diff --git a/.github/workflows/moviepilot-codex-ci.yml b/.github/workflows/moviepilot-codex-ci.yml new file mode 100644 index 000000000..a95ad5129 --- /dev/null +++ b/.github/workflows/moviepilot-codex-ci.yml @@ -0,0 +1,45 @@ +# CI failure intake. This job has no OpenAI or Telegram secret. +name: MoviePilot Codex CI intake + +on: + workflow_run: + workflows: + - Unit Tests + - Pylint Code Quality Check + - MoviePilot Builder v3 + types: [completed] + +permissions: + actions: write + contents: read + +jobs: + dispatch: + if: ${{ github.event.workflow_run.conclusion == 'failure' }} + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Dispatch trusted Codex CI run + shell: bash + env: + GH_TOKEN: ${{ github.token }} + TARGET_WORKFLOW: moviepilot-codex-run.yml + TARGET_REF: ${{ github.event.repository.default_branch }} + SOURCE_EVENT: workflow_run + TARGET_KIND: ci + PROMPT_NAME: ci-fix + TARGET_BRANCH: ${{ github.event.workflow_run.head_branch || github.event.repository.default_branch }} + TARGET_SHA: ${{ github.event.workflow_run.head_sha }} + TARGET_RUN_ID: ${{ github.event.workflow_run.id }} + run: | + set -euo pipefail + gh workflow run "$TARGET_WORKFLOW" \ + --repo "$GITHUB_REPOSITORY" \ + --ref "$TARGET_REF" \ + --field "prompt_name=$PROMPT_NAME" \ + --field "source_event=$SOURCE_EVENT" \ + --field "target_kind=$TARGET_KIND" \ + --field "target_number=" \ + --field "target_ref=$TARGET_BRANCH" \ + --field "target_sha=$TARGET_SHA" \ + --field "target_run_id=$TARGET_RUN_ID" diff --git a/.github/workflows/moviepilot-codex-events.yml b/.github/workflows/moviepilot-codex-events.yml new file mode 100644 index 000000000..0f2499f96 --- /dev/null +++ b/.github/workflows/moviepilot-codex-events.yml @@ -0,0 +1,41 @@ +# MoviePilot Codex event intake. This job has no OpenAI or Telegram secret. +name: MoviePilot Codex event intake + +on: + issues: + types: [opened, reopened, edited] + pull_request_target: + types: [opened, reopened, synchronize, ready_for_review, edited] + +permissions: + actions: write + contents: read + +jobs: + dispatch: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Dispatch trusted Codex run + shell: bash + env: + GH_TOKEN: ${{ github.token }} + TARGET_WORKFLOW: moviepilot-codex-run.yml + TARGET_REF: ${{ github.event.repository.default_branch }} + SOURCE_EVENT: ${{ github.event_name }} + TARGET_KIND: ${{ github.event_name == 'issues' && 'issue' || 'pull_request' }} + PROMPT_NAME: ${{ github.event_name == 'issues' && 'issue-triage' || 'pr-review' }} + TARGET_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number || '' }} + TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }} + TARGET_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + set -euo pipefail + gh workflow run "$TARGET_WORKFLOW" \ + --repo "$GITHUB_REPOSITORY" \ + --ref "$TARGET_REF" \ + --field "prompt_name=$PROMPT_NAME" \ + --field "source_event=$SOURCE_EVENT" \ + --field "target_kind=$TARGET_KIND" \ + --field "target_number=$TARGET_NUMBER" \ + --field "target_ref=$TARGET_BRANCH" \ + --field "target_sha=$TARGET_SHA" diff --git a/.github/workflows/moviepilot-codex-fix.yml b/.github/workflows/moviepilot-codex-fix.yml new file mode 100644 index 000000000..557bf0bbf --- /dev/null +++ b/.github/workflows/moviepilot-codex-fix.yml @@ -0,0 +1,39 @@ +# Manual fix dispatch. Codex receives write permissions only in the reusable workflow. +name: MoviePilot Codex fix + +on: + workflow_dispatch: + inputs: + issue_number: + description: Issue or PR number to investigate. + required: true + type: string + prompt_name: + description: issue-fix, ci-fix, or delivery. + required: false + default: issue-fix + type: string + +permissions: + contents: write + issues: write + pull-requests: write + +jobs: + codex: + uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-fix.yml@2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be + with: + control_repository: jxxghp/MoviePilot-Maintenance + control_ref: 2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be + prompt_name: ${{ inputs.prompt_name }} + codex_model: ${{ vars.CODEX_MODEL }} + codex_effort: ${{ vars.CODEX_EFFORT || 'high' }} + openai_base_url: ${{ vars.OPENAI_BASE_URL }} + publish_comments: true + autofix_enabled: ${{ vars.CODEX_AUTOFIX_ENABLED == 'true' }} + telegram_enabled: ${{ vars.TELEGRAM_ENABLED == 'true' }} + telegram_chat_id: ${{ vars.TELEGRAM_CHAT_ID }} + secrets: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + MAINTENANCE_TARGET_GH_TOKEN: ${{ secrets.MAINTENANCE_TARGET_GH_TOKEN }} + TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} diff --git a/.github/workflows/moviepilot-codex-run.yml b/.github/workflows/moviepilot-codex-run.yml new file mode 100644 index 000000000..3100f9152 --- /dev/null +++ b/.github/workflows/moviepilot-codex-run.yml @@ -0,0 +1,77 @@ +# Trusted run for jxxghp/MoviePilot. The control ref is immutable. +name: MoviePilot Codex trusted run + +on: + workflow_dispatch: + inputs: + prompt_name: + required: true + type: string + source_event: + required: true + type: string + target_kind: + required: true + type: string + target_number: + required: false + type: string + target_ref: + required: false + type: string + target_sha: + required: false + type: string + target_run_id: + required: false + type: string + +permissions: + contents: read + issues: write + pull-requests: read + +jobs: + shadow: + if: ${{ vars.CODEX_ENABLED == 'true' && vars.CODEX_PUBLISH_COMMENTS != 'true' }} + uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-event.yml@2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be + with: + control_repository: jxxghp/MoviePilot-Maintenance + control_ref: 2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be + prompt_name: ${{ inputs.prompt_name }} + codex_model: ${{ vars.CODEX_MODEL }} + codex_effort: ${{ vars.CODEX_EFFORT || 'medium' }} + openai_base_url: ${{ vars.OPENAI_BASE_URL }} + publish_comments: false + autofix_enabled: false + telegram_enabled: false + source_event: ${{ inputs.source_event }} + target_kind: ${{ inputs.target_kind }} + target_number: ${{ inputs.target_number }} + target_ref: ${{ inputs.target_ref }} + target_sha: ${{ inputs.target_sha }} + target_run_id: ${{ inputs.target_run_id }} + secrets: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + + propose: + if: ${{ vars.CODEX_ENABLED == 'true' && vars.CODEX_PUBLISH_COMMENTS == 'true' }} + uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-propose.yml@2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be + with: + control_repository: jxxghp/MoviePilot-Maintenance + control_ref: 2d9823f44bb1d31e2bbcf9bddf9d14ad2c8f35be + prompt_name: ${{ inputs.prompt_name }} + codex_model: ${{ vars.CODEX_MODEL }} + codex_effort: ${{ vars.CODEX_EFFORT || 'medium' }} + openai_base_url: ${{ vars.OPENAI_BASE_URL }} + telegram_enabled: ${{ vars.TELEGRAM_ENABLED == 'true' }} + telegram_chat_id: ${{ vars.TELEGRAM_CHAT_ID }} + source_event: ${{ inputs.source_event }} + target_kind: ${{ inputs.target_kind }} + target_number: ${{ inputs.target_number }} + target_ref: ${{ inputs.target_ref }} + target_sha: ${{ inputs.target_sha }} + target_run_id: ${{ inputs.target_run_id }} + secrets: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} diff --git a/.github/workflows/pr-agent.yml b/.github/workflows/pr-agent.yml index 0fb35e770..80fa632aa 100644 --- a/.github/workflows/pr-agent.yml +++ b/.github/workflows/pr-agent.yml @@ -1,18 +1,7 @@ name: PR-Agent on: - pull_request_target: - # Fork 审查需要目标仓库凭据；该 job 仅通过 GitHub API 读取 PR 内容，不 checkout 或执行 PR 分支代码。 - types: - - opened - - reopened - - ready_for_review - - review_requested - - synchronize - issue_comment: - types: - - created - - edited + workflow_dispatch: permissions: contents: read