@activade/opencode-auth-sync

OpenCode plugin that automatically syncs your authentication credentials to GitHub repositories as secrets whenever they change.

Why?

When using OpenCode with Claude Max, OpenAI, or other OAuth providers, your tokens refresh periodically. This plugin watches for those changes and automatically syncs the updated credentials to your GitHub repositories, keeping your CI/CD workflows authenticated.

Quick Start

bunx @activade/opencode-auth-sync

The interactive setup wizard will:

1. Check prerequisites (GitHub CLI)
2. List your repositories
3. Let you select which repos to sync
4. Configure the plugin automatically

Running the wizard again will merge your changes with the existing configuration, preserving any custom settings like debounceMs or credentialsPath that you've modified.

Manual Installation

Add to ~/.config/opencode/opencode.json:

{
  "plugin": [
    "@activade/opencode-auth-sync"
  ]
}

Create ~/.config/opencode/opencode-auth-sync.json:

{
  "$schema": "https://raw.githubusercontent.com/activadee/opencode-auth-sync/main/schema.json",
  "enabled": true,
  "repositories": [
    "your-username/repo1",
    "your-org/private-repo"
  ]
}

Configuration Options

Option	Type	Default	Description
enabled	boolean	true	Enable/disable the plugin
credentialsPath	string	~/.local/share/opencode/auth.json	Path to OpenCode auth file
secretName	string	OPENCODE_AUTH	GitHub secret name
repositories	string[]	[]	Repositories to sync (owner/repo format)
debounceMs	number	1000	Debounce delay for file changes
authFileHashes	object	(auto-managed)	Per-repository SHA-256 hashes of last synced auth.json (managed by plugin)

Prerequisites

• GitHub CLI installed and authenticated (gh auth login)
• Write access to target repositories

How It Works

1. Plugin watches ~/.local/share/opencode/auth.json for changes
2. When tokens refresh, the file updates
3. Plugin computes a SHA-256 hash of the file content and compares it against the stored hash
4. If the hash differs (content actually changed), syncs to configured repositories via gh secret set
5. Toast notifications show sync status

The hash-based change detection reduces unnecessary GitHub API calls when file metadata changes but content remains the same.

Using the Secret in GitHub Actions

# .github/workflows/example.yml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Setup OpenCode Auth
        run: |
          mkdir -p ~/.local/share/opencode
          echo '${{ secrets.OPENCODE_AUTH }}' > ~/.local/share/opencode/auth.json

Extracting Specific Tokens

- name: Extract Anthropic Token
  run: |
    ANTHROPIC_TOKEN=$(echo '${{ secrets.OPENCODE_AUTH }}' | jq -r '.anthropic.access')
    echo "::add-mask::$ANTHROPIC_TOKEN"
    echo "ANTHROPIC_API_KEY=$ANTHROPIC_TOKEN" >> $GITHUB_ENV

Synced Providers

The auth file contains credentials for all configured OpenCode providers:

• anthropic - Claude Max (OAuth)
• openai - ChatGPT Plus/Pro (OAuth)
• google - Gemini (OAuth)
• API key providers

Development

Running Tests

bun test

Type Checking

bun run type-check

Building

bun run build

License

MIT