Phase 1: auditor (audit-task.sh + Gitea Actions workflow); runner crash-loop fix documented
This commit is contained in:
danny8632
176
agents/audit-task.sh
Executable file
176
agents/audit-task.sh
Executable file
@@ -0,0 +1,176 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# audit-task.sh <owner>/<repo> <pr-number>
|
||||||
|
#
|
||||||
|
# Reads a Gitea PR, finds the linked issue (via "Resolves #N" in the PR body),
|
||||||
|
# asks claude to audit the diff against the issue's done criteria, and posts
|
||||||
|
# a structured review comment on the PR.
|
||||||
|
#
|
||||||
|
# Env knobs:
|
||||||
|
# MODEL default sonnet (the auditor's model)
|
||||||
|
# MAX_WALLCLOCK default 10m
|
||||||
|
# GITEA_URL default https://gitea.dannyhaslund.dk
|
||||||
|
# GITEA_TOKEN_FILE default /etc/agent/gitea-token
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
REPO="${1:-}"
|
||||||
|
PR_NUM="${2:-}"
|
||||||
|
[[ -z "$REPO" || -z "$PR_NUM" ]] && { echo "usage: $0 <owner>/<repo> <pr-number>" >&2; exit 64; }
|
||||||
|
|
||||||
|
MODEL="${MODEL:-sonnet}"
|
||||||
|
MAX_WALLCLOCK="${MAX_WALLCLOCK:-10m}"
|
||||||
|
GITEA_URL="${GITEA_URL:-https://gitea.dannyhaslund.dk}"
|
||||||
|
GITEA_TOKEN_FILE="${GITEA_TOKEN_FILE:-/etc/agent/gitea-token}"
|
||||||
|
LOG_ROOT="${LOG_ROOT:-/var/agent/logs}"
|
||||||
|
|
||||||
|
[[ -r "$GITEA_TOKEN_FILE" ]] || { echo "missing $GITEA_TOKEN_FILE" >&2; exit 65; }
|
||||||
|
GITEA_TOKEN="$(cat "$GITEA_TOKEN_FILE")"
|
||||||
|
|
||||||
|
mkdir -p "$LOG_ROOT"
|
||||||
|
LOG_FILE="$LOG_ROOT/audit-pr${PR_NUM}-$(date -u +%Y%m%dT%H%M%S).log"
|
||||||
|
log() { printf '[%s] %s\n' "$(date -u +%H:%M:%S)" "$*" | tee -a "$LOG_FILE"; }
|
||||||
|
|
||||||
|
# ---------- 1. Fetch PR ----------
|
||||||
|
log "Fetching PR $REPO#$PR_NUM"
|
||||||
|
pr="$(curl -fsS -H "Authorization: token $GITEA_TOKEN" "$GITEA_URL/api/v1/repos/$REPO/pulls/$PR_NUM")"
|
||||||
|
pr_title="$(jq -r .title <<<"$pr")"
|
||||||
|
pr_body="$(jq -r .body <<<"$pr")"
|
||||||
|
pr_head="$(jq -r .head.ref <<<"$pr")"
|
||||||
|
pr_base="$(jq -r .base.ref <<<"$pr")"
|
||||||
|
|
||||||
|
# ---------- 2. Find linked issue ----------
|
||||||
|
issue_num="$(grep -oiE '(resolves|closes|fixes)\s+#[0-9]+' <<<"$pr_body" | head -1 | grep -oE '[0-9]+' || true)"
|
||||||
|
if [[ -n "$issue_num" ]]; then
|
||||||
|
log "Linked issue: #$issue_num"
|
||||||
|
issue_body="$(curl -fsS -H "Authorization: token $GITEA_TOKEN" \
|
||||||
|
"$GITEA_URL/api/v1/repos/$REPO/issues/$issue_num" | jq -r .body)"
|
||||||
|
else
|
||||||
|
log "WARN: no linked issue found in PR body; auditing against PR description only"
|
||||||
|
issue_body="(no linked issue; audit against PR description and general code quality)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ---------- 3. Get diff ----------
|
||||||
|
DIFF_FILE="$(mktemp)"
|
||||||
|
trap 'rm -f "$DIFF_FILE" "$AUDIT_OUT" 2>/dev/null' EXIT
|
||||||
|
|
||||||
|
curl -fsS -H "Authorization: token $GITEA_TOKEN" \
|
||||||
|
"$GITEA_URL/api/v1/repos/$REPO/pulls/$PR_NUM.diff" > "$DIFF_FILE"
|
||||||
|
|
||||||
|
diff_size="$(wc -c < "$DIFF_FILE")"
|
||||||
|
log "Diff size: $diff_size bytes"
|
||||||
|
|
||||||
|
# Truncate to 32 KB if too large
|
||||||
|
if [[ $diff_size -gt 32768 ]]; then
|
||||||
|
log "Truncating diff to 32 KB for claude"
|
||||||
|
head -c 32768 "$DIFF_FILE" > "${DIFF_FILE}.trim"
|
||||||
|
echo -e "\n\n[... diff truncated at 32KB ...]" >> "${DIFF_FILE}.trim"
|
||||||
|
mv "${DIFF_FILE}.trim" "$DIFF_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ---------- 4. Audit via claude ----------
|
||||||
|
SCHEMA='{
|
||||||
|
"type": "object",
|
||||||
|
"required": ["verdict", "summary", "criteria"],
|
||||||
|
"properties": {
|
||||||
|
"verdict": { "type": "string", "enum": ["approve", "request_changes", "comment"] },
|
||||||
|
"summary": { "type": "string", "minLength": 10 },
|
||||||
|
"criteria": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"required": ["criterion", "status"],
|
||||||
|
"properties": {
|
||||||
|
"criterion": { "type": "string" },
|
||||||
|
"status": { "type": "string", "enum": ["pass", "fail", "unclear"] },
|
||||||
|
"note": { "type": "string" }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"issues_found": { "type": "array", "items": { "type": "string" } }
|
||||||
|
}
|
||||||
|
}'
|
||||||
|
|
||||||
|
PROMPT="You are the auditor agent in an autonomous coding pipeline. Review the pull request against the linked issue's Done criteria.
|
||||||
|
|
||||||
|
Be strict but fair:
|
||||||
|
- pass = the diff clearly satisfies the criterion
|
||||||
|
- fail = the diff clearly does not, or contradicts it
|
||||||
|
- unclear = cannot determine from the diff alone (e.g. requires running tests)
|
||||||
|
|
||||||
|
Set verdict:
|
||||||
|
- approve = all criteria pass, no significant issues
|
||||||
|
- comment = mostly fine but some criteria are unclear or minor issues
|
||||||
|
- request_changes = at least one criterion fails, or critical issues
|
||||||
|
|
||||||
|
issues_found is for code-quality concerns the issue did NOT specify but that
|
||||||
|
matter for merge: security holes, broken syntax, obvious bugs, dependency
|
||||||
|
problems. Do NOT bikeshed style.
|
||||||
|
|
||||||
|
Do not call any tools. Produce the JSON from the prompt text alone.
|
||||||
|
|
||||||
|
# Linked issue body
|
||||||
|
|
||||||
|
$issue_body
|
||||||
|
|
||||||
|
# PR title
|
||||||
|
|
||||||
|
$pr_title
|
||||||
|
|
||||||
|
# PR body
|
||||||
|
|
||||||
|
$pr_body
|
||||||
|
|
||||||
|
# Diff ($pr_head into $pr_base)
|
||||||
|
|
||||||
|
$(cat "$DIFF_FILE")
|
||||||
|
|
||||||
|
Return only the JSON matching the schema."
|
||||||
|
|
||||||
|
AUDIT_OUT="$(mktemp)"
|
||||||
|
log "Invoking claude (model=$MODEL, timeout=$MAX_WALLCLOCK)"
|
||||||
|
set +e
|
||||||
|
timeout --signal=INT --kill-after=30s "$MAX_WALLCLOCK" \
|
||||||
|
claude -p "$PROMPT" \
|
||||||
|
--model "$MODEL" \
|
||||||
|
--output-format json \
|
||||||
|
--json-schema "$SCHEMA" \
|
||||||
|
--allowedTools "" \
|
||||||
|
< /dev/null > "$AUDIT_OUT" 2>>"$LOG_FILE"
|
||||||
|
rc=$?
