# Gadfly — REUSABLE adversarial-review workflow (Gitea `workflow_call`). # # Centralizes the ~90-line consumer stub so a repo can subscribe to Gadfly with # a tiny caller. A consumer workflow does: # # jobs: # review: # if: ... # actor gate for the comment trigger # uses: steve/gadfly/.gitea/workflows/review-reusable.yml@v1 # secrets: # forward ONLY what the reviewer needs # OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }} # CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # with: { allowed_users: "..." } # config inputs are optional (see below) # # The swarm config (models, specialists, concurrency) is resolved at RUNTIME from, # in order: a consumer's `with:` input → the owner's user-scope GADFLY_DEFAULT_* # variable → the image's built-in default. Because variables are injected per-run # (not part of this cached file), the owner retunes the whole fleet by editing ONE # variable — see the inputs block and README "Central config via variables". # Secrets are DECLARED below (workflow_call.secrets) so a # caller forwards only the credentials the reviewer actually uses — least # privilege — rather than `secrets: inherit`, which leaks every caller secret # (registry/deploy/db creds) into this workflow. `secrets: inherit` still works # if you accept that exposure; the explicit form is recommended. GITEA_TOKEN is # the automatic job token (no need to forward it). # # Advisory only — never blocks a merge. The image is pinned to an immutable # :sha- tag here (act_runner caches :latest); bump it per Gadfly release. # Consumers should pin `uses: ...@v1` — a curated release tag moved on deliberate # releases, so central tuning here propagates without per-consumer edits — or a # full `@` for an immutable pin. Avoid `@main` (moves on every push). name: Gadfly review (reusable) on: workflow_call: # The swarm config (models, specialists, concurrency) is resolved at RUNTIME, # in priority order: a consumer's explicit `with:` input → the owner's # user/org-level variable (GADFLY_DEFAULT_*) → the image's built-in default. # Variables are injected per-run by Gitea (not baked into this file), so the # owner can retune the whole fleet by editing ONE variable — it propagates even # though long-lived act_runners CACHE this workflow file by ref (a moved tag is # NOT re-fetched; only a runtime value or a fresh @ bypasses the cache). # # Owner-set user-scope variables (see README "Central config via variables"): # GADFLY_DEFAULT_MODELS, GADFLY_DEFAULT_SPECIALISTS, # GADFLY_DEFAULT_PROVIDER_CONCURRENCY, GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY, # GADFLY_ENDPOINT_RAGNAROS (the 4090 Ti endpoint). # An unset variable + no input → the image default (one model, default suite), # so a public consumer with neither still gets a sane minimal review. inputs: models: { type: string, default: "" } # GADFLY_MODELS — empty falls back to user var GADFLY_DEFAULT_MODELS, then the image default specialists: { type: string, default: "" } # GADFLY_SPECIALISTS — empty falls back to user var GADFLY_DEFAULT_SPECIALISTS provider: { type: string, default: "" } # GADFLY_PROVIDER base_url: { type: string, default: "" } # GADFLY_BASE_URL provider_concurrency: { type: string, default: "" } # GADFLY_PROVIDER_CONCURRENCY — empty falls back to user var GADFLY_DEFAULT_PROVIDER_CONCURRENCY provider_lens_concurrency: { type: string, default: "" } # GADFLY_PROVIDER_LENS_CONCURRENCY — empty falls back to user var GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY timeout_secs: { type: string, default: "600" } # GADFLY_TIMEOUT_SECS (per lens) max_steps: { type: string, default: "14" } # GADFLY_MAX_STEPS worker_model: { type: string, default: "" } # GADFLY_WORKER_MODEL allowed_users: { type: string, default: "" } # GADFLY_ALLOWED_USERS (consumer-specific; set in your stub) trigger_phrase: { type: string, default: "" } # GADFLY_TRIGGER_PHRASE # Job wall-clock cap. 90 as a default: the 5-lens suite across a slow lane # (claude-code with extended thinking) over two passes can run long. timeout_minutes: { type: number, default: 