feat: add reusable OpenCode runner

[xnoto]

Summary

Adds a reusable, caller-scoped OpenCode GitHub Actions workflow. It receives only a caller repository path containing canonical agents and skills plus KIMI_API_KEY; stages an isolated runner configuration; installs OpenCode 1.18.23; and invokes opencode github run with sharing disabled.

Fixes # — not applicable

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — final-head lint passed at 87c84d0573afd0b1319b678aacc5caf9ea3f6fec.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed

Impact and rollout

Producer: makeitworkcloud/shared-workflows owns the reusable opencode.yml workflow interface. It accepts one required config-source-path input and one required KIMI_API_KEY secret. The workflow runs on ubuntu-24.04, checks out the caller repository, and needs caller-granted contents, pull-requests, and issues write permissions for OpenCode's existing branch/comment delivery behavior.

This repair selects no consumer. The originally proposed charts caller in makeitworkcloud/charts#66 is closed unmerged; its historical immutable pin was 73444d2177762549d8c476dc612f23811e0a2180. No active caller or secret provisioning is established by this repair. No existing reusable interface, ARC runner contract, OpenTofu behavior, chart artifact, GitOps desired state, or deployment changes were made.

The runner requires a KIMI_API_KEY Actions secret in each opt-in caller. Current tfroot-github source does not distribute it to charts; encrypted-secret provisioning is a separate confirmation- and OpenTofu-gated change.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — no caller references this workflow until a reviewed caller PR merges; revert this workflow before adopting it to disable new use

AI agent materially produced this change. Knowledge source revision consulted: 25417c8d85ca246f7afb570630bf4ca463401999. Existing caller search found only opentofu.yml and _dependabot-notify.yml consumers; neither is changed.

October 2 conflict repair

Updated this feature branch with current main and reconciled only the README, preserving current stale-lifecycle, environment-gated apply, runner, and setup guidance alongside the original OpenCode guide. The workflow remains byte-identical to its original blob b629be5a23c71d3f5e6e1f023cb55a1a036d3dac. Independent adversarial and delivery reviews found no Critical/High issue in the repair delta; they do not approve the pre-existing workflow design or caller activation. Normal PR CI passed; no local validation, workflow dispatch, PR merge, publication, secret change, or live operation occurred. Merge and any later caller adoption remain separate owner-confirmation gates.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed