StanPonomarev/agentci
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: restore auth and research variant

Browse Source
This commit is contained in:
StanPonomarev
2026-07-21 00:28:19 +02:00
parent d3946b195e
commit 45858bff06
9 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -5
View File
@@ -59,7 +59,8 @@ has a connected provider. The worker leaves jobs queued while the runtime is una
Models use OpenCode's `provider/model` format. Planning, implementation, and research can use
different providers. Optional `AGENTCI_PLAN_VARIANT` and `AGENTCI_IMPLEMENT_VARIANT` values are
passed directly to OpenCode for providers that support variants.
passed directly to OpenCode for providers that support variants. `AGENTCI_RESEARCH_VARIANT`
configures the research subagent and defaults to `high`.
`AGENTCI_OPENCODE_VERSION` controls the npm version or range installed into the image and defaults
to `^1`. The build verifies that the resolved version is still OpenCode 1.x and prints it. Compose
@@ -68,10 +69,11 @@ auto-update is disabled so an image cannot cross into OpenCode 2.x after it is b
The trusted configuration is `opencode/opencode.json`. It grants `permission: "allow"` globally
and to every built-in or custom agent that Agent CI can invoke. Repository-local OpenCode config
and plugins are disabled so a clone cannot replace the service policy. OpenCode's scanned home and
global configuration paths are root-owned and read-only, and external skill discovery is disabled,
so an agent cannot persist instructions for later repositories. CodeGraph, Context7, and `gh_grep`
are configured as MCP servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits.
and external plugins are disabled so a clone cannot replace the service policy. OpenCode's default
plugins remain enabled for provider authentication. Its scanned home and global configuration paths
are root-owned and read-only, and external skill discovery is disabled, so an agent cannot persist
instructions for later repositories. CodeGraph, Context7, and `gh_grep` are configured as MCP
servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits.
The `research` subagent has the same unrestricted permissions as every other agent. Its prompt
asks it to focus on external evidence, but this is guidance rather than an isolation boundary.