temeddix
8c2041bbc5
The agent and the bot are now two accounts, and the runner is one Deno script. - `author-token` (was `gitea-token`): commits, pushes, and opens pull requests; the agent sees it as `GITEA_TOKEN`, and commits use that account's login and email. - `reviewer-token`: posts comments and reviews as the bot; withheld from the agent's environment so it can never approve as the bot. - A `pull_request` run posts a review instead of a comment: `REQUEST_CHANGES` when the response mentions `@bot`, `COMMENT` when the run failed, `APPROVED` otherwise. Gitea refuses self-approval, so the two accounts must differ. - The reviewer checks the whole repository against `commons/code-rules`, which is fetched and embedded in the prompt, and requests changes for violations even when the diff did not cause them. - `run.ts` replaces the three shell scripts plus `jq`, `envsubst`, and `ansifilter`; only `deno` is added to the install step, per the rules' Deno-over-Node policy. A `.gitea` workflow runs `deno fmt`, `lint`, and `check`. Callers must rename `gitea-token` and add `reviewer-token` (`write:issue` and `write:repository` scopes). A rejection stays until the bot reviews again, so callers that want it lifted after a fix should trigger on `pull_request: [opened, synchronize]`. Verified with a fake `claude` binary against this PR in an isolated `HOME`: git author configured from the token, prompt rendered with rules and comment history, events streamed, reviewer token absent from the agent's environment, review posted (then deleted). Reviewed-on: #1 Co-authored-by: Danny Kim <temeddix@gmail.com> Co-committed-by: Danny Kim <temeddix@gmail.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
name: Bot agents
|
|
description: Run a coding agent for approved Gitea issue/PR automation
|
|
|
|
inputs:
|
|
bot-type:
|
|
description: Which bot to run, either `codex` or `claude`
|
|
required: true
|
|
author-token:
|
|
description: >-
|
|
Gitea token of the account that commits, pushes, and opens pull requests,
|
|
with the `read:user`, `write:issue`, and `write:repository` scopes. The
|
|
agent sees it as `GITEA_TOKEN`.
|
|
required: true
|
|
reviewer-token:
|
|
description: >-
|
|
Gitea token of the bot account that posts comments and pull request
|
|
reviews, with the `write:issue` and `write:repository` scopes. Never
|
|
exposed to the agent, so it must differ from the author.
|
|
required: true
|
|
bot-token:
|
|
description: API key or token for the selected bot
|
|
required: false
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
# This step assumes this is `node:24-bookworm` container.
|
|
- name: Install dependencies
|
|
shell: bash
|
|
run: npm install -g @openai/codex @anthropic-ai/claude-code deno
|
|
- name: Run bot
|
|
shell: bash
|
|
run: deno run -A "${ACTION_PATH}/run.ts"
|
|
env:
|
|
ACTION_PATH: ${{ gitea.action_path }}
|
|
BOT_TYPE: ${{ inputs.bot-type }}
|
|
BOT_TOKEN: ${{ inputs.bot-token }}
|
|
GITEA_API_URL: ${{ gitea.api_url }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
GITEA_TOKEN: ${{ inputs.author-token }}
|
|
REVIEWER_TOKEN: ${{ inputs.reviewer-token }}
|
|
EVENT_NAME: ${{ gitea.event_name }}
|
|
ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}
|
|
COMMENT: ${{ toJSON(gitea.event.comment || gitea.event.review) }}
|