From 3ac4a928bbdc8fd80c61b881c6be5d57b2d19e37 Mon Sep 17 00:00:00 2001
From: Michael Dwan <mdwan@cloudflare.com>
Date: Fri, 27 Mar 2026 12:44:46 -0600
Subject: [PATCH 1/5] Add OpenCode AI review for pull requests

Automated review via Cloudflare AI Gateway (Kimi K2.5) on every PR open
and push. Includes language-specific review skills for Go, Python, and
Rust, plus a cross-cutting Cog architecture skill.

Skip with the no-ai-review label or [skip-review]/[WIP] in the title.
---
 .github/workflows/opencode-review.yml   | 57 +++++++++++++++++++++++++
 .github/workflows/opencode.yml          | 35 +++++++++++++++
 .opencode/agents/reviewer.md            | 40 +++++++++++++++++
 .opencode/skills/cog-review/SKILL.md    | 51 ++++++++++++++++++++++
 .opencode/skills/go-review/SKILL.md     | 44 +++++++++++++++++++
 .opencode/skills/python-review/SKILL.md | 47 ++++++++++++++++++++
 .opencode/skills/rust-review/SKILL.md   | 49 +++++++++++++++++++++
 opencode.json                           | 12 ++++++
 8 files changed, 335 insertions(+)
 create mode 100644 .github/workflows/opencode-review.yml
 create mode 100644 .github/workflows/opencode.yml
 create mode 100644 .opencode/agents/reviewer.md
 create mode 100644 .opencode/skills/cog-review/SKILL.md
 create mode 100644 .opencode/skills/go-review/SKILL.md
 create mode 100644 .opencode/skills/python-review/SKILL.md
 create mode 100644 .opencode/skills/rust-review/SKILL.md
 create mode 100644 opencode.json

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
new file mode 100644
index 0000000000..aefdd8b21a
--- /dev/null
+++ b/.github/workflows/opencode-review.yml
@@ -0,0 +1,57 @@
+name: opencode-review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+
+    # Skip if label or title says so
+    if: |
+      !contains(github.event.pull_request.labels.*.name, 'no-ai-review') &&
+      !contains(github.event.pull_request.title, '[skip-review]') &&
+      !contains(github.event.pull_request.title, '[wip]') &&
+      !contains(github.event.pull_request.title, '[WIP]')
+
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: read
+      issues: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Run OpenCode Review
+        uses: anomalyco/opencode/github@latest
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_GATEWAY_ID: ${{ secrets.CLOUDFLARE_GATEWAY_ID }}
+        with:
+          model: cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5
+          agent: reviewer
+          prompt: |
+            Review this pull request. Focus on what matters:
+            - Bugs, logic errors, race conditions
+            - Security issues
+            - Performance concerns
+            - Architectural fit with existing patterns
+            - Error handling gaps
+
+            Be practical. This repo has Go, Python, and Rust -- linters (golangci-lint,
+            ruff, clippy) already run in CI, so don't flag formatting or style issues
+            they catch.
+
+            Scope your review to the PR's intent. Don't pile on about pre-existing
+            issues unrelated to this change. Leave things better than you found them,
+            but keep the burden proportional.
+
+            Use file:line references. Use ```suggestion blocks for concrete fixes.
+            Flag blockers vs nice-to-haves clearly.
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
new file mode 100644
index 0000000000..e2ca86f6ad
--- /dev/null
+++ b/.github/workflows/opencode.yml
@@ -0,0 +1,35 @@
+name: opencode
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  opencode:
+    if: |
+      contains(github.event.comment.body, ' /oc') ||
+      startsWith(github.event.comment.body, '/oc') ||
+      contains(github.event.comment.body, ' /opencode') ||
+      startsWith(github.event.comment.body, '/opencode')
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: read
+      issues: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run opencode
+        uses: anomalyco/opencode/github@latest
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_GATEWAY_ID: ${{ secrets.CLOUDFLARE_GATEWAY_ID }}
+        with:
+          model: cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5
\ No newline at end of file
diff --git a/.opencode/agents/reviewer.md b/.opencode/agents/reviewer.md
new file mode 100644
index 0000000000..8ec1644f6a
--- /dev/null
+++ b/.opencode/agents/reviewer.md
@@ -0,0 +1,40 @@
+---
+description: Read-only code reviewer for pull requests
+mode: primary
+model: cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5
+temperature: 0.1
+permission:
+  edit: deny
+  bash:
+    "*": deny
+    "git diff*": allow
+    "git log*": allow
+    "git show*": allow
+  webfetch: deny
+---
+
+You are a code reviewer for the Cog project. Cog packages ML models into
+production-ready containers. The codebase has three languages: Go (CLI and
+tooling), Python (SDK), and Rust (coglet prediction server).
+
+## How to review
+
+1. Read the full diff. Understand what the PR is trying to do before commenting.
+2. Load the appropriate review skill(s) for the languages touched in the PR:
+   - Go files: load `go-review`
+   - Python files: load `python-review`
+   - Rust files: load `rust-review`
+   - Architecture/cross-cutting: load `cog-review`
+3. Focus on substance, not style. Linters handle formatting.
+4. Scope feedback to the PR's purpose. Don't demand unrelated refactors.
+5. Be direct. Say what the problem is, why it matters, and how to fix it.
+
+## Comment format
+
+- Reference specific files and lines: `path/to/file.go:42`
+- Use ```suggestion blocks when proposing concrete code changes
+- Categorize findings:
+  - **Blocker**: Must fix before merge (bugs, security, data loss)
+  - **Should fix**: Important but not blocking (error handling gaps, edge cases)
+  - **Nit**: Minor improvement, take it or leave it
+- If the PR looks good, say so briefly. Don't invent problems.
diff --git a/.opencode/skills/cog-review/SKILL.md b/.opencode/skills/cog-review/SKILL.md
new file mode 100644
index 0000000000..fbd66d0ea9
--- /dev/null
+++ b/.opencode/skills/cog-review/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: cog-review
+description: Cog architecture and cross-cutting review guidelines
+---
+
+## Cog architecture review guidelines
+
+Cog packages ML models into production-ready containers. Use this skill for
+changes that cross language boundaries or touch core architecture.
+
+### Component overview
+
+- **CLI** (Go): `cmd/cog/` and `pkg/` -- builds, runs, and deploys models
+- **Python SDK**: `python/cog/` -- predictor interface, types, HTTP/queue server
+- **Coglet** (Rust): `crates/` -- prediction server inside containers (HTTP, worker management, IPC)
+
+### Key design patterns
+
+**Wheel resolution**: The CLI discovers SDK and coglet wheels from `dist/` at
+Docker build time. Wheels are NOT embedded in the binary. Changes to build
+artifacts need to account for this.
+
+**Dockerfile generation**: `pkg/dockerfile/` generates Dockerfiles from `cog.yaml`
+config. Template injection and escaping matter here.
+
+**Config parsing**: `pkg/config/config.go` parses `cog.yaml`. Schema is at
+`pkg/config/data/config_schema_v1.0.json`. Changes must keep schema and Go
+code in sync.
+
+**Two-process coglet**: Parent process (HTTP server + orchestrator) and child
+worker process (Python predictor execution) communicate via IPC. Changes to
+the IPC protocol affect both Rust and Python code.
+
+**Compatibility matrix**: CUDA/PyTorch/TensorFlow compatibility is managed in
+`tools/compatgen/`. Framework version changes have wide blast radius.
+
+### Cross-cutting concerns
+
+- **VERSION.txt** is the single source of truth for versioning. `Cargo.toml` must match.
+- Changes to `python/cog/base_predictor.py` affect all downstream model authors.
+- Changes to `docs/` require running `mise run docs:llm` to regenerate `docs/llms.txt`.
+- CLI reference docs are auto-generated -- changes to `cmd/` or `pkg/cli/` require `mise run docs:cli`.
+- Integration tests in `integration-tests/` use Go's testscript and need a built cog binary.
+
+### What to watch for
+
+- Breaking changes to the predictor interface or cog.yaml schema
+- Docker build changes that affect layer caching or build time
+- IPC protocol changes without updating both Rust and Python sides
+- Version bumps that miss one of the places VERSION.txt needs to match
+- New ML framework versions without compatibility testing
diff --git a/.opencode/skills/go-review/SKILL.md b/.opencode/skills/go-review/SKILL.md
new file mode 100644
index 0000000000..60c5a43558
--- /dev/null
+++ b/.opencode/skills/go-review/SKILL.md
@@ -0,0 +1,44 @@
+---
+name: go-review
+description: Go code review guidelines for the Cog codebase
+---
+
+## Go review guidelines
+
+This project uses Go for the CLI (`cmd/cog/`, `pkg/`) and support tooling (`tools/`).
+
+### What linters already catch (skip these)
+
+golangci-lint runs errcheck, gocritic, gosec, govet, ineffassign, misspell,
+revive, staticcheck, and unused. Don't flag issues these would catch.
+
+### What to look for
+
+**Error handling**
+- Errors returned but not checked or silently discarded
+- User-facing errors should use `pkg/errors.CodedError` with error codes
+- Generic error wrapping that loses context (`fmt.Errorf("failed")` with no `%w`)
+
+**Imports**
+- Should be three groups: stdlib, third-party, internal (`github.com/replicate/cog/pkg/...`)
+- Only flag if actually wrong, not cosmetic reordering
+
+**Testing**
+- Must use `testify/require` for fatal assertions and `testify/assert` for non-fatal
+- No raw `if` checks with `t.Fatal`/`t.Errorf`
+- Prefer table-driven tests for similar cases
+- Prefer specific assertions (`Equal`, `Contains`, `NoError`) over `True`/`False`
+
+**Concurrency**
+- Goroutine leaks (no cleanup path, missing context cancellation)
+- Shared state without synchronization
+- Channel misuse (sends on closed channels, unbuffered channels in wrong contexts)
+
+**Docker/container patterns**
+- The CLI uses the Docker Go SDK. Watch for leaked clients, unclosed response bodies
+- Dockerfile generation is in `pkg/dockerfile/` -- template injection risks
+
+**Architecture**
+- Commands belong in `pkg/cli/`, business logic in `pkg/`
+- Config parsing/validation in `pkg/config/`
+- Don't mix CLI concerns with library logic
diff --git a/.opencode/skills/python-review/SKILL.md b/.opencode/skills/python-review/SKILL.md
new file mode 100644
index 0000000000..7ac56147ce
--- /dev/null
+++ b/.opencode/skills/python-review/SKILL.md
@@ -0,0 +1,47 @@
+---
+name: python-review
+description: Python code review guidelines for the Cog SDK
+---
+
+## Python review guidelines
+
+This project uses Python for the SDK (`python/cog/`) which defines the predictor
+interface, type system, and HTTP/queue server.
+
+### What linters already catch (skip these)
+
+ruff handles pycodestyle (E), Pyflakes (F), isort (I), warnings (W), bandit (S),
+bugbear (B), and annotations (ANN). Don't flag issues these would catch.
+
+### What to look for
+
+**Type annotations**
+- Required on all function signatures
+- Use `typing_extensions` for backward compatibility
+- Avoid `Any` where a concrete type is possible
+- Check that type annotations actually match runtime behavior
+
+**Compatibility**
+- Must support Python 3.10 through 3.13
+- Watch for syntax/stdlib features only available in newer versions
+- `from __future__ import annotations` if using newer annotation syntax
+
+**Error handling**
+- No bare `except:` or `except Exception:` that swallows everything
+- Exceptions should have descriptive messages
+- Resource cleanup with context managers, not try/finally when avoidable
+
+**Async patterns**
+- Tests use pytest-asyncio -- async tests need proper fixtures
+- Watch for blocking calls inside async functions
+- Proper cleanup of async resources (aclose, async context managers)
+
+**Predictor interface**
+- `base_predictor.py` is the core interface -- changes here affect all users
+- `types.py` defines input/output types -- check backward compatibility
+- Server code in `python/cog/server/` handles HTTP -- watch for request handling bugs
+
+**Testing**
+- Uses pytest with fixtures
+- tox runs tests across Python 3.10-3.13
+- Test isolation: don't rely on global state or test ordering
diff --git a/.opencode/skills/rust-review/SKILL.md b/.opencode/skills/rust-review/SKILL.md
new file mode 100644
index 0000000000..04f8881857
--- /dev/null
+++ b/.opencode/skills/rust-review/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: rust-review
+description: Rust code review guidelines for Coglet
+---
+
+## Rust review guidelines
+
+This project uses Rust for Coglet (`crates/`), the prediction server that runs
+inside Cog containers. It handles HTTP requests, worker process management, and
+prediction execution.
+
+### What linters already catch (skip these)
+
+clippy runs in CI. cargo-deny audits dependencies for license/advisory issues.
+Don't flag issues these would catch.
+
+### What to look for
+
+**Error handling**
+- Use `thiserror` for typed errors in library code, `anyhow` for application errors
+- Don't use `.unwrap()` or `.expect()` in non-test code unless the invariant is documented
+- Error context: use `.context()` or `.with_context()` from anyhow, not bare `?`
+
+**Ownership and lifetimes**
+- Unnecessary cloning where a borrow would work
+- Lifetime issues that suggest a design problem (not just annotation noise)
+- Arc/Mutex when simpler patterns exist
+
+**Async (tokio)**
+- Blocking operations inside async contexts (use `spawn_blocking`)
+- Missing `.await` on futures (compiler catches some, but not all logical issues)
+- Proper cancellation handling and cleanup
+- Task/JoinHandle leaks
+
+**Safety**
+- Any `unsafe` block needs justification and a safety comment
+- FFI boundaries with Python (PyO3) -- check for panics across FFI, GIL handling
+- Memory safety in IPC between parent and worker processes
+
+**Architecture**
+- `crates/coglet/` is the core: HTTP server, worker orchestration, IPC
+- `crates/coglet-python/` is PyO3 bindings for Python predictor integration
+- Two-process architecture: parent (HTTP + orchestrator) and worker (Python execution)
+- Don't mix IPC concerns with HTTP handling
+- Snapshot tests use `insta` -- check if snapshots need updating
+
+**Dependencies**
+- New dependencies should be justified -- `crates/deny.toml` audits them
+- Prefer std or existing deps over adding new ones for small tasks
diff --git a/opencode.json b/opencode.json
new file mode 100644
index 0000000000..881246fed0
--- /dev/null
+++ b/opencode.json
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "provider": {
+    "cloudflare-ai-gateway": {
+      "models": {
+        "workers-ai/@cf/moonshotai/kimi-k2.5": {
+          "name": "Kimi K2.5 (Workers AI via Gateway)"
+        }
+      }
+    }
+  }
+}

