From 17064a6d75f6bcf9b633fe96829accdfa75a4a93 Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Sat, 27 Jun 2026 22:26:13 -0400 Subject: [PATCH] ci: inherit gadfly's default swarm (slim caller, re-pin @b02b11d) steve/gadfly#10 centralized the curated swarm (3 cloud + Claude Code, 5-lens suite) as the reusable workflow's input defaults. Drop majordomo's explicit `with:` swarm block and inherit it; only the consumer-specific allow-list remains. Re-pin to the post-#10 gadfly commit (@b02b11d). Update CLAUDE.md's Gadfly section to match (was 6 cloud / 3 lenses). Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/adversarial-review.yml | 30 ++++++++++--------------- CLAUDE.md | 8 ++++--- 2 files changed, 17 insertions(+), 21 deletions(-) diff --git a/.gitea/workflows/adversarial-review.yml b/.gitea/workflows/adversarial-review.yml index 40b9f4e..4d78060 100644 --- a/.gitea/workflows/adversarial-review.yml +++ b/.gitea/workflows/adversarial-review.yml @@ -1,10 +1,8 @@ -# Gadfly adversarial review — subscribes to steve/gadfly's reusable workflow. -# A curated swarm: 3 strong cloud models (minimax-m3, glm-5.2, deepseek-v4-pro) -# + the Claude Code engine (sonnet, opus, opus:max) — all three claudes run -# concurrently (claude-code=3). Every model runs the 5-lens default suite -# (security, correctness, maintainability, performance, error-handling); lenses -# are global, so this applies to the cloud AND claude models. No local Macs. -# Advisory only — never blocks a merge. +# Gadfly adversarial review — subscribes to steve/gadfly's reusable workflow and +# INHERITS its default swarm. This stub holds only the triggers, the actor gate, +# secret forwarding, and the allow-list; the swarm config (models, lenses, +# concurrency, timeouts) lives centrally in gadfly's review-reusable.yml so it is +# tuned in ONE place. Advisory only — never blocks a merge. name: Adversarial Review (Gadfly) @@ -31,8 +29,9 @@ concurrency: jobs: review: # Security: only trusted users may trigger a secret-bearing run via a PR - # comment (pull_request + workflow_dispatch are already trusted). Mirrors - # the allowed_users input below (the in-container belt-and-suspenders check). + # comment (pull_request + workflow_dispatch are already trusted). Mirrors the + # allowed_users input below (the in-container belt-and-suspenders check) — both + # lists must stay in sync; a workflow if: can't read a workflow_call input. if: >- github.event_name != 'issue_comment' || (github.event.issue.pull_request @@ -41,19 +40,14 @@ jobs: || github.actor == 'dazed')) # Pinned to an immutable gadfly commit (not @main): a push to gadfly can't # silently change the code that runs with our forwarded secrets. - uses: steve/gadfly/.gitea/workflows/review-reusable.yml@20a5c431f22d43bab0f711c14ce74de3a735c110 - # Least privilege: forward ONLY the secrets this swarm uses (GITEA_TOKEN is auto). + uses: steve/gadfly/.gitea/workflows/review-reusable.yml@b02b11d69139843665da4cdbf776bc0b3583490d + # Least privilege: forward only the review secrets (not `secrets: inherit`, + # which would expose every repo secret). GITEA_TOKEN is the automatic token. secrets: OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }} CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }} GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }} with: - models: "minimax-m3:cloud,glm-5.2:cloud,deepseek-v4-pro:cloud,claude-code/sonnet,claude-code/opus,claude-code/opus:max" - specialists: "security,correctness,maintainability,performance,error-handling" - provider_concurrency: "ollama-cloud=3,claude-code=3" - provider_lens_concurrency: "ollama-cloud=3" - timeout_secs: "600" - max_steps: "14" + # Consumer-specific allow-list; everything else is inherited. allowed_users: "steve,fizi,dazed" - timeout_minutes: 90 diff --git a/CLAUDE.md b/CLAUDE.md index f6f1dad..148c931 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -142,9 +142,11 @@ Ship work through PRs and let Gadfly review it before merge: - **Push to a PR, never straight to `main`.** Branch, push, open a PR. `.gitea/workflows/adversarial-review.yml` runs Gadfly (the standalone - agentic adversarial reviewer) — a fleet of 6 ollama-cloud models, each - running the 3-lens suite (security, correctness, error-handling). Advisory - only; it never blocks the merge. + agentic adversarial reviewer) by subscribing to gadfly's reusable workflow + and inheriting its default swarm — 3 cloud models + the Claude Code engine + (sonnet/opus/opus:max), each running the 5-lens suite (security, correctness, + maintainability, performance, error-handling). The swarm is tuned centrally + in gadfly, not here. Advisory only; it never blocks the merge. - **Wait for Gadfly to finish, then read its output.** Don't merge while the review is still running. Each model posts one consolidated comment; weigh every finding on its merits and fix the real ones (Gadfly is a simple