diff --git a/.changes/pr-pipeline/feat-intake-on-run-claude-cli-4237677a.md b/.changes/pr-pipeline/feat-intake-on-run-claude-cli-4237677a.md new file mode 100644 index 0000000000..3f26c4cb54 --- /dev/null +++ b/.changes/pr-pipeline/feat-intake-on-run-claude-cli-4237677a.md @@ -0,0 +1,11 @@ +--- +bump: minor +--- + +### Added + +- `funding`, a map from Claude lane id to its funding role (`reviews`, `automations` or + `issue-lane`), whose `_CLAUDE_API_KEY` and `_CLAUDE_CODE_OAUTH_TOKEN` secrets a lane + on ci-workflows' run-claude-cli action passes; intake is the first, and the other entries name + the role each lane takes when it moves ([README.md, Funding](https://github.com/melodic-software/claude-code-plugins/blob/main/docs/conventions/pr-pipeline/README.md#funding)). + `version` stays 2. diff --git a/.github/workflows/intake-triage.yml b/.github/workflows/intake-triage.yml index caed8631b7..d1b2410e4e 100644 --- a/.github/workflows/intake-triage.yml +++ b/.github/workflows/intake-triage.yml @@ -127,12 +127,14 @@ jobs: concurrency: group: intake-triage-${{ github.event.issue.number || inputs.issue-number || github.run_id }} cancel-in-progress: false - uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@ff8cd36321423de961381e608e4a31563e74adb3 # v0.49.0 + uses: melodic-software/ci-workflows/.github/workflows/intake-triage.yml@f129f4c142d00ec3feacbf2b9102d327088504bf # v0.51.0 with: runner: ubuntu-24.04 + role: automations claude-args: ${{ needs.born-triaged.outputs.claude-args }} issue-number: ${{ inputs.issue-number }} allowed-author-ids: ${{ needs.born-triaged.outputs.human-ids }} allowed-bot-sender-ids: ${{ needs.born-triaged.outputs.bot-ids }} secrets: - CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + CLAUDE_API_KEY: ${{ secrets.AUTOMATIONS_CLAUDE_API_KEY }} + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.AUTOMATIONS_CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/docs/conventions/pr-pipeline.yaml b/docs/conventions/pr-pipeline.yaml index 58d79bb13f..8d65d34655 100644 --- a/docs/conventions/pr-pipeline.yaml +++ b/docs/conventions/pr-pipeline.yaml @@ -349,6 +349,20 @@ models: # work-resolve-issue's read-only pass that describes a reused lane branch. summarize-reuse: summary +# The funding role whose secrets pay for each Claude lane's runs (README.md, +# Funding). A lane on ci-workflows' run-claude-cli action (today only intake) +# passes its role with _CLAUDE_API_KEY and _CLAUDE_CODE_OAUTH_TOKEN, +# role upper-snake; the others are the role each lane takes when it moves there. +funding: + intake: automations + pr-unblock: automations + fix-ci: automations + pr-verify: automations + pr-refine: automations + claude-review: reviews + claude-security-review: reviews + work-resolve-issue: issue-lane + loop: review-rounds: 3 dependency-review-rounds: 2 diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md index 74e5330c46..2ceae129af 100644 --- a/docs/conventions/pr-pipeline/README.md +++ b/docs/conventions/pr-pipeline/README.md @@ -13,6 +13,7 @@ - [Trust-root paths](#trust-root-paths) - [The lane sweep](#the-lane-sweep) - [Models](#models) +- [Funding](#funding) - [Loop caps](#loop-caps) - [Limits](#limits) - [Planning lane work](#planning-lane-work) @@ -954,6 +955,21 @@ every skill activity's; `review` (`opus`, 60 turns, no effort), the verifier's; 30 turns), intake triage's and the [lane sweep](#the-lane-sweep)'s; and `summary` (`sonnet`, effort `medium`, 10 turns), the reuse summary pass's. +## Funding + +`funding` maps each Claude lane or activity id to the funding role whose secrets pay for its runs: +`reviews`, `automations` or `issue-lane`. A lane on ci-workflows' `run-claude-cli` action passes +its role with the role's two secrets, `_CLAUDE_API_KEY` and `_CLAUDE_CODE_OAUTH_TOKEN` +(role upper-snake, so `issue-lane` gives `ISSUE_LANE_`); the action tries the key first and the +subscription token only after a credit stop. No workflow reads the map; each lane's workflow names +its role and secrets, and the runner policy admits them. This repository's map: `intake`, +`pr-unblock`, `fix-ci`, `pr-verify` and `pr-refine` take `automations`; `claude-review` and +`claude-security-review` take `reviews`; `work-resolve-issue` takes `issue-lane`. + +Only `intake` runs on `run-claude-cli` today. Every other entry is the role its lane takes when it +moves there: until then it runs claude-code-action with an OAuth token alone, and it never gets an +API key, since claude-code-action runs are not paid from API credits. + ## Loop caps One counter per PR, in the findings store, is shared by every lane. After `loop.review-rounds` diff --git a/docs/conventions/pr-pipeline/pr-pipeline.schema.json b/docs/conventions/pr-pipeline/pr-pipeline.schema.json index 7ae3d00c3b..32cccf2846 100644 --- a/docs/conventions/pr-pipeline/pr-pipeline.schema.json +++ b/docs/conventions/pr-pipeline/pr-pipeline.schema.json @@ -132,7 +132,13 @@ } }, "merge": { "$ref": "#/$defs/merge" }, - "models": { "$ref": "#/$defs/models" } + "models": { "$ref": "#/$defs/models" }, + "funding": { + "type": "object", + "propertyNames": { "$ref": "#/$defs/name" }, + "additionalProperties": { "enum": ["reviews", "automations", "issue-lane"] }, + "description": "Claude lane id -> the funding role whose secrets pay for its runs. The lane passes the role to run-claude-cli with _CLAUDE_API_KEY and _CLAUDE_CODE_OAUTH_TOKEN, role upper-snake (README.md, Funding)." + } }, "$defs": { "name": {