Paul Rastoin
d5c7b735d2
# Introduction Getting rid of the fine grained PAT used to dispatch to internal repositories. Repo dispatch requires the contents write permissions which is too wide for such use Refactored all senders and target to pass through a workflow dispatch instead Creating a centralize app that forges a token with actions: write only provided permissions to mitigate any token exfiltrations
79 lines
2.8 KiB
YAML
79 lines
2.8 KiB
YAML
name: AI Catalog Sync
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 6 * * *' # Daily at 6 AM UTC
|
|
workflow_dispatch: # Allow manual trigger
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
sync-catalog:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
env:
|
|
NODE_OPTIONS: '--max-old-space-size=4096'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
ref: main
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/yarn-install
|
|
|
|
- name: Build dependencies
|
|
run: npx nx build twenty-shared
|
|
|
|
- name: Run catalog sync
|
|
run: npx nx run twenty-server:ts-node-no-deps-transpile-only -- ./scripts/ai-sync-models-dev.ts
|
|
|
|
- name: Check for changes
|
|
id: changes
|
|
run: |
|
|
if git diff --quiet packages/twenty-server/src/engine/metadata-modules/ai/ai-models/ai-providers.json; then
|
|
echo "changed=false" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "changed=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Create pull request
|
|
if: steps.changes.outputs.changed == 'true'
|
|
uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.6
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
commit-message: 'chore: sync AI model catalog from models.dev'
|
|
title: 'chore: sync AI model catalog from models.dev'
|
|
body: |
|
|
Automated daily sync of `ai-providers.json` from [models.dev](https://models.dev).
|
|
|
|
This PR updates pricing, context windows, and model availability based on the latest data.
|
|
New models meeting inclusion criteria (tool calling, pricing data, context limits) are added automatically.
|
|
Deprecated models are detected based on cost-efficiency within the same model family.
|
|
|
|
**Please review before merging** — verify no critical models were incorrectly deprecated.
|
|
branch: chore/ai-catalog-sync
|
|
base: main
|
|
labels: ai, automated
|
|
delete-branch: true
|
|
|
|
- name: Mint twenty-infra dispatch token
|
|
id: app-token
|
|
if: steps.changes.outputs.changed == 'true'
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ vars.TWENTY_WORKFLOW_DISPATCHER_CLIENT_ID }}
|
|
private-key: ${{ secrets.TWENTY_WORKFLOW_DISPATCHER_PRIVATE_KEY }}
|
|
owner: twentyhq
|
|
repositories: twenty-infra
|
|
permission-actions: write
|
|
|
|
- name: Trigger automerge
|
|
if: steps.changes.outputs.changed == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: |
|
|
gh workflow run automerge-i18n.yaml --repo twentyhq/twenty-infra --ref main
|