ci: call the canonical agent jury instead of a local copy - #135
Open
todie wants to merge 3 commits into
Open
Conversation
Replaces this repo's local jury workflow(s) with a caller of cerebral-work/.github/.github/workflows/agent-jury.yml@v1. A census on 2026-08-16 found the jury copy-pasted into 39 repositories in 11 distinct versions across two filename families (agent-jury.yml and code-review.yml, frequently both in the same repo). Fixes landed in one repo reached none of the others, so most repos were running a version months behind and nobody could tell which. The canonical workflow is the most advanced of those variants, carrying the three-tier pass/fail/error split, the 60000-byte diff budget that fixed the truncation false-blockers, the verdict enum whitelist that closes GITHUB_OUTPUT forgery, and dual key sourcing. No behaviour is lost. The check name gains a job prefix and becomes "jury / GLM-5.2 code review"; no branch protection in either org referenced the old bare name.
The self-hosted default cannot reach the LLM gateway from this org. The cerebral-work-runners base NetworkPolicy permits DNS, public 443 with RFC1918 explicitly excluded, traefik:8443 and apiserver:6443 — nothing else. The gateway is a ClusterIP on :4000 inside 10.0.0.0/8, so jury jobs scheduled there fail HTTP 000 (transport) rather than reaching the gateway at all. Measured on terrarium#206: three-tier split correctly reported 'error — review not delivered, HTTP 000' rather than a false rejection. arc-runners/reverie carries the matching pair (reverie-llm-egress plus allow-arc-runners-ingress in ns llm) and works today, so this is a pin to a working pool rather than a workaround. The durable fix is to give cerebral-work-runners the same policy pair that unsigned-gg-runners 0.2.8 already ships and 0.1.5 lacks; this override comes out when that lands.
The canonical reusable workflow lives in cerebral-work/.github, so `secrets: inherit` silently delivers NOTHING to a caller in unsigned-gg. Measured today across four conversions using the identical caller: cerebral-work/cortex #65 -> verdict delivered, approved cerebral-work/reverie #1671 -> verdict delivered unsigned-gg/vilicus #21 -> 401 'Authentication Error, No api key passed in' unsigned-gg/soma #98 -> 401, same body The 401 body is the tell: 'No api key passed in' means the value was EMPTY, not wrong. The repo secrets were seeded 21 seconds before those runs started, so staleness is ruled out; the difference is purely which org the caller is in. Explicit passing works same-org and cross-org, so all callers use one shape rather than branching on org.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces this repo's local jury workflow(s) with a thin caller of
cerebral-work/.github/.github/workflows/agent-jury.yml@v1.Removed: `.github/workflows/agent-jury.yml` `.github/workflows/code-review.yml`
Added:
.github/workflows/agent-jury.yml(12 lines)Why
A census on 2026-08-16 found the jury copy-pasted into 39 repositories in 11 distinct versions across two filename families —
agent-jury.yml(22 copies) andcode-review.yml(20 copies), frequently both in the same repo. A fix landed in one repo reached none of the others.The canonical implementation is the most advanced of those variants and carries:
GITHUB_OUTPUTforgery via newline injection from model outputNote for reviewers
The check name gains a job prefix:
jury / GLM-5.2 code review. No branch protection in either org referenced the old bare name — verified across all 13 jury repos, and on the Free plan private repos cannot have required checks at all.