From 8a6b23de35bbcdb960e6d2ece0a4bdb70d20e92b Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:22:57 +0900
Subject: [PATCH 01/22] Use local action in mention workflow

---
 .github/workflows/opencode-bot.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index b77f79e..fbb6bc8 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -57,6 +57,10 @@ on:
         type: number
         description: Maximum minutes to let OpenCode run
         default: 60
+      action-ref:
+        required: true
+        type: string
+        description: OpenCode action revision to check out
       runs-on:
         required: false
         type: string
@@ -124,8 +128,16 @@ jobs:
           fetch-depth: 1
           token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
           persist-credentials: false
+      - name: Checkout OpenCode action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          repository: dceoy/opencode-action
+          ref: ${{ inputs.action-ref }}
+          path: .opencode-action
+          fetch-depth: 1
+          persist-credentials: false
       - name: Run OpenCode
-        uses: dceoy/opencode-action@v0  # zizmor: ignore[unpinned-uses] maintained by this repository's major release tag
+        uses: ./.opencode-action
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

From bba3969cf9a5a9f70f48e2634e20d52ee06c4f91 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:22:58 +0900
Subject: [PATCH 02/22] Use local action in review workflow

---
 .github/workflows/opencode-review.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index a91a42a..f5aa759 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -57,6 +57,10 @@ on:
         type: number
         description: Maximum minutes to let OpenCode run
         default: 60
+      action-ref:
+        required: true
+        type: string
+        description: OpenCode action revision to check out
       runs-on:
         required: false
         type: string
@@ -116,8 +120,16 @@ jobs:
           fetch-depth: 1
           token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
           persist-credentials: false
+      - name: Checkout OpenCode action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          repository: dceoy/opencode-action
+          ref: ${{ inputs.action-ref }}
+          path: .opencode-action
+          fetch-depth: 1
+          persist-credentials: false
       - name: Run OpenCode
-        uses: dceoy/opencode-action@v0  # zizmor: ignore[unpinned-uses] maintained by this repository's major release tag
+        uses: ./.opencode-action
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

From 3f58b6e0cd706ef16512cd448fafa3127fbd3b9d Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:23:00 +0900
Subject: [PATCH 03/22] Test the current local action revision

---
 .github/workflows/opencode.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index 2b82a7d..ce0667e 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -30,6 +30,7 @@ jobs:
     uses: ./.github/workflows/opencode-review.yml
     with:
       model: sakura/preview/Kimi-K2.7-Code
+      action-ref: ${{ github.sha }}
     secrets:
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -62,6 +63,7 @@ jobs:
     uses: ./.github/workflows/opencode-bot.yml
     with:
       model: sakura/preview/Kimi-K2.7-Code
+      action-ref: ${{ github.sha }}
     secrets:
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

From f3955814ebb44c514e388e4d36ed5d7cf03718c7 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:23:31 +0900
Subject: [PATCH 04/22] Document reusable workflow credentials and action refs

---
 docs/reusable-workflows.md | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index ad9b785..1a97cb3 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -2,7 +2,7 @@
 
 `opencode-action` publishes two reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
 
-The examples below pin the reusable workflow definition to the commit that introduced these workflows. The called workflow currently invokes `dceoy/opencode-action@v0` internally, so this fixes the workflow definition without making the nested action reference immutable.
+The examples below pin the reusable workflow definition and its `action-ref` input to the same commit. The called workflow checks out that OpenCode action revision and invokes it from a local path, so a full commit SHA makes both layers immutable.
 
 ## Mention bot
 
@@ -25,9 +25,10 @@ jobs:
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@7c392aad14ab1281630ae0c93e81d727f76b3e92
+    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@87c8c6821360f1ced2fbb0868fb8e583df100046
     with:
       model: opencode-go/kimi-k3
+      action-ref: 87c8c6821360f1ced2fbb0868fb8e583df100046
     secrets:
       OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
 ```
@@ -53,9 +54,10 @@ jobs:
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@7c392aad14ab1281630ae0c93e81d727f76b3e92
+    uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@87c8c6821360f1ced2fbb0868fb8e583df100046
     with:
       model: openrouter/openrouter/free
+      action-ref: 87c8c6821360f1ced2fbb0868fb8e583df100046
     secrets:
       OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
 ```
@@ -81,16 +83,17 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `opencode-version`    | `latest`                                                            | OpenCode version to install.                                  |
 | `use-bundled-toolkit` | `true`                                                              | Use the bundled OpenCode toolkit.                             |
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
+| `action-ref`          | Required                                                            | Revision of `dceoy/opencode-action` to check out.              |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
 ## Secrets
 
