From 451568486da27627cb1246055b9944de51975f72 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:40:06 +0900
Subject: [PATCH 01/20] feat: add workflow-dispatch reusable workflow

---
 .github/workflows/opencode-dispatch.yml | 143 ++++++++++++++++++++++++
 1 file changed, 143 insertions(+)
 create mode 100644 .github/workflows/opencode-dispatch.yml

diff --git a/.github/workflows/opencode-dispatch.yml b/.github/workflows/opencode-dispatch.yml
new file mode 100644
index 0000000..c2b5f58
--- /dev/null
+++ b/.github/workflows/opencode-dispatch.yml
@@ -0,0 +1,143 @@
+---
+name: Manual OpenCode task
+on:
+  workflow_call:
+    inputs:
+      model:
+        required: true
+        type: string
+        description: Model to use with OpenCode
+      prompt:
+        required: true
+        type: string
+        description: Prompt to run
+      agent:
+        required: false
+        type: string
+        description: Primary agent to use
+        default: build
+      share:
+        required: false
+        type: boolean
+        description: Share the OpenCode session
+        default: false
+      use-github-token:
+        required: false
+        type: boolean
+        description: Use GITHUB_TOKEN directly instead of OpenCode App token exchange
+        default: false
+      variant:
+        required: false
+        type: string
+        description: Provider-specific model variant
+        default: ''
+      oidc-base-url:
+        required: false
+        type: string
+        description: Base URL for OIDC token exchange
+        default: https://api.opencode.ai
+      opencode-version:
+        required: false
+        type: string
+        description: OpenCode version to install
+        default: latest
+      use-bundled-toolkit:
+        required: false
+        type: boolean
+        description: Use the action's bundled OpenCode toolkit
+        default: true
+      timeout-minutes:
+        required: false
+        type: number
+        description: Maximum minutes to let OpenCode run
+        default: 60
+      runs-on:
+        required: false
+        type: string
+        description: Runner to use
+        default: ubuntu-latest
+    secrets:
+      ANTHROPIC_API_KEY:
+        required: false
+        description: Anthropic API key
+      OPENAI_API_KEY:
+        required: false
+        description: OpenAI API key
+      OPENROUTER_API_KEY:
+        required: false
+        description: OpenRouter API key
+      OPENCODE_API_KEY:
+        required: false
+        description: OpenCode API key
+      SAKURA_AI_ENGINE_API_KEY:
+        required: false
+        description: Sakura AI Engine API key
+      GOOGLE_GENERATIVE_AI_API_KEY:
+        required: false
+        description: Google Generative AI API key
+      DEEPSEEK_API_KEY:
+        required: false
+        description: DeepSeek API key
+      XAI_API_KEY:
+        required: false
+        description: xAI API key
+      GROQ_API_KEY:
+        required: false
+        description: Groq API key
+      CEREBRAS_API_KEY:
+        required: false
+        description: Cerebras API key
+      MOONSHOT_API_KEY:
+        required: false
+        description: Moonshot AI API key
+      GH_TOKEN:
+        required: false
+        description: GitHub token for repository access
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+  id-token: write
+  actions: read
+jobs:
+  opencode-dispatch:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 1
+          token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
+          persist-credentials: ${{ inputs.use-github-token }}
+      - name: Configure Git identity
+        if: inputs.use-github-token
+        run: |
+          git config --local user.name 'opencode-agent[bot]'
+          git config --local user.email 'opencode-agent[bot]@users.noreply.github.com'
+      - name: Run OpenCode
+        uses: $/.
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          SAKURA_AI_ENGINE_API_KEY: ${{ secrets.SAKURA_AI_ENGINE_API_KEY }}
+          GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
+          CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
+          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        with:
+          model: ${{ inputs.model }}
+          agent: ${{ inputs.agent || 'build' }}
+          share: ${{ inputs.share }}
+          prompt: ${{ inputs.prompt }}
+          use-github-token: ${{ inputs.use-github-token }}
+          variant: ${{ inputs.variant }}
+          oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
+          opencode-version: ${{ inputs.opencode-version || 'latest' }}
+          use-bundled-toolkit: ${{ inputs.use-bundled-toolkit }}
+          timeout-minutes: ${{ inputs.timeout-minutes || 60 }}

From 204a23d53411e68f12aa29723478a858092956cf Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:41:03 +0900
Subject: [PATCH 02/20] docs: document manual dispatch workflow

---
 README.md | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 1877b7c..a9f5799 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # opencode-action
 
-Run an [OpenCode](https://opencode.ai/) agent from GitHub issue and pull request comments.
+Run an [OpenCode](https://opencode.ai/) agent from GitHub Actions, including issue and pull request comments, pull request reviews, and manually dispatched tasks.
 
 [![CI](https://github.com/dceoy/opencode-action/actions/workflows/ci.yml/badge.svg)](https://github.com/dceoy/opencode-action/actions/workflows/ci.yml)
 
@@ -62,12 +62,13 @@ The default setup exchanges the workflow OIDC token for an OpenCode GitHub App t
 
 ## Reusable workflows
 
-For smaller caller workflows, this repository provides reusable workflows for the mention bot and pull request reviews:
+For smaller caller workflows, this repository provides reusable workflows for manual dispatches, the mention bot, and pull request reviews:
 
-| Workflow                                                       | Purpose                                                                           |
-| -------------------------------------------------------------- | --------------------------------------------------------------------------------- |
-| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted issue or pull request comments, or from a fixed prompt. |
-| [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.                      |
+| Workflow                                                           | Purpose                                                                           |
+| ------------------------------------------------------------------ | --------------------------------------------------------------------------------- |
+| [`opencode-dispatch.yml`](.github/workflows/opencode-dispatch.yml) | Run a required prompt from a trusted `workflow_dispatch` caller.                  |
+| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)           | Run OpenCode from trusted issue or pull request comments, or from a fixed prompt. |
+| [`opencode-review.yml`](.github/workflows/opencode-review.yml)     | Run the bundled `/review-pr` flow for `pull_request` events.                      |
 
 See [Reusable workflows](docs/reusable-workflows.md) for caller examples, inputs, secrets, and permission requirements.
 

From 1ecd349a8c4410ff12b204da7ea03a460592963b Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:41:52 +0900
Subject: [PATCH 03/20] docs: add reusable workflow_dispatch example

---
 docs/reusable-workflows.md | 55 +++++++++++++++++++++++++++++++++-----
 1 file changed, 48 insertions(+), 7 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 0115ff4..d5da1c9 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -1,8 +1,47 @@
 # Reusable workflows
 
-`opencode-action` publishes two reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
+`opencode-action` publishes three reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
 
-The examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/.` references the action at the repository root from the same repository and running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
+Released workflow examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/.` references the action at the repository root from the same repository and running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
+
+## Manual dispatch
+
+Use `opencode-dispatch.yml` from a caller whose only trigger is `workflow_dispatch`. The reusable workflow requires both `model` and `prompt` and skips runs from any other event.
+
+<!-- prettier-ignore -->
+```yaml
+---
+name: OpenCode task
+on:
+  workflow_dispatch:
+    inputs:
+      prompt:
+        description: Prompt to run
+        required: true
+        type: string
+      model:
+        description: Model to use with OpenCode
+        required: true
+        default: opencode-go/kimi-k3
+        type: string
+
+jobs:
+  opencode:
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
+      actions: read
+    uses: dceoy/opencode-action/.github/workflows/opencode-dispatch.yml@main
+    with:
+      model: ${{ inputs.model }}
+      prompt: ${{ inputs.prompt }}
+    secrets:
+      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+```
+
+Pin `@main` to a full commit SHA once using this workflow in production. Because the caller is manually dispatched, the called workflow permits `contents: write`; the caller still controls whether that permission is granted. The default authentication remains the OpenCode App-token flow. Set `use-github-token: true` only when the caller token itself should be used for repository writes.
 
 ## Mention bot
 
@@ -68,16 +107,16 @@ To focus the review, override `prompt` with a supported review aspect, for examp
 
 ## Inputs
 
-Both reusable workflows expose the action configuration plus a runner input:
+The reusable workflows share most action inputs plus a runner input:
 
 | Input                 | Default                                                             | Description                                                   |
 | --------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------- |
 | `model`               | Required                                                            | Model in `provider/model` format.                             |
 | `agent`               | `build`                                                             | Primary agent.                                                |
 | `share`               | `false`                                                             | Share the OpenCode session.                                   |
-| `prompt`              | `''` for `opencode-bot.yml`; `/review-pr` for `opencode-review.yml` | Fixed prompt.                                                 |
+| `prompt`              | Required for dispatch; `''` for bot; `/review-pr` for review       | Fixed prompt.                                                 |
 | `use-github-token`    | `false`                                                             | Use the workflow token instead of the default App-token flow. |
-| `mentions`            | `/opencode,/oc`                                                     | Comma-separated trigger phrases.                              |
+| `mentions`            | `/opencode,/oc`                                                     | Comment triggers; not exposed by the dispatch workflow.       |
 | `variant`             | `''`                                                                | Provider-specific model variant.                              |
 | `oidc-base-url`       | `https://api.opencode.ai`                                           | OIDC exchange base URL.                                       |
 | `opencode-version`    | `latest`                                                            | OpenCode version to install.                                  |
@@ -91,10 +130,12 @@ GitHub.com's `$/path` self repository syntax resolves to the repository and comm
 
 Pass only the provider secret needed by the selected model. The reusable workflows accept `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `OPENROUTER_API_KEY`, `OPENCODE_API_KEY`, `SAKURA_AI_ENGINE_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `GROQ_API_KEY`, `CEREBRAS_API_KEY`, and `MOONSHOT_API_KEY`.
 
-`GH_TOKEN` is optional. When omitted, the reusable workflow falls back to the caller's `github.token`. With `use-github-token: true`, that fallback is limited to `contents: read` by the called workflow even if the caller grants `contents: write`. For code-writing operations such as `/oc fix this`, pass a separately write-scoped `GH_TOKEN`; otherwise GitHub API writes to repository contents fail with `403`.
+`GH_TOKEN` is optional. When omitted, the reusable workflow falls back to the caller's `github.token`. With `use-github-token: true`, the bot and review workflows limit that fallback to `contents: read`, while the dispatch workflow can use `contents: write` when the caller grants it. A separately supplied `GH_TOKEN` is not governed by the called workflow's `GITHUB_TOKEN` permission ceiling.
 
 ## Permissions
 
-The reusable workflows request `contents: read`, `pull-requests: write`, `issues: write`, `id-token: write`, and `actions: read`. A called workflow can only maintain or reduce the caller's `GITHUB_TOKEN` permissions: the caller must grant the requested permissions, but its higher `contents` permission cannot override the called workflow's `contents: read` ceiling. A separately supplied `GH_TOKEN` is not governed by that `GITHUB_TOKEN` permission ceiling.
+`opencode-bot.yml` and `opencode-review.yml` request `contents: read`, `pull-requests: write`, `issues: write`, `id-token: write`, and `actions: read`. `opencode-dispatch.yml` requests the same permissions except `contents: write` because manual dispatch is a trusted operator action intended to support code-changing tasks.
+
+A called workflow can only maintain or reduce the caller's `GITHUB_TOKEN` permissions: the caller must grant the requested permissions, and a separately supplied `GH_TOKEN` is not governed by that `GITHUB_TOKEN` permission ceiling.
 
 The examples keep `permissions`, `with`, and `secrets` under the calling job so their scopes are explicit: `permissions` controls the caller token, `with` configures the reusable workflow inputs, and `secrets` passes credentials.

From 752011d47215a285eebed04084f2b3a7e87c4d6d Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:50:10 +0900
Subject: [PATCH 04/20] refactor: reuse bot workflow for manual dispatch

---
 .github/workflows/opencode-dispatch.yml | 143 ------------------------
 1 file changed, 143 deletions(-)
 delete mode 100644 .github/workflows/opencode-dispatch.yml

diff --git a/.github/workflows/opencode-dispatch.yml b/.github/workflows/opencode-dispatch.yml
deleted file mode 100644
index c2b5f58..0000000
--- a/.github/workflows/opencode-dispatch.yml
+++ /dev/null
@@ -1,143 +0,0 @@
----
-name: Manual OpenCode task
-on:
-  workflow_call:
-    inputs:
-      model:
-        required: true
-        type: string
-        description: Model to use with OpenCode
-      prompt:
-        required: true
-        type: string
-        description: Prompt to run
-      agent:
-        required: false
-        type: string
-        description: Primary agent to use
-        default: build
-      share:
-        required: false
-        type: boolean
-        description: Share the OpenCode session
-        default: false
-      use-github-token:
-        required: false
-        type: boolean
-        description: Use GITHUB_TOKEN directly instead of OpenCode App token exchange
-        default: false
-      variant:
-        required: false
-        type: string
-        description: Provider-specific model variant
-        default: ''
-      oidc-base-url:
-        required: false
-        type: string
-        description: Base URL for OIDC token exchange
-        default: https://api.opencode.ai
-      opencode-version:
-        required: false
-        type: string
-        description: OpenCode version to install
-        default: latest
-      use-bundled-toolkit:
-        required: false
-        type: boolean
-        description: Use the action's bundled OpenCode toolkit
-        default: true
-      timeout-minutes:
-        required: false
-        type: number
-        description: Maximum minutes to let OpenCode run
-        default: 60
-      runs-on:
-        required: false
-        type: string
-        description: Runner to use
-        default: ubuntu-latest
-    secrets:
-      ANTHROPIC_API_KEY:
-        required: false
-        description: Anthropic API key
-      OPENAI_API_KEY:
-        required: false
-        description: OpenAI API key
-      OPENROUTER_API_KEY:
-        required: false
-        description: OpenRouter API key
-      OPENCODE_API_KEY:
-        required: false
-        description: OpenCode API key
-      SAKURA_AI_ENGINE_API_KEY:
-        required: false
-        description: Sakura AI Engine API key
-      GOOGLE_GENERATIVE_AI_API_KEY:
-        required: false
-        description: Google Generative AI API key
-      DEEPSEEK_API_KEY:
-        required: false
-        description: DeepSeek API key
-      XAI_API_KEY:
-        required: false
-        description: xAI API key
-      GROQ_API_KEY:
-        required: false
-        description: Groq API key
-      CEREBRAS_API_KEY:
-        required: false
-        description: Cerebras API key
-      MOONSHOT_API_KEY:
-        required: false
-        description: Moonshot AI API key
-      GH_TOKEN:
-        required: false
-        description: GitHub token for repository access
-permissions:
-  contents: write
-  pull-requests: write
-  issues: write
-  id-token: write
-  actions: read
-jobs:
-  opencode-dispatch:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ${{ inputs.runs-on || 'ubuntu-latest' }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          fetch-depth: 1
-          token: ${{ secrets.GH_TOKEN || github.token }}  # zizmor: ignore[secrets-outside-env] caller-provided secret
-          persist-credentials: ${{ inputs.use-github-token }}
-      - name: Configure Git identity
-        if: inputs.use-github-token
-        run: |
-          git config --local user.name 'opencode-agent[bot]'
-          git config --local user.email 'opencode-agent[bot]@users.noreply.github.com'
-      - name: Run OpenCode
-        uses: $/.
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          SAKURA_AI_ENGINE_API_KEY: ${{ secrets.SAKURA_AI_ENGINE_API_KEY }}
-          GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
-          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
-          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
-          CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
-          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
-        with:
-          model: ${{ inputs.model }}
-          agent: ${{ inputs.agent || 'build' }}
-          share: ${{ inputs.share }}
-          prompt: ${{ inputs.prompt }}
-          use-github-token: ${{ inputs.use-github-token }}
-          variant: ${{ inputs.variant }}
-          oidc-base-url: ${{ inputs.oidc-base-url || 'https://api.opencode.ai' }}
-          opencode-version: ${{ inputs.opencode-version || 'latest' }}
-          use-bundled-toolkit: ${{ inputs.use-bundled-toolkit }}
-          timeout-minutes: ${{ inputs.timeout-minutes || 60 }}

From d8a04faa8ed766d8781567a9ff79412d2c706549 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:50:32 +0900
Subject: [PATCH 05/20] docs: document workflow_dispatch via bot workflow

---
 README.md | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index a9f5799..3ef42a1 100644
--- a/README.md
+++ b/README.md
@@ -62,13 +62,12 @@ The default setup exchanges the workflow OIDC token for an OpenCode GitHub App t
 
 ## Reusable workflows
 
-For smaller caller workflows, this repository provides reusable workflows for manual dispatches, the mention bot, and pull request reviews:
+For smaller caller workflows, this repository provides reusable workflows for OpenCode tasks and pull request reviews:
 
-| Workflow                                                           | Purpose                                                                           |
-| ------------------------------------------------------------------ | --------------------------------------------------------------------------------- |
-| [`opencode-dispatch.yml`](.github/workflows/opencode-dispatch.yml) | Run a required prompt from a trusted `workflow_dispatch` caller.                  |
-| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)           | Run OpenCode from trusted issue or pull request comments, or from a fixed prompt. |
-| [`opencode-review.yml`](.github/workflows/opencode-review.yml)     | Run the bundled `/review-pr` flow for `pull_request` events.                      |
+| Workflow                                                       | Purpose                                                                                                                |
+| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted comments or any caller event with a fixed prompt, including `workflow_dispatch`.             |
+| [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.                                                           |
 
 See [Reusable workflows](docs/reusable-workflows.md) for caller examples, inputs, secrets, and permission requirements.
 