90 } # Declared so callers can forward ONLY the secrets the reviewer needs # (least privilege) instead of `secrets: inherit`, which would hand this # workflow every secret in the caller's repo (registry/deploy/db creds the # review never touches). All optional — an unset/unpassed secret resolves to # empty, harmless for the providers a given consumer doesn't use. GITEA_TOKEN # is the automatic job token and need not be declared/forwarded. Named # endpoints (GADFLY_ENDPOINT_*) come from user/org VARS now, not secrets. secrets: OLLAMA_CLOUD_API_KEY: { required: false } OPENAI_API_KEY: { required: false } ANTHROPIC_API_KEY: { required: false } GOOGLE_API_KEY: { required: false } GADFLY_API_KEY: { required: false } CLAUDE_CODE_OAUTH_TOKEN: { required: false } GADFLY_FINDINGS_URL: { required: false } GADFLY_FINDINGS_TOKEN: { required: false } # The reusable job posts the review comment, so it needs issues/PR write. Gitea # caps these by the caller's granted permissions; declaring them here is explicit. permissions: contents: read issues: write pull-requests: write jobs: review: runs-on: ubuntu-latest timeout-minutes: ${{ inputs.timeout_minutes }} steps: - uses: docker://gitea.stevedudenhoeffer.com/steve/gadfly:sha-c342bdb env: # --- event context (from the CALLER's github.*) ------------------- GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} # github.token is the auto job token from the github CONTEXT (not a # secret), so it's present even without `secrets: inherit`. Using # secrets.GITEA_TOKEN here would be empty under explicit secret # forwarding, since the auto token isn't a forwarded workflow_call secret. GITEA_TOKEN: ${{ github.token }} EVENT_NAME: ${{ github.event_name }} PR: ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} PR_BRANCH: ${{ github.head_ref }} IS_DRAFT: ${{ github.event.pull_request.draft }} COMMENT_BODY: ${{ github.event.comment.body }} COMMENT_ID: ${{ github.event.comment.id }} ACTOR: ${{ github.actor }} # --- provider auth (forwarded workflow_call secrets; empty if the caller doesn't forward it) - OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }} OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }} GADFLY_API_KEY: ${{ secrets.GADFLY_API_KEY }} CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # Named LAN endpoints, defined in user/org vars (format # "|[|]"). Adding a NEW name still needs a line # here — a reusable workflow can't enumerate arbitrary vars.GADFLY_ENDPOINT_*. # NB: vars are NOT masked like secrets — if an endpoint embeds an auth # token, keep that one a secret instead. GADFLY_ENDPOINT_M1: ${{ vars.GADFLY_ENDPOINT_M1 }} GADFLY_ENDPOINT_M5: ${{ vars.GADFLY_ENDPOINT_M5 }} # ragnaros = the 4090 Ti via its llama-swap proxy. Defined in the user # var GADFLY_ENDPOINT_RAGNAROS (format "|[|]") # so the URL can change without editing this file; the matching model is # ragnaros/qwen3.6-27b in GADFLY_DEFAULT_MODELS. NB: use the un-hyphenated # `llamaswap` provider spelling in the var — the pinned image needs it. GADFLY_ENDPOINT_RAGNAROS: ${{ vars.GADFLY_ENDPOINT_RAGNAROS }} # --- findings telemetry (optional) -------------------------------- GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }} GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }} # --- config (from inputs; empty => image default) ----------------- GADFLY_MODELS: ${{ inputs.models || vars.GADFLY_DEFAULT_MODELS }} GADFLY_SPECIALISTS: ${{ inputs.specialists || vars.GADFLY_DEFAULT_SPECIALISTS }} GADFLY_PROVIDER: ${{ inputs.provider }} GADFLY_BASE_URL: ${{ inputs.base_url }} GADFLY_PROVIDER_CONCURRENCY: ${{ inputs.provider_concurrency || vars.GADFLY_DEFAULT_PROVIDER_CONCURRENCY }} GADFLY_PROVIDER_LENS_CONCURRENCY: ${{ inputs.provider_lens_concurrency || vars.GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY }} GADFLY_TIMEOUT_SECS: ${{ inputs.timeout_secs }} GADFLY_MAX_STEPS: ${{ inputs.max_steps }} GADFLY_WORKER_MODEL: ${{ inputs.worker_model }} GADFLY_ALLOWED_USERS: ${{ inputs.allowed_users }} GADFLY_TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}