OpenCode: run it headless in scripts and CI, with JSON output

The Stack

Tested Against

Prerequisites

• OpenCode installed
• A provider logged in to actually run it

Steps

1. 1

   Write a read-only headless invocation and validate it

   opencode run executes a prompt non-interactively; --format json gives machine-readable events. Pin the CI run to the read-only plan agent. For PRs, `opencode github install` wires a GitHub Actions workflow. CI checks the invocation uses --agent plan --format json and that plan denies edit/bash.

   cat > opencode.json <<'JSON'
   {
     "$schema": "https://opencode.ai/config.json",
     "agent": {
       "plan": { "mode": "primary", "model": "provider/your-model", "permission": { "edit": "deny", "bash": "deny" } }
     }
   }
   JSON
   cat > ci-review.sh <<'SH'
   #!/usr/bin/env bash
   opencode run --agent plan --format json "Review the uncommitted changes for bugs and security issues"
   SH
   node -e 'const fs=require("fs");const c=JSON.parse(fs.readFileSync("opencode.json","utf8"));const p=c.agent.plan.permission;const safe=p.edit==="deny"&&p.bash==="deny";const cmd=fs.readFileSync("ci-review.sh","utf8");const usesPlan=cmd.indexOf("--agent plan")>=0;const usesJson=cmd.indexOf("--format json")>=0;if(safe&&usesPlan&&usesJson){console.log("config OK: headless run uses --agent plan --format json, plan is read-only (edit/bash deny)")}else{console.log("BAD");process.exit(1)}'

2. 2

   Wire it into the pipeline (the model step, not checked by CI)

   Run the script in CI, or attach fast runs to a warm server: `opencode serve &` then `opencode run --attach http://localhost:4096 -m provider/your-model "..."`. The actual run executes the model, so CI never claims it.