Establish OpenCode compatibility certification corpus

.github/workflows/watch-upstream.yml

@@ -0,0 +1,81 @@
+name: Watch upstream OpenCode
+
+on:
+  schedule:
+    - cron: "23 */6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: opencode-upstream-watcher
+  cancel-in-progress: false
+
+jobs:
+  open-compatibility-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Resolve latest release
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          release="$(gh api repos/anomalyco/opencode/releases/latest)"
+          tag="$(jq -r .tag_name <<<"$release")"
+          current="$(jq -r .release_tag manifests/upstream.json)"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "published_at=$(jq -r .published_at <<<"$release")" >> "$GITHUB_OUTPUT"
+          echo "release_url=$(jq -r .html_url <<<"$release")" >> "$GITHUB_OUTPUT"
+          if [ "$tag" = "$current" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Stop when a PR already exists
+        if: steps.release.outputs.changed == 'true'
+        id: existing
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          branch="compat/upstream-${TAG#v}"
+          count="$(gh pr list --state open --head "$branch" --json number --jq length)"
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          if [ "$count" -gt 0 ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Resolve immutable image and update manifests
+        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
+        env:
+          TAG: ${{ steps.release.outputs.tag }}
+          PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
+          RELEASE_URL: ${{ steps.release.outputs.release_url }}
+        run: |
+          digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${TAG#v}" --format '{{json .Manifest}}' | jq -r .digest)"
+          ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$digest"
+          ruby test/repository_test.rb
+      - name: Open compatibility PR
+        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.release.outputs.tag }}
+          BRANCH: ${{ steps.existing.outputs.branch }}
+        run: |
+          git config user.name "opencode-compat-bot"
+          git config user.email "opencode-compat-bot@users.noreply.github.com"
+          git switch -c "$BRANCH"
+          git add manifests/image-matrix.json manifests/upstream.json
+          git commit -m "Test OpenCode ${TAG} compatibility"
+          git push --set-upstream origin "$BRANCH"
+          gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "Test OpenCode ${TAG} compatibility" \
+            --body "Upstream watcher detected ${TAG}, resolved its immutable OCI digest, and added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."