Repository navigation

Review new commits on #458 [s7fyc] #88

Workflow file for this run

.github/workflows/pullfrog.yml at 49a9c68

	# PULLFROG ACTION — DO NOT EDIT EXCEPT WHERE INDICATED
	name: Pullfrog
	run-name: ${{ inputs.name \|\| github.workflow }}
	on:
	workflow_dispatch:
	inputs:
	prompt:
	type: string
	description: Agent prompt
	name:
	type: string
	description: Run name

	# Every run is dispatched against the default branch, so a single shared group
	# would make two reviews cancel each other. The group is keyed on the run name
	# the dispatcher passes — one group per pull request under review — so a fresh
	# review of the SAME pull request supersedes a stale one, while reviews of
	# different pull requests never collide. Without a run name the key falls back
	# to the run id, which is unique, so the group degrades to "cancel nothing".
	concurrency:
	group: ${{ github.workflow }}-${{ inputs.name \|\| github.run_id }}
	cancel-in-progress: true

	# Read-only by default: no job may write to the repository unless it says so.
	permissions:
	contents: read

	jobs:
	pullfrog:
	name: Pullfrog agent
	runs-on: ubuntu-latest
	permissions:
	# The action mints a short-lived OIDC token to prove this run's identity
	# to Pullfrog's own token service, which is how a Router or subscription
	# plan authenticates without a long-lived key stored in this repository.
	# It grants nothing on the repository itself.
	id-token: write # OIDC identity for Pullfrog's token service only.
	# Read the diff under review. Deliberately NOT `write`: the agent is
	# review-only (see `push: disabled` below) and has no commit path.
	contents: read
	steps:
	- name: Checkout code
	uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
	with:
	fetch-depth: 1
	# actions/checkout defaults to persist-credentials: true, which
	# leaves the job's GITHUB_TOKEN in .git/config. That hands the agent
	# a working push credential inside the very checkout it operates on,
	# which contradicts `push: disabled` below — the token is a write
	# path the input cannot close. Pinakes' own CI policy check refuses
	# any checkout that persists credentials, and it was right to.
	# Nothing here needs it: the agent reaches GitHub through the App's
	# installation token, and these repositories are public, so an
	# unauthenticated fetch works.
	persist-credentials: false
	- name: Run agent
	# Pinned to a commit SHA rather than the documented `@v0`, which is a
	# tag that MOVES — it has already advanced through ninety v0.1.x
	# releases. This is the one action here that runs an agent with access
	# to the repository, so a mutable ref is the last place to accept one.
	# Pullfrog's versioning page supports pinning and notes nothing is
	# lost: the action fetches its steps from npm either way, so the agent
	# still tracks patch releases without this file changing. Bump the SHA
	# to update.
	uses: pullfrog/pullfrog@0d318bef8c7cf7ae3f193ef32b2bc74e1d94b4d1 # v0.1.90
	with:
	prompt: ${{ inputs.prompt }}
	# REVIEW ONLY. `push` defaults to `enabled`, which lets the agent
	# push branches and open pull requests of its own. Every commit and
	# pull request in this repository is authored by its maintainer, so
	# the agent gets no write path: it reads the diff and comments. The
	# input is declared in the action's action.yml and is not mentioned
	# in the getting-started guide.
	push: disabled
	# Scrubs _TOKEN / _KEY / _SECRET / _PASSWORD / *_CREDENTIAL from
	# the environment the agent's shell sees. Already the default for a
	# public repository; set explicitly so that making this repository
	# private some day cannot silently widen it — private repos default
	# to `enabled`.
	shell: restricted
	env:
	# add at least one provider API key
	ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
	CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
	OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
	GOOGLE_GENERATIVE_AI_API_KEY:
	${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
	GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
	XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
	DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
	MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
	KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
	META_MODEL_API_KEY: ${{ secrets.META_MODEL_API_KEY }}
	OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
	AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }}
	OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}

	# for Amazon Bedrock (https://docs.pullfrog.com/bedrock)
	# AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
	# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	# AWS_REGION: us-east-1
	# BEDROCK_MODEL_ID: <bedrock-model-id>

	# for Google Vertex AI (https://docs.pullfrog.com/vertex)
	# VERTEX_SERVICE_ACCOUNT_JSON: >-
	# ${{ secrets.VERTEX_SERVICE_ACCOUNT_JSON }}
	# GOOGLE_CLOUD_PROJECT: my-project
	# VERTEX_LOCATION: global
	# VERTEX_MODEL_ID: <vertex-model-id>

	# for Azure OpenAI (https://docs.pullfrog.com/azure)
	# AZURE_RESOURCE_NAME is the <name> in https://<name>.openai.azure.com
	# AZURE_DEPLOYMENT is your deployment's name, not the model it serves
	# AZURE_RESOURCE_NAME: my-resource
	# AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
	# AZURE_DEPLOYMENT: <deployment-name>
	# both limits are required — set them to the real limits of that model
	# AZURE_CONTEXT: "400000"
	# AZURE_MAX_OUTPUT: "128000"

	# for any OpenAI-compatible endpoint — LiteLLM, Cloudflare AI Gateway,
	# self-hosted vLLM (https://docs.pullfrog.com/openai-compatible)
	# OPENAI_COMPATIBLE_BASE_URL: https://litellm.example.com/v1
	# OPENAI_COMPATIBLE_API_KEY: ${{ secrets.OPENAI_COMPATIBLE_API_KEY }}
	# OPENAI_COMPATIBLE_MODEL: <model-id>
	# both limits are required — set them to the real limits of that model
	# OPENAI_COMPATIBLE_CONTEXT: "128000"
	# OPENAI_COMPATIBLE_MAX_OUTPUT: "16384"

Navigation Menu

Repository navigation

Review new commits on #458 [s7fyc] #88

Workflow file

Review new commits on #458 [s7fyc] #88

Uh oh!

Workflow file for this run