-Pass only the provider secret needed by the selected model. The reusable workflows accept `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `OPENROUTER_API_KEY`, `OPENCODE_API_KEY`, and `SAKURA_AI_ENGINE_API_KEY`.
+Pass only the provider secret needed by the selected model. The reusable workflows accept `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `OPENROUTER_API_KEY`, `OPENCODE_API_KEY`, `SAKURA_AI_ENGINE_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `GROQ_API_KEY`, `CEREBRAS_API_KEY`, and `MOONSHOT_API_KEY`.
 
-`GH_TOKEN` is optional. When omitted, the reusable workflow falls back to the caller's `github.token`. If `use-github-token: true`, ensure the caller grants the permissions required by the requested operation.
+`GH_TOKEN` is optional. When omitted, the reusable workflow falls back to the caller's `github.token`. With `use-github-token: true`, that fallback is limited to `contents: read` by the called workflow even if the caller grants `contents: write`. For code-writing operations such as `/oc fix this`, pass a separately write-scoped `GH_TOKEN`; otherwise GitHub API writes to repository contents fail with `403`.
 
 ## Permissions
 
-The reusable workflows request `contents: read`, `pull-requests: write`, `issues: write`, `id-token: write`, and `actions: read`. A called workflow cannot elevate the `GITHUB_TOKEN` permissions granted by its caller, so the calling job must grant the permissions needed by the selected mode.
+The reusable workflows request `contents: read`, `pull-requests: write`, `issues: write`, `id-token: write`, and `actions: read`. A called workflow can only maintain or reduce the caller's `GITHUB_TOKEN` permissions: the caller must grant the requested permissions, but its higher `contents` permission cannot override the called workflow's `contents: read` ceiling. A separately supplied `GH_TOKEN` is not governed by that `GITHUB_TOKEN` permission ceiling.
 
 The examples keep `permissions`, `with`, and `secrets` under the calling job so their scopes are explicit: `permissions` controls the caller token, `with` configures the reusable workflow inputs, and `secrets` passes credentials.

From 24ab45ed9f967ae7373973c03e43738c15324399 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:29:24 +0900
Subject: [PATCH 05/22] Run review workflow directly on pull requests

---
 .github/workflows/opencode-review.yml | 36 +++++++++++++++++++--------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index f5aa759..a407114 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -103,6 +103,10 @@ on:
       GH_TOKEN:
         required: false
         description: GitHub token for repository access
+  pull_request:
+    types:
+      - opened
+      - ready_for_review
 permissions:
   contents: read
   pull-requests: write
@@ -111,8 +115,18 @@ permissions:
   actions: read
 jobs:
   opencode-review:
-    if: github.event_name == 'pull_request'
-    runs-on: ${{ inputs.runs-on }}
+    if: >
+      github.event_name == 'pull_request'
+      && (
+        inputs.action-ref != ''
+        || (
+          contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
+          && (! github.event.pull_request.draft)
+          && (! startsWith(github.head_ref, 'dependabot/'))
+          && (! startsWith(github.head_ref, 'renovate/'))
+        )
+      )
+    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -124,7 +138,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: dceoy/opencode-action
-          ref: ${{ inputs.action-ref }}
+          ref: ${{ inputs.action-ref || github.sha }}
           path: .opencode-action
           fetch-depth: 1
           persist-credentials: false
@@ -144,14 +158,14 @@ jobs:
           MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         with:
-          model: ${{ inputs.model }}
-          agent: ${{ inputs.agent }}
+          model: ${{ inputs.model || 'sakura/preview/Kimi-K2.7-Code' }}
+          agent: ${{ inputs.agent || 'build' }}
           share: ${{ inputs.share }}
-          prompt: ${{ inputs.prompt }}
+          prompt: ${{ inputs.prompt || '/review-pr' }}
           use-github-token: ${{ inputs.use-github-token }}
-          mentions: ${{ inputs.mentions }}
+          mentions: ${{ inputs.mentions || '/opencode,/oc' }}
           variant: ${{ inputs.variant }}
-          oidc-base-url: ${{ inputs.oidc-base-url }}
-          opencode-version: ${{ inputs.opencode-version }}
-          use-bundled-toolkit: ${{ inputs.use-bundled-toolkit }}
-          timeout-minutes: ${{ inputs.timeout-minutes }}
+          oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
+          opencode-version: ${{ inputs.opencode-version || 'latest' }}
+          use-bundled-toolkit: ${{ inputs.action-ref == '' || inputs.use-bundled-toolkit }}
+          timeout-minutes: ${{ inputs.timeout-minutes || 60 }}

From 5def935731ee82aa448a64bf1a4b19adb0226ce8 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:29:37 +0900
Subject: [PATCH 06/22] Run mention bot directly on comments

---
 .github/workflows/opencode-bot.yml | 31 +++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index fbb6bc8..3b77167 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -103,6 +103,12 @@ on:
       GH_TOKEN:
         required: false
         description: GitHub token for repository access
+  issue_comment:
+    types:
+      - created
+  pull_request_review_comment:
+    types:
+      - created
 permissions:
   contents: read
   pull-requests: write
@@ -115,12 +121,19 @@ jobs:
       (
         (github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment')
         && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+        && (
+          inputs.action-ref != ''
+          || startsWith(github.event.comment.body, '/oc')
+          || contains(github.event.comment.body, ' /oc')
+          || startsWith(github.event.comment.body, '/opencode')
+          || contains(github.event.comment.body, ' /opencode')
+        )
       ) || (
         github.event_name != 'issue_comment'
         && github.event_name != 'pull_request_review_comment'
         && inputs.prompt != ''
       )
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -132,7 +145,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: dceoy/opencode-action
-          ref: ${{ inputs.action-ref }}
+          ref: ${{ inputs.action-ref || github.sha }}
           path: .opencode-action
           fetch-depth: 1
           persist-credentials: false
@@ -152,14 +165,14 @@ jobs:
           MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         with:
-          model: ${{ inputs.model }}
-          agent: ${{ inputs.agent }}
+          model: ${{ inputs.model || 'sakura/preview/Kimi-K2.7-Code' }}
+          agent: ${{ inputs.agent || 'build' }}
           share: ${{ inputs.share }}
           prompt: ${{ inputs.prompt }}
           use-github-token: ${{ inputs.use-github-token }}
-          mentions: ${{ inputs.mentions }}
+          mentions: ${{ inputs.mentions || '/opencode,/oc' }}
           variant: ${{ inputs.variant }}
-          oidc-base-url: ${{ inputs.oidc-base-url }}
-          opencode-version: ${{ inputs.opencode-version }}
-          use-bundled-toolkit: ${{ inputs.use-bundled-toolkit }}
-          timeout-minutes: ${{ inputs.timeout-minutes }}
+          oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
+          opencode-version: ${{ inputs.opencode-version || 'latest' }}
+          use-bundled-toolkit: ${{ inputs.action-ref == '' || inputs.use-bundled-toolkit }}
+          timeout-minutes: ${{ inputs.timeout-minutes || 60 }}

From d914d42573b66bf7e13f5e9da36f4e08788f2719 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:29:42 +0900
Subject: [PATCH 07/22] Remove redundant OpenCode wrapper workflow

---
 .github/workflows/opencode.yml | 79 ----------------------------------
 1 file changed, 79 deletions(-)
 delete mode 100644 .github/workflows/opencode.yml

diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
deleted file mode 100644
index ce0667e..0000000
--- a/.github/workflows/opencode.yml
+++ /dev/null
@@ -1,79 +0,0 @@
----
-name: Pull request review and mention bot using OpenCode
-on:
-  pull_request:
-    types:
-      - opened
-      - ready_for_review
-  issue_comment:
-    types:
-      - created
-  pull_request_review_comment:
-    types:
-      - created
-permissions:
-  contents: read
-jobs:
-  opencode-review:
-    if: >
-      github.event_name == 'pull_request'
-      && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
-      && (! github.event.pull_request.draft)
-      && (! startsWith(github.head_ref, 'dependabot/'))
-      && (! startsWith(github.head_ref, 'renovate/'))
-    permissions:
-      contents: read
-      pull-requests: write
-      issues: write
-      id-token: write
-      actions: read
-    uses: ./.github/workflows/opencode-review.yml
-    with:
-      model: sakura/preview/Kimi-K2.7-Code
-      action-ref: ${{ github.sha }}
-    secrets:
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-      SAKURA_AI_ENGINE_API_KEY: ${{ secrets.SAKURA_AI_ENGINE_API_KEY }}
-      GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
-      DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-      XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
-      GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
-      CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
-      MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
-      GH_TOKEN: ${{ secrets.GH_TOKEN }}
-  opencode-bot:
-    if: >
-      (github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment')
-      && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      && (
-        startsWith(github.event.comment.body, '/oc')
-        || contains(github.event.comment.body, ' /oc')
-        || startsWith(github.event.comment.body, '/opencode')
-        || contains(github.event.comment.body, ' /opencode')
-      )
-    permissions:
-      contents: read
-      pull-requests: write
-      issues: write
-      id-token: write
-      actions: read
-    uses: ./.github/workflows/opencode-bot.yml
-    with:
-      model: sakura/preview/Kimi-K2.7-Code
-      action-ref: ${{ github.sha }}
-    secrets:
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-      SAKURA_AI_ENGINE_API_KEY: ${{ secrets.SAKURA_AI_ENGINE_API_KEY }}
-      GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
-      DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-      XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
-      GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
-      CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
-      MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
-      GH_TOKEN: ${{ secrets.GH_TOKEN }}

From 374572fe312d56479e69a29af6a81d627e7d9839 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:31:09 +0900
Subject: [PATCH 08/22] Fix reusable workflow table formatting

---
 docs/reusable-workflows.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 1a97cb3..b43d5d8 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -83,7 +83,7 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `opencode-version`    | `latest`                                                            | OpenCode version to install.                                  |
 | `use-bundled-toolkit` | `true`                                                              | Use the bundled OpenCode toolkit.                             |
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
-| `action-ref`          | Required                                                            | Revision of `dceoy/opencode-action` to check out.              |
+| `action-ref`          | Required                                                            | Revision of `dceoy/opencode-action` to check out.             |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
 ## Secrets

From 7417e6182071be993c83223c8b6c3c3fde84b162 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:38:22 +0900
Subject: [PATCH 09/22] Use self action reference in review workflow

---
 .github/workflows/opencode-review.yml | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index a407114..83b8d34 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -57,10 +57,6 @@ on:
         type: number
         description: Maximum minutes to let OpenCode run
         default: 60
-      action-ref:
-        required: true
-        type: string
-        description: OpenCode action revision to check out
       runs-on:
         required: false
         type: string
@@ -118,7 +114,7 @@ jobs:
     if: >
       github.event_name == 'pull_request'
       && (
-        inputs.action-ref != ''
+        inputs.model != ''
         || (
           contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)
           && (! github.event.pull_request.draft)
@@ -134,16 +130,8 @@ jobs:
           fetch-depth: 1
           token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
           persist-credentials: false
-      - name: Checkout OpenCode action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          repository: dceoy/opencode-action
-          ref: ${{ inputs.action-ref || github.sha }}
-          path: .opencode-action
-          fetch-depth: 1
-          persist-credentials: false
       - name: Run OpenCode
-        uses: ./.opencode-action
+        uses: $/
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -167,5 +155,5 @@ jobs:
           variant: ${{ inputs.variant }}
           oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
           opencode-version: ${{ inputs.opencode-version || 'latest' }}
-          use-bundled-toolkit: ${{ inputs.action-ref == '' || inputs.use-bundled-toolkit }}
+          use-bundled-toolkit: ${{ inputs.model == '' || inputs.use-bundled-toolkit }}
           timeout-minutes: ${{ inputs.timeout-minutes || 60 }}

From ce6a3194587be23854fee77ec01adfc3a3b44697 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:38:36 +0900
Subject: [PATCH 10/22] Use self action reference in bot workflow

---
 .github/workflows/opencode-bot.yml | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index 3b77167..6bc0064 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -57,10 +57,6 @@ on:
         type: number
         description: Maximum minutes to let OpenCode run
         default: 60
-      action-ref:
-        required: true
-        type: string
-        description: OpenCode action revision to check out
       runs-on:
         required: false
         type: string
@@ -122,7 +118,7 @@ jobs:
         (github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment')
         && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
         && (
-          inputs.action-ref != ''
+          inputs.model != ''
           || startsWith(github.event.comment.body, '/oc')
           || contains(github.event.comment.body, ' /oc')
           || startsWith(github.event.comment.body, '/opencode')
@@ -141,16 +137,8 @@ jobs:
           fetch-depth: 1
           token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
           persist-credentials: false
-      - name: Checkout OpenCode action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          repository: dceoy/opencode-action
-          ref: ${{ inputs.action-ref || github.sha }}
-          path: .opencode-action
-          fetch-depth: 1
-          persist-credentials: false
       - name: Run OpenCode
-        uses: ./.opencode-action
+        uses: $/
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -174,5 +162,5 @@ jobs:
           variant: ${{ inputs.variant }}
           oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
           opencode-version: ${{ inputs.opencode-version || 'latest' }}
-          use-bundled-toolkit: ${{ inputs.action-ref == '' || inputs.use-bundled-toolkit }}
+          use-bundled-toolkit: ${{ inputs.model == '' || inputs.use-bundled-toolkit }}
           timeout-minutes: ${{ inputs.timeout-minutes || 60 }}

From fd2d5798d08000106c491a8d3b6eb65cdee5fc29 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:38:49 +0900
Subject: [PATCH 11/22] Document self action references

---
 docs/reusable-workflows.md | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index b43d5d8..7d0bc9c 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -2,7 +2,7 @@
 
 `opencode-action` publishes two reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
 
-The examples below pin the reusable workflow definition and its `action-ref` input to the same commit. The called workflow checks out that OpenCode action revision and invokes it from a local path, so a full commit SHA makes both layers immutable.
+The examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/` references the action from the same repository at the running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
 
 ## Mention bot
 
@@ -28,7 +28,6 @@ jobs:
     uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@87c8c6821360f1ced2fbb0868fb8e583df100046
     with:
       model: opencode-go/kimi-k3
-      action-ref: 87c8c6821360f1ced2fbb0868fb8e583df100046
     secrets:
       OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
 ```
@@ -57,7 +56,6 @@ jobs:
     uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@87c8c6821360f1ced2fbb0868fb8e583df100046
     with:
       model: openrouter/openrouter/free
-      action-ref: 87c8c6821360f1ced2fbb0868fb8e583df100046
     secrets:
       OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
 ```
@@ -83,9 +81,10 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `opencode-version`    | `latest`                                                            | OpenCode version to install.                                  |
 | `use-bundled-toolkit` | `true`                                                              | Use the bundled OpenCode toolkit.                             |
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
-| `action-ref`          | Required                                                            | Revision of `dceoy/opencode-action` to check out.             |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
+The `$/` self repository reference is supported on GitHub.com and resolves to the repository and commit of the workflow where it appears, including when that workflow is called from another repository. GitHub Enterprise Server does not support this syntax.
+
 ## Secrets
 
 Pass only the provider secret needed by the selected model. The reusable workflows accept `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `OPENROUTER_API_KEY`, `OPENCODE_API_KEY`, `SAKURA_AI_ENGINE_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `GROQ_API_KEY`, `CEREBRAS_API_KEY`, and `MOONSHOT_API_KEY`.

From 34f88feff7442e9346690b752dd51143b31b5858 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:40:17 +0900
Subject: [PATCH 12/22] Ignore unsupported self-reference lint

---
 .github/actionlint.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..3cd547e
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+---
+paths:
+  .github/workflows/opencode-*.yml:
+    ignore:
+      # actionlint does not yet recognize GitHub's $/ self repository reference.
+      - 'specifying action "\$/" in invalid format because ref is missing'

From 9d55dc9a567bea92be058e631bf422f8d4e09f0d Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:52:33 +0900
Subject: [PATCH 13/22] Update reusable workflow pins after release

---
 .github/workflows/post-release.yml | 32 +++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index f1b722d..55821c2 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write
     uses: dceoy/gha-for-devops/.github/workflows/github-major-version-tag.yml@main  # zizmor: ignore[unpinned-uses]
-  readme:
+  release-pins:
     permissions:
       contents: write
       pull-requests: write
@@ -44,25 +44,33 @@ jobs:
             fi
           fi
           tee -a "${GITHUB_OUTPUT}" <<< "tag=${tag}"
-      - name: Update README
+      - name: Update release pins
         env:
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
         run: |
-          match_count="$(grep -Ec 'uses: dceoy/opencode-action@[0-9a-f]{40}' README.md || true)"
-          if [[ "${match_count}" != 1 ]]; then
-            echo "Expected exactly one pinned dceoy/opencode-action reference in README.md, found ${match_count}." >&2
+          release_sha="$(git rev-parse "${RELEASE_TAG}^{commit}")"
+
+          readme_match_count="$(grep -Ec 'uses: dceoy/opencode-action@[0-9a-f]{40}' README.md || true)"
+          if [[ "${readme_match_count}" != 1 ]]; then
+            echo "Expected exactly one pinned dceoy/opencode-action reference in README.md, found ${readme_match_count}." >&2
+            exit 1
+          fi
+
+          workflow_match_count="$(grep -Ec 'uses: dceoy/opencode-action/.github/workflows/opencode-(bot|review)\.yml@[0-9a-f]{40}' docs/reusable-workflows.md || true)"
+          if [[ "${workflow_match_count}" != 2 ]]; then
+            echo "Expected exactly two pinned reusable workflow references in docs/reusable-workflows.md, found ${workflow_match_count}." >&2
             exit 1
-          else
-            release_sha="$(git rev-parse "${RELEASE_TAG}^{commit}")"
-            sed -iE "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
           fi
+
+          sed -iE "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
+          sed -iE "s|(uses: dceoy/opencode-action/.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
           token: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
-          commit-message: Update README for ${{ steps.release.outputs.tag }}
-          title: Update README for ${{ steps.release.outputs.tag }}
-          branch: github-actions/readme
+          commit-message: Update release pins for ${{ steps.release.outputs.tag }}
+          title: Update release pins for ${{ steps.release.outputs.tag }}
+          branch: github-actions/release-pins
           base: ${{ github.event.repository.default_branch }}
-          body: Update the README action pin for ${{ steps.release.outputs.tag }}.
+          body: Update the README action pin and reusable workflow documentation pins for ${{ steps.release.outputs.tag }}.
           delete-branch: true

From 4a1a9269a9f2c9a3333c30546595ec26e0dd1322 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:52:55 +0900
Subject: [PATCH 14/22] Tighten reusable workflow pin matching

---
 .github/workflows/post-release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index 55821c2..abbe6ab 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -56,14 +56,14 @@ jobs:
             exit 1
           fi
 
-          workflow_match_count="$(grep -Ec 'uses: dceoy/opencode-action/.github/workflows/opencode-(bot|review)\.yml@[0-9a-f]{40}' docs/reusable-workflows.md || true)"
+          workflow_match_count="$(grep -Ec 'uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@[0-9a-f]{40}' docs/reusable-workflows.md || true)"
           if [[ "${workflow_match_count}" != 2 ]]; then
             echo "Expected exactly two pinned reusable workflow references in docs/reusable-workflows.md, found ${workflow_match_count}." >&2
             exit 1
           fi
 
           sed -iE "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
-          sed -iE "s|(uses: dceoy/opencode-action/.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
+          sed -iE "s|(uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:

From ff3c2a1aa2aa33861dab33bc86679f265bb89e9a Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:58:13 +0900
Subject: [PATCH 15/22] Pin reusable workflow examples to self-reference
 implementation