From 1c5fb077bcd4828da3550b336cd2186789ce95d0 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:50:54 +0900
Subject: [PATCH 06/20] docs: reuse bot workflow for manual dispatch

---
 docs/reusable-workflows.md | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index d5da1c9..93bab16 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -1,12 +1,12 @@
 # Reusable workflows
 
-`opencode-action` publishes three reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
+`opencode-action` publishes two reusable GitHub Actions workflows under `.github/workflows`. Call them as jobs with `uses`, then pass action configuration through `with` and provider credentials through `secrets`.
 
-Released workflow examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/.` references the action at the repository root from the same repository and running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
+The examples below pin the reusable workflow definition to a full commit SHA. Inside the called workflow, `uses: $/.` references the action at the repository root from the same repository and running commit, so the workflow reference also pins the action implementation without a second checkout or a separate action revision input.
 
 ## Manual dispatch
 
-Use `opencode-dispatch.yml` from a caller whose only trigger is `workflow_dispatch`. The reusable workflow requires both `model` and `prompt` and skips runs from any other event.
+Use `opencode-bot.yml` from a `workflow_dispatch` caller and pass a non-empty fixed `prompt`. The existing non-comment path in `opencode-bot.yml` runs for any caller event when `prompt` is set, so a separate dispatch-specific reusable workflow is unnecessary.
 
 <!-- prettier-ignore -->
 ```yaml
@@ -28,12 +28,12 @@ on:
 jobs:
   opencode:
     permissions:
-      contents: write
+      contents: read
       issues: write
       pull-requests: write
       id-token: write
       actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-dispatch.yml@main
+    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@743cd15bb9bdfa0b9659347f995b977f635fe2a3  # v0.7.2
     with:
       model: ${{ inputs.model }}
       prompt: ${{ inputs.prompt }}
@@ -41,7 +41,7 @@ jobs:
       OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
 ```
 
-Pin `@main` to a full commit SHA once using this workflow in production. Because the caller is manually dispatched, the called workflow permits `contents: write`; the caller still controls whether that permission is granted. The default authentication remains the OpenCode App-token flow. Set `use-github-token: true` only when the caller token itself should be used for repository writes.
+The reusable workflow keeps `contents: read` for the caller token. For code-changing tasks, pass a separately write-scoped `GH_TOKEN`; higher `contents` permission on the caller's `GITHUB_TOKEN` cannot raise the called workflow's permission ceiling.
 
 ## Mention bot
 
@@ -107,16 +107,16 @@ To focus the review, override `prompt` with a supported review aspect, for examp
 
 ## Inputs
 
-The reusable workflows share most action inputs plus a runner input:
+Both reusable workflows expose the action configuration plus a runner input:
 
 | Input                 | Default                                                             | Description                                                   |
 | --------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------- |
 | `model`               | Required                                                            | Model in `provider/model` format.                             |
 | `agent`               | `build`                                                             | Primary agent.                                                |
 | `share`               | `false`                                                             | Share the OpenCode session.                                   |
-| `prompt`              | Required for dispatch; `''` for bot; `/review-pr` for review       | Fixed prompt.                                                 |
+| `prompt`              | `''` for `opencode-bot.yml`; `/review-pr` for `opencode-review.yml` | Fixed prompt.                                                 |
 | `use-github-token`    | `false`                                                             | Use the workflow token instead of the default App-token flow. |
-| `mentions`            | `/opencode,/oc`                                                     | Comment triggers; not exposed by the dispatch workflow.       |
+| `mentions`            | `/opencode,/oc`                                                     | Comma-separated trigger phrases.                              |
 | `variant`             | `''`                                                                | Provider-specific model variant.                              |
 | `oidc-base-url`       | `https://api.opencode.ai`                                           | OIDC exchange base URL.                                       |
 | `opencode-version`    | `latest`                                                            | OpenCode version to install.                                  |
@@ -130,12 +130,10 @@ GitHub.com's `$/path` self repository syntax resolves to the repository and comm
 
 Pass only the provider secret needed by the selected model. The reusable workflows accept `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `OPENROUTER_API_KEY`, `OPENCODE_API_KEY`, `SAKURA_AI_ENGINE_API_KEY`, `GOOGLE_GENERATIVE_AI_API_KEY`, `DEEPSEEK_API_KEY`, `XAI_API_KEY`, `GROQ_API_KEY`, `CEREBRAS_API_KEY`, and `MOONSHOT_API_KEY`.
 
-`GH_TOKEN` is optional. When omitted, the reusable workflow falls back to the caller's `github.token`. With `use-github-token: true`, the bot and review workflows limit that fallback to `contents: read`, while the dispatch workflow can use `contents: write` when the caller grants it. A separately supplied `GH_TOKEN` is not governed by the called workflow's `GITHUB_TOKEN` permission ceiling.
+`GH_TOKEN` is optional. When omitted, the reusable workflow falls back to the caller's `github.token`. With `use-github-token: true`, that fallback is limited to `contents: read` by the called workflow even if the caller grants `contents: write`. For code-writing operations such as `/oc fix this`, pass a separately write-scoped `GH_TOKEN`; otherwise GitHub API writes to repository contents fail with `403`.
 
 ## Permissions
 
-`opencode-bot.yml` and `opencode-review.yml` request `contents: read`, `pull-requests: write`, `issues: write`, `id-token: write`, and `actions: read`. `opencode-dispatch.yml` requests the same permissions except `contents: write` because manual dispatch is a trusted operator action intended to support code-changing tasks.
-
-A called workflow can only maintain or reduce the caller's `GITHUB_TOKEN` permissions: the caller must grant the requested permissions, and a separately supplied `GH_TOKEN` is not governed by that `GITHUB_TOKEN` permission ceiling.
+The reusable workflows request `contents: read`, `pull-requests: write`, `issues: write`, `id-token: write`, and `actions: read`. A called workflow can only maintain or reduce the caller's `GITHUB_TOKEN` permissions: the caller must grant the requested permissions, but its higher `contents` permission cannot override the called workflow's `contents: read` ceiling. A separately supplied `GH_TOKEN` is not governed by that `GITHUB_TOKEN` permission ceiling.
 
