GitHub action fails on repos created after 2026-07-15 (new OIDC sub format)

[chAwater]

Description

OpenCode GitHub Actions fails on repos created after 2026-07-15 (immutable OIDC sub → "p.rest" error)

Error log in GitHub Actions:

> Run opencode github run
Failed to parse JSON
Creating comment...
Error: Unexpected error

undefined is not an object (evaluating 'p.rest')

---

Root cause analysis (too long, so I fold it)

• According to the GitHub changelog, the immutable OIDC tokens changed from repo:octocat/my-repo:ref:refs/heads/main to repo:octocat@123456/my-repo@456789:ref:refs/heads/main
• In function exchangeForAppToken:

  opencode/packages/opencode/src/cli/cmd/github.handler.ts

  Lines 988 to 1002 in 67caf89

  	async function exchangeForAppToken(token: string) {
  	const response = token.startsWith("github_pat_")
  	? await fetch(`${oidcBaseUrl}/exchange_github_app_token_with_pat`, {
  	method: "POST",
  	headers: {
  	Authorization: `Bearer ${token}`,
  	},
  	body: JSON.stringify({ owner, repo }),
  	})
  	: await fetch(`${oidcBaseUrl}/exchange_github_app_token`, {
  	method: "POST",
  	headers: {
  	Authorization: `Bearer ${token}`,
  	},
  	})

• exchange_github_app_token (get wrong owner (octocat@123456) and repo (my-repo@456789), but not raise error):

  opencode/packages/function/src/api.ts

  Lines 270 to 285 in 67caf89

  	// verify token
  	const JWKS = createRemoteJWKSet(new URL(JWKS_URL))
  	let owner, repo
  	try {
  	const { payload } = await jwtVerify(token, JWKS, {
  	issuer: GITHUB_ISSUER,
  	audience: EXPECTED_AUDIENCE,
  	})
  	const sub = payload.sub // e.g. 'repo:my-org/my-repo:ref:refs/heads/main'
  	const parts = sub.split(":")[1].split("/")
  	owner = parts[0]
  	repo = parts[1]
  	} catch (err) {
  	console.error("Token verification failed:", err)
  	return c.json({ error: "Invalid or expired token" }, { status: 403 })
  	}

• Error (404, repo not found), maybe raise RequestError but is not caught:

  opencode/packages/function/src/api.ts

  Lines 296 to 299 in 67caf89

  	const { data: installation } = await octokit.apps.getRepoInstallation({
  	owner,
  	repo,
  	})

• Error handling (but the response is not json, so got the "Failed to parse JSON"):

  opencode/packages/opencode/src/cli/cmd/github.handler.ts

  Lines 1004 to 1007 in 67caf89

  	if (!response.ok) {
  	const responseJson = (await response.json()) as { error?: string }
  	throw new Error(`App token exchange failed: ${response.status} ${response.statusText} - ${responseJson.error}`)
  	}

• Catch the error in github.handler.ts (logging the "Creating comment..." in createComment):

  opencode/packages/opencode/src/cli/cmd/github.handler.ts

  Lines 631 to 643 in 67caf89

  	} catch (e: any) {
  	exitCode = 1
  	console.error(e instanceof Error ? e.message : String(e))
  	let msg = e
  	if (e instanceof Process.RunFailedError) {
  	msg = e.stderr.toString()
  	} else if (e instanceof Error) {
  	msg = e.message
  	}
  	if (isUserEvent) {
  	await createComment(`${msg}${footer()}`)
  	await removeReaction(commentType)
  	}

• createComment fail because octoRest is undefined (logging the "Error: Unexpected error undefined is not an object (evaluating 'p.rest')")
  

  opencode/packages/opencode/src/cli/cmd/github.handler.ts

  Lines 1264 to 1273 in 67caf89

  	async function createComment(body: string) {
  	// Only called for non-schedule events, so issueId is defined
  	console.log("Creating comment...")
  	return await octoRest.rest.issues.createComment({
  	owner,
  	repo,
  	issue_number: issueId!,
  	body,
  	})
  	}

---

Workaround fix: use_github_token: true

BTW: I'd like to work on a PR to fix this. However, there are a lot of open PRs already (mine might not get attention), so please let me know whether a PR would be welcome, or if the maintainers will handle it — just to avoid wasting time.

---

Plugins

none

OpenCode version

1.18.3 (by anomalyco/opencode/github@latest)

Steps to reproduce

1. Create a new repo (created after 2026-07-15).
2. Install the opencode GitHub agent by running opencode github install in this new repo (generate the .github/workflows/opencode.yml), commit and push it.
3. Create a new issue and add a comment eg. /oc explan this issue
4. Check the GitHub Actions log

Screenshot and/or share link

https://github.com/chAwater/oc-github-test/actions/runs/29696153829/job/88217168896?pr=5

Operating System

ubuntu-latest (GitHub Actions runner)

Terminal

none