ci(review): improve instructions, comment inline, guardrails

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,7 +10,6 @@
 - [ ] I read [CONTRIBUTING.md](https://github.com/nickjvandyke/opencode.nvim/blob/main/CONTRIBUTING.md)
 - [ ] I ensured my changes pass automated checks
 - [ ] I reviewed and understand the AI-generated code in my changes (if any)
-- [ ] I addressed actionable AI review feedback (if any)
 
 ## Description
 

.github/workflows/opencode-review.yml

@@ -15,7 +15,7 @@ jobs:
       contains(github.event.comment.body, '/review') &&
       github.event.comment.author_association == 'OWNER'
     runs-on: ubuntu-latest
-    timeout-minutes: 3
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
         with:
@@ -25,12 +25,19 @@ jobs:
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENCODE_PERMISSION: '{ "bash": { "*": "deny", "gh*": "allow", "gh pr review*": "deny", "gh pr review --comment*": "allow" } }'
         with:
           model: opencode/big-pickle
           use_github_token: true
           prompt: |
             Review this pull request:
-            - Check for code quality issues
-            - Look for potential bugs
-            - Suggest improvements
-            - See CONTRIBUTING.md for additional guidelines
+            - **Code quality**: Spot style, maintainability, and correctness issues
+            - **Bugs**: Catch logic errors, edge cases, and incorrect assumptions
+            - **Improvements**: Suggest better approaches where applicable
+            - **Guidelines**: See CONTRIBUTING.md for project-specific conventions
+            - **PR health**: Comment if the PR mixes unrelated changes, lacks a clear "why" in the description, or is unreasonably large for what it achieves.
+            - **Contributor check**: For external contributors, verify the PR template is filled out, CI passes, and CONTRIBUTING.md was followed.
+
+            Diffs are important, but make sure you read the entire file to get proper context. Make it clear the suggestions are merely suggestions and the human can decide what to do.
+
+            If applicable, use `gh pr review --comment` to post inline suggestions on specific lines. Use a review comment (not inline) for high-level architectural or cross-file feedback. If you have a good suggested fix, include it in a code suggestion block.