fix: support OpenCode auth in read-only executor

deploy/Dockerfile

@@ -16,11 +16,10 @@ RUN apk add --no-cache ca-certificates coreutils git openssh-client \
     /var/lib/gitea-agent/state \
     /var/lib/gitea-agent/workspaces \
     /var/lib/opencode-agent/data \
+    /var/lib/opencode-agent/state \
     /var/lib/opencode-agent/cache \
     && install -d -o root -g root -m 0555 \
-    /opt/ci-agents \
-    /opt/ci-agents/empty-config \
-    /opt/ci-agents/empty-config/opencode
+    /opt/ci-agents
 
 COPY --from=app-build /src/app/dist /opt/ci-agents/dist
 COPY --from=app-build /src/app/node_modules /opt/ci-agents/node_modules
@@ -59,12 +58,12 @@ RUN npm install --global --omit=dev "opencode-ai@${OPENCODE_VERSION}" \
     && rm -f "/tmp/${asset}" /tmp/gitea-mcp
 
 COPY opencode /opt/ci-agents/opencode
-RUN chmod -R a-w /opt/ci-agents \
-    && chown ci-agent /opt/ci-agents/empty-config/opencode \
-    && chmod u+w /opt/ci-agents/empty-config/opencode
+RUN touch /opt/ci-agents/opencode/.gitignore \
+    && chmod -R a-w /opt/ci-agents
 
 ENV XDG_DATA_HOME=/var/lib/opencode-agent/data \
-    XDG_CONFIG_HOME=/opt/ci-agents/empty-config \
+    XDG_CONFIG_HOME=/var/lib/opencode-agent/state \
+    XDG_STATE_HOME=/var/lib/opencode-agent/state \
     XDG_CACHE_HOME=/var/lib/opencode-agent/cache \
     OPENCODE_CONFIG_DIR=/opt/ci-agents/opencode \
     OPENCODE_DISABLE_PROJECT_CONFIG=true \

deploy/compose.yaml

@@ -34,16 +34,8 @@ services:
       GITEA_WRITE_TOKEN_FILE: /run/secrets/gitea_write_token
       GITEA_WEBHOOK_SECRET_FILE: /run/secrets/gitea_webhook_secret
     secrets:
-      - source: gitea_write_token
-        target: gitea_write_token
-        uid: "10001"
-        gid: "10001"
-        mode: 0400
-      - source: gitea_webhook_secret
-        target: gitea_webhook_secret
-        uid: "10001"
-        gid: "10001"
-        mode: 0400
+      - gitea_write_token
+      - gitea_webhook_secret
     networks:
       - gitea-common
     healthcheck:
@@ -54,6 +46,9 @@ services:
 
   executor:
     <<: *common
+    tmpfs:
+      - /tmp:rw,nosuid,nodev,mode=1777
+      - /var/lib/opencode-agent/state:rw,nosuid,nodev,noexec,mode=1777
     build:
       context: ..
       dockerfile: deploy/Dockerfile
@@ -63,19 +58,15 @@ services:
       <<: *common-environment
       GITEA_READ_TOKEN_FILE: /run/secrets/gitea_read_token
       XDG_DATA_HOME: /var/lib/opencode-agent/data
+      XDG_STATE_HOME: /var/lib/opencode-agent/state
       XDG_CACHE_HOME: /var/lib/opencode-agent/cache
     secrets:
-      - source: gitea_read_token
-        target: gitea_read_token
-        uid: "10001"
-        gid: "10001"
-        mode: 0400
+      - gitea_read_token
     volumes:
       - ${AGENT_STATE_DIR:-./state/server}:/var/lib/gitea-agent/state
       - ${AGENT_WORKSPACE_DIR:-./state/workspaces}:/var/lib/gitea-agent/workspaces
       - ${OPENCODE_DATA_DIR:-./state/opencode}:/var/lib/opencode-agent/data
       - ${CACHE_DIR:-./state/cache}:/var/lib/opencode-agent/cache
-      - ${OPENCODE_CONFIG_DIR:-./deploy/opencode-config}:/opt/ci-agents/empty-config/opencode
     depends_on:
       controller:
         condition: service_healthy