|
||||||
|
set -e
|
||||||
|
log "claude exited rc=$rc"
|
||||||
|
|
||||||
|
if [[ $rc -ne 0 ]]; then
|
||||||
|
log "ERROR — auditor failed; posting fallback comment"
|
||||||
|
curl -fsS -X POST -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
|
||||||
|
-d "$(jq -nc --arg b "agent auditor: failed to produce an audit (claude rc=$rc). Log: \`$LOG_FILE\`" '{body:$b}')" \
|
||||||
|
"$GITEA_URL/api/v1/repos/$REPO/issues/$PR_NUM/comments" > /dev/null
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ---------- 5. Render review comment ----------
|
||||||
|
audit="$(jq -c '.structured_output' "$AUDIT_OUT")"
|
||||||
|
verdict="$(jq -r .verdict <<<"$audit")"
|
||||||
|
summary="$(jq -r .summary <<<"$audit")"
|
||||||
|
criteria_md="$(jq -r '.criteria // [] | map("- **" + (.status|ascii_upcase) + "** — " + .criterion + (if .note then " _" + .note + "_" else "" end)) | join("\n")' <<<"$audit")"
|
||||||
|
issues_md="$(jq -r '.issues_found // [] | if length == 0 then "_none_" else map("- " + .) | join("\n") end' <<<"$audit")"
|
||||||
|
|
||||||
|
# Verdict badge
|
||||||
|
case "$verdict" in
|
||||||
|
approve) badge=":white_check_mark: APPROVE" ;;
|
||||||
|
comment) badge=":speech_balloon: COMMENT" ;;
|
||||||
|
request_changes) badge=":no_entry: REQUEST_CHANGES" ;;
|
||||||
|
*) badge=":grey_question: $verdict" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
review_body="$(printf '## Auditor review — %s\n\n%s\n\n### Criteria\n\n%s\n\n### Other issues found\n\n%s\n\n---\n_model: %s · log: `%s`_\n' \
|
||||||
|
"$badge" "$summary" "$criteria_md" "$issues_md" "$MODEL" "$LOG_FILE")"
|
||||||
|
|
||||||
|
# ---------- 6. Post comment ----------
|
||||||
|
log "Posting review (verdict=$verdict)"
|
||||||
|
curl -fsS -X POST -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
|
||||||
|
-d "$(jq -nc --arg b "$review_body" '{body:$b}')" \
|
||||||
|
"$GITEA_URL/api/v1/repos/$REPO/issues/$PR_NUM/comments" > /dev/null
|
||||||
|
|
||||||
|
log "Done. verdict=$verdict"
|
||||||
|
echo "$verdict"
|
||||||
47
auditor/workflow-template.yml
Normal file
47
auditor/workflow-template.yml
Normal file
@@ -0,0 +1,47 @@
|
|||||||
|
# Drop into each agent-managed project repo as .gitea/workflows/auditor.yml.
|
||||||
|
# Requires the project to have these Gitea Actions secrets configured:
|
||||||
|
# AUDITOR_SSH_KEY — private ed25519 key whose public counterpart is in
|
||||||
|
# agent@dev-01:~/.ssh/authorized_keys
|
||||||
|
#
|
||||||
|
# The workflow SSH's into dev-01 (192.168.1.29) and runs audit-task.sh, which
|
||||||
|
# uses claude headless to review the PR against its linked issue's Done
|
||||||
|
# criteria, then posts the audit as a PR comment.
|
||||||
|
|
||||||
|
name: Auditor
|
||||||
|
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
types: [opened, synchronize, reopened]
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
audit:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: debian:bookworm-slim
|
||||||
|
steps:
|
||||||
|
- name: Install ssh + curl
|
||||||
|
run: |
|
||||||
|
apt-get update -qq
|
||||||
|
apt-get install -y -qq openssh-client curl jq ca-certificates
|
||||||
|
|
||||||
|
- name: Audit PR via dev-01
|
||||||
|
env:
|
||||||
|
AUDITOR_KEY: ${{ secrets.AUDITOR_SSH_KEY }}
|
||||||
|
REPO: ${{ github.repository }}
|
||||||
|
PR_NUM: ${{ github.event.pull_request.number }}
|
||||||
|
run: |
|
||||||
|
set -e
|
||||||
|
[ -n "$AUDITOR_KEY" ] || { echo "ERROR: AUDITOR_SSH_KEY secret not set"; exit 1; }
|
||||||
|
|
||||||
|
mkdir -p ~/.ssh
|
||||||
|
printf '%s\n' "$AUDITOR_KEY" > ~/.ssh/id_ed25519
|
||||||
|
chmod 600 ~/.ssh/id_ed25519
|
||||||
|
|
||||||
|
# Trust dev-01's host key — collected at runtime; LAN-only path
|
||||||
|
ssh-keyscan -H 192.168.1.29 >> ~/.ssh/known_hosts 2>/dev/null
|
||||||
|
|
||||||
|
ssh -i ~/.ssh/id_ed25519 \
|
||||||
|
-o BatchMode=yes \
|
||||||
|
-o StrictHostKeyChecking=yes \
|
||||||
|
agent@192.168.1.29 \
|
||||||
|
"PATH=\$HOME/.local/bin:/usr/local/bin:\$PATH MAX_WALLCLOCK=10m /usr/local/bin/audit-task.sh '$REPO' '$PR_NUM'"
|
||||||
Reference in New Issue
Block a user