fix(github): scaffold workflows that don't depend on a private action

DIVERGENCES.md

@@ -76,7 +76,7 @@ from the squash message first, or use a plain merge.
 | `packages/opencode/package.json` | bin key `opencode` → `codev` (shim path `./bin/opencode` unchanged); added `release` script | Installed command is `codev` — matches the CLI's `scriptName` and help text (the hub's command is `codevhub`; it relinquished the `codev` bin in codev-ai ≥ 0.4.0). `bun run release` publishes the version in this file (upstream-synced; script/release.ts is fork-only). | Keep our bin key and release line; take upstream's other fields including `version`. |
 | `bun.lock` | Mirrors the bin key rename above and the fork-only workspace packages/deps (`@codev/gateway`) | Lockfile records workspace bin mappings and workspace deps. Known quirk: the root workspace stanza still says `"name": "opencode"` — bun never syncs the root manifest's name into an existing lock (verified: neither `bun install` nor `--lockfile-only` rewrites it); it self-corrects only on a from-scratch regeneration and is harmless meanwhile. Don't hand-edit it. | Regenerate with `bun install`; never hand-merge. |
 | `packages/tui/package.json` | Added dependency `"@codev/gateway": "workspace:*"` | The fork's gateway configure dialog imports SSO/backend/config-block logic from the fork-only `packages/codev-gateway`. | Keep our dependency line; take upstream's other fields. |
-| `packages/tui/src/feature-plugins/home/tips-view.tsx` | `NO_MODELS_TIP` points at `/configure` (CoDev gateway) instead of `/connect`; tip strings rebranded — built-CLI examples `opencode <cmd>` → `codev <cmd>` (`serve`, `upgrade`, `agent create`, `github install`, `debug config`) and product prose "OpenCode" → "CoDev Code". Dropped the `docker run … ghcr.io/anomalyco/opencode` tip and the `/connect` tip that advertised "OpenCode Zen" (a generic `/connect` tip already exists). GitHub-integration tips rebranded to the fork's trigger: the two `/opencode` tips and the `/oc` PR-review tip now say `/codev` (matches the rebranded `github.handler.ts` + `github/action.yml` defaults). | The tips name the fork's CLI (`codev`), product, and `/codev` GitHub trigger; no fork docker image (see web-docs install row); Zen is upstream's hosted gateway. The `opencode.status` command id stays (internal identifier, not user-facing). | Keep our tip text and the docker-tip and Zen-`/connect`-tip deletions. Rebrand any new upstream `opencode <cmd>`/"OpenCode"/`/opencode`-trigger tip; drop any re-added docker/brew/curl install tip. |
+| `packages/tui/src/feature-plugins/home/tips-view.tsx` | `NO_MODELS_TIP` points at `/configure` (CoDev gateway) instead of `/connect`; tip strings rebranded — built-CLI examples `opencode <cmd>` → `codev <cmd>` (`serve`, `upgrade`, `agent create`, `github install`, `debug config`) and product prose "OpenCode" → "CoDev Code". Dropped the `docker run … ghcr.io/anomalyco/opencode` tip and the `/connect` tip that advertised "OpenCode Zen" (a generic `/connect` tip already exists). GitHub-integration tips rebranded to the fork's trigger: the two `/opencode` tips and the `/oc` PR-review tip now say `/codev` (matches the rebranded `github.handler.ts` defaults). | The tips name the fork's CLI (`codev`), product, and `/codev` GitHub trigger; no fork docker image (see web-docs install row); Zen is upstream's hosted gateway. The `opencode.status` command id stays (internal identifier, not user-facing). | Keep our tip text and the docker-tip and Zen-`/connect`-tip deletions. Rebrand any new upstream `opencode <cmd>`/"OpenCode"/`/opencode`-trigger tip; drop any re-added docker/brew/curl install tip. |
 | `packages/tui/src/feature-plugins/sidebar/footer.tsx` | Deleted the dismissable "Getting started" card (free-models pitch + `/connect` pointer + `dismissed_getting_started` KV flag); the sidebar footer keeps only the cwd path display | The card advertises upstream's hosted free Zen models — which the fork hides — and points at `/connect` while first-run setup routes through `/configure`; the fork's startup gate covers onboarding. | Keep the card deleted; take upstream's changes to the remaining path display. |
 | `packages/tui/src/ui/dialog.tsx` | Added a `persistent` store flag (with `setPersistent`/`persistent` accessors): escape and the click-outside backdrop no-op while set, and ctrl+c dispatches `app.exit.confirm` (base-mode-only, so suppressed under modal) instead of closing; every `replace`/`clear` resets it to false | The CoDev gateway configure flow is a non-dismissable first-run gate; ctrl+c stays the quit escape hatch (double-press — see the double-Ctrl+C row). Default-false keeps every other dialog dismissable. | Keep our persistent flag, the escape/backdrop guards, the ctrl+c `app.exit.confirm` dispatch, and the reset lines; take upstream's surrounding changes. |
 | `packages/tui/src/ui/dialog-select.tsx` | Added a `persistent?` prop that hides the top-right `esc` hint | A non-dismissable select shouldn't advertise `esc` (the dialog store's persistent flag blocks the actual close). | Keep our prop + the `Show` wrapper around the esc label; take upstream's surrounding changes. |
@@ -140,8 +140,8 @@ from the squash message first, or use a plain merge.
 | `screenshot-uk.png` | Deleted | Orphaned README-translation asset; referenced by nothing. | Keep deleted. |
 | `artifacts/` (whole directory) | Deleted | Upstream's Remotion marketing-video project (`glm52-rise-video`) with rendered MP4/PNG binaries committed; irrelevant to the fork and bloats every clone. | Keep deleted (`git rm` the upstream side of modify/delete conflicts); delete new upstream additions under `artifacts/` too. |
 | `packages/web/` + `packages/docs/` (whole directories) | Deleted | The Astro/Starlight docs site — which also carried upstream's marketing lander and the `/s/<id>` share viewer, neither deployed by the fork — and an untouched Mintlify starter kit that nothing referenced. The fork's user-facing docs live in the [codev-landing-page](https://github.com/quickbeard/codev-landing-page) repo (`content/docs/code`), which every in-app docs link already points at (see the browser-opened docs-links row). The `sst.cloudflare.x.Astro("Web")` block in `infra/app.ts` was removed with it. | Keep deleted (`git rm` the upstream side of modify/delete conflicts); delete any new upstream files under these directories too. |
-| `github/action.yml`, `github/index.ts`, `github/README.md` | Action name/prose "opencode" → "CoDev Code"; the action installs `codev-code` from npm (version from the npm registry, `npm install --prefix ~/.codev-code`, cache key `codev-*`) and runs `codev github run`; `mentions` input defaults to `/codev` (index.ts trigger matcher likewise); `share` input defaults to `"false"`; `use_github_token` defaults to `"true"`; README setup targets `quickbeard/codev-code/github@main` with GITHUB_TOKEN auth; index.ts spawns `codev serve`, generates `codev/*` branches, and rebrands visible strings | The action must install and run the fork's published CLI, not stock opencode. The fork has no GitHub App and its share service defaults off (config.ts row), so token exchange and sharing default off here too. NOT renamed: the `@opencode-ai/sdk` import, `api.opencode.ai` exchange endpoints, the `opencode-github-action` OIDC audience, `opencode.ai` share URLs, the social-cards URL, and internal identifiers (`createOpencode`, `assertOpencodeConnected`). | Keep our install steps, input defaults, and strings; take upstream's surrounding logic changes. |
-| `packages/opencode/src/cli/cmd/github.handler.ts` | CLI side of the GitHub integration rebranded to match `github/` (row above). `githubRun`: `MENTIONS` default `/opencode,/oc` → `/codev`, generated branches `opencode/*` → `codev/*`, comment footer `[opencode session]` → `[codev session]`, visible log/prompt strings "opencode" → "codev". `githubInstall`: no longer installs upstream's GitHub App (browser flow + `api.opencode.ai` install poll removed; the fork's action defaults to GITHUB_TOKEN auth); scaffolds `.github/workflows/codev.yml` (was `opencode.yml`) triggering on `/codev` with `contents`/`issues`/`pull-requests: write` permissions, `uses: quickbeard/codev-code/github@main`, and `GITHUB_TOKEN` in `env`; next-steps text says `/codev summarize` and links the fork's `github/` README. | The trigger phrase, branches, footer, and scaffolded workflow are user-facing and must match the fork's action defaults (`github/action.yml` row); the fork has no GitHub App to install. NOT renamed: `AGENT_USERNAME` `opencode-agent[bot]` (upstream App bot identity, used for reaction cleanup in the app-token path), `api.opencode.ai` exchange endpoints, the `opencode-github-action` OIDC audience, `opencode.ai` share URLs, and the social-cards URL. | Keep our trigger/branch/footer strings and the app-less install flow; take upstream's surrounding logic changes. If upstream adds new user-facing "opencode" strings or workflow scaffold changes, rebrand them the same way. |
+| `github/` (whole directory) | Deleted — `action.yml` was a composite action living in this repo, so `uses: quickbeard/codev-code/github@main` resolved for nobody outside it; its only job was installing the public `codev-code` npm package and running `codev github run`, which the documented workflow now does inline (see the `github.handler.ts` row). With the action gone the rest of the directory was orphaned: `index.ts` was a standalone duplicate of the `githubRun` logic that `action.yml` never invoked, and the package was not a member of the root `workspaces` list, so nothing built, tested, or imported it. `README.md` content now lives in the fork's docs at `content/docs/code/{en,vi}/github.mdx` in [codev-landing-page](https://github.com/quickbeard/codev-landing-page) | The fork's repo is private and owned by a user account, not an org, so GitHub cannot share an action in it with any other repository — every user who copied the documented workflow hit "repository not found" on their first run. The npm package is public, so inlining the steps is the only distribution path that works, and it leaves the whole directory dead. The fork has no GitHub App and its share service defaults off (config.ts row), so sharing defaults off here too | Keep deleted (`git rm` the upstream side of modify/delete conflicts); delete new upstream additions under `github/` too. If this repo ever goes public and the action is worth restoring, restore `action.yml` only and re-point the docs. |
+| `packages/opencode/src/cli/cmd/github.handler.ts` | CLI side of the GitHub integration rebranded to match `github/` (row above). `githubRun`: `MENTIONS` default `/opencode,/oc` → `/codev`, generated branches `opencode/*` → `codev/*`, comment footer `[opencode session]` → `[codev session]`, visible log/prompt strings "opencode" → "codev", and `USE_GITHUB_TOKEN` defaults to **true** when unset (upstream returns false). `githubInstall`: no longer installs upstream's GitHub App (browser flow + `api.opencode.ai` install poll removed); scaffolds `.github/workflows/codev.yml` (was `opencode.yml`) triggering on `/codev` with `contents`/`issues`/`pull-requests: write` permissions, an `npm install -g codev-code` step and a `codev github run` step carrying `GITHUB_TOKEN` and `MODEL` in `env` — no `uses:`, see the `github/` row; next-steps text says `/codev summarize` and links the fork's hosted docs at `/en/docs/code/github` (the `github/` README it used to link is deleted). | The trigger phrase, branches, footer, and scaffolded workflow are user-facing. The fork has no GitHub App to install, so OIDC token exchange can never succeed here: `USE_GITHUB_TOKEN` must default true, or an unset variable sends users down the exchange path and fails asking for `id-token: write`. Upstream's false default was masked while the composite action passed the input explicitly; deleting the action exposed it. NOT renamed: `AGENT_USERNAME` `opencode-agent[bot]` (upstream App bot identity, used for reaction cleanup in the app-token path), `api.opencode.ai` exchange endpoints, the `opencode-github-action` OIDC audience, `opencode.ai` share URLs, and the social-cards URL. | Keep our trigger/branch/footer strings, the app-less install flow, the `USE_GITHUB_TOKEN` true default, and the actionless scaffold; take upstream's surrounding logic changes. If upstream adds new user-facing "opencode" strings or workflow scaffold changes, rebrand them the same way; never let a scaffold change reintroduce `uses: quickbeard/codev-code/github@main`. |
 | Project-repo links: `packages/tui/src/component/error-component.tsx`, `SECURITY.md` | "This project's repo" links `github.com/anomalyco/opencode` → `github.com/quickbeard/codev-code`: the TUI crash screen's report-bug URL (`issues/new?template=bug-report.yml` — the fork's template keeps upstream's field ids incl. `opencode-version`, so the prefill params still work) and its auto-generated "Reported automatically from the opencode crash screen" prose → "codev"; SECURITY.md's report-a-vulnerability advisories link | Crash reports, vulnerability reports, and contributions belong on the fork's repo, not upstream's. NOT repointed (deliberate upstream references): README attribution + CHANGELOG/DIVERGENCES upstream citations, upstream issue links in code comments (`mcp/index.ts`), model-persona prompt files, test fixtures (`github-remote.test.ts`, `shared.test.ts`), tree-sitter wasm download URLs, the disabled AUR/Homebrew section of `script/publish.ts`, `packages/{cli,ui,http-recorder}` manifest metadata (unpublished by the fork), console/stats/enterprise routes (not deployed by the fork), and desktop `copy-metainfo.ts` (desktop unshipped — revisit with the desktop bucket). | Keep our URLs and crash-screen prose; take upstream's surrounding changes. Repoint any new "report/contribute here" link; leave the NOT-repointed list. |
 | `.github/TEAM_MEMBERS` | Deleted | Upstream's team roster. The five workflows that read it (pr-standards, pr-management, triage, duplicate-issues, compliance-close) fetch it from a `dev` branch this fork doesn't have, so they are already inert here. | Keep deleted. |
 | `packages/script/src/index.ts` | Guard the `.github/TEAM_MEMBERS` read: fall back to an empty team list when the file is absent instead of throwing at module load | This module is imported by the publish path (`publish.ts`); the deleted `TEAM_MEMBERS` (row above) made `bun run release` crash with ENOENT. `Script.team` has no consumers in the fork. | Keep our `exists()` guard; take upstream's surrounding changes. |