teahubxyzandclaude
17e51a6b08
- beats_of/verdict/retry: trust only github-actions[bot] and owner/member/collaborator authors (forged state and stranger retries on a public repo) - touches_protected: paginate pull files and include previous_filename - browser_check: drop .git after clone, serve only the venture folder, Chrome with no network but localhost - Hands.run: execute in a docker container when a daemon exists (TIME_RUN_IMAGE), host shell fallback - tests: logins on fake comments, stranger retry/forged beat cases, paginated files fake Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6 Co-authored-by: claude <noreply@anthropic.com>
57 lines
2.4 KiB
YAML
57 lines
2.4 KiB
YAML
name: heartbeat
|
|
# Time's clock: hourly, right away when a card gets `ready` or a spec gets `spec`, and when a PR is reviewed
|
|
# (dry-run until TIME_MODE=live; merges only with TIME_AUTOMERGE=on).
|
|
on:
|
|
schedule:
|
|
- cron: "7 * * * *"
|
|
workflow_dispatch:
|
|
issues:
|
|
types: [labeled]
|
|
pull_request_review:
|
|
types: [submitted]
|
|
issue_comment:
|
|
types: [created]
|
|
permissions:
|
|
contents: write # squash-merge approved, green PRs
|
|
issues: write
|
|
pull-requests: write
|
|
checks: read
|
|
statuses: write # a Venice worker's test run is recorded as the PR's check
|
|
concurrency:
|
|
group: heartbeat
|
|
cancel-in-progress: false
|
|
jobs:
|
|
tick:
|
|
# issues: only `ready`/`spec` labels. comments: only on PRs, only a reviewer verdict (Approve/Object).
|
|
if: >-
|
|
(github.event_name != 'issues' || contains(fromJSON('["ready","spec"]'), github.event.label.name)) &&
|
|
(github.event_name != 'issue_comment' || (github.event.issue.pull_request &&
|
|
(startsWith(github.event.comment.body, '**Approve') || startsWith(github.event.comment.body, 'Approve') ||
|
|
startsWith(github.event.comment.body, '**Object') || startsWith(github.event.comment.body, 'Object'))))
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
sparse-checkout: .github/time
|
|
persist-credentials: false # the worker's shell must not find the token in .git/config
|
|
- run: python3 .github/time/time.py heartbeat
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
|
|
VENICE_API_KEY: ${{ secrets.VENICE_API_KEY }}
|
|
TIME_RUN_IMAGE: node:22-bookworm # the worker's shell runs in a throwaway container, not next to these secrets
|
|
TIME_MODE: ${{ vars.TIME_MODE }}
|
|
TIME_DAILY_CAP: ${{ vars.TIME_DAILY_CAP }}
|
|
TIME_CURSOR_MODEL: ${{ vars.TIME_CURSOR_MODEL }}
|
|
TIME_REVIEW: ${{ vars.TIME_REVIEW }}
|
|
TIME_STUCK_HOURS: ${{ vars.TIME_STUCK_HOURS }}
|
|
TIME_AUTOMERGE: ${{ vars.TIME_AUTOMERGE }}
|
|
TIME_REQUIRE_CHECKS: ${{ vars.TIME_REQUIRE_CHECKS }}
|
|
TIME_PROTECTED: ${{ vars.TIME_PROTECTED }}
|
|
TIME_PARALLEL: ${{ vars.TIME_PARALLEL }}
|
|
TIME_PLANNER: ${{ vars.TIME_PLANNER }}
|
|
TIME_WORKER: ${{ vars.TIME_WORKER }}
|
|
TIME_WORKER_STEPS: ${{ vars.TIME_WORKER_STEPS }}
|
|
TIME_WORKER_MAX_TOKENS: ${{ vars.TIME_WORKER_MAX_TOKENS }}
|