mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-26 01:12:21 +00:00
7b366fede5
The pull_request_target / issues auto-triggers always passed the LLM API key, and AGENT_SHIN_ENABLED only gated --close. In dry-run mode the script still calls the model whenever the key is present, so an external user could open/reopen PRs or issues with large bodies to drain LLM credits before the bot was ever enabled. Bind OPENAI_API_KEY to the empty string unless AGENT_SHIN_ENABLED is 'true' (workflow has opted in to model costs) or the workflow is running via workflow_dispatch (requires write access — collaborator only). The script already short-circuits with skip-no-llm-key when the key is empty, so the pre-enable rollout path for manual QA via 'gh workflow run' still works for collaborators, but auto-triggered runs from external authors cannot spend credits. |
||
|---|---|---|
| .. | ||
| codeql | ||
| ISSUE_TEMPLATE | ||
| observatory | ||
| screenshots | ||
| scripts | ||
| workflows | ||
| dependabot.yaml | ||
| deploy-to-aws.png | ||
| FUNDING.yml | ||
| pull_request_template.md | ||
| template.yaml | ||
