AI models — live catalog with one-click refresh

2026-09-14 18:56:52 +00:00 · 2026-09-02 10:00:27 +02:00
parent ebfb842dc3
commit 220a670b46
17 changed files with 1134 additions and 51 deletions
@@ -0,0 +1,103 @@
+name: Verify AI models catalog
+
+# Runs the AI-model verifier and commits any changes to
+# AppImage/config/verified_ai_models.json on the same branch the run
+# was launched from.
+#
+# GitHub only fires `on: schedule` from the default branch, so the
+# daily cron always runs against main and keeps stable users fresh.
+# When a beta cycle needs its own refresh on develop, use the
+# "Run workflow" button on the Actions tab and pick develop from the
+# branch selector — the same YAML then checks out develop, runs the
+# verifier and commits back to develop. Cross-branch pushes never
+# happen: each run only touches the branch it started on.
+#
+# The verifier code lives at .github/scripts/ai-models-verifier/ and
+# reads API keys from repository Secrets. Any provider without a key
+# is skipped silently — the workflow keeps going with the rest.
+
+on:
+  schedule:
+    - cron: '0 4 * * *'   # 04:00 UTC every day — cron always fires from main
+  workflow_dispatch:       # manual trigger — branch is picked in the UI
+
+permissions:
+  contents: write
+
+concurrency:
+  # Keyed by branch so a manual develop run does not collide with the
+  # scheduled main run — each branch gets its own serialisation lane.
+  group: verify-ai-models-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out the branch this run belongs to
+        uses: actions/checkout@v4
+        with:
+          # `github.ref_name` resolves to main for the cron and to the
+          # branch selected in the dispatch UI otherwise. The same
+          # value is used again below when we push, so every run is
+          # symmetric: checkout X → refresh → push X.
+          ref: ${{ github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Run verifier
+        working-directory: .github/scripts/ai-models-verifier
+        env:
+          # API keys — each is optional. verify.py silently skips any
+          # provider whose *_API_KEY env var is empty, so the workflow
+          # runs even when only a subset of keys is configured.
+          OPENAI_API_KEY:     ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY:  ${{ secrets.ANTHROPIC_API_KEY }}
+          GROQ_API_KEY:       ${{ secrets.GROQ_API_KEY }}
+          GEMINI_API_KEY:     ${{ secrets.GEMINI_API_KEY }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          # Optional base URLs for custom-endpoint providers.
+          OPENAI_BASE_URL:    ${{ secrets.OPENAI_BASE_URL }}
+        run: |
+          python3 verify.py --json-out /tmp/report.json || true
+          if [ ! -s /tmp/report.json ]; then
+            echo "Verifier produced no report — bailing"
+            exit 1
+          fi
+
+      - name: Apply report to catalog
+        id: apply
+        working-directory: .
+        run: |
+          set +e
+          python3 .github/scripts/ai-models-verifier/apply.py \
+            --report /tmp/report.json \
+            --catalog AppImage/config/verified_ai_models.json
+          code=$?
+          set -e
+          case "$code" in
+            0)  echo "changed=false" >> "$GITHUB_OUTPUT" ;;
+            10) echo "changed=true"  >> "$GITHUB_OUTPUT" ;;
+            *)  echo "apply.py exited with $code"; exit "$code" ;;
+          esac
+
+      - name: Commit and push back to the same branch
+        if: steps.apply.outputs.changed == 'true'
+        run: |
+          git config user.name  "proxmenux-bot"
+          git config user.email "proxmenux-bot@users.noreply.github.com"
+          git add AppImage/config/verified_ai_models.json
+          git commit -m "chore(ai-models): daily catalog refresh"
+          # Push to the branch this run started on — same ref used at
+          # checkout above, so the operation is symmetric regardless of
+          # whether cron (main) or dispatch (any branch) triggered it.
+          git push origin HEAD:${{ github.ref_name }}
+
+      - name: Report unchanged
+        if: steps.apply.outputs.changed != 'true'
+        run: echo "Catalog already up to date — nothing to commit."