+
+
+`
+ }
+
+ const manifest = buildManifest(routeHost)
+ const manifestJson = JSON.stringify(manifest)
+
+ return `
+
+
+ GHES Exchange Server
+The exchange server is configured and ready.
+-
+
- GHES Host +
- ${escapeHtml(ghesHost)} +
- App ID +
- ${escapeHtml(appId || "N/A")} +
- Status +
- Operational +
+ POST /exchange_github_app_token with an OIDC Bearer token to get an installation token.
+
+
+
+`
+}
+
+export function renderSuccessPage(result: AppManifestResult, ghesHost: string): string {
+ return `
+
+
+ GHES Exchange Server
+No GitHub App is configured yet. Click the button below to create one on your GHES instance.
+This will redirect you to ${escapeHtml(ghesHost)} to authorize the app creation.
+ ++ After creation, you will be redirected back here with the app credentials. +
+
+
+
+`
+}
+
+export function renderErrorPage(error: string): string {
+ return `
+
+
+ GitHub App Created Successfully
+The app has been created and the exchange server is now configured in-memory.
+-
+
- App ID +
- ${result.id} +
- Slug +
- ${escapeHtml(result.slug)} +
- Client ID +
- ${escapeHtml(result.client_id)} +
- Client Secret +
- ${escapeHtml(result.client_secret)} +
- Webhook Secret +
- ${escapeHtml(result.webhook_secret)} +
Private Key (PEM)
+ + +Persist to Kubernetes (optional)
+To survive pod restarts, store the credentials as K8s resources:
+
+# Update ConfigMap with the App ID
+oc patch configmap ghes-exchange-config -n arc-runners \\
+ --type merge -p '{"data":{"GHES_APP_ID":"${result.id}"}}'
+
+# Create or update the secret with the private key
+oc create secret generic opencode-ghes-secrets -n arc-runners \\
+ --from-literal=github-app-private-key="$(cat <pem-file>)" \\
+ --dry-run=client -o yaml | oc apply -f -
+
+# Restart the deployment to pick up changes
+oc rollout restart deployment/ghes-exchange -n arc-runners
+
+ + Important: Save the private key now. It cannot be retrieved from GitHub again. +
++ View app on GHES + | + Back to status page +
+
+
+
+`
+}
diff --git a/packages/ghes-exchange/tsconfig.json b/packages/ghes-exchange/tsconfig.json
new file mode 100644
index 000000000000..38c147fb536d
--- /dev/null
+++ b/packages/ghes-exchange/tsconfig.json
@@ -0,0 +1,11 @@
+{
+ "$schema": "https://json.schemastore.org/tsconfig",
+ "extends": "@tsconfig/bun/tsconfig.json",
+ "compilerOptions": {
+ "module": "ESNext",
+ "moduleResolution": "bundler",
+ "strict": true,
+ "outDir": "dist"
+ },
+ "include": ["src"]
+}
diff --git a/packages/opencode/src/cli/cmd/github.ts b/packages/opencode/src/cli/cmd/github.ts
index fd1a2f7e583f..e2679f05e29c 100644
--- a/packages/opencode/src/cli/cmd/github.ts
+++ b/packages/opencode/src/cli/cmd/github.ts
@@ -132,6 +132,83 @@ type IssueQueryResponse = {
}
}
+type GHESAuthStrategy = "oidc" | "in-workflow"
+
+type AppManifestResult = {
+ id: number
+ slug: string
+ pem: string
+ webhook_secret: string
+ client_id: string
+ client_secret: string
+}
+
+function buildManifestFormHTML(ghesUrl: string, manifestJson: string) {
+ return `
+
+
+ Setup Error
+An error occurred during GitHub App creation.
+${escapeHtml(error)}
+
+
+
+
+
+
+`
+}
+
+const HTML_MANIFEST_SUCCESS = `
+
+
+ Creating GitHub App...
+Redirecting to ${ghesUrl}...
+
+
+
+
+`
+
+const HTML_MANIFEST_ERROR = (error: string) => `
+
+
+ GitHub App Created Successfully
+You can close this window and return to the terminal.
