Skip to content

fix(workflows): standardize model/api-base-url params for custom LLM #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
YiWang24 merged 4 commits into from
May 4, 2026
Merged

fix(workflows): standardize model/api-base-url params for custom LLM #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
eead9e5
fix(workflows): standardize model/api-base-url for custom LLM
YiWang24 May 4, 2026
f42d0b3
fix(tests): update PR routing test for explicit secret mapping
YiWang24 May 4, 2026
acb09e2
chore(manifest): bump YiAgent/OpenCI SHA to be43e4e
YiWang24 May 4, 2026
5b18a26
fix(scripts): use perl -pi for portable in-place sed on macOS/Linux
YiWang24 May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ concurrency:

jobs:
agent:
uses: YiAgent/OpenCI/.github/workflows/reusable/agent.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/agent.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
task: ${{ inputs.task }}
prompt: ${{ inputs.prompt }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ concurrency:

jobs:
ci:
uses: YiAgent/OpenCI/.github/workflows/reusable/ci.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/ci.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ github.sha }}
registry: ghcr.io
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependencies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ concurrency:

jobs:
deps:
uses: YiAgent/OpenCI/.github/workflows/reusable/deps.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/deps.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
runner: blacksmith-32vcpu-ubuntu-2404
4 changes: 2 additions & 2 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
&& github.event.workflow_run.name == 'ci'
&& github.event.workflow_run.conclusion == 'success')
|| (github.event_name == 'workflow_dispatch' && inputs.mode == 'stg')
uses: YiAgent/OpenCI/.github/workflows/reusable/stg.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/stg.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
app-name: ${{ vars.APP_NAME || github.event.repository.name }}
image-name: ${{ vars.IMAGE_NAME || github.event.repository.name }}
Expand All @@ -54,7 +54,7 @@ jobs:
&& github.event.workflow_run.name == 'release'
&& github.event.workflow_run.conclusion == 'success')
|| (github.event_name == 'workflow_dispatch' && inputs.mode == 'prd')
uses: YiAgent/OpenCI/.github/workflows/reusable/prd.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/prd.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
app-name: ${{ vars.APP_NAME || github.event.repository.name }}
image-name: ${{ vars.IMAGE_NAME || github.event.repository.name }}
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,13 +22,14 @@ concurrency:

jobs:
docs:
uses: YiAgent/OpenCI/.github/workflows/reusable/docs.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/docs.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
build-cmd: ${{ vars.DOCS_BUILD_CMD || '' }}
docs-path: ${{ vars.DOCS_DIR || 'docs' }}
site-dir: ${{ vars.DOCS_SITE_DIR || 'site' }}
enable-agent: true
runner: blacksmith-32vcpu-ubuntu-2404
model: ${{ vars.AI_MODEL || '' }}
secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }}
Expand Down
25 changes: 17 additions & 8 deletions .github/workflows/issue-ops.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ on:
type: choice
default: lifecycle
options: [lifecycle, maintenance, ingest]
model:
required: false
type: string
default: ""
description: "AI model override (e.g. glm-4-flash). Leave empty to use vars.AI_MODEL or the reusable default."

permissions:
contents: write
Expand All @@ -32,55 +37,59 @@ concurrency:
jobs:
lifecycle:
if: github.event_name == 'issues' || github.event_name == 'issue_comment'
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: lifecycle
runner: blacksmith-32vcpu-ubuntu-2404
model: ${{ vars.AI_MODEL || '' }}
secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
api-base-url: ${{ secrets.API_BASE_URL }}
api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }}
sentry-token: ${{ secrets.SENTRY_TOKEN }}
linear-token: ${{ secrets.LINEAR_TOKEN }}
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
mcp-dispatch-token: ${{ secrets.MCP_DISPATCH_TOKEN }}

ingest:
if: github.event_name == 'repository_dispatch'
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: ingest
runner: blacksmith-32vcpu-ubuntu-2404
model: ${{ vars.AI_MODEL || '' }}
secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
api-base-url: ${{ secrets.API_BASE_URL }}
api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }}
sentry-token: ${{ secrets.SENTRY_TOKEN }}
linear-token: ${{ secrets.LINEAR_TOKEN }}
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
mcp-dispatch-token: ${{ secrets.MCP_DISPATCH_TOKEN }}

maintenance:
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance')
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: maintenance
runner: blacksmith-32vcpu-ubuntu-2404
model: ${{ vars.AI_MODEL || '' }}
Comment on lines 69 to +74

@coderabbitai coderabbitai Bot May 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

workflow_dispatch model override is ignored for maintenance runs.

