mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-10-28 06:22:22 +00:00
5d1bc3dcea
* feat(eval): measure PR cost before merge Reuse authenticated historical MCP measurements for one pinned PR preview. Keep the protected main evaluator and publish separate evidence that cannot authorize a release. * fix(eval): gate PR cost runs on a label Require a repository writer label event and retain the opt-in label and exact PR head before dispatch and paid sessions. Keep the request handler on trusted base code and execute evaluation on main. * ci: document trusted cost label trigger * fix(eval): restrict previews to maintainer labels Remove manual PR preview inputs and authorize Maintain/Admin roles before calling the protected reusable evaluator. Compare workflow measurement settings with historical evidence instead of exempting the entire workflow. --------- Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
66 lines
2.3 KiB
YAML
66 lines
2.3 KiB
YAML
name: PR cost evaluation request
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [labeled]
|
|
branches: [main]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: false
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
request:
|
|
if: >-
|
|
github.repository == 'abhigyanpatwari/GitNexus' &&
|
|
github.event.label.name == 'run-cost-evaluation' &&
|
|
github.run_attempt == 1
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
actions: read
|
|
outputs:
|
|
pr: ${{ steps.request.outputs.pr }}
|
|
sha: ${{ steps.request.outputs.sha }}
|
|
comparison_run_id: ${{ steps.request.outputs.comparison_run_id }}
|
|
run_attempt: ${{ steps.request.outputs.run_attempt }}
|
|
steps:
|
|
# pull_request_target uses trusted base code; never check out the PR here.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
persist-credentials: false
|
|
- name: Request one pinned comparison from trusted main
|
|
id: request
|
|
working-directory: eval
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
python3 -m workflow_bench.pr_evaluation dispatch-label \
|
|
--repo "$GITHUB_REPOSITORY" --event "$GITHUB_EVENT_PATH" >> "$GITHUB_OUTPUT"
|
|
echo "run_attempt=$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
|
|
|
|
evaluate:
|
|
needs: [request]
|
|
if: needs.request.outputs.run_attempt == github.run_attempt
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
actions: write
|
|
id-token: write
|
|
uses: ./.github/workflows/release-evaluation.yml
|
|
# Named forwarding also binds the callee's environment-only secrets.
|
|
secrets:
|
|
GITNEXUS_EVOLUTION_AWS_ROLE_ARN: ${{ secrets.GITNEXUS_EVOLUTION_AWS_ROLE_ARN }}
|
|
GITNEXUS_EVOLUTION_EC2_INSTANCE_ID: ${{ secrets.GITNEXUS_EVOLUTION_EC2_INSTANCE_ID }}
|
|
GITNEXUS_BENCH_OPENAI_API_KEY: ${{ secrets.GITNEXUS_BENCH_OPENAI_API_KEY }}
|
|
GITNEXUS_BENCH_ANTHROPIC_API_KEY: ${{ secrets.GITNEXUS_BENCH_ANTHROPIC_API_KEY }}
|
|
with:
|
|
candidate_pr: ${{ needs.request.outputs.pr }}
|
|
expected_pr_sha: ${{ needs.request.outputs.sha }}
|
|
comparison_run_id: ${{ needs.request.outputs.comparison_run_id }}
|