From 4b30dbb5e6ceb75bbc4eba563837322c68ac456a Mon Sep 17 00:00:00 2001
From: Michael Dwan <mdwan@cloudflare.com>
Date: Fri, 27 Mar 2026 14:10:37 -0600
Subject: [PATCH 2/5] Fix model config: add capability flags for Kimi K2.5 via
 AI Gateway

The built-in cloudflare-ai-gateway provider needs explicit model
capabilities (tool_call, reasoning, interleaved, modalities, limits)
to construct a language model. Without them, the SDK threw
'sdk.languageModel is not a function'. Config matches the pattern
from cloudflare/ci/ai.
---
 opencode.json | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/opencode.json b/opencode.json
index 881246fed0..374fd6b088 100644
--- a/opencode.json
+++ b/opencode.json
@@ -4,7 +4,29 @@
     "cloudflare-ai-gateway": {
       "models": {
         "workers-ai/@cf/moonshotai/kimi-k2.5": {
-          "name": "Kimi K2.5 (Workers AI via Gateway)"
+          "name": "Kimi K2.5 (Workers AI via AI Gateway)",
+          "attachment": true,
+          "reasoning": true,
+          "tool_call": true,
+          "temperature": true,
+          "interleaved": {
+            "field": "reasoning_content"
+          },
+          "modalities": {
+            "input": ["text", "image"],
+            "output": ["text"]
+          },
+          "limit": {
+            "context": 256000,
+            "output": 64000
+          },
+          "options": {
+            "temperature": 0.1,
+            "top_p": 0.95,
+            "max_tokens": 64000,
+            "store": false,
+            "parallel_tool_calls": true
+          }
         }
       }
     }