At Line 69, manual dispatch with mode=maintenance routes to this job, but Line 74 always uses vars.AI_MODEL. That drops inputs.model even when explicitly provided.

Suggested fix 
   maintenance:
     if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance')
@@
-      model: ${{ vars.AI_MODEL || '' }}
+      model: ${{ (github.event_name == 'workflow_dispatch' && inputs.model) || vars.AI_MODEL || '' }}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/issue-ops.yml around lines 69 - 74, The workflow always
passes vars.AI_MODEL to the reusable job, ignoring a manually provided
inputs.model; update the job input for model (the "model:" under the reusable
"uses: YiAgent/OpenCI/.../issue.yml" invocation) to prefer inputs.model and fall
back to vars.AI_MODEL (e.g., use an expression that evaluates inputs.model
first, then vars.AI_MODEL, then empty string) so a workflow_dispatch with
inputs.model actually overrides the maintenance run.

secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
api-base-url: ${{ secrets.API_BASE_URL }}
api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }}
sentry-token: ${{ secrets.SENTRY_TOKEN }}
linear-token: ${{ secrets.LINEAR_TOKEN }}
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
mcp-dispatch-token: ${{ secrets.MCP_DISPATCH_TOKEN }}

manual:
if: github.event_name == 'workflow_dispatch' && inputs.mode != 'maintenance'
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: ${{ inputs.mode }}
runner: blacksmith-32vcpu-ubuntu-2404
model: ${{ inputs.model || vars.AI_MODEL || '' }}
secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
api-base-url: ${{ secrets.API_BASE_URL }}
api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }}
sentry-token: ${{ secrets.SENTRY_TOKEN }}
linear-token: ${{ secrets.LINEAR_TOKEN }}
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/observability.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,15 +30,15 @@ concurrency:
jobs:
observe-canary:
if: ${{ github.event_name == 'schedule' && github.event.schedule == '*/15 * * * *' }}
uses: YiAgent/OpenCI/.github/workflows/reusable/observability.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/observability.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: canary-watch
runner: blacksmith-32vcpu-ubuntu-2404
secrets: inherit

observe-drift:
if: ${{ github.event_name == 'schedule' && github.event.schedule == '0 4 * * *' }}
uses: YiAgent/OpenCI/.github/workflows/reusable/observability.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/observability.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: terraform-drift
infra-dir: ${{ vars.INFRA_DIR || 'infrastructure' }}
Expand All @@ -50,7 +50,7 @@ jobs:
(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
|| github.event_name == 'repository_dispatch'
|| (github.event_name == 'workflow_dispatch' && inputs.mode == 'verify-fix')
uses: YiAgent/OpenCI/.github/workflows/reusable/observability.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/observability.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: verify-fix
runner: blacksmith-32vcpu-ubuntu-2404
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/on-maintenance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ jobs:
if: |
!contains(fromJSON('["pr-review","flag-audit"]'),
needs.resolve-mode.outputs.mode)
uses: YiAgent/OpenCI/.github/workflows/reusable/maintenance.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/maintenance.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: ${{ needs.resolve-mode.outputs.mode }}
openci-ref: ${{ needs.resolve-mode.outputs.openci-ref }}
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,12 @@ concurrency:

jobs:
checks:
uses: YiAgent/OpenCI/.github/workflows/reusable/pr.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/pr.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
enable-ai-review: true
enable-eval: true
runner: blacksmith-32vcpu-ubuntu-2404
secrets: inherit
model: ${{ vars.AI_MODEL || '' }}
secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }}
Comment on lines +37 to +39

@coderabbitai coderabbitai Bot May 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pass the rest of the reusable PR secrets explicitly.

This two-entry map regresses the previous secrets: inherit behavior: .github/workflows/reusable/pr.yml still accepts codecov-token, sonar-token, snyk-token, and release-pat, so those integrations will now see null even when the repo secrets are configured. Please either map the remaining optional secrets here as well or narrow the reusable workflow surface in the same PR.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/pull-request.yml around lines 37 - 39, The reusable PR
workflow lost inherited secrets by replacing secrets: inherit with an explicit
two-entry map (anthropic-api-key and api-base-url); restore the missing optional
secrets used by the reusable workflow (codecov-token, sonar-token, snyk-token,
release-pat) by either switching back to secrets: inherit or adding explicit
mappings for codecov-token, sonar-token, snyk-token and release-pat alongside
anthropic-api-key and api-base-url so the reusable workflow
(.github/workflows/reusable/pr.yml) receives non-null values.