+
+
+
+`
+
const AGENT_USERNAME = "opencode-agent[bot]"
const AGENT_REACTION = "eyes"
const WORKFLOW_FILE = ".github/workflows/opencode.yml"
@@ -159,6 +236,24 @@ export function parseGitHubRemote(url: string): { owner: string; repo: string }
return { owner: match[1], repo: match[2] }
}
+// Like parseGitHubRemote but matches any host (for GHES support)
+export function parseGitRemote(url: string): { host: string; owner: string; repo: string } | null {
+ const match = url.match(/^(?:(?:https?|ssh):\/\/)?(?:git@)?([^/:]+)[:/]([^/]+)\/([^/]+?)(?:\.git)?$/)
+ if (!match) return null
+ return { host: match[1], owner: match[2], repo: match[3] }
+}
+
+function getGitHubURLs() {
+ const serverUrl = (process.env.GITHUB_SERVER_URL || "https://github.com").replace(/\/+$/, "")
+ const apiUrl = (process.env.GITHUB_API_URL || "https://api.github.com").replace(/\/+$/, "")
+ const host = new URL(serverUrl).host
+ return { serverUrl, apiUrl, host }
+}
+
+function getNoreplyEmail(username: string, host: string) {
+ return `${username}@users.noreply.${host}`
+}
+
/**
* Extracts displayable text from assistant response parts.
* Returns null for non-text responses (signals summary needed).
@@ -204,7 +299,7 @@ export const GithubInstallCommand = cmd({
UI.empty()
prompts.intro("Install GitHub agent")
const app = await getAppInfo()
- await installGitHubApp()
+ const ghesStrategy = await installGitHubApp()
const providers = await ModelsDev.get().then((p) => {
// TODO: add guide for copilot, for now just hide it
@@ -220,26 +315,50 @@ export const GithubInstallCommand = cmd({
printNextSteps()
function printNextSteps() {
- let step2
- if (provider === "amazon-bedrock") {
- step2 =
- "Configure OIDC in AWS - https://docs.github.com/en/actions/how-tos/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services"
- } else {
- step2 = [
- ` 2. Add the following secrets in org or repo (${app.owner}/${app.repo}) settings`,
+ const providerSecrets =
+ provider === "amazon-bedrock"
+ ? [
+ " Configure OIDC in AWS - https://docs.github.com/en/actions/how-tos/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services",
+ ]
+ : [
+ ` 2. Add the following secrets in org or repo (${app.owner}/${app.repo}) settings`,
+ "",
+ ...providers[provider].env.map((e) => ` - ${e}`),
+ ]
+
+ let ghesSteps: string[] = []
+ if (ghesStrategy === "in-workflow") {
+ ghesSteps = [
+ "",
+ ` 3. Add GHES app secrets in org or repo (${app.owner}/${app.repo}) settings`,
+ "",
+ " - OPENCODE_GHES_APP_ID (the App ID printed above)",
+ " - OPENCODE_GHES_APP_PRIVATE_KEY (the private key from app creation)",
+ ]
+ } else if (ghesStrategy === "oidc") {
+ ghesSteps = [
+ "",
+ ` 3. Deploy the GHES exchange server (packages/ghes-exchange)`,
+ "",
+ ` 4. Add secrets in org or repo (${app.owner}/${app.repo}) settings`,
"",
- ...providers[provider].env.map((e) => ` - ${e}`),
- ].join("\n")
+ " - OPENCODE_OIDC_BASE_URL (URL of your deployed exchange server)",
+ ]
}
+ const learnMoreStep = ghesStrategy
+ ? " Go to a GitHub issue and comment `/oc summarize` to see the agent in action"
+ : " 3. Go to a GitHub issue and comment `/oc summarize` to see the agent in action"
+
prompts.outro(
[
"Next steps:",
"",
` 1. Commit the \`${WORKFLOW_FILE}\` file and push`,
- step2,
+ ...providerSecrets,
+ ...ghesSteps,
"",
- " 3. Go to a GitHub issue and comment `/oc summarize` to see the agent in action",
+ learnMoreStep,
"",
" Learn more about the GitHub agent - https://opencode.ai/docs/github/#usage-examples",
].join("\n"),
@@ -253,14 +372,15 @@ export const GithubInstallCommand = cmd({
throw new UI.CancelledError()
}
- // Get repo info
+ // Get repo info - use parseGitRemote to support any host (GHES)
const info = (await $`git remote get-url origin`.quiet().nothrow().text()).trim()
- const parsed = parseGitHubRemote(info)
+ const parsed = parseGitRemote(info)
if (!parsed) {
prompts.log.error(`Could not find git repository. Please run this command from a git repository.`)
throw new UI.CancelledError()
}
- return { owner: parsed.owner, repo: parsed.repo, root: Instance.worktree }
+ const isGHES = parsed.host !== "github.com"
+ return { owner: parsed.owner, repo: parsed.repo, host: parsed.host, root: Instance.worktree, isGHES }
}
async function promptProvider() {
@@ -314,13 +434,36 @@ export const GithubInstallCommand = cmd({
return model
}
- async function installGitHubApp() {
+ async function installGitHubApp(): PromiseGitHub App Creation Failed
+An error occurred.
+${error}
+