From d5ade6129e750fbd36e7894631f32182bc396654 Mon Sep 17 00:00:00 2001
From: Michael Dwan <mdwan@cloudflare.com>
Date: Fri, 27 Mar 2026 14:39:00 -0600
Subject: [PATCH 3/5] Switch to custom OpenAI-compatible provider for AI
 Gateway

The built-in cloudflare-ai-gateway provider doesn't support Workers AI
models -- its SDK has no languageModel factory for them. Use a custom
provider (cf-gateway) with @ai-sdk/openai-compatible pointing at the
gateway's /compat endpoint instead. Construct CF_GATEWAY_BASE_URL from
secrets in CI.
---
 .github/workflows/opencode-review.yml |  5 ++---
 .github/workflows/opencode.yml        |  5 ++---
 .opencode/agents/reviewer.md          |  2 +-
 opencode.json                         | 32 +++++++++------------------
 4 files changed, 16 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index aefdd8b21a..a34c8dc60f 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -32,10 +32,9 @@ jobs:
         uses: anomalyco/opencode/github@latest
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          CLOUDFLARE_GATEWAY_ID: ${{ secrets.CLOUDFLARE_GATEWAY_ID }}
+          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ secrets.CLOUDFLARE_ACCOUNT_ID }}/${{ secrets.CLOUDFLARE_GATEWAY_ID }}/compat
         with:
-          model: cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5
+          model: cf-gateway/kimi-k2.5
           agent: reviewer
           prompt: |
             Review this pull request. Focus on what matters:
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index e2ca86f6ad..240aa500a4 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -29,7 +29,6 @@ jobs:
         uses: anomalyco/opencode/github@latest
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          CLOUDFLARE_GATEWAY_ID: ${{ secrets.CLOUDFLARE_GATEWAY_ID }}
+          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ secrets.CLOUDFLARE_ACCOUNT_ID }}/${{ secrets.CLOUDFLARE_GATEWAY_ID }}/compat
         with:
-          model: cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5
\ No newline at end of file
+          model: cf-gateway/kimi-k2.5
\ No newline at end of file
diff --git a/.opencode/agents/reviewer.md b/.opencode/agents/reviewer.md
index 8ec1644f6a..26ea3950d3 100644
--- a/.opencode/agents/reviewer.md
+++ b/.opencode/agents/reviewer.md
@@ -1,7 +1,7 @@
 ---
 description: Read-only code reviewer for pull requests
 mode: primary
-model: cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5
+model: cf-gateway/kimi-k2.5
 temperature: 0.1
 permission:
   edit: deny
diff --git a/opencode.json b/opencode.json
index 374fd6b088..889e6877f4 100644
--- a/opencode.json
+++ b/opencode.json
@@ -1,31 +1,21 @@
 {
   "$schema": "https://opencode.ai/config.json",
+  "enabled_providers": ["anthropic", "openai", "workers-ai", "google", "cf-gateway"],
   "provider": {
-    "cloudflare-ai-gateway": {
+    "cf-gateway": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "Cloudflare AI Gateway",
+      "options": {
+        "baseURL": "{env:CF_GATEWAY_BASE_URL}",
+        "apiKey": "{env:CLOUDFLARE_API_TOKEN}"
+      },
       "models": {
-        "workers-ai/@cf/moonshotai/kimi-k2.5": {
-          "name": "Kimi K2.5 (Workers AI via AI Gateway)",
-          "attachment": true,
-          "reasoning": true,
-          "tool_call": true,
-          "temperature": true,
-          "interleaved": {
-            "field": "reasoning_content"
-          },
-          "modalities": {
-            "input": ["text", "image"],
-            "output": ["text"]
-          },
+        "kimi-k2.5": {
+          "id": "workers-ai/@cf/moonshotai/kimi-k2.5",
+          "name": "Kimi K2.5 (Workers AI via Gateway)",
           "limit": {
             "context": 256000,
             "output": 64000
-          },
-          "options": {
-            "temperature": 0.1,
-            "top_p": 0.95,
-            "max_tokens": 64000,
-            "store": false,
-            "parallel_tool_calls": true
           }
         }
       }

