oryn.yml

name: Oryn
on:
  workflow_dispatch:
    inputs:
      preflight:
        description: Check App access and planning without model calls or publication
        type: boolean
        default: true
      item:
        description: Exact issue or PR number (blank means scan)
        type: string
      comment:
        description: Exact maintainer command comment ID (requires item)
        type: string
      mode:
        description: Review or request validated repair
        type: choice
        options: [review, repair]
        default: review
      timeout:
        description: Task budget in seconds (10–3000; blank uses the repository default)
        type: string
      publish:
        description: Publish review comments and advisory labels
        type: boolean
        default: false
  schedule:
    - cron: "23 */6 * * *"
  issues:
    types: [opened, edited, reopened]
  issue_comment:
    types: [created, edited]
  # Only the trusted default branch supplies executable workflows and policy; PR source is data for the credential-free model.
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    types: [opened, synchronize, reopened, ready_for_review, edited]
permissions:
  contents: read
defaults:
  run:
    working-directory: .oryn-runtime
concurrency:
  group: ${{ (github.event_name != 'issue_comment' || github.event.comment.user.type != 'Bot') && (github.event_name == 'workflow_dispatch' || (github.event_name == 'schedule' && vars.ORYN_ENABLED == 'true') || (github.event_name != 'schedule' && vars.ORYN_EVENT_ENABLED == 'true')) && 'oryn-sweep' || format('oryn-disabled-{0}', github.run_id) }}
  cancel-in-progress: false
  queue: max
jobs:
  plan:
    if: (github.event_name != 'issue_comment' || github.event.comment.user.type != 'Bot') && (github.event_name == 'workflow_dispatch' || (github.event_name == 'schedule' && vars.ORYN_ENABLED == 'true') || (github.event_name != 'schedule' && vars.ORYN_EVENT_ENABLED == 'true'))
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    outputs:
      source-ref: ${{ steps.revision.outputs.ref }}
      matrix: ${{ steps.admit.outputs.matrix || steps.plan.outputs.matrix }}
      count: ${{ (steps.admit.outputs.count || steps.plan.outputs.count) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.event.repository.default_branch }}
          persist-credentials: false
      - id: revision
        working-directory: .
        run: echo "ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
      - uses: ./.github/actions/setup-oryn
        with:
          client-id: ${{ vars.ORYN_APP_CLIENT_ID }}
          private-key: ${{ secrets.ORYN_APP_PRIVATE_KEY }}
      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: target
        with:
          client-id: ${{ vars.ORYN_APP_CLIENT_ID }}
          private-key: ${{ secrets.ORYN_APP_PRIVATE_KEY }}
          owner: SII-Holos
          repositories: synergy
          permission-contents: read
          permission-issues: ${{ inputs.preflight == true && 'read' || 'write' }}
          permission-pull-requests: ${{ inputs.preflight == true && 'read' || 'write' }}
          permission-checks: read
          permission-statuses: read
          permission-actions: read
      - id: plan
        run: bun script/plan-workflow.ts
        env:
          ORYN_ENABLED: ${{ vars.ORYN_ENABLED }}
          ORYN_EVENT_ENABLED: ${{ vars.ORYN_EVENT_ENABLED }}
          ORYN_MODEL: ${{ vars.ORYN_MODEL || 'oryn/glm-5.3-flash' }}
          ORYN_READ_TOKEN: ${{ steps.target.outputs.token }}
          ORYN_BOT_LOGIN: ${{ steps.target.outputs.app-slug }}[bot]
          INPUT_REPOSITORY: SII-Holos/synergy
          INPUT_ITEM: ${{ inputs.item }}
          INPUT_COMMENT: ${{ inputs.comment }}
          INPUT_MODE: ${{ inputs.mode || 'review' }}
          INPUT_TIMEOUT: ${{ inputs.timeout }}
          ORYN_TASK_TIMEOUT_SECONDS: ${{ vars.ORYN_TASK_TIMEOUT_SECONDS || '1800' }}
      - if: inputs.preflight != true && (inputs.publish == true || (github.event_name == 'schedule' && vars.ORYN_SCHEDULE_PUBLISH == 'true') || (github.event_name != 'workflow_dispatch' && github.event_name != 'schedule' && vars.ORYN_EVENT_PUBLISH == 'true'))
        id: admit
        run: bun script/admit-workflow.ts
        env:
          ORYN_ALLOW_PUBLISH: "1"
          ORYN_WRITE_TOKEN: ${{ steps.target.outputs.token }}
          ORYN_BOT_LOGIN: ${{ steps.target.outputs.app-slug }}[bot]
      - if: (steps.admit.outputs.count || steps.plan.outputs.count) != '0'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan
          overwrite: true
          path: .oryn-runtime/.artifacts/
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 7
  process:
    needs: plan
    if: inputs.preflight != true && needs.plan.outputs.count != '' && needs.plan.outputs.count != '0'
    strategy:
      fail-fast: false
      max-parallel: 2
      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
    uses: ./.github/workflows/oryn-item.yml
    with:
      slug: ${{ matrix.slug }}
      number: ${{ matrix.number }}
      runtime: ${{ matrix.runtime }}
      source-ref: ${{ needs.plan.outputs.source-ref }}
      publish: ${{ inputs.publish == true || (github.event_name == 'schedule' && vars.ORYN_SCHEDULE_PUBLISH == 'true') || (github.event_name != 'workflow_dispatch' && github.event_name != 'schedule' && vars.ORYN_EVENT_PUBLISH == 'true') }}
    secrets:
      ORYN_APP_PRIVATE_KEY: ${{ secrets.ORYN_APP_PRIVATE_KEY }}
      ORYN_GLM_API_KEY: ${{ secrets.ORYN_GLM_API_KEY }}