Repository navigation
build(deps): bump anomalyco/opencode/github from 2.0.18 to 2.2.6 - #1106
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [anomalyco/opencode/github](https://github.com/anomalyco/opencode) from 2.0.18 to 2.2.6. - [Release notes](https://github.com/anomalyco/opencode/releases) - [Changelog](https://github.com/anomalyco/opencode/blob/dev/CHANGELOG.md) - [Commits](anomalyco/opencode@cd9a14a...dc2ffcf) --- updated-dependencies: - dependency-name: anomalyco/opencode/github dependency-version: 2.2.6 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The files' contents are under analysis for test generation. |
|
Review changes with |
|
Review these changes at https://app.gitnotebooks.com/LAF-US/IDAHO-VAULT/pull/1106 |
|
🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews. |
|
We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage. |
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
![gitginie[bot]](https://avatars.githubusercontent.com/in/712912?s=60&v=4){kind=small}
There was a problem hiding this comment.
@dependabot[bot]
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!
✅ Precogs scan complete — No security issues foundCommit
✅ Passed checks (3)
💬 Precogs.ai · Detect. Fix. Merge. |
![inspect-review[bot]](https://avatars.githubusercontent.com/in/3177512?s=60&v=4){kind=small}
There was a problem hiding this comment.
inspect review
Triage: 1 entities analyzed | 0 critical, 0 high, 1 medium, 0 low
Verdict: standard_review
Findings (0)
Reviewed by inspect | Entity-level triage found 0 high-risk changes
✅ SEO Review - no issues introduced by this PRClean - this PR introduces no SEO issues. ✅ 721 checks passed
SEOCode · Docs & troubleshooting
|
Sieve Security Scan ✅No likely vulnerabilities found in changed files. 0 real · 0 suppressed · 0 FP · 0 total |
QWED Security Verification Report1 files scanned | 0 blocked | 0 warnings | 0 info | 0 suppressed | 1 verified Engines
Verified Files
Verified by QWED — deterministic security verification. No LLM used. Verification Context v1.0{
"spec_version": "1.0",
"object": {
"formal_statement": "LAF-US/IDAHO-VAULT@840abafa (PR #1106) is safe to merge"
},
"context": {
"interpretation": {
"theory": "deterministic security verification",
"logic": "evidence-context-policy pipeline"
},
"proof": {
"verifier": "QWED Security",
"verifier_version": "qwed-security-ruleset/15",
"configuration": {
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "840abafae00c564d7c5078d94af336f3b42372b0",
"files_scanned": 1
},
"theory_scope": "PR security scan against QWED deterministic rule set",
"trusted_dependencies": [
"qwed-security"
],
"outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
},
"evidence": {
"evidence": {
"status": "VERIFIED",
"agent_message": "VERIFIED against the QWED deterministic rule set: no security boundary violations detected in the scanned files. This attests to the absence of known-pattern violations for this rule set and commit \u2014 it is not a guarantee that the code is free of all vulnerabilities.",
"developer_fields": {
"total_findings": 0,
"advisory_checks": []
},
"is_authoritative": true,
"proof_ref": "sha256:d437d80e1f9f3edbbae181ff6d402ac3aab235a9e46c0ff1a6923cb5f8604830",
"scan_evidence": {
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "840abafae00c564d7c5078d94af336f3b42372b0",
"pr_number": 1106,
"files_scanned": 1,
"engine_results": 6,
"conclusion": "success",
"rule_set": "qwed-security-ruleset/15",
"engines": [
"ci_scan",
"entropy_scan",
"pattern_scan",
"secret_scan"
]
},
"repo": "LAF-US/IDAHO-VAULT",
"head_sha": "840abafae00c564d7c5078d94af336f3b42372b0",
"files_scanned": 1
},
"proof_ref": "sha256:fc00714426d1a5e02dcc6894eb5a6b7e9a97823be60e88644940fab15871e352"
},
"decision": {
"admission": "ADMIT"
}
},
"verdict": "VERIFIED"
}Attestation (signed, binds the Verification Context above){
"envelope": "qwed-security-attestation/1",
"token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjU2NWFkMDg2NGY3NWJkYmIiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiIyNzU5NTA0IiwiYXVkIjoicXdlZC1hdHRlc3RhdGlvbiIsImlhdCI6MTc5NDQzMjg3NSwiZXhwIjoxNzk0NDMzMTc1LCJxd2VkIjp7InJlc3VsdCI6eyJzdGF0dXMiOiJWRVJJRklFRCIsImFnZW50X21lc3NhZ2UiOiJWRVJJRklFRCBhZ2FpbnN0IHRoZSBRV0VEIGRldGVybWluaXN0aWMgcnVsZSBzZXQ6IG5vIHNlY3VyaXR5IGJvdW5kYXJ5IHZpb2xhdGlvbnMgZGV0ZWN0ZWQgaW4gdGhlIHNjYW5uZWQgZmlsZXMuIFRoaXMgYXR0ZXN0cyB0byB0aGUgYWJzZW5jZSBvZiBrbm93bi1wYXR0ZXJuIHZpb2xhdGlvbnMgZm9yIHRoaXMgcnVsZSBzZXQgYW5kIGNvbW1pdCBcdTIwMTQgaXQgaXMgbm90IGEgZ3VhcmFudGVlIHRoYXQgdGhlIGNvZGUgaXMgZnJlZSBvZiBhbGwgdnVsbmVyYWJpbGl0aWVzLiIsImlzX2F1dGhvcml0YXRpdmUiOnRydWV9LCJwcm9vZl9oYXNoIjoic2hhMjU2OmQ0MzdkODBlMWY5ZjNlZGJiYWUxODFmZjZkNDAyYWMzYWFiMjM1YTllNDZjMGZmMWE2OTIzY2I1Zjg2MDQ4MzAiLCJib3VuZGFyeSI6bnVsbCwiZW52ZWxvcGUiOiJxd2VkLXNlY3VyaXR5LWF0dGVzdGF0aW9uLzEiLCJqdGkiOiIwM2NhNTA0YTRmMjIwNDA4NTg2NWNmNzViOWY4MTRiZSIsInZlcmlmaWNhdGlvbl9jb250ZXh0Ijp7InNwZWNfdmVyc2lvbiI6IjEuMCIsImZvcm1hbF9zdGF0ZW1lbnQiOiJMQUYtVVMvSURBSE8tVkFVTFRAODQwYWJhZmEgKFBSICMxMTA2KSBpcyBzYWZlIHRvIG1lcmdlIiwidmVyZGljdCI6IlZFUklGSUVEIiwiYWRtaXNzaW9uIjoiQURNSVQiLCJ2ZXJpZmllciI6IlFXRUQgU2VjdXJpdHkiLCJ2ZXJpZmllcl92ZXJzaW9uIjoicXdlZC1zZWN1cml0eS1ydWxlc2V0LzE1IiwicHJvb2ZfcmVmIjoic2hhMjU2OmZjMDA3MTQ0MjZkMWE1ZTAyZGNjNjg5NGViNWE2YjdlOWE5NzgyM2JlNjBlODg2NDQ5NDBmYWIxNTg3MWUzNTIifX19.Ukc5qt5-95eFbGjxd4PWT74DyR0KK-uPSDgbW3mQr96Ms4KY15KL2HHQFkkRKOh8t1AMI0nK4JrtDdIX9mDCt3ZcGULgapvkkjvl5O0Y29IPDXMaVqr7TcQgz02n29LSHYXhtKAqWXN8XOzOFmwz_hlFNQMgIvi4EvCQKlBD3qaPfu2zM106qkHLEKUyydQ_X-QRdz9Yyo30XkImNyAFZMHT-RXF3vMNHx9-vTrbaTSoHh1IB8Pc8UqcD9KFYJYlP5nXzAQX1kPCxaCjCkXCUsqFcqLjEi0H4rfk_N6mtY8IbnfLT9-qZHbe0EfenGSSYv2vSbV32TacsWZpE_wK5Q",
"fingerprint": "eacaa0eb48a83af2",
"jwks_url": "https://qwed-security-334760594829.us-central1.run.app/.well-known/jwks.json",
"kid": "565ad0864f75bdbb"
} |
Revieko — PR review
No matching hunks for extensions: .py Full report: HTML · Markdown · JSON Details
— Generated by Revieko · Install GitHub App · Documentation Link details
|
|
REQUEST_APPROVAL · merge · sha256:fc02b39…7b9192 · expires 2026-11-12T02:15:38Z · CONTROL_PLANE_CHANGE Next step for an agent: await_approval. |
🛡️ Zaxion Policy Status: 🟢 PASSGateway Passed
Visit the Full Report for detailed metrics, findings, and interactive remediation. |
|
No critical paths modified ✅ |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
This bump points the workflow at a ref where the action no longer exists. Upstream deleted github/ in v2.2.0, so the job fails at setup and every /oc comment stops working.
Reviewed changes
- Action pin bump —
anomalyco/opencode/githubmoves fromcd9a14a6…(# v2.0.18) todc2ffcf8…(# v2.2.6) in.github/workflows/opencode.yml. The SHA does match thev2.2.6tag, but that tag is a core release tag and no longer carries the action. - Workflow context checked —
issue_comment/pull_request_review_commenttrigger on/ocor/opencode,id-token: write, read-only repo scopes,model: opencode/claude-opus-4-7, notimeout-minutes.
⚠️ Dependabot is tracking core tags for an action that has its own version line
The action is released separately as github-v1.x.y; the core v2.x tags merely happened to bundle the github/ directory until it was deleted. Left as-is, dependabot will keep proposing core-tag bumps that break this workflow on every release.
Technical details
# Split version lines: `v2.x` (core) vs `github-v1.x.y` (action)
## Affected sites
- `.github/workflows/opencode.yml:32` — pin resolves to a tree without `action.yml`
- `.github/dependabot.yml:13` — `github-actions` update rule with no `ignore` entry, so core-tag bumps recur
## Evidence
- `github/action.yml` returns HTTP 200 at `v2.1.4` (`68bc26b7…`) and HTTP 404 at
`v2.2.0` (`1097e266…`) and `v2.2.6` (`dc2ffcf8…`).
- Recursive trees at `v2.2.0` and `v2.2.6` (`truncated: false`) contain no path
beginning with `github/`.
- `CHANGELOG.md` → v2.2.0 "Breaking changes": *"The OpenCode GitHub Action is no
longer published. Remove it from your workflows."* (anomalyco/opencode#59032)
- Last published action release: `github-v1.2.28` =
`17b79f4e0c16dcff200b0417567ed22aeb2d7166`, whose `github/action.yml` exposes
the same `model` / `agent` / `variant` / `mentions` inputs this workflow uses.
## Required outcome
- The workflow must never reference a ref without `github/action.yml`, and the
dependency rule must stop re-proposing core-tag bumps.
## Suggested approach (optional)
- Repin to `17b79f4e0c16dcff200b0417567ed22aeb2d7166 # github-v1.2.28`, or retire
the workflow and run `opencode github run` from an explicit CLI install step.
- Add to `.github/dependabot.yml`:
```yaml
ignore:
- dependency-name: "anomalyco/opencode/github"
```
- Independent of this PR: the action installs `releases/latest` at runtime, so
the CLI always floats. Since v2.2.6 `opencode run` waits on background jobs with
no time limit, and this job has no `timeout-minutes` — worth adding one while
the file is being touched.
## Open questions for the human (optional)
- Is the `/oc` comment responder still wanted, or should the workflow be removed
now that upstream has dropped the action?big-pickle (free) ｜ 𝕏
|
|
||
| - name: Run opencode | ||
| uses: anomalyco/opencode/github@cd9a14a6b688d4021bee381dfd39d2cef9c0f862 # v2.0.18 | ||
| uses: anomalyco/opencode/github@dc2ffcf8bf26f9e669b6aa22b95f50e12be15e06 # v2.2.6 |
Contributor
There was a problem hiding this comment.
This ref has no action to run: upstream deleted the github/ directory in v2.2.0, so dc2ffcf8… (a core release tag) contains no github/action.yml and the job fails during setup with Can't find 'action.yml', 'action.yaml', or 'Dockerfile' under 'anomalyco/opencode/github'. Every /oc and /opencode comment would stop working after this merges.
Technical details
# Pin resolves to a tree without `github/action.yml`
## Affected sites
- `.github/workflows/opencode.yml:32` — `anomalyco/opencode/github@dc2ffcf8…`
## Evidence
- `contents/github/action.yml?ref=<sha>`: HTTP 200 at `v2.1.4` (`68bc26b7…`),
HTTP 404 at `v2.2.0` (`1097e266…`) and `v2.2.6` (`dc2ffcf8…`).
- Recursive tree at `dc2ffcf8…` (12340 entries, `truncated: false`) has no path
starting with `github/`.
- `CHANGELOG.md` → v2.2.0 "Breaking changes": *"The OpenCode GitHub Action is no
longer published. Remove it from your workflows."* (anomalyco/opencode#59032)
## Required outcome
- The workflow references a ref that actually contains the action, or stops
referencing the action at all.
## Suggested approach (optional)
- Last published action release is `github-v1.2.28` =
`17b79f4e0c16dcff200b0417567ed22aeb2d7166`; its `github/action.yml` exists and
accepts the same `model` input this workflow passes, so
`uses: anomalyco/opencode/github@17b79f4e0c16dcff200b0417567ed22aeb2d7166 # github-v1.2.28`
restores working behavior.
- Alternatively retire the workflow and invoke `opencode github run` from an
explicit CLI install step.
Contributor
Up to standards ✅🟢 Issues
|
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — Verification needed
Whether the pinned action waits for a background job and handles timeout cancellation as claimed, and whether this workflow exercises that behavior.
Exact-head CI remains unresolved (1 failed, 2 pending); no CI-dependent merge-safety claim is made.
Owner action: Exercise a finite background job and a timeout-stopped run, or inspect the pinned action’s implementation.
Review details and evidence
Material unknowns
- Whether the pinned action waits for a background job and handles timeout cancellation as claimed, and whether this workflow exercises that behavior. The supplied release notes describe the intended behavior but do not establish that this workflow exercises it. Evidence that the action does not wait or cannot be stopped as claimed would change the judgment to request changes.
LlamaPReview checks
- Read the complete PR-head file
.github/workflows/opencode.yml.
LlamaPReview is open source. Explore the code behind this review.
Copilot stopped reviewing due to an error
November 11, 2026 21:54
Copilot stopped reviewing due to an error
November 11, 2026 22:15
Contributor
There was a problem hiding this comment.
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Copilot review overview
No open issues 🎉
What changed in this PR
Updates the anomalyco/opencode GitHub Action version used in CI to a newer release.
Changes:
- Bump
anomalyco/opencode/githubaction from v2.0.18 to v2.2.6 (pinned by commit SHA)
| File | Description |
|---|---|
| .github/workflows/opencode.yml | Updates the pinned anomalyco/opencode action revision to v2.2.6 to run the newer action in the workflow. |
Review effort: Lite
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps anomalyco/opencode/github from 2.0.18 to 2.2.6.
Release notes
Sourced from anomalyco/opencode/github's releases.
... (truncated)
Changelog
Sourced from anomalyco/opencode/github's changelog.
... (truncated)
Commits
dc2ffcfrelease: v2.2.633f94fcfeat(codemode): expose the VM's suspendable program API (#62413)0f09070fix(tui): return to MCP list after OAuth sign-in (#62245)649f0d5fix(tui): allow favoriting models without a connected integration (#62244)91732f2fix(app): only attach comment@mentionsthat exist (#62242)4db5933chore(infra): stop tracking the regional hostname (#62439)de6f469feat(site): focus the desktop page on four features (#62433)2fdc064fix(site): keep earlier builds' hashed assets after a deploy (#62431)6e92017fix(site): tell search engines not to index dev.opencode.ai (#62430)cd47971feat(site): restyle the docs in the site's shell on dev.opencode.ai (#62425)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Bumps the OpenCode GitHub Action in the CI workflow from v2.0.18 to v2.2.6 and updates the pinned commit SHA in
.github/workflows/opencode.yml.Behavior changed
opencode runnow waits for background jobs (shell commands, subagents, image jobs) before exiting, so CI runs can stay open until those jobs finish or hit a timeout.Written for commit 840abaf. Summary will update on new commits.