From b12aa6541231f47876f354a0f97dbffd3965a5fb Mon Sep 17 00:00:00 2001
From: Michael Dwan <mdwan@cloudflare.com>
Date: Fri, 27 Mar 2026 15:14:17 -0600
Subject: [PATCH 4/5] Fix: use vars not secrets for account/gateway IDs

GitHub variables use ${{ vars.* }}, not ${{ secrets.* }}. The account
ID and gateway ID were stored as repo variables, so the URL was being
constructed as /v1///compat.
---
 .github/workflows/opencode-review.yml | 2 +-
 .github/workflows/opencode.yml        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index a34c8dc60f..189bf22bc3 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -32,7 +32,7 @@ jobs:
         uses: anomalyco/opencode/github@latest
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ secrets.CLOUDFLARE_ACCOUNT_ID }}/${{ secrets.CLOUDFLARE_GATEWAY_ID }}/compat
+          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat
         with:
           model: cf-gateway/kimi-k2.5
           agent: reviewer
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
index 240aa500a4..546614f46c 100644
--- a/.github/workflows/opencode.yml
+++ b/.github/workflows/opencode.yml
@@ -29,6 +29,6 @@ jobs:
         uses: anomalyco/opencode/github@latest
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ secrets.CLOUDFLARE_ACCOUNT_ID }}/${{ secrets.CLOUDFLARE_GATEWAY_ID }}/compat
+          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat
         with:
           model: cf-gateway/kimi-k2.5
\ No newline at end of file

From 72a25f560601e522088aa125d6569d6ecb5e783b Mon Sep 17 00:00:00 2001
From: Michael Dwan <mdwan@cloudflare.com>
Date: Mon, 30 Mar 2026 15:49:35 -0600
Subject: [PATCH 5/5] Remove OpenCode GHA workflows

---
 .github/workflows/opencode-review.yml | 56 ---------------------------
 .github/workflows/opencode.yml        | 34 ----------------
 2 files changed, 90 deletions(-)
 delete mode 100644 .github/workflows/opencode-review.yml
 delete mode 100644 .github/workflows/opencode.yml

diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
deleted file mode 100644
index 189bf22bc3..0000000000
--- a/.github/workflows/opencode-review.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: opencode-review
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-
-    # Skip if label or title says so
-    if: |
-      !contains(github.event.pull_request.labels.*.name, 'no-ai-review') &&
-      !contains(github.event.pull_request.title, '[skip-review]') &&
-      !contains(github.event.pull_request.title, '[wip]') &&
-      !contains(github.event.pull_request.title, '[WIP]')
-
-    permissions:
-      id-token: write
-      contents: read
-      pull-requests: read
-      issues: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Run OpenCode Review
-        uses: anomalyco/opencode/github@latest
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat
-        with:
-          model: cf-gateway/kimi-k2.5
-          agent: reviewer
-          prompt: |
-            Review this pull request. Focus on what matters:
-            - Bugs, logic errors, race conditions
-            - Security issues
-            - Performance concerns
-            - Architectural fit with existing patterns
-            - Error handling gaps
-
-            Be practical. This repo has Go, Python, and Rust -- linters (golangci-lint,
-            ruff, clippy) already run in CI, so don't flag formatting or style issues
-            they catch.
-
-            Scope your review to the PR's intent. Don't pile on about pre-existing
-            issues unrelated to this change. Leave things better than you found them,
-            but keep the burden proportional.
-
-            Use file:line references. Use ```suggestion blocks for concrete fixes.
-            Flag blockers vs nice-to-haves clearly.
diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml
deleted file mode 100644
index 546614f46c..0000000000
--- a/.github/workflows/opencode.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: opencode
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-
-jobs:
-  opencode:
-    if: |
-      contains(github.event.comment.body, ' /oc') ||
-      startsWith(github.event.comment.body, '/oc') ||
-      contains(github.event.comment.body, ' /opencode') ||
-      startsWith(github.event.comment.body, '/opencode')
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
-      pull-requests: read
-      issues: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Run opencode
-        uses: anomalyco/opencode/github@latest
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat
-        with:
-          model: cf-gateway/kimi-k2.5
\ No newline at end of file