layue13
05f8fad38a
Gatekeep evals / eval-floor (push) Successful in 8s
Add .github/workflows/gatekeep-pr.yml with uses: ./ and OPENROUTER_API_KEY from secrets. Forge-agnostic API helper for Gitea.
78 lines
2.9 KiB
Markdown
78 lines
2.9 KiB
Markdown
# Gatekeep
|
||
|
||
AI-assisted PR review for **your own repos**: parallel multi-model review across **providers**, fail-closed PR risk tiers, agreed-only inline findings, blocking security check.
|
||
|
||
**中文说明：** [README.zh-CN.md](./README.zh-CN.md)
|
||
|
||
## Install (remote `uses:`)
|
||
|
||
```yaml
|
||
# .github/workflows/gatekeep.yml ← must live under .github/workflows/ on Gitea/GitHub
|
||
- uses: actions/checkout@v4
|
||
- uses: https://git.potatolab.uk/layue13/gatekeep@main
|
||
# placeholder: uses: https://git.example.com/OWNER/gatekeep@v1
|
||
env:
|
||
# Names must match providers.yaml `key` — FREE-FORM (no required gatekeep_ prefix)
|
||
OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
|
||
with:
|
||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||
```
|
||
|
||
### Dogfood (this repo)
|
||
|
||
`layue13/gatekeep` reviews **its own** PRs via [`.github/workflows/gatekeep-pr.yml`](.github/workflows/gatekeep-pr.yml) with `uses: ./` and `secrets.OPENROUTER_API_KEY`. Open a PR against `main` to see a review (Gitea Actions must have a runner — same pool as other `layue13` repos).
|
||
|
||
Allowlists / Gitea-on-github.com limitations: [`docs/remote-uses.md`](docs/remote-uses.md).
|
||
|
||
## Providers YAML
|
||
|
||
```yaml
|
||
providers:
|
||
openrouter: # only include providers you configure
|
||
key: OPENROUTER_API_KEY # free-form secret/env name — pick any
|
||
protocol: openai # openai | openai-completions | openai-responses | anthropic
|
||
# base_url: optional (defaults exist for openrouter / anthropic / openai)
|
||
models:
|
||
- google/gemma-4-31b-it:free
|
||
- google/gemma-4-26b-a4b-it:free
|
||
- cohere/north-mini-code:free
|
||
- nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free
|
||
```
|
||
|
||
| Field | Meaning |
|
||
| --- | --- |
|
||
| `key` | **Free-form** name of the GitHub secret / env var holding the API key. **No** required `gatekeep_` prefix. |
|
||
| `protocol` | `openai` \| `openai-completions` \| `openai-responses` \| `anthropic` |
|
||
| `models` | Names to use (validated against the provider’s model list API at runtime) |
|
||
| `base_url` | Optional; known provider ids get defaults |
|
||
|
||
Mix providers in one review by listing several entries. Secrets are read from the **workflow step `env`** using each entry’s `key` name.
|
||
|
||
Example suggestion only (still free-form): `key: gatekeep_openrouter` is fine if you named your secret that — not required.
|
||
|
||
## Finding format
|
||
|
||
**Severity** (Critical→Low) + **where** (`path:line`) + **why it matters**. Inline only when ≥2 models agree.
|
||
|
||
## PR risk tiers
|
||
|
||
| Tier | Humans | Auto-merge |
|
||
| --- | --- | --- |
|
||
| low | 0 after Gatekeep + security green | If kill switch on |
|
||
| medium | 1 | No |
|
||
| high | 2 | No |
|
||
|
||
## Optional consumer config
|
||
|
||
`config-dir: .github/gatekeep` with your `providers.yaml`. Omit to use Action `defaults/providers.yaml`.
|
||
|
||
## Layout
|
||
|
||
```
|
||
action.yml
|
||
scripts/ # resolve-providers.py, call-model.sh, …
|
||
defaults/providers.yaml
|
||
config/providers.yaml # example override
|
||
workflows/ templates/ evals/ incidents/ docs/
|
||
```
|