 The examples keep `permissions`, `with`, and `secrets` under the calling job so their scopes are explicit: `permissions` controls the caller token, `with` configures the reusable workflow inputs, and `secrets` passes credentials.

From 0e258cc681ffc21ac25f75e0dc402f8d3487f89c Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:44:22 +0900
Subject: [PATCH 07/20] feat: add workflow_dispatch to OpenCode bot

---
 .github/workflows/opencode-bot.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index e0ac232..77886ff 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -1,5 +1,5 @@
 ---
-name: Mention bot using OpenCode
+name: OpenCode bot
 on:
   workflow_call:
     inputs:
@@ -99,6 +99,22 @@ on:
       GH_TOKEN:
         required: false
         description: GitHub token for repository access
+  workflow_dispatch:
+    inputs:
+      prompt:
+        required: true
+        type: string
+        description: Prompt to run
+      model:
+        required: false
+        type: string
+        description: Model to use with OpenCode
+        default: sakura/preview/Kimi-K2.7-Code
+      use-bundled-toolkit:
+        required: false
+        type: boolean
+        description: Use the action's bundled OpenCode toolkit
+        default: true
   issue_comment:
     types:
       - created

From 34a11ada9f7cfb7ab4e4de33fd6ee70e94808fa0 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:44:43 +0900
Subject: [PATCH 08/20] docs: describe direct workflow dispatch

---
 README.md | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 3ef42a1..2f2b70a 100644
--- a/README.md
+++ b/README.md
@@ -64,10 +64,12 @@ The default setup exchanges the workflow OIDC token for an OpenCode GitHub App t
 
 For smaller caller workflows, this repository provides reusable workflows for OpenCode tasks and pull request reviews:
 
-| Workflow                                                       | Purpose                                                                                                                |
-| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted comments or any caller event with a fixed prompt, including `workflow_dispatch`.             |
-| [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.                                                           |
+| Workflow                                                       | Purpose                                                                                                              |
+| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted comments, direct `workflow_dispatch`, or any caller event with a fixed prompt.            |
+| [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.                                                         |
+
+`opencode-bot.yml` also exposes `workflow_dispatch` directly. Once the workflow is present on the default branch, GitHub Actions clients such as the Actions UI, API clients, or ChatGPT with GitHub access can dispatch it with a `prompt` and optional `model`.
 
 See [Reusable workflows](docs/reusable-workflows.md) for caller examples, inputs, secrets, and permission requirements.
 
@@ -107,6 +109,8 @@ The workflow uses the repository-provided `GITHUB_TOKEN` with `contents: write`
 | `timeout-minutes`     | `60`                      | Stop OpenCode after this many minutes.                                                                                                                                  |
 | `oidc-base-url`       | `https://api.opencode.ai` | OIDC exchange URL for a custom GitHub App installation.                                                                                                                 |
 
+Direct `workflow_dispatch` exposes `prompt`, `model`, and `use-bundled-toolkit`; the remaining values use the workflow defaults.
+
 When `use-github-token: true`, keep `GITHUB_TOKEN` in `env` and grant only the permissions needed for the task.
 
 Outputs are `opencode-version` and `cache-hit`. `cache-hit` is empty on review-only runs (`prompt: /review-pr`), which always skip the cache and install fresh.

From 6177ef8ffde2d9ed5974ed24ad86c07aad75811f Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:45:06 +0900
Subject: [PATCH 09/20] docs: add direct dispatch usage

---
 docs/reusable-workflows.md | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 93bab16..805f69e 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -6,7 +6,17 @@ The examples below pin the reusable workflow definition to a full commit SHA. In
 
 ## Manual dispatch
 
-Use `opencode-bot.yml` from a `workflow_dispatch` caller and pass a non-empty fixed `prompt`. The existing non-comment path in `opencode-bot.yml` runs for any caller event when `prompt` is set, so a separate dispatch-specific reusable workflow is unnecessary.
+`opencode-bot.yml` supports both direct `workflow_dispatch` and reuse from another `workflow_dispatch` workflow.
+
+### Direct dispatch
+
+When `opencode-bot.yml` is on the repository's default branch, it can be started through the GitHub Actions UI or workflow-dispatch API. This also makes it suitable for clients such as ChatGPT with GitHub access that can dispatch Actions workflows.
+
+Direct dispatch requires `prompt`. `model` defaults to `sakura/preview/Kimi-K2.7-Code`, and `use-bundled-toolkit` defaults to `true`. Provider credentials must be configured as Actions secrets in the repository where the workflow runs.
+
+### Reusable caller
+
+A consumer repository can keep its own `workflow_dispatch` entry point and call `opencode-bot.yml` as a reusable workflow:
 
