steveandClaude Opus 5
88f44cf141
PR #30 (qwen/kimi built-ins) is merged and the image is published, so the last-resort pin points at it. Verified the tag exists in the registry before pointing consumers at it — a pin to a tag that was never pushed breaks every consumer at once, and the build succeeding is not by itself proof the tag landed. GADFLY_REVIEWER_TAG still overrides this, and an explicit reviewer_tag input overrides both. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
203 lines
13 KiB
YAML
203 lines
13 KiB
YAML
# Gadfly — REUSABLE adversarial-review workflow (Gitea `workflow_call`).
|
|
#
|
|
# Centralizes the ~90-line consumer stub so a repo can subscribe to Gadfly with
|
|
# a tiny caller. A consumer workflow does:
|
|
#
|
|
# jobs:
|
|
# review:
|
|
# if: ... # actor gate for the comment trigger
|
|
# uses: steve/gadfly/.gitea/workflows/review-reusable.yml@v1
|
|
# secrets: # forward ONLY what the reviewer needs
|
|
# OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
|
|
# CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
# with: { allowed_users: "..." } # config inputs are optional (see below)
|
|
#
|
|
# The swarm config (models, specialists, concurrency) is resolved at RUNTIME from,
|
|
# in order: a consumer's `with:` input → the owner's user-scope GADFLY_DEFAULT_*
|
|
# variable → the image's built-in default. Because variables are injected per-run
|
|
# (not part of this cached file), the owner retunes the whole fleet by editing ONE
|
|
# variable — see the inputs block and README "Central config via variables".
|
|
# Secrets are DECLARED below (workflow_call.secrets) so a
|
|
# caller forwards only the credentials the reviewer actually uses — least
|
|
# privilege — rather than `secrets: inherit`, which leaks every caller secret
|
|
# (registry/deploy/db creds) into this workflow. `secrets: inherit` still works
|
|
# if you accept that exposure; the explicit form is recommended. GITEA_TOKEN is
|
|
# the automatic job token (no need to forward it).
|
|
#
|
|
# Advisory only — never blocks a merge. The reviewer image tag ALSO resolves at
|
|
# runtime (inputs.reviewer_tag → user var GADFLY_REVIEWER_TAG → the fallback pin
|
|
# baked into the `container:` line below), so a Gadfly release is: build the
|
|
# image, update ONE variable — no consumer re-pin. Re-pin the workflow ref only
|
|
# for structural changes to this file.
|
|
# Consumers should pin `uses: ...@<sha>` — long-lived act_runners cache this file
|
|
# by ref, so a moved tag (@v1) or @main is often NOT re-fetched and silently runs
|
|
# a stale copy.
|
|
|
|
name: Gadfly review (reusable)
|
|
|
|
on:
|
|
workflow_call:
|
|
# The swarm config (models, specialists, concurrency) is resolved at RUNTIME,
|
|
# in priority order: a consumer's explicit `with:` input → the owner's
|
|
# user/org-level variable (GADFLY_DEFAULT_*) → the image's built-in default.
|
|
# Variables are injected per-run by Gitea (not baked into this file), so the
|
|
# owner can retune the whole fleet by editing ONE variable — it propagates even
|
|
# though long-lived act_runners CACHE this workflow file by ref (a moved tag is
|
|
# NOT re-fetched; only a runtime value or a fresh @<sha> bypasses the cache).
|
|
#
|
|
# Owner-set user-scope variables (see README "Central config via variables"):
|
|
# GADFLY_REVIEWER_TAG (the reviewer image tag this reusable runs),
|
|
# GADFLY_DEFAULT_MODELS, GADFLY_DEFAULT_SPECIALISTS,
|
|
# GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY (the provider-wide lens budget),
|
|
# GADFLY_ENDPOINT_NETHERSTORM (the local GPU box endpoint).
|
|
# An unset variable + no input → the image default (one model, default suite),
|
|
# so a public consumer with neither still gets a sane minimal review.
|
|
inputs:
|
|
models: { type: string, default: "" } # GADFLY_MODELS — empty falls back to user var GADFLY_DEFAULT_MODELS, then the image default
|
|
specialists: { type: string, default: "" } # GADFLY_SPECIALISTS — empty falls back to user var GADFLY_DEFAULT_SPECIALISTS
|
|
provider: { type: string, default: "" } # GADFLY_PROVIDER
|
|
base_url: { type: string, default: "" } # GADFLY_BASE_URL
|
|
provider_concurrency: { type: string, default: "" } # DEPRECATED / ignored — the per-provider MODEL cap was removed; the lens budget below is the single throttle. Kept so existing callers don't error.
