oy-cli 0.13.6

Focused OpenCode agent with repeatable audits, code reviews, and one-finding fixes
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153

# Examples and CI

The reports below are illustrative. Paths, IDs, wording, and findings depend on the reviewed code and selected model.

## Audit with one finding

```bash
oy audit "authentication boundaries"
```

Shortened `ISSUES.md`:

````markdown
# Audit Issues

> Generated with [oy-cli](https://crates.io/crates/oy-cli): `oy audit 'authentication boundaries'` · 2026-07-13

## Findings summary

- `audit-2a71...` **High** `src/auth.rs:84` — Session lookup accepts an unscoped tenant ID _(status: new; fix: `oy enhance audit-2a71...`)_

## Detailed findings

### [High] Session lookup accepts an unscoped tenant ID

Evidence: `src/auth.rs:84` uses the caller-provided tenant before authorization.

## Machine-readable findings

```json oy-findings
[
  {
    "id": "audit-2a71...",
    "status": "new",
    "source": "audit",
    "severity": "High",
    "title": "Session lookup accepts an unscoped tenant ID",
    "locations": [{"path": "src/auth.rs", "line": 84}],
    "evidence": "Caller-provided tenant reaches session lookup before authorization.",
    "body": "Bind tenant scope to the authenticated principal before lookup.",
    "category": "access-control"
  }
]
```
````

The Markdown is for people; the JSON block preserves finding IDs and state for reruns and `oy enhance`.

## Target-diff review

```bash
oy review main --focus "types and boundaries"
```

Shortened `REVIEW.md`:

````markdown
# Code Quality Review

## Verdict

Needs work.

## Findings summary

- **Medium** — Two structs represent the same persisted state (`src/cli/config.rs:41`).

## Detailed findings

### [Medium] Two structs represent the same persisted state

Both structs are serialized independently. Keep one persisted representation and convert at the boundary.

## Machine-readable findings

```json oy-findings
[{"id":"review-7bd1...","status":"new","source":"review","severity":"Medium","title":"Two structs represent the same persisted state","locations":[{"path":"src/cli/config.rs","line":41}],"evidence":"Both structs are serialized independently.","body":"Keep one persisted representation.","category":"state-ownership"}]
```
````

## Successful no-findings review

````markdown
# Code Quality Review

## Verdict

No major structural concerns.

## Findings summary

No high-conviction findings.

## Machine-readable findings

```json oy-findings
[]
```
````

A successful no-findings report still has generated metadata and an empty JSON array. A failed run exits nonzero or does not finalize the report.

## Fix and confirm

```bash
oy enhance audit-2a71...
# Inspect the source diff and verification output, then rerun:
oy audit "authentication boundaries"
```

The second audit should drop the finding if it no longer applies or update its lifecycle state from current evidence.

## SARIF

```bash
oy audit --format sarif --out oy.sarif
```

oy writes SARIF 2.1.0 with normalized rules, locations, severity, and provenance. Inspect it before upload, especially when repository paths or finding text are sensitive.

## GitHub code scanning

Provider-backed audits need OpenCode credentials. Use protected secrets and do not expose privileged credentials to untrusted pull-request code.

```yaml
permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
  - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0

  - name: Install oy and OpenCode
    run: |
      cargo install oy-cli --locked --version 0.13.6
      mise use --global --yes --minimum-release-age 0 node@24 npm:@opencode-ai/cli@next
      oy setup

  - name: Run audit
    env:
      # Replace with the environment variable required by your OpenCode provider.
      PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}
    run: oy audit --format sarif --out oy.sarif

  - name: Upload SARIF
    if: always() && hashFiles('oy.sarif') != ''
    uses: github/codeql-action/upload-sarif@v4
    with:
      sarif_file: oy.sarif
```

Pin versions in production CI and configure the provider according to the [OpenCode provider guide](https://v2.opencode.ai/providers). oy does not upload reports itself.