Repository navigation
chore(ci): remove the opencode workflow - #15
Merged
Merged
Conversation
The opencode job invoked anomalyco/opencode/github, whose composite action queries releases/latest and pipes https://opencode.ai/install | bash at run time, in a workflow holding OPENCODE_API_KEY, GITHUB_TOKEN and contents:write. Pinning the uses: ref froze the wrapper, not the install script, so the supply-chain exposure could not be removed by pinning. Delete it instead of carrying an unpinnable third-party installer.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Deletes
.github/workflows/opencode.yml— the only opencode-associated workflow in any ofthe 58
nicolasestremrepos (checked every.github/workflows/*.yml|yamlacross theinventory).
Why delete rather than pin
The job ran
anomalyco/opencode/github@77fc88c8…, but at that pinned commit the compositeaction queries
https://api.github.com/repos/anomalyco/opencode/releases/latestand thenexecutes
curl -fsSL https://opencode.ai/install | bash. The SHA freezes the wrapper; itdoes not freeze what is downloaded and executed at run time. The workflow held
OPENCODE_API_KEY,GITHUB_TOKENandcontents: write, so the unpinnable install path wasthe actual risk — pinning only satisfied the linter.
Alert
Closes code-scanning alert #1 (
actions/unpinned-tag,.github/workflows/opencode.yml),dismissed as won't fix and pointing here: the offending file no longer exists on the
default branch once this merges, so the pin no longer has a subject.
No other file in the repo references opencode or anomalyco. No C# touched — the
net8.0-windowsbuild/test cannot run on this Linux host and is unaffected by a workflow deletion.