feat(ci): add himitsu CI command + opencode workflow; guard key.txt in gitignore

Author: Cooper Maruyama

.beads/issues.jsonl

@@ -0,0 +1,33 @@
+name: opencode
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  opencode:
+    if: |
+      contains(github.event.comment.body, ' /oc') ||
+      startsWith(github.event.comment.body, '/oc') ||
+      contains(github.event.comment.body, ' /opencode') ||
+      startsWith(github.event.comment.body, '/opencode')
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: read
+      issues: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run opencode
+        uses: anomalyco/opencode/github@latest
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        with:
+          model: openrouter/tencent/hy3-preview

.github/workflows/opencode.yml

@@ -16,6 +16,7 @@ node_modules
 .meta/
 
 # Local demo and scratch files
+key.txt
 amp
 .cursor
 .mux

.gitignore

@@ -0,0 +1,283 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use clap::{Args, Subcommand, ValueEnum};
+
+use crate::config;
+use crate::error::{HimitsuError, Result};
+
+/// Manage the GitHub Actions workflow for self-serve himitsu rekeys.
+#[derive(Debug, Args)]
+pub struct CiArgs {
+    #[command(subcommand)]
+    pub command: CiCommand,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum CiCommand {
+    /// Show whether the himitsu workflow is installed in this repository.
+    Status(WorkflowPathArgs),
+    /// Install the himitsu self-serve rekey workflow into .github/workflows/.
+    Install(InstallArgs),
+    /// Trigger the installed workflow through the GitHub CLI.
+    Run(RunArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct WorkflowPathArgs {
+    /// Workflow file path, relative to the current directory by default.
+    #[arg(long, default_value = ".github/workflows/himitsu.yml")]
+    pub path: PathBuf,
+}
+
+#[derive(Debug, Args)]
+pub struct InstallArgs {
+    /// Default remote slug to prefill in the workflow_dispatch form.
+    #[arg(long = "default-remote")]
+    pub default_remote: Option<String>,
+
+    /// Git ref for the himitsu action used by the generated workflow.
+    #[arg(long, default_value = "main")]
+    pub action_ref: String,
+
+    /// Workflow file path, relative to the current directory by default.
+    #[arg(long, default_value = ".github/workflows/himitsu.yml")]
+    pub path: PathBuf,
+
+    /// Overwrite an existing workflow file.
+    #[arg(long)]
+    pub force: bool,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+pub enum CiOperation {
+    Sync,
+    AddRecipient,
+    RmRecipient,
+}
+
+impl CiOperation {
+    fn as_input(self) -> &'static str {
+        match self {
+            Self::Sync => "sync",
+            Self::AddRecipient => "add-recipient",
+            Self::RmRecipient => "rm-recipient",
+        }
+    }
+}
+
+#[derive(Debug, Args)]
+pub struct RunArgs {
+    /// Operation to trigger in the workflow.
+    #[arg(long, value_enum, default_value_t = CiOperation::Sync)]
+    pub operation: CiOperation,
+
+    /// Target remote slug (org/repo).
+    #[arg(long = "target-remote")]
+    pub target_remote: Option<String>,
+
+    /// Recipient name for add-recipient or rm-recipient.
+    #[arg(long)]
+    pub recipient_name: Option<String>,
+
+    /// Age public key for add-recipient.
+    #[arg(long)]
+    pub recipient_key: Option<String>,
+
+    /// Target recipient group.
+    #[arg(long, default_value = "team")]
+    pub group: String,
+
+    /// Workflow file name known to GitHub Actions.
+    #[arg(long, default_value = "himitsu.yml")]
+    pub workflow: String,
+
+    /// Print the gh command instead of executing it.
+    #[arg(long)]
+    pub dry_run: bool,
+}
+
+pub fn run(args: CiArgs) -> Result<()> {
+    match args.command {
+        CiCommand::Status(args) => status(&args.path),
+        CiCommand::Install(args) => install(args),
+        CiCommand::Run(args) => trigger(args),
+    }
+}
+
+fn status(path: &Path) -> Result<()> {
+    if path.exists() {
+        println!("himitsu ci installed at {}", path.display());
+    } else {
+        println!(
+            "himitsu ci not installed; run `himitsu ci install` to create {}",
+            path.display()
+        );
+    }
+    Ok(())
+}
+
+fn install(args: InstallArgs) -> Result<()> {
+    if let Some(remote) = &args.default_remote {
+        config::validate_remote_slug(remote)?;
+    }
+
+    if args.path.exists() && !args.force {
+        return Err(HimitsuError::External(format!(
+            "{} already exists; pass --force to overwrite",
+            args.path.display()
+        )));
+    }
+
+    if let Some(parent) = args.path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+
+    let workflow = workflow_template(args.default_remote.as_deref(), &args.action_ref);
+    fs::write(&args.path, workflow)?;
+    println!("Installed himitsu ci workflow at {}", args.path.display());
+    Ok(())
+}
+
+fn trigger(args: RunArgs) -> Result<()> {
+    if let Some(remote) = &args.target_remote {
+        config::validate_remote_slug(remote)?;
+    }
+
+    let mut fields = vec![format!("operation={}", args.operation.as_input())];
+    push_optional_field(&mut fields, "remote", args.target_remote.as_deref());
+    push_optional_field(
+        &mut fields,
+        "recipient-name",
+        args.recipient_name.as_deref(),
+    );
+    push_optional_field(&mut fields, "recipient-key", args.recipient_key.as_deref());
+    fields.push(format!("group={}", args.group));
+
+    if args.dry_run {
+        println!("{}", render_gh_command(&args.workflow, &fields));
+        return Ok(());
+    }
+
+    let mut cmd = Command::new("gh");
+    cmd.args(["workflow", "run", &args.workflow]);
+    for field in &fields {
+        cmd.args(["--field", field]);
+    }
+
+    let status = cmd.status().map_err(|e| {
+        HimitsuError::External(format!(
+            "failed to run `gh workflow run {}`: {e}",
+            args.workflow
+        ))
+    })?;
+
+    if !status.success() {
+        return Err(HimitsuError::External(format!(
+            "gh workflow run exited with status {status}"
+        )));
+    }
+
+    Ok(())
+}
+
+fn push_optional_field(fields: &mut Vec<String>, name: &str, value: Option<&str>) {
+    if let Some(value) = value {
+        if !value.is_empty() {
+            fields.push(format!("{name}={value}"));
+        }
+    }
+}
+
+fn render_gh_command(workflow: &str, fields: &[String]) -> String {
+    let mut parts = vec![
+        "gh".to_string(),
+        "workflow".to_string(),
+        "run".to_string(),
+        workflow.to_string(),
+    ];
+
+    for field in fields {
+        parts.push("--field".to_string());
+        parts.push(field.clone());
+    }
+
+    parts.join(" ")
+}
+
+fn workflow_template(default_remote: Option<&str>, action_ref: &str) -> String {
+    let default_remote = default_remote.unwrap_or("");
+    format!(
+        r#"name: Himitsu Self-Serve Rekey
+
+on:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: "Operation to run"
+        required: true
+        default: sync
+        type: choice
+        options:
+          - sync
+          - add-recipient
+          - rm-recipient
+      remote:
+        description: "Target himitsu remote (org/repo)"
+        required: false
+        default: {default_remote}
+      recipient-name:
+        description: "Recipient name for add-recipient or rm-recipient"
+        required: false
+      recipient-key:
+        description: "Age public key for add-recipient"
+        required: false
+      group:
+        description: "Target recipient group"
+        required: false
+        default: team
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  himitsu:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: darkmatter/himitsu@{action_ref}
+        with:
+          operation: ${{{{ inputs.operation }}}}
+          remote: ${{{{ inputs.remote }}}}
+          recipient-name: ${{{{ inputs.recipient-name }}}}
+          recipient-key: ${{{{ inputs.recipient-key }}}}
+          group: ${{{{ inputs.group }}}}
+"#
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn operation_inputs_match_action_operations() {
+        assert_eq!(CiOperation::Sync.as_input(), "sync");
+        assert_eq!(CiOperation::AddRecipient.as_input(), "add-recipient");
+        assert_eq!(CiOperation::RmRecipient.as_input(), "rm-recipient");
+    }
+
+    #[test]
+    fn dry_run_command_includes_fields() {
+        let fields = vec![
+            "operation=sync".to_string(),
+            "remote=acme/secrets".to_string(),
+        ];
+        assert_eq!(
+            render_gh_command("himitsu.yml", &fields),
+            "gh workflow run himitsu.yml --field operation=sync --field remote=acme/secrets"
+        );
+    }
+}

rust/src/cli/ci.rs

@@ -77,9 +77,7 @@ pub fn run_complete_paths(args: CompletePathsArgs, ctx: &super::Context) -> Resu
 
     // Fast path: serve from the SQLite cache when warm.
     if crate::completions_cache::is_warm(&ctx.state_dir, &stores) {
-        if let Ok(paths) =
-            crate::completions_cache::lookup(&ctx.state_dir, &stores, &args.prefix)
-        {
+        if let Ok(paths) = crate::completions_cache::lookup(&ctx.state_dir, &stores, &args.prefix) {
             let mut out = io::stdout().lock();
             for p in paths {
                 let _ = writeln!(out, "{p}");

rust/src/cli/completions.rs

@@ -1,4 +1,5 @@
 pub mod check;
+pub mod ci;
 pub mod codegen;
 pub mod completions;
 pub mod context;
@@ -343,6 +344,9 @@ pub enum Command {
     /// Verify store checkouts are up to date with their remotes.
     Check(check::CheckArgs),
 
+    /// Manage GitHub Actions workflows for self-serve rekeys.
+    Ci(ci::CiArgs),
+
     /// Show the himitsu documentation (renders README).
     Docs,
 
@@ -393,13 +397,15 @@ impl Cli {
         let is_docs = matches!(&command, Command::Docs);
         let is_completions = matches!(&command, Command::Completions(_));
         let is_complete_paths = matches!(&command, Command::CompletePaths(_));
+        let is_ci = matches!(&command, Command::Ci(_));
 
         if !is_init
             && !is_git
             && !is_version
             && !is_docs
             && !is_completions
             && !is_complete_paths
+            && !is_ci
             && !crate::crypto::keystore::is_initialized(&data_dir)
         {
             eprintln!("First run — initializing himitsu...");
@@ -548,6 +554,7 @@ impl Cli {
             Command::Exec(args) => exec::run(args, &ctx),
             Command::Git(args) => git::run(args, &ctx),
             Command::Check(args) => check::run(args, &ctx),
+            Command::Ci(args) => ci::run(args),
             Command::Docs => docs::run(),
             Command::Version => {
                 println!("{}", crate::build_info::VERSION_LINE);