pullfrog.yml

# PULLFROG ACTION — DO NOT EDIT EXCEPT WHERE INDICATED
# reads branch from .branch file and builds action from that branch
# pullfrog-sync: uses=./.pullfrog-action/action
name: Pullfrog
run-name: ${{ inputs.name || github.workflow }}
on:
  workflow_dispatch:
    inputs:
      prompt:
        type: string
        description: Agent prompt
      name:
        type: string
        description: Run name
      unsafe_overrides:
        type: string
        description: 'JSON env overrides splatted into the action process. UNSAFE: echoed in plaintext in the step header. e2e/debug only.'

permissions:
  id-token: write
  contents: write
  pull-requests: write
  issues: write
  actions: read
  checks: read

jobs:
  pullfrog:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      # pullfrog-sync: prepare-start
      # clone pullfrog/app with the forwarded GH_TOKEN rather than a cross-repo
      # installation-token mint: since pullfrog/app#1272 those mints require an
      # xrepo grant persisted at Pullfrog dispatch, which a preview repo's
      # hand-dispatched run never has.
      - name: Read branch
        id: config
        run: |
          if [ -f .branch ]; then
            echo "branch=$(cat .branch)" >> $GITHUB_OUTPUT
          else
            echo "branch=main" >> $GITHUB_OUTPUT
          fi

      - name: Checkout pullfrog/app action
        run: |
          for i in 1 2 3; do
            git clone --depth 1 --branch "${{ steps.config.outputs.branch }}" \
              "https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/pullfrog/app.git" \
              /tmp/pullfrog-app && break
            echo "Clone attempt $i failed, retrying in 5s..."
            sleep 5
          done
          echo "Checked out pullfrog/app at $(git -C /tmp/pullfrog-app rev-parse HEAD)"

      - uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Build action
        working-directory: /tmp/pullfrog-app/action
        run: |
          # use corepack to read pnpm version from the action repo's own
          # package.json. avoids pnpm/action-setup, which only looks at
          # the preview repo's package.json and breaks when it declares
          # `packageManager`. see PR #844 e2e investigation.
          corepack enable
          pnpm install --frozen-lockfile
          pnpm build

      - name: Copy built action to workspace
        run: |
          rm -rf .pullfrog-action
          mkdir -p .pullfrog-action
          cp -r /tmp/pullfrog-app/action .pullfrog-action/action

      # pullfrog-sync: prepare-end
      - name: Run agent
        uses: ./.pullfrog-action/action
        with:
          prompt: ${{ inputs.prompt }}
        env:
          # per-dispatch env mutation — see wiki/e2e-testing.md
          UNSAFE_OVERRIDES: ${{ inputs.unsafe_overrides }}
          # force local action execution so the PR branch's source is exercised
          # instead of the published npm fallback (see AGENTS.md, wiki/preview-repo.md)
          PULLFROG_FORCE_LOCAL_CLI: "1"
          API_URL: ${{ secrets.API_URL }}
          VERCEL_AUTOMATION_BYPASS_SECRET: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
          # add any additional keys your agent(s) need
          # optionally, comment out any you won't use
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
          MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          # Amazon Bedrock — bearer token inherited from pullfrog org secrets
          # (visibility: all). region + model id are non-sensitive config and
          # default to Opus 4.6 (US); override per preview repo via
          # `gh variable set <NAME> -R pullfrog/preview-<PR>-<branch>` when
          # testing other regions or model ids. see https://docs.pullfrog.com/bedrock.
          AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
          AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
          BEDROCK_MODEL_ID: ${{ vars.BEDROCK_MODEL_ID || 'us.anthropic.claude-opus-4-6-v1' }}
          # Google Vertex AI — service account JSON inherited from pullfrog org secrets
          # (visibility: all). project/location/model id are non-sensitive config and
          # default to pullfrog/global/Gemini Flash; override per preview repo via
          # `gh variable set <NAME> -R pullfrog/preview-<PR>-<branch>` when needed.
          VERTEX_SERVICE_ACCOUNT_JSON: ${{ secrets.VERTEX_SERVICE_ACCOUNT_JSON }}
          GOOGLE_CLOUD_PROJECT: ${{ vars.GOOGLE_CLOUD_PROJECT || 'pullfrog' }}
          VERTEX_LOCATION: ${{ vars.VERTEX_LOCATION || 'global' }}
          VERTEX_MODEL_ID: ${{ vars.VERTEX_MODEL_ID || 'gemini-2.5-flash' }}
          # escape hatches for ad-hoc e2e overrides via repo Actions variables
          PULLFROG_MODEL: ${{ vars.PULLFROG_MODEL }}
          PULLFROG_AGENT: ${{ vars.PULLFROG_AGENT }}