 <!-- prettier-ignore -->
 ```yaml
@@ -43,9 +53,9 @@ jobs:
 
 The reusable workflow keeps `contents: read` for the caller token. For code-changing tasks, pass a separately write-scoped `GH_TOKEN`; higher `contents` permission on the caller's `GITHUB_TOKEN` cannot raise the called workflow's permission ceiling.
 
-## Mention bot
+## OpenCode bot
 
-Use `opencode-bot.yml` for `/opencode` and `/oc` comments, or for another event with a fixed `prompt`.
+Use `opencode-bot.yml` for `/opencode` and `/oc` comments, direct manual dispatch, or another event with a fixed `prompt`.
 
 <!-- prettier-ignore -->
 ```yaml
@@ -72,7 +82,7 @@ jobs:
       OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
 ```
 
-For comment events, the reusable workflow accepts comments only from `OWNER`, `MEMBER`, or `COLLABORATOR` author associations. On other events, set a non-empty `prompt` to run the workflow without a comment trigger.
+For comment events, the reusable workflow accepts comments only from `OWNER`, `MEMBER`, or `COLLABORATOR` author associations. On non-comment events, a non-empty `prompt` is required.
 
 ## Pull request review
 
@@ -124,6 +134,8 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
+Direct `workflow_dispatch` on `opencode-bot.yml` exposes only `prompt`, `model`, and `use-bundled-toolkit`; other settings use the workflow's existing defaults.
+
 GitHub.com's `$/path` self repository syntax resolves to the repository and commit of the workflow where it appears, including when that workflow is called from another repository. These workflows use `$/.` because the action is defined at the repository root. GitHub Enterprise Server does not support this syntax.
 
 ## Secrets

From 0cff329f58593506d37996fd0e68dbe28cb49236 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:49:09 +0900
Subject: [PATCH 10/20] feat: align dispatch inputs with workflow call

---
 .github/workflows/opencode-bot.yml | 57 ++++++++++++++++++++++++++----
 1 file changed, 51 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index 77886ff..e0625b0 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -95,26 +95,71 @@ on:
         description: Cerebras API key
       MOONSHOT_API_KEY:
         required: false
-        description: Moonshot AI API key
+        description: Moonshot API key
       GH_TOKEN:
         required: false
         description: GitHub token for repository access
   workflow_dispatch:
     inputs:
-      prompt:
+      model:
         required: true
         type: string
-        description: Prompt to run
-      model:
+        description: Model to use with OpenCode
+      agent:
         required: false
         type: string
-        description: Model to use with OpenCode
-        default: sakura/preview/Kimi-K2.7-Code
+        description: Primary agent to use
+        default: build
+      share:
+        required: false
+        type: boolean
+        description: Share the OpenCode session
+        default: false
+      prompt:
+        required: false
+        type: string
+        description: Custom prompt to override the event comment
+        default: ''
+      use-github-token:
+        required: false
+        type: boolean
+        description: Use GITHUB_TOKEN directly instead of OpenCode App token exchange
+        default: false
+      mentions:
+        required: false
+        type: string
+        description: Comma-separated list of trigger phrases
+        default: /opencode,/oc
+      variant:
+        required: false
+        type: string
+        description: Provider-specific model variant
+        default: ''
+      oidc-base-url:
+        required: false
+        type: string
+        description: Base URL for OIDC token exchange
+        default: https://api.opencode.ai
+      opencode-version:
+        required: false
+        type: string
+        description: OpenCode version to install
+        default: latest
       use-bundled-toolkit:
         required: false
         type: boolean
         description: Use the action's bundled OpenCode toolkit
         default: true
+      timeout-minutes:
+        required: false
+        type: number
+        description: Maximum minutes to let OpenCode run
+        default: 60
+      runs-on:
+        required: false
+        type: string
+        description: Runner to use
+        default: ubuntu-latest
   issue_comment:
     types:
       - created

From 4d7b21319f29ead6e4710675b65bb80234a49b1c Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:49:30 +0900
Subject: [PATCH 11/20] docs: align dispatch input documentation

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 2f2b70a..d82ad20 100644
--- a/README.md
+++ b/README.md
@@ -69,7 +69,7 @@ For smaller caller workflows, this repository provides reusable workflows for Op
 | [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted comments, direct `workflow_dispatch`, or any caller event with a fixed prompt.            |
 | [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.                                                         |
 
-`opencode-bot.yml` also exposes `workflow_dispatch` directly. Once the workflow is present on the default branch, GitHub Actions clients such as the Actions UI, API clients, or ChatGPT with GitHub access can dispatch it with a `prompt` and optional `model`.
+`opencode-bot.yml` also exposes `workflow_dispatch` directly. Once the workflow is present on the default branch, GitHub Actions clients such as the Actions UI, API clients, or ChatGPT with GitHub access can dispatch it using the same inputs exposed by `workflow_call`.
 
 See [Reusable workflows](docs/reusable-workflows.md) for caller examples, inputs, secrets, and permission requirements.
 
@@ -109,7 +109,7 @@ The workflow uses the repository-provided `GITHUB_TOKEN` with `contents: write`
 | `timeout-minutes`     | `60`                      | Stop OpenCode after this many minutes.                                                                                                                                  |
 | `oidc-base-url`       | `https://api.opencode.ai` | OIDC exchange URL for a custom GitHub App installation.                                                                                                                 |
 
-Direct `workflow_dispatch` exposes `prompt`, `model`, and `use-bundled-toolkit`; the remaining values use the workflow defaults.
+Direct `workflow_dispatch` exposes the same input contract as `workflow_call`. For direct dispatch, `model` is required and the job runs only when `prompt` is non-empty.
 
 When `use-github-token: true`, keep `GITHUB_TOKEN` in `env` and grant only the permissions needed for the task.
 

From a6f06c36074b1ee55a7bb22f5eb5a105021a2373 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:49:50 +0900
Subject: [PATCH 12/20] docs: align direct dispatch inputs

---
 docs/reusable-workflows.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 805f69e..6ab2c94 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -12,7 +12,7 @@ The examples below pin the reusable workflow definition to a full commit SHA. In
 
