Add a link to the deployment on oc build

[33Fraise33]

When /oc build is being triggered, link the build to the issue on github so it is clear which pipeline is fixing the issue

[33Fraise33]

/oc plan look how this can be implemented to make it clearer for the code owner that an action is awaiting approval for an issue

[opencode-agent]

Recommended implementation

Create bidirectional links between the issue and the pending build:

1. Comment on the issue before the environment gate

   • In .github/workflows/opencode.yml, after build authorization succeeds but before the opencode-build environment-gated job starts, add a notification job.

   • Post a deterministic comment such as:

     ⏳ OpenCode build requested and awaiting approval.
     Review the deployment workflow

   • Use github.server_url, github.repository, and github.run_id to construct the link.

   • Use the authorized target number/output rather than parsing the untrusted command again.

   • Run this only for accepted /oc build requests—not plans, rejected requests, or disabled builds.

   • Make retries idempotent by embedding a hidden marker keyed by the workflow run ID and updating an existing matching comment instead of posting duplicates.

2. Link the deployment back to its issue

   • Configure the gated job’s environment with the authorized issue or PR URL:

     environment:
       name: opencode-build
       url: ${{ needs.authorize.outputs.target_url }}

   • This lets the code owner identify the affected issue directly from GitHub’s deployment-approval interface.

3. Keep permissions narrowly scoped

   • Give only the notification job the permission needed to create issue/PR conversation comments.
   • Do not expose OpenAI environment secrets or run repository code in that job.
   • Preserve the existing post-approval reauthorization before OpenCode executes.
   • Update the security description because docs/opencode-github.md currently states that pre-approval authorization uses only invisible, read-only GITHUB_TOKEN checks.

4. Add policy tests

   • Extend the workflow tests under .github/scripts/*.test.mjs to assert:
     • The notification depends on successful authorization.
     • It is restricted to build mode and the build-enabled path.
     • Its URL uses the current repository and run ID.
     • The environment URL comes from the authorized target.
     • Plans and rejected commands cannot post an approval notification.
     • The build remains gated by opencode-build.
   • Update the workflow-policy smoke test in .github/workflows/workflow-lint.yml if it explicitly validates permissions or job structure.

5. Document the behavior

   • Update docs/opencode-github.md under Security Model and Commands to explain that an accepted build request adds an issue/PR comment linking to the pending workflow and that the approval deployment links back to its source issue.

This makes the pending action visible where the owner is already reviewing the issue while also making the approval page identify exactly which issue the deployment addresses.

github run

[33Fraise33]

/oc build implement the requested changes

[opencode-agent]

Created PR #13

github run