feat(dependabot): run major-bump AI gate on GitHub Models (no external key)#6
Merged
Merged
Conversation
…ernal key) Switches the AI risk verdict from a direct OpenAI API call to GitHub Models, per the decision to reserve the OpenAI account for the chatbot/pipeline and use GitHub Models for GitHub automations (RealRate-Private#2229). - Inference now hits https://models.github.ai/inference with the built-in GITHUB_TOKEN + `models: read` permission -- NO OPENAI_API_KEY secret needed (removes the org-secret prerequisite entirely). - Model: openai/gpt-5 (GitHub Models has no Anthropic/Claude; gpt-5 is the strongest catalog model). Override via MODEL_ID. - Script keeps structured JSON output and adds a plain-response + JSON-extract fallback so it is model-agnostic, plus the same fail-closed behavior (any error => verdict=human). The OpenAI SDK is retained only as the OpenAI-compatible client library pointed at the GitHub Models endpoint. Still ships in dry-run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #5, per @Holger-Bartel's call on RealRate-Private#2229: reserve the OpenAI account for the chatbot/pipeline and use GitHub Models for GitHub automations.
What changes
Switches the major-bump AI risk verdict from a direct OpenAI API call to GitHub Models:
https://models.github.ai/inferenceusing the built-inGITHUB_TOKEN+permissions: models: read— noOPENAI_API_KEYsecret (removes the org-secret prerequisite / the wait on an admin).openai/gpt-5— GitHub Models' catalog has no Anthropic/Claude (verified live), so Opus 4.8 isn't available there;gpt-5is the strongest catalog model. Overridable viaMODEL_ID.Robustness (unchanged intent)
verdict=human.continue-on-errorkeeps a failed verdict from blocking the required check.response_format).AIGATE_DRY_RUN: "true").Note
permissions: models: readis the documented GitHub Models scope (seeactions/ai-inferenceREADME).actionlint1.7.7 flags it as unknown — a stale-linter false positive; the scope is valid.Validated:
actionlintclean (ignoring the known-stalemodels-scope rule), Python syntax, and the offline fail-closed path (no token →human).Supersedes the OpenAI-key requirement from #5. Ref RealRate-Private#2229.
🤖 Generated with Claude Code