Add OpenCode AI coding agent installer

[gdellis]

Summary

Add OpenCode AI coding agent installer and update GitHub Actions workflows.

Problem Statement

The linux-setup project lacked an installer for OpenCode, an open-source AI coding agent that provides interactive CLI assistance for software engineering tasks.

Solution Details

• Created installers/setup_opencode.sh with full installation logic including:
  • Binary download from GitHub releases
  • Verification of installation
  • PATH configuration
  • Logging and error handling
• Removed .github/workflows/opencode.yml (redundant workflow)
• Added .github/workflows/pr-review.yml for PR review automation
• Added package.json and bun.lock for Node.js tooling

Testing Performed

• ShellCheck validation passed
• Script follows project coding standards (strict mode, 4-space indentation)
• Uses shared libraries (logging.sh, dependencies.sh)

Affected Components

• installers/setup_opencode.sh (new)
• .github/workflows/opencode.yml (removed)
• .github/workflows/pr-review.yml (new)
• package.json (new)
• bun.lock (new)

Validation Results

• ShellCheck: ✓ Pass
• All scripts use shared libraries correctly

Migration Notes

No breaking changes. New installer adds functionality without affecting existing setups.

[github-actions]

Let me review the PR changes and provide feedback on code quality, potential bugs, security issues, and best practices.

Review Comments

installers/setup_opencode.sh

[line 90] [SECURITY] [HIGH] The script downloads and executes code directly from an external source without verification:

curl -fsSL https://opencode.ai/install | bash

This is a serious security risk as it could execute malicious code if the endpoint is compromised or if DNS is hijacked. The script should download the installation script, verify its checksum/integrity, and then execute it.

[line 88] [IMPROVEMENT] [MEDIUM] The log function is used here but it's not defined in this script. Should use log_info instead:

log "Installing OpenCode..."

[line 38] [BEST PRACTICE] [LOW] There's redundancy in getting the script directory. Consider using a more standard approach:

SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
SCRIPT_DIR="$(cd "${SCRIPT_DIR}" && pwd)"

[line 60] [STYLE] [LOW] There's a duplicate "Logging" header section that seems unnecessary since logging was already set up above.

package.json and bun.lock

These files appear to add Node.js dependencies that don't seem related to the OpenCode installer functionality. The nodejs dependency with version "^0.0.0" seems problematic and unused by the bash installer script.

.github/workflows/pr-review.yml

[line 24] [CONCERN] [MEDIUM] This workflow adds automated PR review functionality using an external action that will review PRs with this specific code. This creates a circular reference where the tool reviews its own integration, which could be problematic.

[line 19] [BEST PRACTICE] [LOW] The validation for OLLAMA_API_KEY checks if it's set but doesn't validate if it's valid, which could lead to runtime errors.

Summary

The main concern is the security vulnerability in the installation script where external code is executed without verification. The other issues are minor but worth addressing for maintainability and security best practices.

opencode session  |  github run

[github-actions]

Pull Request Review

installers/setup_opencode.sh

[line 90] [SECURITY] [HIGH] The script downloads and executes code directly from an external source without verification:

curl -fsSL https://opencode.ai/install | bash

This is a serious security risk as it could execute malicious code if the endpoint is compromised or if DNS is hijacked. The script should download the installation script, verify its checksum/integrity, and then execute it.

[line 88] [IMPROVEMENT] [MEDIUM] The log function is used here but it's not defined in this script. Should use log_info instead:

log "Installing OpenCode..."

[line 38] [BEST PRACTICE] [LOW] There's redundancy in getting the script directory. Consider using a more standard approach:

SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
SCRIPT_DIR="$(cd "${SCRIPT_DIR}" && pwd)"

[line 60] [STYLE] [LOW] There's a duplicate "Logging" header section that seems unnecessary since logging was already set up above.

.github/workflows/pr-review.yml

[line 24] [CONCERN] [MEDIUM] This workflow adds automated PR review functionality using an external action that will review PRs with this specific code. This creates a circular reference where the tool reviews its own integration, which could be problematic.

[line 19] [BEST PRACTICE] [LOW] The validation for OLLAMA_API_KEY checks if it's set but doesn't validate if it's valid, which could lead to runtime errors.

Summary

The main concern is the security vulnerability in the installation script where external code is executed without verification. The other issues are minor but worth addressing for maintainability and security best practices.

opencode session  |  github run

[github-actions]

Looking at this pull request, I can see there are several issues that need to be addressed. Let me provide a detailed review:

Pull Request Review

installers/setup_opencode.sh

[line 75] [SECURITY] [HIGH] The script downloads an installation script from an external source (https://opencode.ai/install) and executes it without verifying its integrity. This creates a potential security vulnerability where a man-in-the-middle attack or compromised server could lead to arbitrary code execution.

[line 106] [BUG] [MEDIUM] The installation script execution redirects errors to a log file but if the installation fails, it will remove the temporary install script before preserving the error log for debugging. This makes troubleshooting difficult.

[line 38] [IMPROVEMENT] [LOW] While the script directory resolution works, it could be simplified using just dirname without the extra cd command:

SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"

.github/workflows/pr-review.yml

[line 24] [CONCERN] [MEDIUM] This workflow creates a circular reference where the OpenCode review action is used to review its own integration. This could lead to inconsistent behavior or infinite loops in the review process.

[line 19] [IMPROVEMENT] [LOW] The validation for OLLAMA_API_KEY only checks if it's set but doesn't validate if it's valid, which could lead to runtime errors that are difficult to debug.

Summary

The primary concern is the security vulnerability where external code is executed without verification. The script should download the installation script, verify its checksum/integrity, and then execute it. Additionally, the circular reference in the PR review workflow should be addressed to prevent potential inconsistencies.

Would you like me to suggest specific fixes for these issues?

opencode session  |  github run

[github-actions]

Pull Request Review

installers/setup_opencode.sh

[line 75] [SECURITY] [HIGH] The script downloads an installation script from an external source (https://opencode.ai/install) and executes it without verifying its integrity. This is a security risk because a man-in-the-middle attack or compromised server could lead to arbitrary code execution.

[line 106] [BUG] [MEDIUM] The error redirection to /tmp/opencode_install_error.log can make debugging difficult because when the temp install script is removed on EXIT, the error log might be removed too. Additionally, the error message references a fixed log location (/tmp/opencode_install_error.log) but this might not actually contain the error if the failure happened elsewhere.

[line 38] [IMPROVEMENT] [LOW] While the script directory resolution works, it could be simplified using just dirname without the extra cd command:

SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"

.github/workflows/pr-review.yml

[line 24] [CONCERN] [MEDIUM] This workflow creates a circular reference where the OpenCode review action is used to review its own integration. This could lead to inconsistent behavior or infinite loops in the review process. The workflow is essentially asking OpenCode to review itself which may cause unpredictable results.

[line 19] [IMPROVEMENT] [LOW] The validation for OLLAMA_API_KEY checks if the secret is set but doesn't validate if it's valid, which could lead to runtime errors that are difficult to debug. It would be better to actually test the key validity.

Summary

The main security issue is downloading and executing an external script without integrity verification. We should download the script, verify its checksum, and then execute it. Also, the error handling with the log file could be made more robust to aid in debugging.

The PR review workflow creates a circular dependency which should be addressed to prevent potential behavioral issues.

Additionally, this PR removes a file (.github/workflows/opencode.yml) but I don't see evidence of this file in the repository which may indicate an issue with the PR change tracking.

opencode session  |  github run

[github-actions]

Pull Request Review

installers/setup_opencode.sh

[line 94] [IMPROVEMENT] [MEDIUM] The log function is used here but it's not defined in this script. Should use log_info instead:

log "Installing OpenCode..."

[line 38] [BEST PRACTICE] [LOW] There's redundancy in getting the script directory. Consider using a more standard approach:

SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
SCRIPT_DIR="$(cd "${SCRIPT_DIR}" && pwd)"

[line 72-82] [BUG] [HIGH] The dependency check logic is flawed. It checks if either bun or npm exists, but then in the installation function it tries to use whichever one exists. However, if neither exists initially, it adds "bun or npm" to missing dependencies but the error message assumes both are missing when actually only the one that existed failed to work.

[line 88-91] [IMPROVEMENT] [LOW] The is_opencode_installed function should probably check if it's the correct version or at least verify that it's functioning properly, not just that the command exists.

[line 96-106] [BUG] [MEDIUM] The installation logic attempts to install via bun or npm but doesn't handle the case where the installed binary might not be in the PATH. The error message suggests adding npm global bin directory to PATH but doesn't provide guidance on how to do that.

[line 118] [BUG] [LOW] The check_dependencies function is called with "$@" but the function definition doesn't accept arguments. This likely results in unintended behavior.

.github/workflows/pr-review.yml

[line 24] [CONCERN] [MEDIUM] This workflow adds automated PR review functionality using an external action that will review PRs with this specific code. This creates a circular reference where the tool reviews its own integration, which could be problematic.

[line 19] [BEST PRACTICE] [LOW] The validation for OLLAMA_API_KEY checks if it's set but doesn't validate if it's valid, which could lead to runtime errors.

Summary

There are several issues that need attention:

1. High severity bug in dependency checking logic
2. Medium severity issues with installation process and argument handling
3. Minor issues with function design and workflow circular reference

The main concerns are the security vulnerability in the dependency checking logic and the circular reference in the PR review workflow. These should be addressed before merging.

No issues found. Good job!

opencode session  |  github run