refactor: consolidate OpenCode auth setup into plugin installation flow

.github/workflows/doc-sync.yml

@@ -16,12 +16,6 @@ jobs:
           ref: ${{ github.head_ref }}
           fetch-depth: 0
 
-      - uses: actions/cache/restore@v4
-        with:
-          path: ~/.local/share/opencode/auth.json
-          key: opencode-auth-
-          restore-keys: opencode-auth-
-
       - uses: activadee/open-workflows/actions/doc-sync@main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-label.yml

@@ -12,12 +12,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/cache/restore@v4
-        with:
-          path: ~/.local/share/opencode/auth.json
-          key: opencode-auth-
-          restore-keys: opencode-auth-
-
       - uses: activadee/open-workflows/actions/issue-label@main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-review.yml

@@ -13,12 +13,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/cache/restore@v4
-        with:
-          path: ~/.local/share/opencode/auth.json
-          key: opencode-auth-
-          restore-keys: opencode-auth-
-
       - uses: activadee/open-workflows/actions/pr-review@main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -82,6 +82,14 @@ gh secret set ANTHROPIC_API_KEY
 ```
 
 **Option 2: Claude Max (OAuth)**
+
+Use the [opencode-auth-sync](https://github.com/activadee/opencode-auth-sync) plugin to automatically sync your OAuth tokens:
+
+```bash
+bunx @activade/opencode-auth-sync
+```
+
+Or manually set the secret:
 ```bash
 gh secret set OPENCODE_AUTH < ~/.local/share/opencode/auth.json
 ```

examples/README.md

@@ -10,7 +10,13 @@ For AI-powered actions (pr-review, issue-label, doc-sync), add your API key:
 gh secret set ANTHROPIC_API_KEY
 ```
 
-Or if using Claude Max subscription:
+Or if using Claude Max subscription, use the [opencode-auth-sync](https://github.com/activadee/opencode-auth-sync) plugin to automatically sync your OAuth tokens:
+
+```bash
+bunx @activade/opencode-auth-sync
+```
+
+Or manually set the secret:
 
 ```bash
 gh secret set OPENCODE_AUTH < ~/.local/share/opencode/auth.json

src/cli/index.ts

@@ -42,11 +42,10 @@ WHAT GETS INSTALLED
   .github/workflows/issue-label.yml
   .github/workflows/doc-sync.yml
   .github/workflows/release.yml
-  .github/workflows/opencode-auth.yml (OAuth only)
 
 REQUIRED SECRETS
   For Claude Max (OAuth):
-    OPENCODE_AUTH - Your auth.json from ~/.local/share/opencode/auth.json
+    OPENCODE_AUTH - Your auth.json (use opencode-auth-sync plugin to keep it updated)
 
   For API Key:
     ANTHROPIC_API_KEY - Your Anthropic API key
@@ -85,11 +84,22 @@ const promptResults = await p.group(
   }
 );
 
-let selectedWorkflows = (promptResults.workflows || []) as WorkflowType[];
+const selectedWorkflows = (promptResults.workflows || []) as WorkflowType[];
 const useOAuth = Boolean(promptResults.useOAuth);
 
-if (useOAuth && !selectedWorkflows.includes('opencode-auth')) {
-  selectedWorkflows = [...selectedWorkflows, 'opencode-auth'];
+let installPlugin = false;
+if (useOAuth) {
+  const pluginPrompt = await p.confirm({
+    message: 'Install opencode-auth-sync plugin? (keeps OAuth tokens synced)',
+    initialValue: true,
+  });
+
+  if (p.isCancel(pluginPrompt)) {
+    p.cancel('Installation cancelled.');
+    process.exit(0);
+  }
+
+  installPlugin = Boolean(pluginPrompt);
 }
 
 const workflowOverrides = new Set<string>();
@@ -165,10 +175,23 @@ if (errors.length > 0) {
 }
 
 if (useOAuth) {
-  p.note(
-    `${color.cyan('1.')} Export your OpenCode auth as a secret:\n   ${color.dim('gh secret set OPENCODE_AUTH < ~/.local/share/opencode/auth.json')}\n\n${color.cyan('2.')} Commit and push the workflow files\n\n${color.cyan('3.')} Run the opencode-auth workflow manually to initialize the cache:\n   ${color.dim('gh workflow run opencode-auth.yml')}`,
-    'Next steps (OAuth)'
-  );
+  if (installPlugin) {
+    p.log.info('Launching opencode-auth-sync setup...');
+    const proc = Bun.spawn(['bunx', '@activade/opencode-auth-sync'], {
+      stdio: ['inherit', 'inherit', 'inherit'],
+    });
+    await proc.exited;
+
+    p.note(
+      `Commit and push the workflow files`,
+      'Next steps'
+    );
+  } else {
+    p.note(
+      `${color.cyan('1.')} Export your OpenCode auth as a secret:\n   ${color.dim('gh secret set OPENCODE_AUTH < ~/.local/share/opencode/auth.json')}\n\n${color.cyan('2.')} Commit and push the workflow files`,
+      'Next steps (OAuth)'
+    );
+  }
 } else {
   p.note(
     `${color.cyan('1.')} Add your Anthropic API key:\n   ${color.dim('gh secret set ANTHROPIC_API_KEY')}\n\n${color.cyan('2.')} Commit and push the workflow files`,

src/cli/installer.ts

@@ -5,7 +5,6 @@ import {
   ISSUE_LABEL,
   DOC_SYNC,
   RELEASE,
-  OPENCODE_AUTH,
   WORKFLOW_FILE_MAP,
   type WorkflowType,
 } from './templates';
@@ -15,7 +14,6 @@ const WORKFLOW_GENERATORS: Record<string, (useOAuth: boolean) => string> = {
   'issue-label': ISSUE_LABEL,
   'doc-sync': DOC_SYNC,
   release: RELEASE,
-  'opencode-auth': OPENCODE_AUTH,
 };
 
 export interface ExistingFile {

src/cli/templates/doc-sync.ts

@@ -1,4 +1,4 @@
-import { ENV_OPENCODE_AUTH, ENV_API_KEY, CACHE_RESTORE_STEP } from './shared';
+import { ENV_OPENCODE_AUTH, ENV_API_KEY } from './shared';
 
 export const DOC_SYNC = (useOAuth: boolean) => `name: Doc Sync
 
@@ -17,7 +17,7 @@ jobs:
         with:
           ref: \${{ github.head_ref }}
           fetch-depth: 0
-${useOAuth ? CACHE_RESTORE_STEP : ''}
+
       - uses: activadee/open-workflows/actions/doc-sync@main
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}${useOAuth ? ENV_OPENCODE_AUTH : ENV_API_KEY}

src/cli/templates/index.ts

@@ -2,14 +2,12 @@ export { PR_REVIEW } from './pr-review';
 export { ISSUE_LABEL } from './issue-label';
 export { DOC_SYNC } from './doc-sync';
 export { RELEASE } from './release';
-export { OPENCODE_AUTH } from './opencode-auth';
 
-export type WorkflowType = 'review' | 'label' | 'doc-sync' | 'release' | 'opencode-auth';
+export type WorkflowType = 'review' | 'label' | 'doc-sync' | 'release';
 
 export const WORKFLOW_FILE_MAP: Record<WorkflowType, string> = {
   review: 'pr-review',
   label: 'issue-label',
   'doc-sync': 'doc-sync',
   release: 'release',
-  'opencode-auth': 'opencode-auth',
 };

src/cli/templates/issue-label.ts

@@ -1,4 +1,4 @@
-import { ENV_OPENCODE_AUTH, ENV_API_KEY, CACHE_RESTORE_STEP } from './shared';
+import { ENV_OPENCODE_AUTH, ENV_API_KEY } from './shared';
 
 export const ISSUE_LABEL = (useOAuth: boolean) => `name: Issue Label
 
@@ -13,7 +13,7 @@ jobs:
       issues: write
     steps:
       - uses: actions/checkout@v4
-${useOAuth ? CACHE_RESTORE_STEP : ''}
+
       - uses: activadee/open-workflows/actions/issue-label@main
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}${useOAuth ? ENV_OPENCODE_AUTH : ENV_API_KEY}

src/cli/templates/pr-review.ts

@@ -1,4 +1,4 @@
-import { ENV_OPENCODE_AUTH, ENV_API_KEY, CACHE_RESTORE_STEP } from './shared';
+import { ENV_OPENCODE_AUTH, ENV_API_KEY } from './shared';
 
 export const PR_REVIEW = (useOAuth: boolean) => `name: PR Review
 
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
-${useOAuth ? CACHE_RESTORE_STEP : ''}
+
       - uses: activadee/open-workflows/actions/pr-review@main
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}${useOAuth ? ENV_OPENCODE_AUTH : ENV_API_KEY}

src/cli/templates/shared.ts

@@ -3,11 +3,3 @@ export const ENV_OPENCODE_AUTH = `
 
 export const ENV_API_KEY = `
           ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}`;
-
-export const CACHE_RESTORE_STEP = `
-      - uses: actions/cache/restore@v4
-        with:
-          path: ~/.local/share/opencode/auth.json
-          key: opencode-auth-
-          restore-keys: opencode-auth-
-`;

test/installer.test.js

@@ -76,6 +76,39 @@ describe('installer workflow functionality', () => {
       expect(content).not.toContain('ANTHROPIC_API_KEY');
     });
 
+    it('does NOT include cache restore step for OAuth', () => {
+      installWorkflows({
+        workflows: ['review'],
+        cwd: tempDir,
+        useOAuth: true,
+      });
+
+      const content = fs.readFileSync(
+        path.join(tempDir, '.github', 'workflows', 'pr-review.yml'),
+        'utf-8'
+      );
+      expect(content).not.toContain('actions/cache/restore');
+      expect(content).not.toContain('opencode-auth-');
+    });
+
+    it('creates all AI workflow types without cache steps', () => {
+      installWorkflows({
+        workflows: ['review', 'label', 'doc-sync'],
+        cwd: tempDir,
+        useOAuth: true,
+      });
+
+      const files = ['pr-review.yml', 'issue-label.yml', 'doc-sync.yml'];
+      for (const file of files) {
+        const content = fs.readFileSync(
+          path.join(tempDir, '.github', 'workflows', file),
+          'utf-8'
+        );
+        expect(content).toContain('OPENCODE_AUTH');
+        expect(content).not.toContain('actions/cache/restore');
+      }
+    });
+
     it('skips existing files without override', () => {
       const workflowDir = path.join(tempDir, '.github', 'workflows');
       fs.mkdirSync(workflowDir, { recursive: true });