ai-scan.yml

name: AI Scheduled Scan

# Weekly deterministic + LLM repo scan. Opens at most max-issues NEW issues per
# run (fingerprint dedupe against open issues); never auto-merges anything.
on:
  schedule:
    - cron: "0 2 * * 1" # Mondays 02:00 UTC
  workflow_dispatch:
    inputs:
      max_issues:
        description: "Max new issues to open this run"
        required: false
        default: "3"
      dry_run:
        description: "Print findings without opening issues"
        required: false
        default: "false"
        type: choice
        options: ["false", "true"]

permissions:
  contents: read

concurrency:
  group: ai-scan-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ai-scan:
    name: Repo scan + auto-issue
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      issues: write
    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Ensure LLM route is available
        shell: bash
        env:
          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
          CPA_BASE_URL: ${{ secrets.CPA_BASE_URL }}
          CPA_API_KEY: ${{ secrets.CPA_API_KEY }}
        run: |
          set -euo pipefail
          # Free models always have a route: an in-job no-auth gateway is
          # started below unless an external GATEWAY_BASE_URL secret is set.
          if [[ -n "${GATEWAY_BASE_URL}" ]]; then
            echo "Using external gateway (URL from secrets; value not printed)."
          else
            echo "No external gateway secret; starting in-job no-auth gateway."
          fi
          if [[ -z "${CPA_API_KEY}" || -z "${CPA_BASE_URL}" ]]; then
            echo "::warning::No CPA credentials; CPA fallback channel disabled (gateway only)."
          fi

      - name: Detect gateway source
        id: gw
        shell: bash
        env:
          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
        run: |
          set -euo pipefail
          # secrets context is not allowed in step `if:`; expose via outputs.
          if [[ -n "${GATEWAY_BASE_URL}" ]]; then
            echo "external=true" >> "$GITHUB_OUTPUT"
          else
            echo "external=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Node
        if: steps.gw.outputs.external != 'true'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: npm

      - name: Start in-job gateway (free models, no login needed)
        if: steps.gw.outputs.external != 'true'
        shell: bash
        run: |
          set -euo pipefail
          npm ci
          npm run build
          # Pinned to track @opencode-ai/sdk ^1.18.29 used by this repo.
          npm i -g opencode-ai@1.18.30
          # No-auth localhost gateway: empty API_KEY = no auth; the gateway
          # spawns its own backend (anonymous out-of-box free quota).
          API_KEY= OPENCODE_PROXY_MANAGE_BACKEND=true OPENCODE_SERVER_PASSWORD=ci-local-only \
            nohup node dist/index.js > /tmp/opencode-gateway.log 2>&1 &
          ok=0
          for i in $(seq 1 60); do
            if curl -sf http://127.0.0.1:10000/health; then
              echo
              echo "gateway: /health 200"
              ok=1
              break
            fi
            sleep 5
          done
          if [[ "$ok" != "1" ]]; then
            echo "gateway failed to start" >&2
            tail -50 /tmp/opencode-gateway.log || true
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Run scheduled scan
        shell: bash
        env:
          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
          GATEWAY_API_KEY: ${{ secrets.GATEWAY_API_KEY }}
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          CPA_BASE_URL: ${{ secrets.CPA_BASE_URL }}
          CPA_API_KEY: ${{ secrets.CPA_API_KEY }}
          GITHUB_TOKEN: ${{ github.token }}
          SCAN_MAX_ISSUES: ${{ inputs.max_issues || '3' }}
          PYTHONPATH: github_bot/src
        run: |
          set -euo pipefail
          # Default to the in-job no-auth gateway when no external URL secret.
          export GATEWAY_BASE_URL="${GATEWAY_BASE_URL:-http://127.0.0.1:10000}"
          if [[ "${{ inputs.dry_run || 'false' }}" == "true" ]]; then
            python3 github_bot/src/github_runner.py --mode=scan --dry-run
          else
            python3 github_bot/src/github_runner.py --mode=scan
          fi