steve/gadfly
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(reusable): runtime-variable swarm config (cache-immune, no more re-pinning to retune) (#14)
Build & push image / build-and-push (push) Successful in 5s
Details

Browse Source
This commit was merged in pull request #14.
This commit is contained in:
steve
2026-06-28 06:00:18 +00:00
parent 95a9ec546a
commit 7bc3c982fa
3 changed files with 74 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/review-reusable.yml
+42 -42
View File
@@ -12,12 +12,12 @@
# CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
# with: { allowed_users: "..." } # config inputs are optional (see below)
#
# Inputs ship the DEFAULT swarm (see the inputs block): 3 cloud models + the
# Claude Code engine + a local 4090 Ti (qwen3.6-27b via llama-swap), 5-lens suite
# (3 claude models concurrent / 5 lenses each; the 4090 Ti runs 1 model × 1 lens). A consumer
# inherits it by omitting `with:` entirely, or overrides any field (e.g.
# `models:` for a cloud-only / different-provider setup; "" falls back to the
# image's built-in default). Secrets are DECLARED below (workflow_call.secrets) so a
# The swarm config (models, specialists, concurrency) is resolved at RUNTIME from,
# in order: a consumer's `with:` input → the owner's user-scope GADFLY_DEFAULT_*
# variable → the image's built-in default. Because variables are injected per-run
# (not part of this cached file), the owner retunes the whole fleet by editing ONE
# variable — see the inputs block and README "Central config via variables".
# Secrets are DECLARED below (workflow_call.secrets) so a
# caller forwards only the credentials the reviewer actually uses — least
# privilege — rather than `secrets: inherit`, which leaks every caller secret
# (registry/deploy/db creds) into this workflow. `secrets: inherit` still works
@@ -34,27 +34,27 @@ name: Gadfly review (reusable)
on:
workflow_call:
# Inputs ship the DEFAULT Gadfly swarm so a consumer can just call this
# workflow (no `with:` block) and inherit it. The default is opinionated —
# 3 strong cloud models + the Claude Code engine (sonnet/opus/opus:max) + a
# local 4090 Ti (qwen3.6-27b via llama-swap at GADFLY_ENDPOINT_RAGNAROS), the
# 5-lens suite, with all 3 claude models concurrent and each running its 5
# lenses at once (the 4090 Ti runs 1 model × 1 lens — a single local GPU). It
# needs OLLAMA_CLOUD_API_KEY and CLAUDE_CODE_OAUTH_TOKEN; a consumer
# with only one (or a different provider) overrides `models:` (and forwards
# just the secrets it uses). Set any input to "" to fall back to the
# image/entrypoint built-in default.
# The swarm config (models, specialists, concurrency) is resolved at RUNTIME,
# in priority order: a consumer's explicit `with:` input → the owner's
# user/org-level variable (GADFLY_DEFAULT_*) → the image's built-in default.
# Variables are injected per-run by Gitea (not baked into this file), so the
# owner can retune the whole fleet by editing ONE variable — it propagates even
# though long-lived act_runners CACHE this workflow file by ref (a moved tag is
# NOT re-fetched; only a runtime value or a fresh @<sha> bypasses the cache).
#
# Peak claude concurrency = provider_concurrency × provider_lens_concurrency
# (3 models × 5 lenses = up to 15 concurrent `claude -p` per pass). If you hit
# subscription rate limits or runner load, dial claude-code down in either knob.
# Owner-set user-scope variables (see README "Central config via variables"):
# GADFLY_DEFAULT_MODELS, GADFLY_DEFAULT_SPECIALISTS,
# GADFLY_DEFAULT_PROVIDER_CONCURRENCY, GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY,
# GADFLY_ENDPOINT_RAGNAROS (the 4090 Ti endpoint).
# An unset variable + no input → the image default (one model, default suite),
# so a public consumer with neither still gets a sane minimal review.
inputs:
models: { type: string, default: "minimax-m3:cloud,glm-5.2:cloud,deepseek-v4-pro:cloud,claude-code/sonnet,claude-code/opus,claude-code/opus:max,ragnaros/qwen3.6-27b" } # GADFLY_MODELS (csv); ragnaros/* = the 4090 Ti via llama-swap (see GADFLY_ENDPOINT_RAGNAROS)
specialists: { type: string, default: "security,correctness,maintainability,performance,error-handling" } # GADFLY_SPECIALISTS (5-lens default suite)
models: { type: string, default: "" } # GADFLY_MODELS — empty falls back to user var GADFLY_DEFAULT_MODELS, then the image default
specialists: { type: string, default: "" } # GADFLY_SPECIALISTS — empty falls back to user var GADFLY_DEFAULT_SPECIALISTS
provider: { type: string, default: "" } # GADFLY_PROVIDER
base_url: { type: string, default: "" } # GADFLY_BASE_URL
provider_concurrency: { type: string, default: "ollama-cloud=3,claude-code=3,ragnaros=1" } # GADFLY_PROVIDER_CONCURRENCY (claude all 3 at once; ragnaros 4090 Ti one model at a time)
provider_lens_concurrency: { type: string, default: "ollama-cloud=3,claude-code=5,ragnaros=1" } # GADFLY_PROVIDER_LENS_CONCURRENCY (claude 5 lenses at once; ragnaros 1 lens at a time)
provider_concurrency: { type: string, default: "" } # GADFLY_PROVIDER_CONCURRENCY — empty falls back to user var GADFLY_DEFAULT_PROVIDER_CONCURRENCY
provider_lens_concurrency: { type: string, default: "" } # GADFLY_PROVIDER_LENS_CONCURRENCY — empty falls back to user var GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY
timeout_secs: { type: string, default: "600" } # GADFLY_TIMEOUT_SECS (per lens)
max_steps: { type: string, default: "14" } # GADFLY_MAX_STEPS
worker_model: { type: string, default: "" } # GADFLY_WORKER_MODEL
@@ -68,8 +68,8 @@ on:
