMP/opencode" | |
| mkdir -p "$install_dir" | |
| curl --fail --location --proto '=https' --tlsv1.2 \ | |
| --output "$archive" \ | |
| https://github.com/anomalyco/opencode/releases/download/v1.18.4/opencode-linux-x64.tar.gz | |
| printf '%s %s\n' \ | |
| bab463c3fb3224d388bb7cfad63f38703df9cf0be2cfd2ce8cb49d886b53a174 \ | |
| "$archive" | sha256sum --check --strict | |
| tar -xzf "$archive" -C "$install_dir" | |
| "$install_dir/opencode" --version | |
| printf '%s\n' "$install_dir" >> "$GITHUB_PATH" | |
| - name: Verify authorized target | |
| env: | |
| AUTHORIZED_BASE_REF: ${{ needs.authorize.outputs.base_ref }} | |
| AUTHORIZED_HEAD_REF: ${{ needs.authorize.outputs.head_ref }} | |
| AUTHORIZED_HEAD_REPO: ${{ needs.authorize.outputs.head_repo }} | |
| AUTHORIZED_HEAD_SHA: ${{ needs.authorize.outputs.head_sha }} | |
| AUTHORIZED_TARGET_STATE: ${{ needs.authorize.outputs.target_state }} | |
| AUTHORIZED_UPDATED_AT: ${{ needs.authorize.outputs.target_updated_at }} | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| TARGET_NUMBER: ${{ needs.authorize.outputs.target_number }} | |
| TARGET_TYPE: ${{ needs.authorize.outputs.target_type }} | |
| run: node .github/scripts/opencode-verify-target.mjs | |
| - name: Reauthorize commenter after approval | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| MODE: build | |
| GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }} | |
| run: node .github/scripts/opencode-authorize-actor.mjs | |
| - name: Configure OpenCode OAuth | |
| env: | |
| OPENAI_OAUTH_ACCESS_TOKEN: ${{ secrets.OPENAI_OAUTH_ACCESS_TOKEN }} | |
| OPENAI_OAUTH_REFRESH_TOKEN: ${{ secrets.OPENAI_OAUTH_REFRESH_TOKEN }} | |
| OPENAI_OAUTH_EXPIRES: ${{ secrets.OPENAI_OAUTH_EXPIRES }} | |
| OPENAI_OAUTH_ACCOUNT_ID: ${{ secrets.OPENAI_OAUTH_ACCOUNT_ID }} | |
| run: node .github/scripts/opencode-auth.mjs | |
| - name: Run constrained OpenCode build | |
| env: | |
| MODEL: ${{ needs.authorize.outputs.model }} | |
| OPENCODE_CONFIG_CONTENT: >- | |
| {"share":"disabled","default_agent":"github-build","small_model":"openai/gpt-5.6-luna","enabled_providers":["openai"],"provider":{"openai":{"whitelist":["gpt-5.6-sol","gpt-5.6-terra","gpt-5.6-luna"]}},"formatter":false,"lsp":false} | |
| PROMPT: ${{ needs.authorize.outputs.prompt }} | |
| SHARE: 'false' | |
| run: opencode github run |