steve
e05bbe0b13
The pinned reusable workflow (@c9dab69d) hardcoded `docker://…/steve/gadfly:sha-b37cd09` into the step URI. That tag was never pushed to the registry, so every review in this repo failed in ~1s on "failed to resolve reference … not found" — a red workflow that reads exactly like a review which found nothing (PR #28, run 7056). @8adeeea runs the reviewer as the job container and resolves its tag per run — inputs.reviewer_tag then vars.GADFLY_REVIEWER_TAG then the baked sha-b850e35 — so the hardcoded-dead-tag failure cannot recur, and retagging the reviewer needs no commit here. Both sha-b850e35 and sha-8adeeea are present in the registry. Gadfly config is read from main, so this has to land on main to take effect for any PR's review.
69 lines
3.2 KiB
YAML
69 lines
3.2 KiB
YAML
# Gadfly adversarial review — subscribes to steve/gadfly's reusable workflow and
|
|
# INHERITS its default swarm. This stub holds only the triggers, the actor gate,
|
|
# secret forwarding, and the allow-list; the swarm config (models, lenses,
|
|
# concurrency, timeouts) lives centrally in gadfly's review-reusable.yml so it is
|
|
# tuned in ONE place. Advisory only — never blocks a merge.
|
|
|
|
name: Adversarial Review (Gadfly)
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, reopened, ready_for_review]
|
|
issue_comment:
|
|
types: [created]
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: "PR number to review"
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: gadfly-${{ github.event.issue.number || github.event.pull_request.number || github.event.inputs.pr_number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
review:
|
|
# Security: only trusted users may trigger a secret-bearing run via a PR
|
|
# comment (pull_request + workflow_dispatch are already trusted). Mirrors the
|
|
# allowed_users input below (the in-container belt-and-suspenders check) — both
|
|
# lists must stay in sync; a workflow if: can't read a workflow_call input.
|
|
if: >-
|
|
github.event_name != 'issue_comment'
|
|
|| (github.event.issue.pull_request
|
|
&& (github.actor == 'steve'
|
|
|| github.actor == 'fizi'
|
|
|| github.actor == 'dazed'))
|
|
# Pinned to an immutable gadfly commit (not @v1): our act_runners are long-lived
|
|
# and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the
|
|
# stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this
|
|
# sha to adopt central swarm changes.
|
|
#
|
|
# NB: the reviewer IMAGE tag is no longer part of this pin. From @8adeeea on,
|
|
# the reusable workflow resolves it per run as
|
|
# `inputs.reviewer_tag || vars.GADFLY_REVIEWER_TAG || 'sha-b850e35'`, so
|
|
# retagging the reviewer is a user-scope variable edit with no commit here.
|
|
# The previous pin (@c9dab69d) hardcoded `docker://…gadfly:sha-b37cd09`, a tag
|
|
# that was never pushed to the registry — every review in this repo died in
|
|
# ~1s on "failed to resolve reference … not found", which reads exactly like a
|
|
# review that found nothing. Before bumping this pin again, check the tag its
|
|
# fallback names is really in the registry.
|
|
uses: steve/gadfly/.gitea/workflows/review-reusable.yml@8adeeeabe0738a797a1bdfc42c5176ea8ee627e4
|
|
# Least privilege: forward only the review secrets (not `secrets: inherit`,
|
|
# which would expose every repo secret). GITEA_TOKEN is the automatic token.
|
|
secrets:
|
|
OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
|
|
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }}
|
|
GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }}
|
|
with:
|
|
# Consumer-specific allow-list; everything else is inherited.
|
|
allowed_users: "steve,fizi,dazed"
|
|
# Gitea >= 1.27 does not propagate dispatch inputs into a called workflow's
|
|
# github.event — thread the PR number explicitly (empty on non-dispatch events).
|
|
pr_number: ${{ github.event.inputs.pr_number }}
|