mirror of
https://github.com/docker/docker-agent.git
synced 2026-11-06 15:07:58 +00:00
Arnaud Héritier
f78c6dd7c3
Two independent improvements to the weekly models.dev snapshot refresh (.github/workflows/update-models.yml), which previously opened PRs with an unsigned commit attributed to whoever happened to trigger the run, and a static, uninformative PR body. Signed commits --------------- Add `sign-commits: true` to the existing `peter-evans/create-pull-request` step. This builds the commit through GitHub's API instead of a local `git push`, so it is Verified regardless of which token creates it. On the default `GITHUB_TOKEN` (used explicitly via `token: github.token` for clarity) the commit author/committer becomes `github-actions[bot]` consistently, rather than the human who happened to run the workflow. `persist-credentials: false` is set on checkout as a minor hardening measure, since `create-pull-request` is given its token explicitly and never needs checkout's persisted git credential. Semantic catalog diff, no AI ----------------------------- `pkg/modelsdev/snapshot.json` is a single-line, multi-megabyte JSON file, so its raw git diff is one useless line — this is why the PR body was static. Instead: - `.github/scripts/models-delta.jq` computes a structural added/removed/changed diff between two snapshot.json files. - `.github/scripts/models-delta-render.jq` renders that diff to markdown tables, with a `safe()`/`safe_diff()` sanitiser clamping every third-party (models.dev) string to a short, bounded, control-character-free charset before it reaches the PR body — that body is consumed by this repo's automated PR-review pipeline, so untrusted text needs bounding before it gets there. - `scripts/models-delta.sh` is the single wrapper around both jq scripts; a new `task models-delta` target and the workflow's "Compute catalog delta" step both call it, so the diff logic exists in exactly one place. With no arguments it diffs HEAD's pkg/modelsdev/snapshot.json against the working tree — the same comparison the workflow makes after `task update-models`, so the local and CI code paths never drift apart. - The workflow uses the rendered markdown as the PR body/title/commit subject. The delta step is `continue-on-error: true` with a static-body fallback step, so a jq/shell bug degrades the PR text instead of silently skipping the weekly refresh. A refresh still opens a PR even when only snapshot_date.txt changed (no catalog content diff), preserving today's behaviour and avoiding any interaction with the check-models-fresh staleness test. - `scripts/models-delta-test.sh` is a golden-fixture regression test for the two jq scripts (fixtures under .github/scripts/testdata/), since they have no Go-test equivalent and only run for real, unattended, once a week. `.github/workflows/models-delta-lint.yml` runs it (plus shellcheck) as its own path-filtered workflow — mirrors the repo's existing docs-lint.yml pattern — rather than unconditionally on every PR via ci.yml's blanket lint job. - A concurrency group and a canonical-repo job guard prevent an overlapping workflow_dispatch from racing the weekly schedule run. Phase 3 of the original proposal (an LLM-written PR summary via docker/docker-agent-action) is deferred to a future change.
554 B
554 B
Added (2)
| id | name | context | in/out per Mtok | capabilities |
|---|---|---|---|---|
acme/model-c |
Model C | 500 | –/– | tools |
evil/weird??model |
Weird ? Name ?with backtick? and a very very very very very very very long tail | 1000k | $3/$6 | – |
Removed (1)
| id | name | context | in/out per Mtok | capabilities |
|---|---|---|---|---|
legacy/old-model??removed |
Old Model ? Removed ?soon? | 4k | $2/$4 | – |
Changed (1)
acme/model-a- cost:
{"input":1,"output":2}→{"input":5,"output":2}
- cost: