mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-27 17:58:07 +00:00
957ea640de
* fix(ci): publish inline E2E evidence Upload bounded screenshot evidence from E2E, then publish validated images from a trusted workflow_run job to commit-pinned branches in the evidence repo. Wait briefly for the live CI review comment marker before publishing, so GitHub's read-after-write delay cannot leave an orphaned evidence branch. * fix(ci): isolate privileged credentials from PR jobs Keep App private keys and Docker Hub credentials out of PR-controlled workflows. Use protected environments for trusted publishing and a public repository variable for the App client ID. * fix(ci): attach E2E evidence with restricted bot session Replace the App-backed evidence repository publisher with gh-image uploads from a dedicated bot session in the gh-image environment. * fix(ci): publish validated E2E evidence from forks Let the trusted default-branch publisher handle bounded, validated evidence artifacts from fork PR CI without checking out or executing fork code.
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
name: Build Skills Index
|
|
|
|
on:
|
|
schedule:
|
|
# Run twice daily: 6 AM and 6 PM UTC
|
|
- cron: "0 6,18 * * *"
|
|
workflow_dispatch: # Manual trigger
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "scripts/build_skills_index.py"
|
|
- ".github/workflows/skills-index.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: write # to trigger deploy-site.yml on schedule
|
|
|
|
jobs:
|
|
build-index:
|
|
# Only run on the upstream repository, not on forks
|
|
if: github.repository == 'NousResearch/hermes-agent'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: trusted-automation
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Get GitHub App token
|
|
id: app-token
|
|
uses: ./.github/actions/get-app-token
|
|
with:
|
|
client-id: ${{ vars.APP_CLIENT_ID }}
|
|
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: "3.11"
|
|
|
|
- name: Install dependencies
|
|
uses: ./.github/actions/retry
|
|
with:
|
|
command: pip install httpx==0.28.1 pyyaml==6.0.2
|
|
|
|
- name: Build skills index
|
|
env:
|
|
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: python scripts/build_skills_index.py
|
|
|
|
- name: Upload index artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: skills-index
|
|
path: website/static/api/skills-index.json
|
|
retention-days: 7
|
|
|
|
# Re-trigger the docs deploy so the refreshed index lands on the live site.
|
|
# The deploy itself is owned by deploy-site.yml (which crawls and deploys
|
|
# everything in one pipeline); we just kick it on a schedule.
|
|
trigger-deploy:
|
|
needs: build-index
|
|
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: trusted-automation
|
|
steps:
|
|
- name: Get GitHub App token
|
|
id: app-token
|
|
uses: ./.github/actions/get-app-token
|
|
with:
|
|
client-id: ${{ vars.APP_CLIENT_ID }}
|
|
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
- name: Trigger Deploy Site workflow
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
run: gh workflow run deploy-site.yml --repo ${{ github.repository }} -f skills_index_run_id=${{ github.run_id }}
|