Skip to content

Fix OpenCode install source - #747

Merged
mariusvniekerk merged 1 commit into
mainfrom
middleman/issue-745-which-opencode-implementation-is-supported-for-roborev
May 26, 2026
Merged

Fix OpenCode install source#747
mariusvniekerk merged 1 commit into
mainfrom
middleman/issue-745-which-opencode-implementation-is-supported-for-roborev

Conversation

@mariusvniekerk

Copy link
Copy Markdown
Collaborator

Summary

  • point README OpenCode setup at the supported anomalyco/opencode distribution
  • update generated GitHub Action setup to install opencode-ai@latest
  • adjust ghaction tests for the new install command

Validation

  • go fmt ./...
  • go vet ./...
  • go test ./internal/ghaction
  • go test ./... (fails in unrelated internal/git TestGetMainRepoRootForBareBackedWorktree: git config core.worktree exit status 128)

The README and generated GitHub Action setup still pointed at the old Go module path, but roborev supports the anomalyco/opencode CLI distribution. Use the current npm package install path so local setup docs and CI bootstrap install the agent roborev expects.

Validation: go fmt ./...; go vet ./...; go test ./internal/ghaction; go test ./... (fails in internal/git TestGetMainRepoRootForBareBackedWorktree with git config core.worktree exit status 128, unrelated to this change).

Generated with Codex
Co-authored-by: Codex <codex@openai.com>
@roborev-ci

roborev-ci Bot commented May 26, 2026

Copy link
Copy Markdown

roborev: Combined Review (633b574)

The PR has one Medium security concern: generated CI installs OpenCode from a mutable npm latest package.

Medium

  • internal/ghaction/ghaction.go:119 - Generated GitHub Actions workflows now run npm install -g opencode-ai@latest for the opencode agent. Because latest is mutable and npm packages can run install-time scripts, a compromised package or malicious release could execute attacker-controlled code in CI before the review step runs with credentials such as ANTHROPIC_API_KEY.

    Suggested remediation: pin OpenCode to an explicit reviewed version, or require users to configure a fixed agent version. Prefer install methods with verifiable provenance or checksums where possible. Also update README.md:186 so the documented recommendation matches the safer pinned CI guidance.


Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

@mariusvniekerk
mariusvniekerk merged commit 57cb444 into main May 26, 2026
8 checks passed
@mariusvniekerk
mariusvniekerk deleted the middleman/issue-745-which-opencode-implementation-is-supported-for-roborev branch May 26, 2026 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant