From d0f0d485a61ba66554dcb61534fe3294b20681e2 Mon Sep 17 00:00:00 2001 From: Dan Lapid Date: Mon, 28 Sep 2026 11:28:51 -0400 Subject: [PATCH] ci: track ask-bonk main and keep Bonk inside the job timeout Use Cloudflare-Studio/ask-bonk/github@main, like most repositories. Stop Bonk five minutes before the job's 30-minute limit so it reports the outcome itself, and deny opencode paths outside the checkout instead of prompting, which nothing can answer in CI. --- .github/workflows/bonk.yml | 7 +++++-- .github/workflows/new-pr-review.yml | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/bonk.yml b/.github/workflows/bonk.yml index 2c9678cf..c2cbaade 100644 --- a/.github/workflows/bonk.yml +++ b/.github/workflows/bonk.yml @@ -29,13 +29,16 @@ jobs: fetch-depth: 1 - name: Run Bonk - uses: Cloudflare-Studio/ask-bonk/github@45777ce774209af96f27cbb5718234cf7fc93474 # v0.5.0 + uses: Cloudflare-Studio/ask-bonk/github@main env: CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_AI_GATEWAY_ACCOUNT_ID }} CLOUDFLARE_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_NAME }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_TOKEN }} - OPENCODE_CONFIG_CONTENT: '{"permission":{"external_directory":{"/home/runner/work/**":"allow"},"question":"deny","doom_loop":"deny"}}' + # Paths outside the checkout are denied, not prompted: nobody can answer a prompt in CI. + OPENCODE_CONFIG_CONTENT: '{"permission":{"external_directory":{"*":"deny","/home/runner/work/**":"allow"},"question":"deny","doom_loop":"deny"}}' with: + # Stop Bonk before the job's timeout-minutes so it can report the outcome itself. + timeout: '25m' oidc_base_url: https://ask-bonk.cloudflare-exponent.workers.dev/auth model: 'cloudflare-ai-gateway/openai/gpt-5.6-sol' mentions: '/bonk,@ask-bonk' diff --git a/.github/workflows/new-pr-review.yml b/.github/workflows/new-pr-review.yml index 83fd4bdc..8c93c6fb 100644 --- a/.github/workflows/new-pr-review.yml +++ b/.github/workflows/new-pr-review.yml @@ -35,13 +35,16 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Run Bonk - uses: Cloudflare-Studio/ask-bonk/github@45777ce774209af96f27cbb5718234cf7fc93474 # v0.5.0 + uses: Cloudflare-Studio/ask-bonk/github@main env: CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_AI_GATEWAY_ACCOUNT_ID }} CLOUDFLARE_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_NAME }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_TOKEN }} - OPENCODE_CONFIG_CONTENT: '{"permission":{"external_directory":{"/home/runner/work/**":"allow"},"question":"deny","doom_loop":"deny"}}' + # Paths outside the checkout are denied, not prompted: nobody can answer a prompt in CI. + OPENCODE_CONFIG_CONTENT: '{"permission":{"external_directory":{"*":"deny","/home/runner/work/**":"allow"},"question":"deny","doom_loop":"deny"}}' with: + # Stop Bonk before the job's timeout-minutes so it can report the outcome itself. + timeout: '25m' oidc_base_url: https://ask-bonk.cloudflare-exponent.workers.dev/auth model: 'cloudflare-ai-gateway/openai/gpt-5.6-terra' forks: 'false'