whitelisting `gh` args should solve it. Event opencode's primitive permission system allows that.