fix(helm): restore quickstart secret contract #1636
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # Responds to /testbot commands in review comments on AI-generated PRs. | |
| # Delegates fixes to Claude Code CLI and posts inline replies. | |
| name: Testbot - Respond to Reviews | |
| on: | |
| pull_request_review_comment: | |
| types: [created] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| concurrency: | |
| group: testbot-respond-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| respond: | |
| environment: testbot-respond | |
| # Label gate + fork rejection. Author association is checked per-thread in | |
| # respond.py, not here — a bot comment event must still let the workflow run | |
| # so it can process pending /testbot threads from repo members. | |
| if: >- | |
| contains(github.event.pull_request.labels.*.name, 'ai-generated') && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| timeout-minutes: 20 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout PR branch | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref }} | |
| fetch-depth: 0 | |
| token: ${{ secrets.SVC_OSMO_CI_TOKEN }} | |
| - name: Setup Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: '3.14.7' | |
| - name: Setup Node.js | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: 20 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| package_json_file: src/ui/package.json | |
| - name: Install UI dependencies | |
| working-directory: src/ui | |
| run: pnpm install --frozen-lockfile | |
| # bazel-contrib/setup-bazel uses GitHub's listReleases API to find the | |
| # bazelisk binary, but as of 2026-04-27 that endpoint returns an empty | |
| # array for bazelbuild/bazelisk while /releases/tags/v<X> still works. | |
| # Install bazelisk directly from the asset URL to bypass the broken path. | |
| # Bazelisk doesn't publish official checksums for v1.27.0 (issue #306), | |
| # so we pin the SHA256 we observed and verify before sudo-installing. | |
| - name: Install Bazelisk | |
| env: | |
| BAZELISK_VERSION: v1.27.0 | |
| BAZELISK_SHA256: e1508323f347ad1465a887bc5d2bfb91cffc232d11e8e997b623227c6b32fb76 | |
| run: | | |
| curl -fsSL -o "$RUNNER_TEMP/bazelisk" \ | |
| "https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_VERSION}/bazelisk-linux-amd64" | |
| echo "${BAZELISK_SHA256} $RUNNER_TEMP/bazelisk" | sha256sum -c - | |
| sudo install -m 0755 "$RUNNER_TEMP/bazelisk" /usr/local/bin/bazelisk | |
| sudo ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel | |
| - name: Setup Bazel | |
| uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8 | |
| with: | |
| bazelisk-cache: true | |
| disk-cache: ${{ github.workflow }} | |
| repository-cache: true | |
| - name: Configure git | |
| run: | | |
| git config user.name "testbot[bot]" | |
| git config user.email "testbot[bot]@users.noreply.github.com" | |
| - name: Respond to review comments | |
| run: | | |
| PYTHONPATH=src/scripts python -m testbot.respond \ | |
| --pr-number ${{ github.event.pull_request.number }} \ | |
| --trigger-phrase /testbot \ | |
| --max-responses 10 \ | |
| --max-turns 200 \ | |
| --timeout 900 \ | |
| --model aws/anthropic/bedrock-claude-opus-5 | |
| env: | |
| ANTHROPIC_API_KEY: ${{ secrets.NVIDIA_NIM_KEY }} | |
| ANTHROPIC_BASE_URL: https://inference-api.nvidia.com | |
| DISABLE_PROMPT_CACHING: "1" # NVIDIA gateway rejects cache_control.ephemeral.scope | |
| CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1" # NVIDIA gateway rejects context_management | |
| GH_TOKEN: ${{ secrets.SVC_OSMO_CI_TOKEN }} |