Context
Observed in PR #31 during GitHub Actions run 29202306851.
Phenomenon
/review-pr is correctly expanded to the review-pr-orchestrator agent.- The reviewer agents complete their analysis and produce seven findings classified as inline findings.
- No inline pull-request review comments are submitted.
- The findings are instead posted as one top-level PR conversation comment by
opencode-agent[bot].
- The workflow job still finishes successfully.
Cause
The structured review flow requires the orchestrator to write {body, comments} to:
$HOME/.config/opencode/review-state/initial.json
The bundled opencode.jsonc allows the individual review-state files under external_directory, while denying all other external paths.
At runtime, OpenCode evaluates access to the state file using the directory pattern:
/home/runner/.config/opencode/review-state/*
That pattern does not match the individual-file allow entries, so the default deny rule is applied. The orchestrator is therefore unable to write the structured review payload.
Because the payload is not written, review-pr-submit.sh submit-initial is not reached and the GitHub pull-request review API is not called. The model then returns the findings as normal assistant output, which opencode github run publishes as a top-level comment.
Issues
- The documented inline-review-only behavior is not preserved.
- Actionable findings with valid diff anchors are emitted outside the structured review API.
- A structured-submission failure does not fail the workflow; fail-closed behavior depends on model compliance with prompt instructions.
- The successful job conclusion hides the review delivery failure.
- Existing Bats tests write the state files directly from the test shell and do not exercise OpenCode's runtime permission evaluation, so this failure is not detected by the current test suite.
Evidence
Context
Observed in PR #31 during GitHub Actions run
29202306851.Phenomenon
/review-pris correctly expanded to thereview-pr-orchestratoragent.opencode-agent[bot].Cause
The structured review flow requires the orchestrator to write
{body, comments}to:The bundled
opencode.jsoncallows the individual review-state files underexternal_directory, while denying all other external paths.At runtime, OpenCode evaluates access to the state file using the directory pattern:
That pattern does not match the individual-file allow entries, so the default deny rule is applied. The orchestrator is therefore unable to write the structured review payload.
Because the payload is not written,
review-pr-submit.sh submit-initialis not reached and the GitHub pull-request review API is not called. The model then returns the findings as normal assistant output, whichopencode github runpublishes as a top-level comment.Issues
Evidence