---
 docs/reusable-workflows.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 7d0bc9c..4d0f913 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -25,7 +25,7 @@ jobs:
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@87c8c6821360f1ced2fbb0868fb8e583df100046
+    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@2c992b25c28496277dc04a698ca3d74f72ef77ec
     with:
       model: opencode-go/kimi-k3
     secrets:
@@ -53,7 +53,7 @@ jobs:
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@87c8c6821360f1ced2fbb0868fb8e583df100046
+    uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@2c992b25c28496277dc04a698ca3d74f72ef77ec
     with:
       model: openrouter/openrouter/free
     secrets:

From 361c07b8d46718c4944911d5c7d9154fbe4b8bfe Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 14:58:31 +0900
Subject: [PATCH 16/22] Update checkout pin in post-release docs refresh

---
 .github/workflows/post-release.yml | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index abbe6ab..d9aed34 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -44,15 +44,36 @@ jobs:
             fi
           fi
           tee -a "${GITHUB_OUTPUT}" <<< "tag=${tag}"
+      - name: Set actions/checkout release
+        id: checkout
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: |
+          tag="$(gh release view --repo actions/checkout --json tagName --jq '.tagName')"
+          sha="$(gh api "repos/actions/checkout/commits/${tag}" --jq '.sha')"
+          if [[ -z "${tag}" || ! "${sha}" =~ ^[0-9a-f]{40}$ ]]; then
+            echo 'Failed to resolve the latest actions/checkout release commit.' >&2
+            exit 1
+          fi
+          tee -a "${GITHUB_OUTPUT}" <<< "tag=${tag}"
+          tee -a "${GITHUB_OUTPUT}" <<< "sha=${sha}"
       - name: Update release pins
         env:
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          CHECKOUT_TAG: ${{ steps.checkout.outputs.tag }}
+          CHECKOUT_SHA: ${{ steps.checkout.outputs.sha }}
         run: |
           release_sha="$(git rev-parse "${RELEASE_TAG}^{commit}")"
 
-          readme_match_count="$(grep -Ec 'uses: dceoy/opencode-action@[0-9a-f]{40}' README.md || true)"
-          if [[ "${readme_match_count}" != 1 ]]; then
-            echo "Expected exactly one pinned dceoy/opencode-action reference in README.md, found ${readme_match_count}." >&2
+          readme_action_match_count="$(grep -Ec 'uses: dceoy/opencode-action@[0-9a-f]{40}' README.md || true)"
+          if [[ "${readme_action_match_count}" != 1 ]]; then
+            echo "Expected exactly one pinned dceoy/opencode-action reference in README.md, found ${readme_action_match_count}." >&2
+            exit 1
+          fi
+
+          readme_checkout_match_count="$(grep -Ec 'uses: actions/checkout@[0-9a-f]{40}' README.md || true)"
+          if [[ "${readme_checkout_match_count}" != 1 ]]; then
+            echo "Expected exactly one pinned actions/checkout reference in README.md, found ${readme_checkout_match_count}." >&2
             exit 1
           fi
 
@@ -63,6 +84,7 @@ jobs:
           fi
 
           sed -iE "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
+          sed -iE "s|(uses: actions/checkout@)[0-9a-f]{40}( +#.*)?|\1${CHECKOUT_SHA} # ${CHECKOUT_TAG}|" README.md
           sed -iE "s|(uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
@@ -72,5 +94,5 @@ jobs:
           title: Update release pins for ${{ steps.release.outputs.tag }}
           branch: github-actions/release-pins
           base: ${{ github.event.repository.default_branch }}
-          body: Update the README action pin and reusable workflow documentation pins for ${{ steps.release.outputs.tag }}.
+          body: Update the README action and actions/checkout pins plus reusable workflow documentation pins for ${{ steps.release.outputs.tag }}.
           delete-branch: true

From 14cbce16f9f884205fab71a55943af7e0dfbd586 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:25:11 +0900
Subject: [PATCH 17/22] Fix GNU sed option parsing in release pin updates

---
 .github/workflows/post-release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index d9aed34..ce38bc9 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -83,9 +83,9 @@ jobs:
             exit 1
           fi
 
-          sed -iE "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
-          sed -iE "s|(uses: actions/checkout@)[0-9a-f]{40}( +#.*)?|\1${CHECKOUT_SHA} # ${CHECKOUT_TAG}|" README.md
-          sed -iE "s|(uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
+          sed -E -i "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
+          sed -E -i "s|(uses: actions/checkout@)[0-9a-f]{40}( +#.*)?|\1${CHECKOUT_SHA} # ${CHECKOUT_TAG}|" README.md
+          sed -E -i "s|(uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:

From 2f992f1af335d69b76b93a3619662fe65e9f4955 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 15:25:57 +0900
Subject: [PATCH 18/22] Fix reusable workflow pin substitution delimiter

---
 .github/workflows/post-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index ce38bc9..da7d7c0 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -85,7 +85,7 @@ jobs:
 
           sed -E -i "s|(uses: dceoy/opencode-action@)[0-9a-f]{40}( +#.*)?|\1${release_sha} # ${RELEASE_TAG}|" README.md
           sed -E -i "s|(uses: actions/checkout@)[0-9a-f]{40}( +#.*)?|\1${CHECKOUT_SHA} # ${CHECKOUT_TAG}|" README.md
-          sed -E -i "s|(uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}|\1${release_sha}|g" docs/reusable-workflows.md
+          sed -E -i "s#(uses: dceoy/opencode-action/\.github/workflows/opencode-(bot|review)\.yml@)[0-9a-f]{40}#\1${release_sha}#g" docs/reusable-workflows.md
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:

From ffdd40708dd33c83d4cc9d8307df1e484c5c62f9 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 16:04:23 +0900
Subject: [PATCH 19/22] Fix self-reference path in review workflow

---
 .github/workflows/opencode-review.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index 83b8d34..629dd60 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -131,7 +131,7 @@ jobs:
           token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
           persist-credentials: false
       - name: Run OpenCode
-        uses: $/
+        uses: $/.
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

From 2157cee0a53e9d5ec3fce6c437557dd6693c8563 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 16:04:36 +0900
Subject: [PATCH 20/22] Fix self-reference path in bot workflow

---
 .github/workflows/opencode-bot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index 6bc0064..ad84a60 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -138,7 +138,7 @@ jobs:
           token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
           persist-credentials: false
       - name: Run OpenCode
-        uses: $/
+        uses: $/.
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

From de968892b27dd42727fa175cd00610a54d091bf9 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 16:04:40 +0900
Subject: [PATCH 21/22] Update actionlint ignore for self-reference path

---
 .github/actionlint.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 3cd547e..3bd41f4 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,4 +3,4 @@ paths:
   .github/workflows/opencode-*.yml:
     ignore:
       # actionlint does not yet recognize GitHub's $/ self repository reference.
-      - 'specifying action "\$/" in invalid format because ref is missing'
+      - 'specifying action "\$/\." in invalid format because ref is missing'

From bcd1c9c0f29bfd16131b0ad19d4ed4c45a0f9dda Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 16 Aug 2026 16:04:56 +0900
Subject: [PATCH 22/22] Document valid root self-reference syntax

---
 docs/reusable-workflows.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 4d0f913..b50af84 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -2,7 +2,7 @@
 
 `opencode-action` publishes two reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
 
-The examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/` references the action from the same repository at the running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
+The examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/.` references the action at the repository root from the same repository and running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
 
 ## Mention bot
 
@@ -25,7 +25,7 @@ jobs:
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@2c992b25c28496277dc04a698ca3d74f72ef77ec
+    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@de968892b27dd42727fa175cd00610a54d091bf9
     with:
       model: opencode-go/kimi-k3
     secrets:
@@ -53,7 +53,7 @@ jobs:
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@2c992b25c28496277dc04a698ca3d74f72ef77ec
+    uses: dceoy/opencode-action/.github/workflows/opencode-review.yml@de968892b27dd42727fa175cd00610a54d091bf9
     with:
       model: openrouter/openrouter/free
     secrets:
@@ -83,7 +83,7 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
-The `$/` self repository reference is supported on GitHub.com and resolves to the repository and commit of the workflow where it appears, including when that workflow is called from another repository. GitHub Enterprise Server does not support this syntax.
+GitHub.com's `$/path` self repository syntax resolves to the repository and commit of the workflow where it appears, including when that workflow is called from another repository. These workflows use `$/.` because the action is defined at the repository root. GitHub Enterprise Server does not support this syntax.
 
 ## Secrets