[awf] api-proxy/smoke: Activate OpenCode smoke test and verify multi-provider routing

[lpcox]

Problem

The smoke-opencode.md workflow exists in .github/workflows/ but has not been compiled to a .lock.yml and is therefore not active in GitHub Actions. The file explicitly notes:

"Compilation is pending opencode engine support in gh-aw. Once the engine is supported, run gh-aw compile .github/workflows/smoke-opencode.md followed by npx tsx scripts/ci/postprocess-smoke-workflows.ts."

Additionally, the smoke-opencode.md only allows defaults + github network domains, which may not cover npm registry traffic needed for opencode-ai@1.2.14 installation, or provider-specific upstream domains (Anthropic, OpenAI, Google, Groq) depending on the OPENCODE_MODEL prefix used.

Context

• Source issue: feat: add OpenCode engine integration (re-apply PR #18403) gh-aw#25830 — adds the OpenCode engine to gh-aw (pkg/workflow/opencode_engine.go)
• The api-proxy sidecar already handles OpenCode on port 10004 (containers/api-proxy/server.js:1057–1138) via resolveOpenCodeRoute(), supporting credential priority: OPENAI_API_KEY → ANTHROPIC_API_KEY → COPILOT_GITHUB_TOKEN
• Types and constants already reference API_PROXY_PORTS.OPENCODE = 10004 (src/types.ts:47)

Root Cause

The smoke-opencode.md was written in anticipation of the OpenCode engine landing in gh-aw, but the compilation step was intentionally deferred. The gh-aw PR #25830 (re-applying the original #18403) is the prerequisite; once it merges, the firewall side needs to compile the workflow and validate the full path.

A secondary gap: the network: allowed list in smoke-opencode.md does not account for all domains that OpenCode needs depending on the model provider prefix (e.g., anthropic/, openai/, google/, groq/). The gh-aw side computes dynamic OpenCodeBaseDefaultDomains + per-provider openCodeProviderDomains at engine invocation time; the smoke test should exercise at least the default Copilot path.

Proposed Solution

1. After gh-aw #25830 merges, compile and post-process the smoke workflow:

   gh-aw compile .github/workflows/smoke-opencode.md
   npx tsx scripts/ci/postprocess-smoke-workflows.ts

   This generates smoke-opencode.lock.yml with the correct local-build substitutions.

2. Verify network: allowed domains in smoke-opencode.md cover:

   • registry.npmjs.org (npm install of opencode-ai)
   • For the default Copilot routing path: api.githubcopilot.com is already covered by defaults; no extra domains needed for the default smoke test
   • Consider adding npmjs.org if not already in the defaults allowlist

3. Validate api-proxy routing for OpenCode: confirm resolveOpenCodeRoute() in containers/api-proxy/server.js:305 correctly falls back through OPENAI_API_KEY → ANTHROPIC_API_KEY → Copilot token derivation for each model prefix, and that the proxy correctly handles the /health endpoint on port 10004.

4. Run the smoke test on a PR to verify the full end-to-end path: OpenCode installs → connects to api-proxy:10004 → Squid allows api.githubcopilot.com → model responds.

Files to Touch

• .github/workflows/smoke-opencode.md — review/update network: allowed if needed
• .github/workflows/smoke-opencode.lock.yml — generate via compile + postprocess
• containers/api-proxy/server.js — no changes expected, but verify resolveOpenCodeRoute handles WebSocket upgrades (line 1118) which OpenCode may require for streaming

Generated by Firewall Issue Dispatcher · ● 1.5M · ◷