Danny Kim
e56ea246bf
Centralize ordered bot profiles and encrypted credentials in `bot-agents`. - Exposes one action input: `master-key`. - Uses Gitea’s automatic job token internally; dependent repositories provide no author/reviewer/profile inputs. - Keeps encrypted Claude and reviewer credentials in `profiles.yml`; tokenless Codex uses its persisted subscription login. - Falls back only on recognized quota exhaustion, with a distinct UID/home per profile and descendant cleanup before fallback. - Separates decryption, agent execution, and reviewer posting so privileged credentials never enter an agent process. - Installs `obra/superpowers` with the standard Skills CLI; removes custom discovery code. - Adds root-level isolation, rollback, symlink, fallback, posting, YAML, and self-workflow CI coverage. Checks: formatting, lint, all entrypoint type checks, 35 tests as root, diff check, secret scan, and repository diagnostics. Reviewed-on: #14 Co-authored-by: Danny Kim <temeddix@gmail.com> Co-committed-by: Danny Kim <temeddix@gmail.com>
65 lines
2.5 KiB
YAML
65 lines
2.5 KiB
YAML
name: Bot agents
|
|
description: Run a coding agent for approved Gitea issue/PR automation
|
|
|
|
inputs:
|
|
master-key:
|
|
description: >-
|
|
Base64url-encoded 256-bit key used to decrypt the central bot profiles
|
|
and reviewer credential.
|
|
required: true
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
# The agent works on the event's commit with full history, as the author.
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
token: ${{ gitea.token }}
|
|
# This step assumes this is `node:24-bookworm` container.
|
|
- name: Install dependencies
|
|
shell: bash
|
|
run: npm install -g @openai/codex @anthropic-ai/claude-code deno
|
|
# A local action lives inside the writable checkout. Execute a root-owned
|
|
# copy so an agent changing this repository cannot replace a later phase.
|
|
- name: Protect action source
|
|
id: source
|
|
shell: bash
|
|
env:
|
|
ACTION_PATH: ${{ gitea.action_path }}
|
|
RUNNER_TEMP: ${{ runner.temp }}
|
|
run: bash "${{ gitea.action_path }}/scripts/protect-source.sh"
|
|
- name: Allow isolated profiles to edit the checkout
|
|
shell: bash
|
|
run: chmod -R a+rwX "${GITHUB_WORKSPACE}"
|
|
- name: Prepare credentials
|
|
id: prepare
|
|
shell: bash
|
|
run: deno run -A "${{ steps.source.outputs.path }}/src/prepare.ts"
|
|
env:
|
|
ACTION_PATH: ${{ steps.source.outputs.path }}
|
|
BOT_AGENTS_MASTER_KEY: ${{ inputs.master-key }}
|
|
RUNNER_TEMP: ${{ runner.temp }}
|
|
- name: Run bot
|
|
id: agent
|
|
shell: bash
|
|
run: deno run -A "${{ steps.source.outputs.path }}/src/run.ts"
|
|
env:
|
|
BOT_AGENTS_MANIFEST: ${{ steps.prepare.outputs.manifest }}
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
GITEA_API_URL: ${{ gitea.api_url }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
EVENT_NAME: ${{ gitea.event_name }}
|
|
ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}
|
|
COMMENT: ${{ toJSON(gitea.event.comment || gitea.event.review) }}
|
|
- name: Post result and remove credentials
|
|
id: post
|
|
if: always() && steps.prepare.outputs.manifest != ''
|
|
shell: bash
|
|
run: deno run -A "${{ steps.source.outputs.path }}/src/post.ts"
|
|
env:
|
|
BOT_AGENTS_MANIFEST: ${{ steps.prepare.outputs.manifest }}
|
|
GITEA_API_URL: ${{ gitea.api_url }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
EVENT_NAME: ${{ gitea.event_name }}
|
|
ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}
|