Repository navigation
Merge pull request #91 from simplycubed/docs/audit-fixes #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: simplycubed | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| ref: | ||
| description: Issue or pull request number, used for concurrency. | ||
| required: true | ||
| type: string | ||
| github-app-id: | ||
| description: GitHub App ID for the SimplyCubed App. | ||
| required: true | ||
| type: string | ||
| issue-number: | ||
| description: Issue number to run, when triggered from issues:labeled. | ||
| default: "" | ||
| required: false | ||
| type: string | ||
| pr-number: | ||
| description: Pull request number to address, when triggered from review submission. | ||
| default: "" | ||
| required: false | ||
| type: string | ||
| dry-run: | ||
| description: Run the whole loop but make no GitHub writes and no push. | ||
| default: false | ||
| required: false | ||
| type: boolean | ||
| comment-body: | ||
| description: Body of the comment that triggered this run, when triggered by a comment. | ||
| default: "" | ||
| required: false | ||
| type: string | ||
| actor-login: | ||
| description: Login of the labeler or review author. | ||
| required: true | ||
| type: string | ||
| azure-openai-endpoint: | ||
| description: Azure OpenAI endpoint, for example https://resource.openai.azure.com. | ||
| required: true | ||
| type: string | ||
| model: | ||
| description: Engine model or deployment name passed to the SimplyCubed CLI. | ||
| default: gpt-5.4 | ||
| required: false | ||
| type: string | ||
| version: | ||
| description: SimplyCubed CLI tag to install. | ||
| default: v0.1.6 | ||
| required: false | ||
| type: string | ||
| secrets: | ||
| azure-openai-api-key: | ||
| required: true | ||
| github-app-private-key: | ||
| required: true | ||
| jobs: | ||
| run: | ||
| if: ${{ inputs['issue-number'] != '' }} | ||
| runs-on: ubuntu-latest | ||
| concurrency: simplycubed-${{ inputs.ref }} | ||
| permissions: {} | ||
| steps: | ||
| - name: Resolve repository scope | ||
| id: repo | ||
| run: | | ||
| echo "owner=${GITHUB_REPOSITORY_OWNER}" >> "${GITHUB_OUTPUT}" | ||
| echo "name=${GITHUB_REPOSITORY#*/}" >> "${GITHUB_OUTPUT}" | ||
| - name: Mint GitHub App token | ||
| id: app-token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| with: | ||
| app-id: ${{ inputs['github-app-id'] }} | ||
| private-key: ${{ secrets['github-app-private-key'] }} | ||
| owner: ${{ steps.repo.outputs.owner }} | ||
| repositories: ${{ steps.repo.outputs.name }} | ||
| permission-contents: write | ||
| permission-issues: write | ||
| permission-pull-requests: write | ||
| - name: Check out repository | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| token: ${{ steps.app-token.outputs.token }} | ||
| - name: Set up Go | ||
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | ||
| with: | ||
| go-version: "1.26" | ||
| - name: Install SimplyCubed CLI | ||
| run: go install github.com/simplycubed/code/cmd/simplycubed@${{ inputs.version }} | ||
| - name: Preflight | ||
| env: | ||
| AZURE_OPENAI_ENDPOINT: ${{ inputs['azure-openai-endpoint'] }} | ||
| AZURE_OPENAI_API_KEY: ${{ secrets['azure-openai-api-key'] }} | ||
| run: simplycubed preflight --repo-dir . | ||
| - name: Install Codex CLI | ||
| run: npm install -g @openai/codex@0.146.0 | ||
| - name: Run SimplyCubed | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| AZURE_OPENAI_ENDPOINT: ${{ inputs['azure-openai-endpoint'] }} | ||
| AZURE_OPENAI_API_KEY: ${{ secrets['azure-openai-api-key'] }} | ||
| # --base is explicit because actions/checkout never creates origin/HEAD, | ||
| # which is the CLI's default base. The CLI resolves that case on its own | ||
| # now, but naming the branch the event came from is exact rather than | ||
| # inferred. | ||
| env: | ||
| COMMENT_BODY: ${{ inputs['comment-body'] }} | ||
| # A comment goes through the parser, which recognises a fixed vocabulary | ||
| # and does nothing otherwise. Without this every comment beginning with | ||
| # the mention would start a full run, including "help" and including a | ||
| # comment asking it NOT to proceed. | ||
| run: | | ||
| if [ -n "${COMMENT_BODY}" ]; then | ||
| simplycubed command ${{ inputs['dry-run'] && '--dry-run' || '' }} --body "${COMMENT_BODY}" "${GITHUB_REPOSITORY}#${{ inputs['issue-number'] }}" --actor "${{ inputs['actor-login'] }}" --model "${{ inputs.model }}" --base "origin/${{ github.event.repository.default_branch }}" --repo-dir . | ||
| else | ||
| simplycubed run ${{ inputs['dry-run'] && '--dry-run' || '' }} "${GITHUB_REPOSITORY}#${{ inputs['issue-number'] }}" --actor "${{ inputs['actor-login'] }}" --model "${{ inputs.model }}" --base "origin/${{ github.event.repository.default_branch }}" --repo-dir . | ||
| fi | ||
| address: | ||
| if: ${{ inputs['pr-number'] != '' }} | ||
| runs-on: ubuntu-latest | ||
| concurrency: simplycubed-${{ inputs.ref }} | ||
| permissions: {} | ||
| steps: | ||
| - name: Resolve repository scope | ||
| id: repo | ||
| run: | | ||
| echo "owner=${GITHUB_REPOSITORY_OWNER}" >> "${GITHUB_OUTPUT}" | ||
| echo "name=${GITHUB_REPOSITORY#*/}" >> "${GITHUB_OUTPUT}" | ||
| - name: Mint GitHub App token | ||
| id: app-token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| with: | ||
| app-id: ${{ inputs['github-app-id'] }} | ||
| private-key: ${{ secrets['github-app-private-key'] }} | ||
| owner: ${{ steps.repo.outputs.owner }} | ||
| repositories: ${{ steps.repo.outputs.name }} | ||
| permission-contents: write | ||
| permission-issues: write | ||
| permission-pull-requests: write | ||
| - name: Check out repository | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| token: ${{ steps.app-token.outputs.token }} | ||
| - name: Set up Go | ||
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | ||
| with: | ||
| go-version: "1.26" | ||
| - name: Install SimplyCubed CLI | ||
| run: go install github.com/simplycubed/code/cmd/simplycubed@${{ inputs.version }} | ||
| - name: Preflight | ||
| env: | ||
| AZURE_OPENAI_ENDPOINT: ${{ inputs['azure-openai-endpoint'] }} | ||
| AZURE_OPENAI_API_KEY: ${{ secrets['azure-openai-api-key'] }} | ||
| run: simplycubed preflight --repo-dir . | ||
| - name: Install Codex CLI | ||
| run: npm install -g @openai/codex@0.146.0 | ||
| - name: Address review feedback | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| AZURE_OPENAI_ENDPOINT: ${{ inputs['azure-openai-endpoint'] }} | ||
| AZURE_OPENAI_API_KEY: ${{ secrets['azure-openai-api-key'] }} | ||
| env: | ||
| COMMENT_BODY: ${{ inputs['comment-body'] }} | ||
| run: | | ||
| if [ -n "${COMMENT_BODY}" ]; then | ||
| simplycubed command ${{ inputs['dry-run'] && '--dry-run' || '' }} --body "${COMMENT_BODY}" "${GITHUB_REPOSITORY}#${{ inputs['pr-number'] }}" --actor "${{ inputs['actor-login'] }}" --model "${{ inputs.model }}" --repo-dir . | ||
| else | ||
| simplycubed address ${{ inputs['dry-run'] && '--dry-run' || '' }} "${GITHUB_REPOSITORY}#${{ inputs['pr-number'] }}" --actor "${{ inputs['actor-login'] }}" --model "${{ inputs.model }}" --repo-dir . | ||
| fi | ||
