Repository navigation
fix(bot): address external review - v1 path, auth gates, verdict, med… #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: AI Scheduled Scan | ||
|
Check failure on line 1 in .github/workflows/ai-scan.yml
|
||
| # Weekly deterministic + LLM repo scan. Opens at most max-issues NEW issues per | ||
| # run (fingerprint dedupe against open issues); never auto-merges anything. | ||
| on: | ||
| schedule: | ||
| - cron: "0 2 * * 1" # Mondays 02:00 UTC | ||
| workflow_dispatch: | ||
| inputs: | ||
| max_issues: | ||
| description: "Max new issues to open this run" | ||
| required: false | ||
| default: "3" | ||
| dry_run: | ||
| description: "Print findings without opening issues" | ||
| required: false | ||
| default: "false" | ||
| type: choice | ||
| options: ["false", "true"] | ||
| permissions: | ||
| contents: read | ||
| concurrency: | ||
| group: ai-scan-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| ai-scan: | ||
| name: Repo scan + auto-issue | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 30 | ||
| permissions: | ||
| contents: read | ||
| issues: write | ||
| steps: | ||
| - name: Check out repository | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - name: Ensure LLM route is available | ||
| shell: bash | ||
| env: | ||
| GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }} | ||
| CPA_BASE_URL: ${{ secrets.CPA_BASE_URL }} | ||
| CPA_API_KEY: ${{ secrets.CPA_API_KEY }} | ||
| run: | | ||
| set -euo pipefail | ||
| # Free models always have a route: an in-job no-auth gateway is | ||
| # started below unless an external GATEWAY_BASE_URL secret is set. | ||
| if [[ -n "${GATEWAY_BASE_URL}" ]]; then | ||
| echo "Using external gateway (URL from secrets; value not printed)." | ||
| else | ||
| echo "No external gateway secret; starting in-job no-auth gateway." | ||
| fi | ||
| if [[ -z "${CPA_API_KEY}" || -z "${CPA_BASE_URL}" ]]; then | ||
| echo "::warning::No CPA credentials; CPA fallback channel disabled (gateway only)." | ||
| fi | ||
| - name: Set up Node | ||
| if: secrets.GATEWAY_BASE_URL == '' | ||
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | ||
| with: | ||
| node-version: 24 | ||
| cache: npm | ||
| - name: Start in-job gateway (free models, no login needed) | ||
| if: secrets.GATEWAY_BASE_URL == '' | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| npm ci | ||
| npm run build | ||
| # Pinned to track @opencode-ai/sdk ^1.18.29 used by this repo. | ||
| npm i -g opencode-ai@1.18.30 | ||
| # No-auth localhost gateway: empty API_KEY = no auth; the gateway | ||
| # spawns its own backend (anonymous out-of-box free quota). | ||
| API_KEY= OPENCODE_PROXY_MANAGE_BACKEND=true OPENCODE_SERVER_PASSWORD=ci-local-only \ | ||
| nohup node dist/index.js > /tmp/opencode-gateway.log 2>&1 & | ||
| ok=0 | ||
| for i in $(seq 1 60); do | ||
| if curl -sf http://127.0.0.1:10000/health; then | ||
| echo | ||
| echo "gateway: /health 200" | ||
| ok=1 | ||
| break | ||
| fi | ||
| sleep 5 | ||
| done | ||
| if [[ "$ok" != "1" ]]; then | ||
| echo "gateway failed to start" >&2 | ||
| tail -50 /tmp/opencode-gateway.log || true | ||
| exit 1 | ||
| fi | ||
| - name: Set up Python | ||
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | ||
| with: | ||
| python-version: "3.12" | ||
| - name: Run scheduled scan | ||
| shell: bash | ||
| env: | ||
| GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }} | ||
| GATEWAY_API_KEY: ${{ secrets.GATEWAY_API_KEY }} | ||
| OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }} | ||
| CPA_BASE_URL: ${{ secrets.CPA_BASE_URL }} | ||
| CPA_API_KEY: ${{ secrets.CPA_API_KEY }} | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| SCAN_MAX_ISSUES: ${{ inputs.max_issues || '3' }} | ||
| PYTHONPATH: github_bot/src | ||
| run: | | ||
| set -euo pipefail | ||
| # Default to the in-job no-auth gateway when no external URL secret. | ||
| export GATEWAY_BASE_URL="${GATEWAY_BASE_URL:-http://127.0.0.1:10000}" | ||
| if [[ "${{ inputs.dry_run || 'false' }}" == "true" ]]; then | ||
| python3 github_bot/src/github_runner.py --mode=scan --dry-run | ||
| else | ||
| python3 github_bot/src/github_runner.py --mode=scan | ||
| fi | ||
