fix: unbreak Bonk - #151
Conversation
![ask-bonk[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
| # 1.15.13 reported nothing at all when the model call failed, which | ||
| # hid this breakage for three weeks. The dev build is what workerd | ||
| # runs against these models. | ||
| opencode_dev: true |
There was a problem hiding this comment.
opencode_dev: true makes the action run bun install -g opencode-ai@dev, so every privileged review run downloads an unpinned moving build with access to the gateway credentials. This negates the SHA pin above and permits a compromised dev publish to exfiltrate those secrets. Use a reviewed immutable OpenCode release instead (or pin the exact package artifact/version) before enabling this workflow.
|
Changes Bonk to GPT-5.6-terra, pins the action SHA, adds runtime guardrails, and documents the setup. Submitted 1 inline security finding: the unpinned |
319ed03 to
62fefe2
Compare
Bonk has posted nothing since 2026-08-18. Three faults stacked: OpenCode 1.15.13 reported nothing on failure, hiding the rest; claude-opus-4-8 is not a valid model id; and the gateway's upstream Anthropic key is invalid, so every anthropic/* model fails auth regardless. Moves to gpt-5.6-terra with variant: high. Not the larger sol, which returns 400 for function tools whenever reasoning_effort is set — fatal for a reviewer that reads files, and why sol has no working run anywhere in the org. Unpins the version. The pin is what let this rot for three weeks: a stale version fails silently, where latest fails loudly and early.
62fefe2 to
9aa80a5
Compare
|
Reopening to fire the opened trigger against opencode-ai@latest. |
1 participant
Bonk has posted nothing since 2026-08-18. Three faults stacked, each hiding the
next: OpenCode 1.15.13 reported nothing at all on failure,
claude-opus-4-8isnot a valid model id, and the gateway's upstream Anthropic key is invalid, so
every
anthropic/*model fails auth regardless of id.Moves to
gpt-5.6-terrawithvariant: high, matching workerd. Not the largergpt-5.6-sol, which returns 400 for function tools wheneverreasoning_effortis set — fatal for a reviewer that reads files, and why sol has no working run
anywhere in the org.