ci(oc): Add external_dir perm

[EttyKitty]

The default is "ask", which causes dead-end, because the user can't respond during workflow execution. The workflow runs on a GitHub runner. I assume there is no risk in free access to external_dir.

---

Summary by cubic

Sets OPENCODE_PERMISSION to allow external_directory access in the opencode workflow. The default "ask" permission dead-ends the workflow since nobody can respond while it runs on a GitHub runner.

^{Written for commit 324498f. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 2/5

• .github/workflows/opencode.yml grants the agent unrestricted access outside the checkout while also allowing id-token: write, creating a significant risk of unauthorized reads, writes, or use of the runner’s OIDC-enabled authentication context; restrict external_directory and remove or narrowly scope the token permission.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/opencode.yml">

<violation number="1" location=".github/workflows/opencode.yml:39">
P2: Granting `external_directory: "allow"` enables the agent to read and write any path outside the checkout on the runner, unrestricted. The runner also carries `id-token: write`, so the agent can reach OIDC/materialized credentials and temp/other-checkout paths. Per opencode docs, this permission accepts a scoped map (e.g. `{ "external_directory": { "/home/runner/work/**": "allow" } }`), and managed tool-output/temp/global config dirs are already exempted from the boundary. Scope the rule to the paths the workflow actually needs instead of a blanket allow.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>