Centralize encrypted bot profiles

action.yml

@@ -2,30 +2,11 @@ name: Bot agents
 description: Run a coding agent for approved Gitea issue/PR automation
 
 inputs:
-  bot-type:
-    description: Which bot to run, either `codex` or `claude`
-    required: true
-  author-token:
+  master-key:
     description: >-
-      Gitea token of the account that commits, pushes, and opens pull requests,
-      with the `read:user`, `write:issue`, and `write:repository` scopes. The
-      agent sees it as `GITEA_TOKEN`.
+      Base64url-encoded 256-bit key used to decrypt the central bot profiles
+      and reviewer credential.
     required: true
-  reviewer-token:
-    description: >-
-      Gitea token of the bot account that posts comments and pull request
-      reviews, with the `write:issue` and `write:repository` scopes. Never
-      exposed to the agent, so it must differ from the author.
-    required: true
-  bot-token:
-    description: API key or token for the selected bot
-    required: false
-  model:
-    description: >-
-      Model for the selected bot. Defaults to `claude-sonnet-5` or
-      `gpt-5.6-terra`, the mid tiers, which cover reviews and fixes.
-    required: false
-
 runs:
   using: composite
   steps:
@@ -33,23 +14,51 @@ runs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-        token: ${{ inputs.author-token }}
+        token: ${{ gitea.token }}
     # This step assumes this is `node:24-bookworm` container.
     - name: Install dependencies
       shell: bash
       run: npm install -g @openai/codex @anthropic-ai/claude-code deno
-    - name: Run bot
+    # A local action lives inside the writable checkout. Execute a root-owned
+    # copy so an agent changing this repository cannot replace a later phase.
+    - name: Protect action source
+      id: source
       shell: bash
-      run: deno run -A "${ACTION_PATH}/run.ts"
       env:
         ACTION_PATH: ${{ gitea.action_path }}
-        BOT_TYPE: ${{ inputs.bot-type }}
-        BOT_TOKEN: ${{ inputs.bot-token }}
-        MODEL: ${{ inputs.model }}
+        RUNNER_TEMP: ${{ runner.temp }}
+      run: bash "${{ gitea.action_path }}/scripts/protect-source.sh"
+    - name: Allow isolated profiles to edit the checkout
+      shell: bash
+      run: chmod -R a+rwX "${GITHUB_WORKSPACE}"
+    - name: Prepare credentials
+      id: prepare
+      shell: bash
+      run: deno run -A "${{ steps.source.outputs.path }}/src/prepare.ts"
+      env:
+        ACTION_PATH: ${{ steps.source.outputs.path }}
+        BOT_AGENTS_MASTER_KEY: ${{ inputs.master-key }}
+        RUNNER_TEMP: ${{ runner.temp }}
+    - name: Run bot
+      id: agent
+      shell: bash
+      run: deno run -A "${{ steps.source.outputs.path }}/src/run.ts"
+      env:
+        BOT_AGENTS_MANIFEST: ${{ steps.prepare.outputs.manifest }}
+        GITEA_TOKEN: ${{ gitea.token }}
         GITEA_API_URL: ${{ gitea.api_url }}
         GITEA_REPOSITORY: ${{ gitea.repository }}
-        GITEA_TOKEN: ${{ inputs.author-token }}
-        REVIEWER_TOKEN: ${{ inputs.reviewer-token }}
         EVENT_NAME: ${{ gitea.event_name }}
         ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}
         COMMENT: ${{ toJSON(gitea.event.comment || gitea.event.review) }}
+    - name: Post result and remove credentials
+      id: post
+      if: always() && steps.prepare.outputs.manifest != ''
+      shell: bash
+      run: deno run -A "${{ steps.source.outputs.path }}/src/post.ts"
+      env:
+        BOT_AGENTS_MANIFEST: ${{ steps.prepare.outputs.manifest }}
+        GITEA_API_URL: ${{ gitea.api_url }}
+        GITEA_REPOSITORY: ${{ gitea.repository }}
+        EVENT_NAME: ${{ gitea.event_name }}
+        ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}