ci: add concurrency and permissions to opencode-review workflow

[zhensherlock]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vue-devtools-unlocker	Building	Preview, Comment	Mar 3, 2026 3:04am

[github-actions]

Code Review: opencode-review.yml

Summary

The PR adds concurrency settings and a permissions block to the GitHub Actions workflow. Overall the changes are reasonable, but there are some issues.

Issues Found

1. Unnecessary id-token: write permission (line 20)

   • This permission allows minting OIDC tokens for cloud provider authentication
   • Not needed for a code review workflow and is a security risk
   • Recommendation: Remove this permission

2. Potentially unnecessary actions: read permission (line 22)

   • The workflow doesn't appear to read action workflow information
   • Recommendation: Remove if not used

3. Potentially unnecessary issues: write permission (line 24)

   • The review prompt focuses on pull requests, not issues
   • Recommendation: Remove if the opencode tool doesn't write to issues

Suggested Fix

Replace the permissions block with a more minimal set:

permissions:
  contents: read
  pull-requests: write

Positive Changes

• ✅ Concurrency settings (lines 7-9) are well-configured
• ✅ cancel-in-progress: true prevents wasted CI resources
• ✅ timeout-minutes: 10 prevents runaway workflows
• ✅ persist-credentials: false is good security practice
• ✅ Author association filter is appropriate

opencode session  |  github run