From ed7747e4239ec844395893b8ada0bbe9239936f7 Mon Sep 17 00:00:00 2001
From: UniDesk Codex <codex@pikapython.com>
Date: Tue, 30 Jun 2026 21:11:57 +0800
Subject: [PATCH] fix: use git-enabled opencode runtime image

---
 deploy/deploy.yaml            | 1 +
 scripts/gitops-render.mjs     | 4 +++-
 scripts/gitops-render.test.ts | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/deploy/deploy.yaml b/deploy/deploy.yaml
index bac286b9..c40042a4 100644
--- a/deploy/deploy.yaml
+++ b/deploy/deploy.yaml
@@ -340,6 +340,7 @@ lanes:
     observability:
       traceExplorerUrlTemplate: /v1/workbench/traces/{trace_id}/events
     opencode:
+      image: 127.0.0.1:5000/hwlab/opencode:1.17.7-git
       providerProfile: dsflash-go
       providerId: dsflash-go
       displayName: AgentRun dsflash-go
diff --git a/scripts/gitops-render.mjs b/scripts/gitops-render.mjs
index 67be9a8c..5a4d5532 100644
--- a/scripts/gitops-render.mjs
+++ b/scripts/gitops-render.mjs
@@ -5652,6 +5652,7 @@ function opencodeRuntimeConfigForProfile(deploy, profile) {
   const providerProxyBasePath = configString(config.providerProxyBasePath) || "/v1";
   const providerProxyBaseURL = configString(config.providerProxyBaseURL) || `http://127.0.0.1:${providerProxyPort}${providerProxyBasePath}`;
   return {
+    image: configString(config.image) || "ghcr.io/anomalyco/opencode:1.17.7",
     providerProfile,
     providerId,
     displayName: configString(config.displayName) || `AgentRun ${providerProfile}`,
@@ -5785,6 +5786,7 @@ function opencodeServerManifest({ profile = "v03", source, deploy = null, catalo
     "hwlab.pikastech.local/opencode-model": opencodeConfig.model,
     "hwlab.pikastech.local/opencode-provider-base-url": opencodeConfig.baseURL,
     "hwlab.pikastech.local/opencode-provider-upstream-base-url": opencodeConfig.upstreamBaseURL,
+    "hwlab.pikastech.local/opencode-image": opencodeConfig.image,
     "hwlab.pikastech.local/opencode-config-sha256": configSha256,
     "hwlab.pikastech.local/opencode-api-key-secret-ref": `${apiKeySecretRef.name}/${apiKeySecretRef.key}`,
     "hwlab.pikastech.local/agentrun-provider-secret-ref": `${opencodeConfig.agentrunSecretNamespace}/${opencodeConfig.agentrunSecretName}`,
@@ -5865,7 +5867,7 @@ function opencodeServerManifest({ profile = "v03", source, deploy = null, catalo
               }],
               containers: [{
                 name,
-                image: "ghcr.io/anomalyco/opencode:1.17.7",
+                image: opencodeConfig.image,
                 imagePullPolicy: "IfNotPresent",
                 command: ["/bin/sh", "-ec"],
                 args: ["exec opencode serve --hostname 0.0.0.0 --port 4096"],
diff --git a/scripts/gitops-render.test.ts b/scripts/gitops-render.test.ts
index bcc05774..9785fd1a 100644
--- a/scripts/gitops-render.test.ts
+++ b/scripts/gitops-render.test.ts
@@ -758,6 +758,7 @@ test("v03 render includes JD01 secret-plane smoke on JD01 gitops root", { timeou
     assert.equal(opencodeDeployment.metadata?.annotations?.["hwlab.pikastech.local/agentrun-provider-secret-ref"], "agentrun-v02/agentrun-v01-provider-dsflash-go");
     assert.equal(opencodeDeployment.metadata?.annotations?.["hwlab.pikastech.local/opencode-provider-base-url"], "http://127.0.0.1:4097/v1");
     assert.equal(opencodeDeployment.metadata?.annotations?.["hwlab.pikastech.local/opencode-provider-upstream-base-url"], "https://opencode.ai/zen/go/v1");
+    assert.equal(opencodeDeployment.metadata?.annotations?.["hwlab.pikastech.local/opencode-image"], "127.0.0.1:5000/hwlab/opencode:1.17.7-git");
     assert.equal(opencodeDeployment.metadata?.annotations?.["hwlab.pikastech.local/opencode-provider-proxy-boot-sh"], "deploy/runtime/boot/opencode-provider-proxy.sh");
     assert.equal(opencodeDeployment.metadata?.annotations?.["hwlab.pikastech.local/values-printed"], "false");
     assert.match(opencodeDeployment.spec?.template?.metadata?.annotations?.["hwlab.pikastech.local/opencode-config-sha256"] ?? "", /^[a-f0-9]{64}$/u);
@@ -767,6 +768,7 @@ test("v03 render includes JD01 secret-plane smoke on JD01 gitops root", { timeou
     assert.match(opencodeGitInit.args?.[0] ?? "", /git -C \/workspace init/u);
     assert.ok(opencodeGitInit.volumeMounts?.some((entry) => entry.name === "workspace" && entry.mountPath === "/workspace"));
     const opencodeContainer = collectContainersFromItem(opencodeDeployment).find((container) => container.name === "opencode-server");
+    assert.equal(opencodeContainer?.image, "127.0.0.1:5000/hwlab/opencode:1.17.7-git");
     assert.deepEqual(opencodeContainer?.command, ["/bin/sh", "-ec"]);
     assert.equal(opencodeContainer?.args?.[0], "exec opencode serve --hostname 0.0.0.0 --port 4096");
     assert.doesNotMatch(opencodeContainer?.args?.[0] ?? "", /apk add|dl-cdn\.alpinelinux\.org/u, "opencode startup must not depend on runtime apk repository access");