feat: automatic PR review workflow with OpenCode AI

[himanshu231204]

What

Adds a new GitHub Actions workflow that automatically reviews every PR using OpenCode AI when it's opened or updated.

How it works

1. Triggers on pull_request events: opened, synchronize, reopened, ready_for_review
2. Skips draft PRs (they aren't ready for review)
3. Runs OpenCode AI with a structured review prompt
4. Posts a review comment covering:
   • Summary of changes
   • Issues found (categorized: BUG, SECURITY, PERFORMANCE, STYLE, TEST)
   • Severity levels (LOW / MEDIUM / HIGH)
   • Positive notes
   • Verdict (APPROVE / COMMENT / REQUEST CHANGES)

Configuration

Setting	Value
Model	opencode/deepseek-v4-flash-free
Secret	OPENCODE_API_KEY (already configured)
Concurrency	Cancels in-progress reviews for same PR
Skip conditions	Draft PRs

Verification

After merging, open any PR and check the Actions tab — the workflow should trigger automatically and post a review comment.

[opencode-agent]

Summary

Adds a .github/workflows/pr-review.yml workflow that automatically reviews PRs using the anomalyco/opencode/github GitHub Action on pull_request events.

---

Issues Found

[BUG] MEDIUM — Missing use_github_token: true and GITHUB_TOKEN

File: .github/workflows/pr-review.yml:41-44

The workflow does not set use_github_token: true or pass GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}. The official OpenCode docs example for PR auto-review explicitly includes both. Without them, the action falls back to OIDC token exchange with api.opencode.ai, which requires the OpenCode GitHub App to be installed on the repo. The PR description only mentions OPENCODE_API_KEY being configured — no mention of the GitHub App installation.

Suggested fix: Add use_github_token: true and the GITHUB_TOKEN env var:

      - name: Run OpenCode PR Review
        uses: anomalyco/opencode/github@latest
        env:
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          model: opencode/deepseek-v4-flash-free
          use_github_token: true
          prompt: |
            ...

[BUG] MEDIUM — pull-requests: read permission insufficient for posting reviews

File: .github/workflows/pr-review.yml:31

pull-requests: read only allows viewing PRs, not creating review comments or issue comments on PRs. If use_github_token is enabled (see above), the GITHUB_TOKEN will lack write access. The action needs pull-requests: write to post a review and issues: write if it falls back to issue-comment posting.

Suggested fix:

    permissions:
      id-token: write
      contents: read
      pull-requests: write
      issues: write

[STYLE] LOW — Unpinned action version with @latest

File: .github/workflows/pr-review.yml:41

Using @latest makes the workflow unpredictable — a new release could break the workflow without a PR change. Pin to @v1 or a specific commit SHA.

Suggested fix: uses: anomalyco/opencode/github@v1

---

Positive Notes

• Concurrency control is a nice touch not in the official example — cancel-in-progress: true prevents wasted runs.
• Draft PR skip (github.event.pull_request.draft == false) correctly avoids reviewing work-in-progress.
• Well-structured prompt with categorized issues, severity levels, and explicit formatting requirements — this should produce consistent, actionable reviews.
• Clean formatting — proper YAML structure, readable job/step names, and clear comments.

---

Verdict

REQUEST CHANGES — The missing use_github_token: true/GITHUB_TOKEN and insufficient pull-requests: read permission are blocking issues that will cause the workflow to fail at runtime. These must be addressed before merging.

opencode session  |  github run

[github-actions]

🎉 Congratulations @himanshu231204!

Your pull request has been successfully merged into main. 🚀

Thank you for contributing to OpenAgentHQ and helping improve the project.

We truly appreciate your contribution and hope to see you back with more amazing PRs!

Happy Open Sourcing! ❤️