Felix FaerberandClaude Opus 5
e29b8141f8
ci / lint (pull_request) Successful in 17s
#122 gave the reusable workflow an explicit workflow_call secret contract so XAI_API_KEY would stop arriving empty. That fixed the model key and quietly broke every caller-provided skill: SECRETS_JSON is toJSON(secrets), so it now contains only the secrets this contract declares, and a skill's setup.sh finds nothing under the names its own repo uses. homelab's node1-ssh skill is the live casualty. Its setup.sh reads SWARM_HOST, SWARM_USER and SSH_PRIV_KEY_B64, takes the "not set -- skipping node1 SSH alias" path, and exits 0; the agent then loads the skill, is told it may run `ssh node1 ...`, and gets nothing. @senior hit exactly this while diagnosing the immich crash-loop in homelab #301 and had to fall back to a blind version revert. The failure is silent by design -- the skip is what lets a fork run without deploy secrets -- so nothing in the run says the capability is gone. Declaring the three optional here is the smallest fix that keeps the contract. It is not a general one: secret names for caller skills are by definition known only to the caller, and an explicit contract cannot express that, so each new caller-skill secret has to be added alongside these. Also fixes two pieces of drift that would spread the same breakage: the header still told callers to use `secrets: inherit`, and README's copy-me stub still showed it, so the next repo onboarded would have arrived with no model key. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx
34 lines
1.7 KiB
YAML
34 lines
1.7 KiB
YAML
name: ai-agent
|
|
run-name: "ai-agent · #${{ github.event.issue.number }}" # quotes required: bare # starts a YAML comment
|
|
# Standard caller for the shared AI-agent workflow (gitea/agents). Copy this file VERBATIM into
|
|
# any repo that should get the agents — it is identical in every repo. All logic + scripts live in
|
|
# agents/.gitea/workflows/; scripts are fetched from @main at run time. The `jobs.agent` wrapper is
|
|
# required: a reusable (workflow_call) workflow can only be invoked from a caller job, not top-level.
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
issues:
|
|
types: [opened]
|
|
jobs:
|
|
agent:
|
|
uses: gitea/agents/.gitea/workflows/agent.yml@main
|
|
# Explicit secret map (plus inherit) so XAI_API_KEY / OLLAMA_* always reach the reusable
|
|
# workflow. secrets: inherit alone has left XAI_API_KEY empty on some Gitea cross-owner calls.
|
|
secrets:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
OLLAMA_URL: ${{ secrets.OLLAMA_URL }}
|
|
OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
|
|
XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
|
|
TOKEN_PM: ${{ secrets.TOKEN_PM }}
|
|
TOKEN_SENIOR: ${{ secrets.TOKEN_SENIOR }}
|
|
TOKEN_JUNIOR: ${{ secrets.TOKEN_JUNIOR }}
|
|
TOKEN_LEAD: ${{ secrets.TOKEN_LEAD }}
|
|
TOKEN_QA: ${{ secrets.TOKEN_QA }}
|
|
TOKEN_OPS: ${{ secrets.TOKEN_OPS }}
|
|
TOKEN_INTERN: ${{ secrets.TOKEN_INTERN }}
|
|
# Secrets for this repo's own caller-provided skills (.gitea/agent-skills/). Unset in a repo
|
|
# that ships no such skill, which is harmless: the skill's setup.sh no-ops on an empty value.
|
|
SWARM_HOST: ${{ secrets.SWARM_HOST }}
|
|
SWARM_USER: ${{ secrets.SWARM_USER }}
|
|
SSH_PRIV_KEY_B64: ${{ secrets.SSH_PRIV_KEY_B64 }}
|