2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ concurrency:

jobs:
release:
uses: YiAgent/OpenCI/.github/workflows/reusable/release.yml@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/.github/workflows/reusable/release.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
mode: ${{ inputs.mode || 'both' }}
image-name: ${{ vars.IMAGE_NAME || github.event.repository.name }}
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/reusable/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Probe secrets
Expand Down Expand Up @@ -155,7 +155,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- id: detect
Expand Down Expand Up @@ -183,7 +183,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- id: build
Expand Down Expand Up @@ -212,7 +212,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- id: scan
Expand All @@ -235,7 +235,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
Expand Down Expand Up @@ -282,7 +282,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: ./.openci/actions/ci/check-migration
Expand All @@ -305,7 +305,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: ./.openci/actions/ci/eval-smoke
Expand Down Expand Up @@ -485,7 +485,7 @@ jobs:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@ebe8fca3260dce68d34d51b74703169e776bc72d
uses: YiAgent/OpenCI/actions/_common/resolve-openci@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Download ci-context artifact
Expand Down
3 changes: 2 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,4 +39,5 @@ gate-context/
.history

# act local testing
.act.env
.act.env*.yml-e
*.yaml-e
2 changes: 1 addition & 1 deletion manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ deps:
softprops/action-gh-release: "b4309332981a82ec1c5618f44dd2e27cc8bfbfda" # v3.0.0

# ── Self (OpenCI vendoring itself via remote action reference) ──────────
YiAgent/OpenCI: "ebe8fca3260dce68d34d51b74703169e776bc72d" # resolve-openci bootstrap
YiAgent/OpenCI: "be43e4efd2f14f2a3da7d5264356a9e6774c8ef1" # resolve-openci bootstrap

# ─────────────────────────────────────────────────────────────────────────────
# Reusable workflow catalog (consumed via `uses: YiAgent/OpenCI/.github/workflows/<id>.yml@<ref>`)
Expand Down
4 changes: 2 additions & 2 deletions scripts/bump-self-sha.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,15 +95,15 @@ if [ -z "$old_sha" ]; then
die "YiAgent/OpenCI not found in manifest.yml .deps — add it manually first."
fi

sed -i'' -e "s|${old_sha}|${new_sha}|g" "$MANIFEST"
perl -pi -e "s|\Q${old_sha}\E|${new_sha}|g" "$MANIFEST"
info "Updated manifest.yml"

# ── 5. Update all workflow files that reference the old SHA ──────────────────

updated=0
while IFS= read -r -d '' f; do
if grep -q "$old_sha" "$f" 2>/dev/null; then
sed -i'' -e "s|${old_sha}|${new_sha}|g" "$f"
perl -pi -e "s|\Q${old_sha}\E|${new_sha}|g" "$f"
info "Updated $f"
updated=$((updated + 1))
fi
Expand Down
4 changes: 2 additions & 2 deletions tests/actions/on-pr-routing.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,8 @@ setup() {
grep -q 'runner:.*blacksmith-32vcpu-ubuntu-2404' "$ENTRY"
}

@test "checks job inherits secrets" {
grep -q 'secrets: inherit' "$ENTRY"
@test "checks job passes anthropic-api-key secret" {
grep -q 'anthropic-api-key:' "$ENTRY"
Comment on lines +59 to +60

@coderabbitai coderabbitai Bot May 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Assert the mapped secret value, not only the key name.

At Line 60, this check passes even if anthropic-api-key is wired to the wrong secret. Assert the full mapping to secrets.ANTHROPIC_API_KEY to catch silent miswiring.

Suggested test hardening 
 `@test` "checks job passes anthropic-api-key secret" {
-  grep -q 'anthropic-api-key:' "$ENTRY"
+  grep -Eq 'anthropic-api-key:\s*\$\{\{\s*secrets\.ANTHROPIC_API_KEY\s*\}\}' "$ENTRY"
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@test "checks job passes anthropic-api-key secret" {
grep -q 'anthropic-api-key:' "$ENTRY"
`@test` "checks job passes anthropic-api-key secret" {
grep -Eq 'anthropic-api-key:\s*\$\{\{\s*secrets\.ANTHROPIC_API_KEY\s*\}\}' "$ENTRY"
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@tests/actions/on-pr-routing.bats` around lines 59 - 60, The test "checks job
passes anthropic-api-key secret" currently only greps for the key name; update
it to assert the full mapped value so miswiring fails the test—read the ENTRY
content and grep or assert that the secret is mapped exactly to the expected
value (e.g., the YAML/DSL entry for anthropic-api-key maps to
secrets.ANTHROPIC_API_KEY); modify the assertion in the test (referencing the
test name and the ENTRY variable) to check the full mapping string rather than
just the key name.

}

# ---------------------------------------------------------------------------
Expand Down
Loading