Model-release watch: don't register unofferable models + CI-opened PRs - #150
Closed
adambalogh wants to merge 1 commit into
Closed
Model-release watch: don't register unofferable models + CI-opened PRs#150adambalogh wants to merge 1 commit into
adambalogh wants to merge 1 commit into
Conversation
The daily model-release watch runs in a scheduled session, and a scheduled session cannot open a pull request. The GitHub API access an interactive session has is session-scoped and is not passed through when a routine fires, and the container's git credentials only cover git transport — against the REST API they get 403 "GitHub access is not enabled for this session". A test run confirmed it: the session pushed fine, then spent several minutes downloading and installing the gh binary before failing the same way, because the missing piece was authorization, not a CLI. So take the PR out of the session's hands. The session pushes a claude/model-release-* branch; this workflow notices the push and opens the draft PR with the Actions token. Title and body come from the branch's last commit message, since that is the only channel the pushing session has for them, and the job no-ops when the branch already has an open PR so a follow-up push does not open a second one. REQUIRES A SETTING: "Allow GitHub Actions to create and approve pull requests" must be on for this repository (Settings -> Actions -> General -> Workflow permissions, or the same switch at the org level, which overrides it). It is off by default. Without it the job fails with "GitHub Actions is not permitted to create or approve pull requests", which is what a test push of a claude/model-release-* branch produced before this landed — permissions: pull-requests: write on the job is necessary but not sufficient. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LCzE1jP1Yvy4fbSj4xtRkv
adambalogh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits, both hardening the daily model-release watch that #149 set up.
1. Do not register models the catalog would not offer
The registry is cheap to append to, which is exactly why it grows without anyone deciding it should. A daily job proposing every model our providers ship makes that worse: left alone it would register routing for models nothing surfaces, and each one is a name the gateway then has to route, price and test forever for a model no user can select.
.claude/skills/add-gateway-model/SKILL.mdnow points at the curation bar that actually governs this — the one in chat-api'sadd-catalog-modelskill, tightened in OpenGradient/chat-api#281, where a new model earns a picker row only if it offers something no current row does and a better model replaces the one it supersedes rather than joining it. Registration is downstream of that decision, so it gets applied here first rather than registering speculatively and sorting it out later.No code change; the registry itself is untouched.
2. Open the model-release PR from CI
A scheduled Claude session can push a branch but cannot open a pull request: the GitHub API access an interactive session has is session-scoped and isn't passed through when a routine fires, and the container's git credentials cover git transport only — against the REST API they get
403 "GitHub access is not enabled for this session". A test run confirmed it end to end: the session pushed fine, then spent several minutes installing theghbinary before failing the same way, because the missing piece was authorization, not a CLI..github/workflows/open-model-release-pr.ymlfires on pushes toclaude/model-release-**and opens the draft PR with the Actions token, taking title and body from the branch's last commit message. It no-ops when the branch already has an open PR.permissions: pull-requests: writeis necessary but not sufficient. A throwawayclaude/model-release-selftestpush produced run 33783298707:If the GitHub App connection turns out to give scheduled sessions API access directly, this second commit becomes unnecessary and can be dropped — the first one stands on its own either way.
Note: the
claude/model-release-selftestbranch is left over from that test and should be deleted; my push credentials can't remove remote branches.The companion change is OpenGradient/chat-api#281.
🤖 Generated with Claude Code
https://claude.ai/code/session_01LCzE1jP1Yvy4fbSj4xtRkv