|
|
provider_lens_concurrency: { type: string, default: "" } # GADFLY_PROVIDER_LENS_CONCURRENCY — the per-provider lens budget (shared across the provider's models); empty falls back to user var GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY
|
|
timeout_secs: { type: string, default: "600" } # GADFLY_TIMEOUT_SECS (per lens)
|
|
max_steps: { type: string, default: "14" } # GADFLY_MAX_STEPS
|
|
worker_model: { type: string, default: "" } # GADFLY_WORKER_MODEL
|
|
allowed_users: { type: string, default: "" } # GADFLY_ALLOWED_USERS (consumer-specific; set in your stub)
|
|
reviewer_tag: { type: string, default: "" } # reviewer image tag (e.g. "sha-b850e35") — empty falls back to user var GADFLY_REVIEWER_TAG, then the pin baked into the container: line
|
|
# Gitea >= 1.27 does not propagate the CALLER's workflow_dispatch inputs into a
|
|
# called workflow's github.event, so a manual "review PR #N" dispatch arrived
|
|
# here with an empty PR and died at the entrypoint's "PR required" check. The
|
|
# caller stub must thread it explicitly: `pr_number: ${{ github.event.inputs.pr_number }}`.
|
|
pr_number: { type: string, default: "" }
|
|
trigger_phrase: { type: string, default: "" } # GADFLY_TRIGGER_PHRASE
|
|
consolidate: { type: string, default: "" } # GADFLY_CONSOLIDATE — "" => auto (one consensus comment for >=2 models); "0" => one comment per model
|
|
inline_review: { type: string, default: "" } # GADFLY_INLINE_REVIEW — "" => on (post a COMMENT-state PR review with inline comments on changed lines); "0" => off
|
|
# Job wall-clock cap. 90 as a default: the 5-lens suite across a slow lane
|
|
# (claude-code with extended thinking) over two passes can run long.
|
|
timeout_minutes: { type: number, default: 90 }
|
|
# Declared so callers can forward ONLY the secrets the reviewer needs
|
|
# (least privilege) instead of `secrets: inherit`, which would hand this
|
|
# workflow every secret in the caller's repo (registry/deploy/db creds the
|
|
# review never touches). All optional — an unset/unpassed secret resolves to
|
|
# empty, harmless for the providers a given consumer doesn't use. GITEA_TOKEN
|
|
# is the automatic job token and need not be declared/forwarded. Named
|
|
# endpoints (GADFLY_ENDPOINT_*) come from user/org VARS now, not secrets.
|
|
secrets:
|
|
OLLAMA_CLOUD_API_KEY: { required: false }
|
|
OPENAI_API_KEY: { required: false }
|
|
ANTHROPIC_API_KEY: { required: false }
|
|
GOOGLE_API_KEY: { required: false }
|
|
# Alibaba Model Studio (Qwen), for GADFLY_MODELS entries like
|
|
# "qwen/qwen3.8-max". NOT interchangeable with OPENAI_API_KEY: majordomo's
|
|
# qwen built-in reads QWEN_API_KEY only and deliberately refuses to fall
|
|
# back to the OpenAI key, so an unforwarded secret is a 401, not a
|
|
# mis-billed OpenAI call.
|
|
QWEN_API_KEY: { required: false }
|
|
# Moonshot (Kimi) over its own API — distinct from the ollama-cloud
|
|
# "kimi-k2.6:cloud" entry, which is keyed by OLLAMA_CLOUD_API_KEY.
|
|
KIMI_API_KEY: { required: false }
|
|
GADFLY_API_KEY: { required: false }
|
|
CLAUDE_CODE_OAUTH_TOKEN: { required: false }
|
|
GADFLY_FINDINGS_URL: { required: false }
|
|
GADFLY_FINDINGS_TOKEN: { required: false }
|
|
|
|
# The reusable job posts the review comment, so it needs issues/PR write. Gitea
|
|
# caps these by the caller's granted permissions; declaring them here is explicit.
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
review:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: ${{ inputs.timeout_minutes }}