 When `opencode-bot.yml` is on the repository's default branch, it can be started through the GitHub Actions UI or workflow-dispatch API. This also makes it suitable for clients such as ChatGPT with GitHub access that can dispatch Actions workflows.
 
-Direct dispatch requires `prompt`. `model` defaults to `sakura/preview/Kimi-K2.7-Code`, and `use-bundled-toolkit` defaults to `true`. Provider credentials must be configured as Actions secrets in the repository where the workflow runs.
+Direct dispatch exposes the same inputs, types, required flags, and defaults as `workflow_call`. `model` is required. `prompt` retains the reusable-workflow default of `''`, but the job runs only when it is non-empty. Provider credentials must be configured as Actions secrets in the repository where the workflow runs.
 
 ### Reusable caller
 
@@ -134,7 +134,7 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
-Direct `workflow_dispatch` on `opencode-bot.yml` exposes only `prompt`, `model`, and `use-bundled-toolkit`; other settings use the workflow's existing defaults.
+Direct `workflow_dispatch` on `opencode-bot.yml` mirrors the complete `workflow_call` input contract above, including `agent`, `share`, `use-github-token`, `mentions`, `variant`, `oidc-base-url`, `opencode-version`, `use-bundled-toolkit`, `timeout-minutes`, and `runs-on`.
 
 GitHub.com's `$/path` self repository syntax resolves to the repository and commit of the workflow where it appears, including when that workflow is called from another repository. These workflows use `$/.` because the action is defined at the repository root. GitHub Enterprise Server does not support this syntax.
 

From 30fe217081525b82698b8ed1262efcfba583b9f2 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:50:19 +0900
Subject: [PATCH 13/20] docs: clarify direct dispatch prompt requirement

---
 docs/reusable-workflows.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 6ab2c94..0848a4e 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -12,7 +12,7 @@ The examples below pin the reusable workflow definition to a full commit SHA. In
 
 When `opencode-bot.yml` is on the repository's default branch, it can be started through the GitHub Actions UI or workflow-dispatch API. This also makes it suitable for clients such as ChatGPT with GitHub access that can dispatch Actions workflows.
 
-Direct dispatch exposes the same inputs, types, required flags, and defaults as `workflow_call`. `model` is required. `prompt` retains the reusable-workflow default of `''`, but the job runs only when it is non-empty. Provider credentials must be configured as Actions secrets in the repository where the workflow runs.
+Direct dispatch exposes the same inputs, types, required flags, and defaults as `workflow_call`. `model` is required. `prompt` retains the reusable-workflow default of `''`, but a non-empty value is required for the job to run. Provider credentials must be configured as Actions secrets in the repository where the workflow runs.
 
 ### Reusable caller
 

From 6e2df7cc4508730a38a978068a6ecaf9f787cf64 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:50:40 +0900
Subject: [PATCH 14/20] docs: clarify aligned dispatch contract

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index d82ad20..413b641 100644
--- a/README.md
+++ b/README.md
@@ -109,7 +109,7 @@ The workflow uses the repository-provided `GITHUB_TOKEN` with `contents: write`
 | `timeout-minutes`     | `60`                      | Stop OpenCode after this many minutes.                                                                                                                                  |
 | `oidc-base-url`       | `https://api.opencode.ai` | OIDC exchange URL for a custom GitHub App installation.                                                                                                                 |
 
-Direct `workflow_dispatch` exposes the same input contract as `workflow_call`. For direct dispatch, `model` is required and the job runs only when `prompt` is non-empty.
+Direct `workflow_dispatch` exposes the same input contract as `workflow_call`. For direct dispatch, `model` is required and a non-empty `prompt` is required for the job to run.
 
 When `use-github-token: true`, keep `GITHUB_TOKEN` in `env` and grant only the permissions needed for the task.
 

From 6ac99b1d9f8382d97191c2e7a0800a2a6a6f3283 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:51:00 +0900
Subject: [PATCH 15/20] chore: keep dispatch and reusable inputs identical


From 0c6439a91fc663a9e57f5939042b7033164a644e Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 02:11:54 +0900
Subject: [PATCH 16/20] fix: allow intentional workflow dispatch inputs

---
 .github/workflows/opencode-bot.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index e0625b0..dd56e4c 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -95,10 +95,11 @@ on:
         description: Cerebras API key
       MOONSHOT_API_KEY:
         required: false
-        description: Moonshot API key
+        description: Moonshot AI API key
       GH_TOKEN:
         required: false
         description: GitHub token for repository access
+  # checkov:skip=CKV_GHA_7: Parameterized manual dispatch is an intentional trusted-operator interface.
   workflow_dispatch:
     inputs:
       model:

From e75c74ee47b7ad2e8a31f1b37eb9545643667569 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 02:12:39 +0900
Subject: [PATCH 17/20] docs: simplify workflow dispatch guidance

---
 README.md | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 413b641..a894ca2 100644
--- a/README.md
+++ b/README.md
@@ -64,12 +64,10 @@ The default setup exchanges the workflow OIDC token for an OpenCode GitHub App t
 
 For smaller caller workflows, this repository provides reusable workflows for OpenCode tasks and pull request reviews:
 
-| Workflow                                                       | Purpose                                                                                                              |
-| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted comments, direct `workflow_dispatch`, or any caller event with a fixed prompt.            |
-| [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.                                                         |
-
-`opencode-bot.yml` also exposes `workflow_dispatch` directly. Once the workflow is present on the default branch, GitHub Actions clients such as the Actions UI, API clients, or ChatGPT with GitHub access can dispatch it using the same inputs exposed by `workflow_call`.
+| Workflow                                                       | Purpose                                                                 |
+| -------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| [`opencode-bot.yml`](.github/workflows/opencode-bot.yml)       | Run OpenCode from trusted comments, manual dispatch, or a fixed prompt. |
