Skip to content

feat(deps): migrate auth imports from phenotype-go-kit to phenotype-go-auth #827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 4 commits into from
Mar 2, 2026
Merged

feat(deps): migrate auth imports from phenotype-go-kit to phenotype-go-auth #827

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
87726f9
centralize provider alias normalization in cliproxyctl
KooshaPari Feb 26, 2026
26722cb
chore(airlock): track default workflow config
KooshaPari Feb 27, 2026
a1a831f
chore(artifacts): remove stale AI tooling artifacts
KooshaPari Mar 1, 2026
a216992
feat(deps): migrate from phenotype-go-kit monolith to phenotype-go-auth
KooshaPari Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions .airlock/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
# Airlock workflow configuration
# Documentation: https://github.com/airlock-hq/airlock

name: Main Pipeline

on:
push:
branches: ['**']
Comment on lines +4 to +8
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR title/description indicate a Go auth dependency/import migration, but the actual diff introduces an Airlock pipeline and deletes Spec Kitty-related assets. Please update the PR title/description (and test plan) to reflect the changes shown here, or split these changes into a separate PR to keep history and review scope coherent.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

push.branches: ['**'] is redundant in many CI systems because push triggers already run for all branches by default. If Airlock follows that convention, consider removing the explicit branch glob (or restricting it to the intended branches) to keep the config simpler and reduce unnecessary pipeline runs.

Suggested change
branches: ['**']

Copilot uses AI. Check for mistakes.

Comment on lines +6 to +9
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cd .airlock/workflows && find . -name "main.yml" -type f

Repository: KooshaPari/cliproxyapi-plusplus

Length of output: 85

🏁 Script executed:

cat -n .airlock/workflows/main.yml | head -50

Repository: KooshaPari/cliproxyapi-plusplus

Length of output: 1583

🌐 Web query:

GitHub Actions on.push recursive trigger prevention branches-ignore syntax

💡 Result:

To prevent recursive on: push triggers (a workflow commits/pushes and re-triggers itself), branches-ignore can help only if you push your automation commits to a branch you ignore—it can’t “ignore pushes made by this workflow” by itself.

1) branches-ignore syntax (for on: push)

on:
  push:
    branches-ignore:
      - "automation/**"
      - "gh-actions/**"
      - "release/**-alpha"

branches-ignore is a list of glob patterns matched against the branch ref name. You cannot use branches and branches-ignore together for the same event. If you need include+exclude, use branches with ! negative patterns instead. [1]

2) Practical pattern: push automation commits to a dedicated branch, then ignore it

Workflow A runs on main, commits, and pushes to automation/update-files; your normal CI workflow ignores automation/** so it won’t loop.

on:
  push:
    branches:
      - main
    # (or ignore the automation branch in the workflow(s) you *don't* want triggered)
on:
  push:
    branches-ignore:
      - "automation/**"

(Using branch filters this way is exactly what branches-ignore is for.) [1]

3) The built-in recursion guard you usually want: use GITHUB_TOKEN for the push

If your workflow pushes using the repository GITHUB_TOKEN, events caused by that token generally do not start new workflow runs, which prevents accidental recursion. [2]

If you do want the push to trigger other workflows, you typically must push using a PAT or GitHub App token instead. [2]

4) Alternative: skip runs via commit message

For push / pull_request workflows, adding e.g. [skip ci] / [skip actions] (or the skip-checks: true trailer) to the commit message will skip the workflow run that commit would have triggered. [3]

Sources

[1] GitHub Docs — Workflow syntax (on.push.branches-ignore, glob patterns, include/exclude rules): https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax
[2] GitHub Docs — Triggering a workflow from a workflow (GITHUB_TOKEN won’t create new workflow runs): https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-when-your-workflow-runs/triggering-a-workflow
[3] GitHub Docs — Skipping workflow runs (commit message / trailer): https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs

Prevent recursive triggers from push-on-push behavior.

Line 8 triggers on every branch with branches: ['**']. When the push step (line 39–40) commits changes, the workflow will re-run unless protected. However, the suggested fix has a syntax issue: you cannot use both branches and branches-ignore in the same trigger.

Use one of these approaches instead:

  1. Recommended: Verify the push step uses GITHUB_TOKEN. If airlock-hq/airlock/defaults/push@main pushes with the default GITHUB_TOKEN, GitHub automatically prevents triggered workflow runs—no recursion occurs.

  2. If you need branch filtering, replace (not add to) the branches key:

    • Use branches-ignore to exclude automation branches, or
    • Use branches with negative patterns: branches: ['**', '!automation/**']

Check the Airlock documentation to confirm which token the push action uses and whether recursion prevention is already built in.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.airlock/workflows/main.yml around lines 6 - 9, The workflow's push trigger
uses branches: ['**'] which can cause recursive runs when the push step
(airlock-hq/airlock/defaults/push@main) commits changes; verify the push action
uses the default GITHUB_TOKEN (which prevents recursion) and if it does not,
change the push action to use GITHUB_TOKEN or otherwise prevent recursion;
alternatively, if you must filter branches, replace the current branches key
with either branches-ignore to exclude automation branches or use a branches
array with a negative pattern (e.g., include '**' and exclude 'automation/**')
rather than adding both branches and branches-ignore.

jobs:
default:
name: Lint, Test & Deploy
steps:
# Rebase onto upstream to handle drift
- name: rebase
uses: airlock-hq/airlock/defaults/rebase@main
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# First, check if the file exists and view its content
if [ -f .airlock/workflows/main.yml ]; then
  echo "=== File exists. Showing content with line numbers: ==="
  cat -n .airlock/workflows/main.yml
else
  echo "File not found at .airlock/workflows/main.yml"
  # Try to find it
  find . -name "main.yml" -o -name "*.yml" | head -20
fi

Repository: KooshaPari/cliproxyapi-plusplus

Length of output: 1639

Pin workflow actions to immutable commit SHAs instead of @main.

Lines 16, 20, 28, 32, 36, 40, and 45 use mutable branch references (@main). This creates supply-chain and reproducibility risks for CI behavior, as the referenced actions can change without notice.

Replace each @main ref with a specific commit SHA:

Suggested changes 
- uses: airlock-hq/airlock/defaults/rebase@main
+ uses: airlock-hq/airlock/defaults/rebase@<commit-sha>

- uses: airlock-hq/airlock/defaults/lint@main
+ uses: airlock-hq/airlock/defaults/lint@<commit-sha>

- uses: airlock-hq/airlock/defaults/describe@main
+ uses: airlock-hq/airlock/defaults/describe@<commit-sha>

- uses: airlock-hq/airlock/defaults/document@main
+ uses: airlock-hq/airlock/defaults/document@<commit-sha>

- uses: airlock-hq/airlock/defaults/test@main
+ uses: airlock-hq/airlock/defaults/test@<commit-sha>

- uses: airlock-hq/airlock/defaults/push@main
+ uses: airlock-hq/airlock/defaults/push@<commit-sha>

- uses: airlock-hq/airlock/defaults/create-pr@main
+ uses: airlock-hq/airlock/defaults/create-pr@<commit-sha>
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.airlock/workflows/main.yml at line 16, Replace all mutable action refs that
use the branch suffix "@main" with immutable commit SHAs for each occurrence
(e.g., the uses entries like "airlock-hq/airlock/defaults/rebase@main" and the
other uses lines at the same pattern). Locate the seven "uses: ...@main" entries
(the ones currently referencing `@main`) and update each to a specific commit SHA
(one SHA per action) so the workflow is pinned to exact commits for
reproducibility and supply-chain safety.


# Run linters and formatters, auto-fix issues
- name: lint
uses: airlock-hq/airlock/defaults/lint@main
Comment on lines +15 to +20
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All uses: ...@main references are pinned to a moving branch, which increases supply-chain risk and can lead to non-reproducible runs. Pin these to immutable versions (a tagged release) or a specific commit SHA so the pipeline behavior is stable and auditable.

Copilot uses AI. Check for mistakes.

# Commit auto-fix patches and lock the worktree
- name: freeze
run: airlock exec freeze

# Generate PR title and description from the diff
- name: describe
uses: airlock-hq/airlock/defaults/describe@main

# Update documentation to reflect changes
- name: document
uses: airlock-hq/airlock/defaults/document@main

# Run tests
- name: test
uses: airlock-hq/airlock/defaults/test@main

# Push changes to upstream (pauses for user approval first)
- name: push
uses: airlock-hq/airlock/defaults/push@main
require-approval: true

# Create pull/merge request
- name: create-pr
uses: airlock-hq/airlock/defaults/create-pr@main
58 changes: 0 additions & 58 deletions .claudeignore
View file
Open in desktop

This file was deleted.

76 changes: 0 additions & 76 deletions .cursor/commands/spec-kitty.accept.md
View file
Open in desktop

This file was deleted.

184 changes: 0 additions & 184 deletions .cursor/commands/spec-kitty.analyze.md
View file
Open in desktop

This file was deleted.

Loading
Loading