Merge pull request 'ci(tag): déclenche Renovate sur tf-depl-kubernetes dès que l'image de release est poussée (opencode)' (#76 ) from ci/renovate-dispatch-on-release into main

Reviewed-on: #76
ci(tag): dispatch Renovate on tf-depl-kubernetes once the release image is pushed
2026-10-18 13:46:34 -04:00 · 2026-10-18 13:21:35 -04:00 · 2026-10-17 15:38:12 -04:00 · 2026-10-17 19:28:14 +00:00 · 2026-10-13 22:30:30 -04:00 · 2026-10-14 02:14:01 +00:00
11 changed files with 130 additions and 105 deletions
@@ -9,27 +9,27 @@ jobs:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile

  test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - run: docker build -t ci-image:${{ github.sha }} .

  build-push:
    needs: [test]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -43,7 +43,7 @@ jobs:
          images: jcabillot/opencode
          tags: |
            type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: true
@@ -7,28 +7,28 @@ jobs:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile
  test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - run: docker build -t ci-image:${{ github.sha }} .
  build:
    needs: [test]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - run: docker build -t jcabillot/opencode:${{ github.sha }} .
  tag:
    needs: [build]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - name: Configure git auth
@@ -8,14 +8,14 @@ jobs:
  hadolint:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile

  build-test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - run: docker build -t ci-image:${{ github.sha }} .
@@ -0,0 +1,12 @@
+name: Renovate
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    uses: perso/gitea-pipelines/.gitea/workflows/renovate.yaml@main
+    secrets: inherit
@@ -9,25 +9,25 @@ jobs:
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile

  test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - run: docker build -t ci-image:${{ github.sha }} .

  build-push:
    needs: [test]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -38,10 +38,29 @@ jobs:
          tags: |
            type=ref,event=tag
            type=ref,event=tag,suffix=-latest
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
+
+  trigger-renovate:
+    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
+    # Renovate instance only scans hourly, so this dispatch opens the image bump
+    # PR within minutes of the release instead of up to an hour later.
+    needs: [build-push]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
+        # needs: build-push — Renovate reads Docker Hub, so a scan started before
+        # the push lands would only see the previous release.
+        # RENOVATE_TOKEN is the org-level secret of this organisation.
+        run: |
+          curl -sS -f -X POST \
+            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{{"ref":"main"}}' \
+            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
+          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"
@@ -2,7 +2,7 @@

 ## Project overview

-This repository builds and publishes a Docker image for [OpenCode](https://opencode.ai), the open source AI coding agent. The image runs OpenCode in headless server mode (`opencode serve`) and is automatically rebuilt and pushed to Docker Hub (`jcabillot/opencode`) every night by a Gitea Actions pipeline.
+This repository builds and publishes a Docker image for [OpenCode](https://opencode.ai), the open source AI coding agent. The image ships OpenCode 2, runs it in headless server mode (`opencode serve`), and is automatically rebuilt and pushed to Docker Hub (`jcabillot/opencode`) every night by a Gitea Actions pipeline.

 ## Repository structure

@@ -17,18 +17,25 @@ This repository builds and publishes a Docker image for [OpenCode](https://openc

 ## Dependency management

- **Always pin versions** in the Dockerfile `npm install` command (e.g. `opencode-ai@1.16.2 n2-soul@9.0.9`). Never leave packages unpinned.
+- **Always pin versions** in the Dockerfile `npm install` command (e.g. `@opencode/cli@2.0.32 n2-soul@9.0.9`). Never leave packages unpinned.
 - **Update renovate customManagers** when adding, removing, or renaming a dependency tracked in the Dockerfile. Each pinned package must have a corresponding `customManager` entry in `renovate.json` with a regex `matchStrings` pattern that captures the version. If a dependency is added without a renovate entry, Renovatebot will not open automated PRs for it.
 - **apt packages** (apt-get install lines in Dockerfile) and **COPY --from** image references are not currently tracked by Renovate. Pinning these manually is acceptable for now but adding renovate managers for them is encouraged.

 ## Dockerfile conventions

- **Base image**: `node:24` — Debian-based Node.js image (not Alpine, needed for apt packages).
- **Install**: `npm i -g opencode-ai@<version> n2-soul@<version>` — installs OpenCode and Soul globally, both pinned.
+- **Base image**: `node:26-trixie` — Debian-based Node.js image (not Alpine) so that downstream images can still use `apt-get` and Node-based MCP servers keep working.
+- **Install**: `npm i -g @opencode/cli@<version> n2-soul@<version>` — installs OpenCode 2 and Soul globally, both pinned. `@opencode/cli` replaced `opencode-ai` as the published package in OpenCode 2; `--allow-scripts=@opencode/cli` is required for its `postinstall` to select the native binary.
 - **Version check**: `RUN opencode --version` after install to validate the build and record the installed version in build logs.
 - **Dedicated user**: a non-root `opencode` user and group are created with `groupadd`/`useradd` (UID/GID 1000). All runtime steps run as this user.
 - **Cluster tooling**: `kubectl` is copied from the official `registry.k8s.io/kubectl` image (multi-stage COPY).
- **Entrypoint**: `["opencode"]` — arguments are passed at runtime (e.g. `serve`).
+- **Entrypoint**: `["opencode"]` — arguments are passed at runtime; `serve` starts the headless server. Bare `opencode` opens the TUI, so the server is always invoked explicitly.
+
+## OpenCode 2 notes
+
+- The npm package is `@opencode/cli` (bins `opencode` and `opencode2`); `opencode-ai` stops at 1.19.x and must not come back.
+- `opencode attach` no longer exists: point a client at a server with `opencode --server <url>` (after the subcommand when one is given). `opencode-attach` wraps this.
+- The server always authenticates: username is fixed to `opencode`, password comes from `OPENCODE_SERVER_PASSWORD` or `OPENCODE_PASSWORD`, and a random one is generated and logged when neither is set.
+- The v1 REST API was replaced (`/global/health` is gone, every route now lives under `/api/*` and requires auth). Any client calling the v1 API — e.g. `perso/opencode-dispatch` — must be migrated separately.

 ## CI/CD conventions (Gitea Actions)

@@ -44,17 +51,17 @@ This repository builds and publishes a Docker image for [OpenCode](https://openc
 docker build -t opencode .

 # Run the server on all interfaces
-docker run -it -p 4096:4096 opencode --hostname 0.0.0.0
+docker run -it -p 4096:4096 opencode serve --hostname 0.0.0.0

 # Run with a project mounted
 docker run -it -p 4096:4096 \
  -v $(pwd):/home/opencode/project \
-  opencode --hostname 0.0.0.0
+  opencode serve --hostname 0.0.0.0

 # Protect with a password
 docker run -it -p 4096:4096 \
  -e OPENCODE_SERVER_PASSWORD=secret \
-  opencode --hostname 0.0.0.0
+  opencode serve --hostname 0.0.0.0
 ```

 ## opencode serve options
@@ -63,12 +70,15 @@ docker run -it -p 4096:4096 \
 |------|---------|-------------|
 | `--port` | `4096` | Port to listen on |
 | `--hostname` | `127.0.0.1` | Hostname to bind |
-| `--mdns` | `false` | Enable mDNS discovery |
-| `--cors` | `[]` | Additional allowed browser origins |
+| `--cors` | `[]` | Additional allowed browser origins (repeatable) |
+| `--service` | `false` | Run as the shared background service |
+| `--stdio` | `false` | Serve over stdio for editor integrations |

 ## Environment variables

 | Variable | Description |
 |----------|-------------|
-| `OPENCODE_SERVER_PASSWORD` | Enables HTTP basic auth |
-| `OPENCODE_SERVER_USERNAME` | Overrides the default username (`opencode`) |
+| `OPENCODE_SERVER_PASSWORD` | Server password (HTTP basic auth, username `opencode`) |
+| `OPENCODE_PASSWORD` | Same, takes precedence over `OPENCODE_SERVER_PASSWORD` |
+
+`OPENCODE_SERVER_USERNAME` existed in OpenCode 1 and is no longer read: the username is always `opencode`.
@@ -1,9 +1,10 @@
-FROM node:24-trixie
+FROM node:26-trixie

 ENV NPM_CONFIG_UPDATE_NOTIFIER=false \
  NPM_CONFIG_LOGLEVEL=warn \
  NODE_ENV=production

+
 RUN apt-get update && \
    apt-get upgrade -y --no-install-recommends ca-certificates && \
    rm -rf /var/lib/apt/lists/* && \
@@ -12,13 +13,16 @@ RUN apt-get update && \
    groupadd -g 1000 opencode; \
    useradd -m -u 1000 -g 1000 -s /usr/bin/bash opencode; \
    npm update -g --no-fund --no-audit && \
-    npm install -g --no-fund --no-audit opencode-ai@1.16.2 n2-soul@9.0.9 && \
+    npm install -g --no-fund --no-audit --ignore-scripts n2-soul@9.0.9 && \
+    npm install -g --no-fund --no-audit --allow-scripts=better-sqlite3 better-sqlite3@12.11.1 && \
+    rm -rf /usr/local/lib/node_modules/n2-soul/node_modules/better-sqlite3 && \
+    npm install -g --no-fund --no-audit --allow-scripts=@opencode/cli @opencode/cli@2.0.32 && \
    npm cache clean --force && \
    chown -R 1000:1000 /usr/local/lib/node_modules/n2-soul/

 COPY --chmod=755 opencode-attach /usr/local/bin/opencode-attach
-COPY --from=registry.k8s.io/kubectl:v1.36.2 /bin/kubectl /usr/local/bin/kubectl
-
+COPY --from=registry.k8s.io/kubectl:v1.37.1 /bin/kubectl /usr/local/bin/kubectl
+# hadolint ignore=DL3066
 USER opencode
 WORKDIR /home/opencode

@@ -1,38 +0,0 @@
-pipeline {
-  environment {
-    registry = 'https://registry.hub.docker.com'
-    registryCredential = 'dockerhub_jcabillot'
-    dockerImage = 'jcabillot/opencode'
-  }
-
-  agent any
-
-  triggers {
-    cron('@midnight')
-  }
-
-  stages {
-    stage('Clone repository') {
-      steps{
-        checkout scm
-      }
-    }
-
-    stage('Build image') {
-      steps{
-        sh 'docker build --force-rm=true --no-cache=true --pull -t ${dockerImage} .'
-      }
-    }
-
-    stage('Deploy Image') {
-      steps{
-        script {
-          withCredentials([usernamePassword(credentialsId: 'dockerhub_jcabillot', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
-            sh 'docker login --username ${DOCKER_USER} --password ${DOCKER_PASS}'
-            sh 'docker push ${dockerImage}'
-          }
-        }
-      }
-    }
-  }
-}
@@ -4,7 +4,7 @@ Docker image for running [OpenCode](https://opencode.ai) as a headless HTTP serv

 ## What is OpenCode?

-OpenCode is an open source AI coding agent available as a terminal interface, desktop app, or IDE extension. This image runs it in server mode (`opencode serve`), exposing an HTTP API that clients can connect to.
+OpenCode is an open source AI coding agent available as a terminal interface, desktop app, or IDE extension. This image ships OpenCode 2 and runs it in server mode (`opencode serve`), exposing an HTTP API and web UI that clients can connect to.

 ## Pull

@@ -12,7 +12,7 @@ OpenCode is an open source AI coding agent available as a terminal interface, de
 docker pull jcabillot/opencode
 ```

-The image is rebuilt and pushed to Docker Hub automatically every night via the Jenkins pipeline.
+The image is rebuilt and pushed to Docker Hub automatically every night by the Gitea Actions pipeline.

 ## Build locally

@@ -22,14 +22,16 @@ docker build -t opencode .

 ## Run

+The entrypoint is the `opencode` binary; pass `serve` to start the headless server:
+
 ```bash
-docker run -it -p 4096:4096 jcabillot/opencode
+docker run -it -p 4096:4096 jcabillot/opencode serve
 ```

-By default the server listens on `127.0.0.1:4096`. To expose it on all interfaces:
+The server listens on `127.0.0.1:4096` by default. To expose it on all interfaces:

 ```bash
-docker run -it -p 4096:4096 jcabillot/opencode --hostname 0.0.0.0
+docker run -it -p 4096:4096 jcabillot/opencode serve --hostname 0.0.0.0
 ```

 ### Mount a project
@@ -37,7 +39,7 @@ docker run -it -p 4096:4096 jcabillot/opencode --hostname 0.0.0.0
 ```bash
 docker run -it -p 4096:4096 \
  -v $(pwd):/home/opencode/project \
-  jcabillot/opencode --hostname 0.0.0.0
+  jcabillot/opencode serve --hostname 0.0.0.0
 ```

 ### Secure with a password
@@ -45,17 +47,17 @@ docker run -it -p 4096:4096 \
 ```bash
 docker run -it -p 4096:4096 \
  -e OPENCODE_SERVER_PASSWORD=your-password \
-  jcabillot/opencode --hostname 0.0.0.0
+  jcabillot/opencode serve --hostname 0.0.0.0
 ```

-Authentication uses HTTP basic auth. The default username is `opencode`, override it with `OPENCODE_SERVER_USERNAME`.
+Authentication uses HTTP basic auth. The username is always `opencode`; the password is read from `OPENCODE_SERVER_PASSWORD` (or `OPENCODE_PASSWORD`). When neither is set, OpenCode 2 generates a random password and prints it to the log at startup — the server is never left unauthenticated.

 ## Troubleshooting helper

 The image includes an `opencode-attach` wrapper in `PATH` that runs:

 ```bash
-opencode attach -p "${OPENCODE_SERVER_PASSWORD}" "${OPENCODE_API_URL}"
+opencode --server "${OPENCODE_API_URL}"
 ```

 Example:
@@ -66,31 +68,39 @@ export OPENCODE_API_URL=http://127.0.0.1:4096
 opencode-attach
 ```

+Extra arguments are forwarded to the client, with `--server` appended to the subcommand:
+
+```bash
+opencode-attach session list --format json
+```
+
 ## API

 Once running, the server exposes an OpenAPI 3.1 spec at:

 ```
-http://localhost:4096/doc
+http://localhost:4096/openapi.json
 ```

+The web UI is served at `/` and is reachable without credentials; every `/api/*` route requires basic auth.
+
 Key endpoints:

 | Method | Path | Description |
 |--------|------|-------------|
-| `GET` | `/global/health` | Health check and version |
-| `GET` | `/session` | List sessions |
-| `POST` | `/session` | Create a session |
-| `POST` | `/session/:id/message` | Send a message |
-| `GET` | `/event` | Server-sent events stream |
+| `GET` | `/api/info` | Health check and version |
+| `GET` | `/api/session` | List sessions |
+| `POST` | `/api/session` | Create a session |
+| `POST` | `/api/session/:id/prompt` | Send a message |
+| `GET` | `/api/event` | Server-sent events stream |

-See the [OpenCode server docs](https://opencode.ai/docs/server/) for the full API reference.
+See the [OpenCode v2 API reference](https://opencode.ai/v2/docs/api/) for the full API surface.

 ## Image details

- **Base image**: `node:24` (Debian)
- **Install**: `opencode-ai` via npm global install
+- **Base image**: `node:26-trixie` (Debian)
+- **Install**: `@opencode/cli` (OpenCode 2) via npm global install
 - **User**: dedicated non-root `opencode` user
 - **Cluster tooling**: `kubectl` (copied from official registry image)
- **Entrypoint**: `opencode serve`
+- **Entrypoint**: `opencode`
 - **Default port**: `4096`
@@ -45,4 +45,12 @@ trap cleanup_lock INT TERM EXIT
 kill_existing_instance
 printf '%s\n' "$$" > "$LOCKFILE"

-exec opencode attach -p "${OPENCODE_SERVER_PASSWORD}" "${OPENCODE_API_URL}" "$@"
+# OpenCode 2 dropped `opencode attach`: a client is pointed at a server with
+# --server <url>, which must follow the subcommand when one is given.
+if [ "$#" -eq 0 ]; then
+    set -- --server "${OPENCODE_API_URL}"
+else
+    set -- "$@" --server "${OPENCODE_API_URL}"
+fi
+
+exec opencode "$@"
@@ -12,12 +12,12 @@
    },
    {
      "customType": "regex",
-      "description": "Track opencode-ai npm package pinned in Dockerfile RUN command",
+      "description": "Track @opencode/cli npm package pinned in Dockerfile RUN command",
      "managerFilePatterns": ["/^Dockerfile$/"],
-      "matchStrings": ["opencode-ai@(?<currentValue>[^\\s]+)"],
-      "depNameTemplate": "opencode-ai",
+      "matchStrings": ["@opencode/cli@(?<currentValue>[^\\s]+)"],
+      "depNameTemplate": "@opencode/cli",
      "datasourceTemplate": "npm",
      "versioningTemplate": "npm"
    }
  ]
-}
+}