+| [`opencode-review.yml`](.github/workflows/opencode-review.yml) | Run the bundled `/review-pr` flow for `pull_request` events.            |
 
 See [Reusable workflows](docs/reusable-workflows.md) for caller examples, inputs, secrets, and permission requirements.
 
@@ -109,7 +107,7 @@ The workflow uses the repository-provided `GITHUB_TOKEN` with `contents: write`
 | `timeout-minutes`     | `60`                      | Stop OpenCode after this many minutes.                                                                                                                                  |
 | `oidc-base-url`       | `https://api.opencode.ai` | OIDC exchange URL for a custom GitHub App installation.                                                                                                                 |
 
-Direct `workflow_dispatch` exposes the same input contract as `workflow_call`. For direct dispatch, `model` is required and a non-empty `prompt` is required for the job to run.
+Direct `workflow_dispatch` uses the same inputs as `workflow_call`; `model` and a non-empty `prompt` are required to run the job.
 
 When `use-github-token: true`, keep `GITHUB_TOKEN` in `env` and grant only the permissions needed for the task.
 

From a8fbb5e81750d2b10f12bd5c82a0277b99844f2a Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 02:12:57 +0900
Subject: [PATCH 18/20] docs: trim manual dispatch guidance

---
 docs/reusable-workflows.md | 49 ++------------------------------------
 1 file changed, 2 insertions(+), 47 deletions(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 0848a4e..318f89b 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -6,52 +6,7 @@ The examples below pin the reusable workflow definition to a full commit SHA. In
 
 ## Manual dispatch
 
-`opencode-bot.yml` supports both direct `workflow_dispatch` and reuse from another `workflow_dispatch` workflow.
-
-### Direct dispatch
-
-When `opencode-bot.yml` is on the repository's default branch, it can be started through the GitHub Actions UI or workflow-dispatch API. This also makes it suitable for clients such as ChatGPT with GitHub access that can dispatch Actions workflows.
-
-Direct dispatch exposes the same inputs, types, required flags, and defaults as `workflow_call`. `model` is required. `prompt` retains the reusable-workflow default of `''`, but a non-empty value is required for the job to run. Provider credentials must be configured as Actions secrets in the repository where the workflow runs.
-
-### Reusable caller
-
-A consumer repository can keep its own `workflow_dispatch` entry point and call `opencode-bot.yml` as a reusable workflow:
-
-<!-- prettier-ignore -->
-```yaml
----
-name: OpenCode task
-on:
-  workflow_dispatch:
-    inputs:
-      prompt:
-        description: Prompt to run
-        required: true
-        type: string
-      model:
-        description: Model to use with OpenCode
-        required: true
-        default: opencode-go/kimi-k3
-        type: string
-
-jobs:
-  opencode:
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
-      id-token: write
-      actions: read
-    uses: dceoy/opencode-action/.github/workflows/opencode-bot.yml@743cd15bb9bdfa0b9659347f995b977f635fe2a3  # v0.7.2
-    with:
-      model: ${{ inputs.model }}
-      prompt: ${{ inputs.prompt }}
-    secrets:
-      OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-```
-
-The reusable workflow keeps `contents: read` for the caller token. For code-changing tasks, pass a separately write-scoped `GH_TOKEN`; higher `contents` permission on the caller's `GITHUB_TOKEN` cannot raise the called workflow's permission ceiling.
+`opencode-bot.yml` exposes `workflow_dispatch` with the same inputs as `workflow_call`. `model` is required, and `prompt` must be non-empty for the job to run. It can be dispatched from the Actions UI or API, including clients such as ChatGPT with GitHub access.
 
 ## OpenCode bot
 
@@ -134,7 +89,7 @@ Both reusable workflows expose the action configuration plus a runner input:
 | `timeout-minutes`     | `60`                                                                | Maximum OpenCode runtime in minutes.                          |
 | `runs-on`             | `ubuntu-latest`                                                     | Runner label for the called job.                              |
 
-Direct `workflow_dispatch` on `opencode-bot.yml` mirrors the complete `workflow_call` input contract above, including `agent`, `share`, `use-github-token`, `mentions`, `variant`, `oidc-base-url`, `opencode-version`, `use-bundled-toolkit`, `timeout-minutes`, and `runs-on`.
+Direct `workflow_dispatch` on `opencode-bot.yml` uses the same inputs.
 
 GitHub.com's `$/path` self repository syntax resolves to the repository and commit of the workflow where it appears, including when that workflow is called from another repository. These workflows use `$/.` because the action is defined at the repository root. GitHub Enterprise Server does not support this syntax.
 

From d1121b7ff2aa3a6a82c8e7086c3eb3fed987c839 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 02:28:57 +0900
Subject: [PATCH 19/20] docs: qualify workflow dispatch clients

---
 docs/reusable-workflows.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/reusable-workflows.md b/docs/reusable-workflows.md
index 318f89b..057e186 100644
--- a/docs/reusable-workflows.md
+++ b/docs/reusable-workflows.md
@@ -6,7 +6,7 @@ The examples below pin the reusable workflow definition to a full commit SHA. In
 
 ## Manual dispatch
 
-`opencode-bot.yml` exposes `workflow_dispatch` with the same inputs as `workflow_call`. `model` is required, and `prompt` must be non-empty for the job to run. It can be dispatched from the Actions UI or API, including clients such as ChatGPT with GitHub access.
+`opencode-bot.yml` exposes `workflow_dispatch` with the same inputs as `workflow_call`. `model` is required, and `prompt` must be non-empty for the job to run. It can be dispatched from the Actions UI or by API clients and integrations authorized to dispatch GitHub Actions workflows.
 
 ## OpenCode bot
 

From 4f6ab0a9e3e7d57bba030753781db7e9276db993 Mon Sep 17 00:00:00 2001
From: Daichi Narushima <1938249+dceoy@users.noreply.github.com>
Date: Mon, 7 Sep 2026 03:31:14 +0900
Subject: [PATCH 20/20] style: inline Checkov workflow dispatch skip

---
 .github/workflows/opencode-bot.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/opencode-bot.yml b/.github/workflows/opencode-bot.yml
index dd56e4c..0cf7ccb 100644
--- a/.github/workflows/opencode-bot.yml
+++ b/.github/workflows/opencode-bot.yml
@@ -99,8 +99,7 @@ on:
       GH_TOKEN:
         required: false
         description: GitHub token for repository access
-  # checkov:skip=CKV_GHA_7: Parameterized manual dispatch is an intentional trusted-operator interface.
-  workflow_dispatch:
+  workflow_dispatch:  # checkov:skip=CKV_GHA_7: Parameterized manual dispatch is an intentional trusted-operator interface.
     inputs:
       model:
         required: true