fix(workflows): standardize model/api-base-url params for custom LLM#38
Conversation
- Replace API_BASE_URL with ANTHROPIC_BASE_URL in issue-ops.yml - Replace secrets:inherit with explicit mapping in pull-request.yml - Add model input (vars.AI_MODEL) to pull-request, issue-ops, docs
ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one. |
📝 WalkthroughWalkthroughMultiple GitHub Actions workflow files and configuration are updated to pin reusable workflows and actions to a new YiAgent/OpenCI commit SHA. Secret references are renamed from ChangesYiAgent/OpenCI Dependency Update & Wiring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.gitignore (1)
41-44:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFix likely typo in
.gitignoreignore pattern (*.yaml-e→*.yml-e).The PR intent was to ignore sed-created macOS backup files with the
*.yml-esuffix, but the current.gitignoreignores*.yaml-e(line 43). If backups are truly named*.yml-e, this pattern won’t match and the backups could still be accidentally committed.🛠️ Proposed fix
# act local testing .act.env*.yml-e -*.yaml-e +*.yml-e🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.gitignore around lines 41 - 44, Replace the incorrect ignore pattern '*.yaml-e' with the intended '*.yml-e' in the .gitignore so sed-created macOS backup files with the .yml-e suffix are actually ignored; locate the existing '*.yaml-e' entry and change it to '*.yml-e' (ensure no other duplicate patterns conflict).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/issue-ops.yml:
- Around line 69-74: The workflow always passes vars.AI_MODEL to the reusable
job, ignoring a manually provided inputs.model; update the job input for model
(the "model:" under the reusable "uses: YiAgent/OpenCI/.../issue.yml"
invocation) to prefer inputs.model and fall back to vars.AI_MODEL (e.g., use an
expression that evaluates inputs.model first, then vars.AI_MODEL, then empty
string) so a workflow_dispatch with inputs.model actually overrides the
maintenance run.
In @.github/workflows/pull-request.yml:
- Around line 37-39: The reusable PR workflow lost inherited secrets by
replacing secrets: inherit with an explicit two-entry map (anthropic-api-key and
api-base-url); restore the missing optional secrets used by the reusable
workflow (codecov-token, sonar-token, snyk-token, release-pat) by either
switching back to secrets: inherit or adding explicit mappings for
codecov-token, sonar-token, snyk-token and release-pat alongside
anthropic-api-key and api-base-url so the reusable workflow
(.github/workflows/reusable/pr.yml) receives non-null values.
In `@tests/actions/on-pr-routing.bats`:
- Around line 59-60: The test "checks job passes anthropic-api-key secret"
currently only greps for the key name; update it to assert the full mapped value
so miswiring fails the test—read the ENTRY content and grep or assert that the
secret is mapped exactly to the expected value (e.g., the YAML/DSL entry for
anthropic-api-key maps to secrets.ANTHROPIC_API_KEY); modify the assertion in
the test (referencing the test name and the ENTRY variable) to check the full
mapping string rather than just the key name.
---
Outside diff comments:
In @.gitignore:
- Around line 41-44: Replace the incorrect ignore pattern '*.yaml-e' with the
intended '*.yml-e' in the .gitignore so sed-created macOS backup files with the
.yml-e suffix are actually ignored; locate the existing '*.yaml-e' entry and
change it to '*.yml-e' (ensure no other duplicate patterns conflict).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1299d86c-3fcf-4f0d-ba3e-adf0e93cdc6a
📒 Files selected for processing (15)
.github/workflows/agent.yml.github/workflows/ci.yml.github/workflows/dependencies.yml.github/workflows/deploy.yml.github/workflows/docs.yml.github/workflows/issue-ops.yml.github/workflows/observability.yml.github/workflows/on-maintenance.yml.github/workflows/pull-request.yml.github/workflows/release.yml.github/workflows/reusable/ci.yml.gitignoremanifest.ymlscripts/bump-self-sha.shtests/actions/on-pr-routing.bats
| if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance') | ||
| uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@ebe8fca3260dce68d34d51b74703169e776bc72d | ||
| uses: YiAgent/OpenCI/.github/workflows/reusable/issue.yml@be43e4efd2f14f2a3da7d5264356a9e6774c8ef1 | ||
| with: | ||
| mode: maintenance | ||
| runner: blacksmith-32vcpu-ubuntu-2404 | ||
| model: ${{ vars.AI_MODEL || '' }} |
There was a problem hiding this comment.
workflow_dispatch model override is ignored for maintenance runs.
At Line 69, manual dispatch with mode=maintenance routes to this job, but Line 74 always uses vars.AI_MODEL. That drops inputs.model even when explicitly provided.
Suggested fix
maintenance:
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance')
@@
- model: ${{ vars.AI_MODEL || '' }}
+ model: ${{ (github.event_name == 'workflow_dispatch' && inputs.model) || vars.AI_MODEL || '' }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/issue-ops.yml around lines 69 - 74, The workflow always
passes vars.AI_MODEL to the reusable job, ignoring a manually provided
inputs.model; update the job input for model (the "model:" under the reusable
"uses: YiAgent/OpenCI/.../issue.yml" invocation) to prefer inputs.model and fall
back to vars.AI_MODEL (e.g., use an expression that evaluates inputs.model
first, then vars.AI_MODEL, then empty string) so a workflow_dispatch with
inputs.model actually overrides the maintenance run.
| secrets: | ||
| anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| api-base-url: ${{ secrets.ANTHROPIC_BASE_URL }} |
There was a problem hiding this comment.
Pass the rest of the reusable PR secrets explicitly.
This two-entry map regresses the previous secrets: inherit behavior: .github/workflows/reusable/pr.yml still accepts codecov-token, sonar-token, snyk-token, and release-pat, so those integrations will now see null even when the repo secrets are configured. Please either map the remaining optional secrets here as well or narrow the reusable workflow surface in the same PR.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/pull-request.yml around lines 37 - 39, The reusable PR
workflow lost inherited secrets by replacing secrets: inherit with an explicit
two-entry map (anthropic-api-key and api-base-url); restore the missing optional
secrets used by the reusable workflow (codecov-token, sonar-token, snyk-token,
release-pat) by either switching back to secrets: inherit or adding explicit
mappings for codecov-token, sonar-token, snyk-token and release-pat alongside
anthropic-api-key and api-base-url so the reusable workflow
(.github/workflows/reusable/pr.yml) receives non-null values.
| @test "checks job passes anthropic-api-key secret" { | ||
| grep -q 'anthropic-api-key:' "$ENTRY" |
There was a problem hiding this comment.
Assert the mapped secret value, not only the key name.
At Line 60, this check passes even if anthropic-api-key is wired to the wrong secret. Assert the full mapping to secrets.ANTHROPIC_API_KEY to catch silent miswiring.
Suggested test hardening
`@test` "checks job passes anthropic-api-key secret" {
- grep -q 'anthropic-api-key:' "$ENTRY"
+ grep -Eq 'anthropic-api-key:\s*\$\{\{\s*secrets\.ANTHROPIC_API_KEY\s*\}\}' "$ENTRY"
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| @test "checks job passes anthropic-api-key secret" { | |
| grep -q 'anthropic-api-key:' "$ENTRY" | |
| `@test` "checks job passes anthropic-api-key secret" { | |
| grep -Eq 'anthropic-api-key:\s*\$\{\{\s*secrets\.ANTHROPIC_API_KEY\s*\}\}' "$ENTRY" | |
| } |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@tests/actions/on-pr-routing.bats` around lines 59 - 60, The test "checks job
passes anthropic-api-key secret" currently only greps for the key name; update
it to assert the full mapped value so miswiring fails the test—read the ENTRY
content and grep or assert that the secret is mapped exactly to the expected
value (e.g., the YAML/DSL entry for anthropic-api-key maps to
secrets.ANTHROPIC_API_KEY); modify the assertion in the test (referencing the
test name and the ENTRY variable) to check the full mapping string rather than
just the key name.
1 participant
Summary
api-base-urlsecret name:issue-ops.ymlwas usingAPI_BASE_URL, all other callers useANTHROPIC_BASE_URL. Now unified.secrets: inheritwith explicit secret mapping inpull-request.ymlto prevent silent secret name mismatches.modelinput (fromvars.AI_MODELrepo variable) topull-request.yml,issue-ops.yml, anddocs.ymlso the AI model can be configured without code changes.bump-self-sha.shto useperl -piinstead ofsed -i''for cross-platform compatibility (macOS BSD sed was creating.yml-ebackup files).grep -P(Linux-only) →grep -Ein bats tests for macOS compatibility.*.yml-eto.gitignoreto prevent future accidental commits of sed backup files.To use GLM 5.1 (or any OpenAI-compatible LLM via proxy)
Set these in repo Settings → Secrets and variables:
ANTHROPIC_API_KEYANTHROPIC_BASE_URLAI_MODELglm-4-flash)Test plan
vars.AI_MODELabsent → uses reusable workflow default (claude-sonnet-4-5-20250929)Need help on this PR? Tag
@codesmithwith what you need.Summary by CodeRabbit