opencode-security.yml

name: Code Foundry Security

on:
  pull_request:
    branches: [main]
    types:
      - ready_for_review
      - synchronize
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: code-foundry-opencode-security-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  # Only superseded pull-request scans are cancelled; dispatches queue.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  detect:
    name: OpenCode Security / Detect
    # The OPENCODE_SECURITY repository or organization variable is the only
    # enablement control, so gate the detector itself on it: a disabled
    # repository must not allocate a runner just to report that it is off.
    if: >-
      vars.CI_BILLING_PAUSED != 'true' &&
      vars.OPENCODE_SECURITY == 'true' &&
      (github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false))
    runs-on: ubuntu-slim
    timeout-minutes: 10
    outputs:
      enabled: ${{ steps.detect.outputs.enabled }}
      token: ${{ steps.detect.outputs.token }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Detect configuration and token
        id: detect
        env:
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          OPENCODE_SECURITY: ${{ vars.OPENCODE_SECURITY }}
        run: |
          enabled=false
          token=false
          # OpenCode Security is controlled only by the repository or
          # organization variable. An unset value is disabled.
          if [ "$OPENCODE_SECURITY" = "true" ]; then
            enabled=true
          fi
          if [ -n "$OPENCODE_API_KEY" ]; then token=true; fi
          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
          echo "token=$token" >> "$GITHUB_OUTPUT"

  # Reusable workflows can only be called from a job level, so the scan is
  # its own job gated on the detect outputs. The scanner runs for any ready
  # pull request (or manual dispatch) when the repository variable opts in
  # and the API key is configured.
  scan:
    name: OpenCode Security / Scan
    needs: detect
    if: >-
      vars.CI_BILLING_PAUSED != 'true' &&
      needs.detect.outputs.enabled == 'true' &&
      needs.detect.outputs.token == 'true'
    uses: 0xPlayerOne/opencode-security/.github/workflows/opencode-security.yml@137698ef3545204af8fad00fc8bd64d663c8122e # main
    with:
      # This is the scanner checkout ref, not the consumer PR ref. The
      # reusable workflow already checks out the consumer repository.
      source_ref: 137698ef3545204af8fad00fc8bd64d663c8122e
      runner: ubuntu-latest
      model: opencode-go/muse-spark-1.3-contributor
      mode: standard
      fail_on_severity: high
      max_cost_usd: 1
    secrets:
      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}