# workflow every secret in the caller's repo (registry/deploy/db creds the
# review never touches). All optional — an unset/unpassed secret resolves to
# empty, harmless for the providers a given consumer doesn't use. GITEA_TOKEN
# is the automatic job token and need not be declared/forwarded. Consumers
# with bespoke GADFLY_ENDPOINT_<NAME>s beyond M1/M5 need the full stub.
# is the automatic job token and need not be declared/forwarded. Named
# endpoints (GADFLY_ENDPOINT_*) come from user/org VARS now, not secrets.
secrets:
OLLAMA_CLOUD_API_KEY: { required: false }
OPENAI_API_KEY: { required: false }
@@ -77,8 +77,6 @@ on:
GOOGLE_API_KEY: { required: false }
GADFLY_API_KEY: { required: false }
CLAUDE_CODE_OAUTH_TOKEN: { required: false }
GADFLY_ENDPOINT_M1: { required: false }
GADFLY_ENDPOINT_M5: { required: false }
GADFLY_FINDINGS_URL: { required: false }
GADFLY_FINDINGS_TOKEN: { required: false }
@@ -117,27 +115,29 @@ jobs:
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
GADFLY_API_KEY: ${{ secrets.GADFLY_API_KEY }}
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
# Common named foreman/LAN endpoints (optional). Consumers with other
# GADFLY_ENDPOINT_<NAME>s need the full stub (examples/), since a
# reusable workflow can't enumerate arbitrary names.
GADFLY_ENDPOINT_M1: ${{ secrets.GADFLY_ENDPOINT_M1 }}
GADFLY_ENDPOINT_M5: ${{ secrets.GADFLY_ENDPOINT_M5 }}
# ragnaros = the 4090 Ti, reached over the LAN through its llama-swap
# proxy (lazy-loads models on demand). Plain https URL, no credential —
# set here so the default `ragnaros/qwen3.6-27b` model resolves for all
# consumers. Registers provider "ragnaros". NB: use the un-hyphenated
# `llamaswap` provider spelling — the pinned image accepts that form.
GADFLY_ENDPOINT_RAGNAROS: "llamaswap|https://llama-swap.ragnaros.dudenhoeffer.casa"
# Named LAN endpoints, defined in user/org vars (format
# "<provider>|<base-url>[|<key>]"). Adding a NEW name still needs a line
# here — a reusable workflow can't enumerate arbitrary vars.GADFLY_ENDPOINT_*.
# NB: vars are NOT masked like secrets — if an endpoint embeds an auth
# token, keep that one a secret instead.
GADFLY_ENDPOINT_M1: ${{ vars.GADFLY_ENDPOINT_M1 }}
GADFLY_ENDPOINT_M5: ${{ vars.GADFLY_ENDPOINT_M5 }}
# ragnaros = the 4090 Ti via its llama-swap proxy. Defined in the user
# var GADFLY_ENDPOINT_RAGNAROS (format "<provider>|<base-url>[|<key>]")
# so the URL can change without editing this file; the matching model is
# ragnaros/qwen3.6-27b in GADFLY_DEFAULT_MODELS. NB: use the un-hyphenated
# `llamaswap` provider spelling in the var — the pinned image needs it.
GADFLY_ENDPOINT_RAGNAROS: ${{ vars.GADFLY_ENDPOINT_RAGNAROS }}
# --- findings telemetry (optional) --------------------------------
GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }}
GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }}
# --- config (from inputs; empty => image default) -----------------
GADFLY_MODELS: ${{ inputs.models }}
GADFLY_SPECIALISTS: ${{ inputs.specialists }}
GADFLY_MODELS: ${{ inputs.models || vars.GADFLY_DEFAULT_MODELS }}
GADFLY_SPECIALISTS: ${{ inputs.specialists || vars.GADFLY_DEFAULT_SPECIALISTS }}
GADFLY_PROVIDER: ${{ inputs.provider }}
GADFLY_BASE_URL: ${{ inputs.base_url }}
GADFLY_PROVIDER_CONCURRENCY: ${{ inputs.provider_concurrency }}
GADFLY_PROVIDER_LENS_CONCURRENCY: ${{ inputs.provider_lens_concurrency }}
GADFLY_PROVIDER_CONCURRENCY: ${{ inputs.provider_concurrency || vars.GADFLY_DEFAULT_PROVIDER_CONCURRENCY }}
GADFLY_PROVIDER_LENS_CONCURRENCY: ${{ inputs.provider_lens_concurrency || vars.GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY }}
GADFLY_TIMEOUT_SECS: ${{ inputs.timeout_secs }}
GADFLY_MAX_STEPS: ${{ inputs.max_steps }}
GADFLY_WORKER_MODEL: ${{ inputs.worker_model }}