|
|
# The reviewer runs as the JOB container (steps exec inside it), not a
|
|
# `uses: docker://` step: a job container image accepts ${{ }} expressions,
|
|
# while a `uses:` ref is parsed before any context exists. That lets the tag
|
|
# resolve per-run — inputs.reviewer_tag → user var GADFLY_REVIEWER_TAG → the
|
|
# baked fallback — so bumping the reviewer image is a ONE-variable edit that
|
|
# reaches every consumer despite their cached workflow ref.
|
|
#
|
|
# Always point the variable at an immutable :sha-<short> tag, never :latest —
|
|
# act_runner caches :latest and often does NOT re-pull a moved one; a fresh
|
|
# unique tag forces the pull. NB: vars are editable at will — whoever can edit
|
|
# the owner's variables redirects every consumer's reviewer image (same blast
|
|
# radius as editing this file, but without a commit trail).
|
|
#
|
|
# Fallback pin: sha-b850e35 — adds the qwen/kimi built-ins (PR #30: majordomo
|
|
# bumped for the qwen provider, a credential pre-flight that names the missing
|
|
# variable, and one no-cross-vendor-fallback rule so a keyless kimi/qwen
|
|
# endpoint can never send an OpenAI key to another vendor) on top of the
|
|
# provider-wide lens budget (PR #27). Keep it current-ish when touching this
|
|
# file anyway.
|
|
container:
|
|
image: gitea.stevedudenhoeffer.com/steve/gadfly:${{ inputs.reviewer_tag || vars.GADFLY_REVIEWER_TAG || 'sha-b850e35' }}
|
|
steps:
|
|
- name: Run the gadfly reviewer
|
|
run: /entrypoint.sh
|
|
env:
|
|
# --- event context (from the CALLER's github.*) -------------------
|
|
GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
# github.token is the auto job token from the github CONTEXT (not a
|
|
# secret), so it's present even without `secrets: inherit`. Using
|
|
# secrets.GITEA_TOKEN here would be empty under explicit secret
|
|
# forwarding, since the auto token isn't a forwarded workflow_call secret.
|
|
GITEA_TOKEN: ${{ github.token }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
PR: ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number || inputs.pr_number }}
|
|
PR_BRANCH: ${{ github.head_ref }}
|
|
IS_DRAFT: ${{ github.event.pull_request.draft }}
|
|
COMMENT_BODY: ${{ github.event.comment.body }}
|
|
COMMENT_ID: ${{ github.event.comment.id }}
|
|
ACTOR: ${{ github.actor }}
|
|
# --- provider auth (forwarded workflow_call secrets; empty if the caller doesn't forward it) -
|
|
# OLLAMA_CLOUD_API_KEY powers both the ollama-cloud majordomo path AND
|
|
# the opencode engine (GADFLY_MODELS entry "opencode/<model>").
|
|
OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
|
|
# Qwen (Alibaba Model Studio) and Kimi (Moonshot) over their own APIs,
|
|
# for GADFLY_MODELS entries like "qwen/qwen3.8-max". Each built-in
|
|
# reads ONLY its own variable — no cross-provider fallback — so a
|
|
# missing line here is a clean 401, never a silently mis-keyed call.
|
|
QWEN_API_KEY: ${{ secrets.QWEN_API_KEY }}
|
|
KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
|
|
GADFLY_API_KEY: ${{ secrets.GADFLY_API_KEY }}
|
|
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
# Named LAN endpoints, defined in user/org vars (format
|
|
# "<provider>|<base-url>[|<key>]"). Adding a NEW name still needs a line
|
|
# here — a reusable workflow can't enumerate arbitrary vars.GADFLY_ENDPOINT_*.
|
|
# NB: vars are NOT masked like secrets — if an endpoint embeds an auth
|
|
# token, keep that one a secret instead.
|
|
GADFLY_ENDPOINT_M1: ${{ vars.GADFLY_ENDPOINT_M1 }}
|
|
GADFLY_ENDPOINT_M5: ${{ vars.GADFLY_ENDPOINT_M5 }}
|
|
# netherstorm = the local GPU box via its llama-swap proxy. Defined in the
|
|
# user var GADFLY_ENDPOINT_NETHERSTORM (format "<provider>|<base-url>[|<key>]",
|
|
# e.g. "llamaswap|https://llama-swap.netherstorm...") so the URL can change
|
|
# without editing this file; the matching model is netherstorm/qwen3.6-27b in
|
|
# GADFLY_DEFAULT_MODELS. NB: use the un-hyphenated `llamaswap` provider
|
|
# spelling in the var — the pinned image needs it. Without this line the var
|
|
# is silently dropped at the workflow_call boundary ('unknown provider').
|
|
GADFLY_ENDPOINT_NETHERSTORM: ${{ vars.GADFLY_ENDPOINT_NETHERSTORM }}
|
|
# --- findings telemetry (optional) --------------------------------
|
|
GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }}
|
|
GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }}
|
|
# --- config (from inputs; empty => image default) -----------------
|
|
GADFLY_MODELS: ${{ inputs.models || vars.GADFLY_DEFAULT_MODELS }}
|
|
GADFLY_SPECIALISTS: ${{ inputs.specialists || vars.GADFLY_DEFAULT_SPECIALISTS }}
|
|
GADFLY_PROVIDER: ${{ inputs.provider }}
|
|
GADFLY_BASE_URL: ${{ inputs.base_url }}
|
|
# NB: GADFLY_PROVIDER_CONCURRENCY (the old model cap) is intentionally no
|
|
# longer forwarded — entrypoint.sh ignores it. The lens budget is the one
|
|
# throttle now, shared across a provider's models.
|
|
GADFLY_PROVIDER_LENS_CONCURRENCY: ${{ inputs.provider_lens_concurrency || vars.GADFLY_DEFAULT_PROVIDER_LENS_CONCURRENCY }}
|
|
GADFLY_TIMEOUT_SECS: ${{ inputs.timeout_secs }}
|
|
GADFLY_MAX_STEPS: ${{ inputs.max_steps }}
|
|
GADFLY_WORKER_MODEL: ${{ inputs.worker_model }}
|
|
GADFLY_ALLOWED_USERS: ${{ inputs.allowed_users }}
|
|
GADFLY_TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}
|
|
GADFLY_CONSOLIDATE: ${{ inputs.consolidate }}
|
|
GADFLY_INLINE_REVIEW: ${{ inputs.inline_review }}
|