pullfrog.yml

name: Pullfrog owner command

# Only a new owner command can run the agent. Dashboard dispatch, automatic
# reviews, pushes, edited comments and schedules are deliberately absent.
on:
  issue_comment:
    types: [created]

permissions:
  contents: read

jobs:
  pullfrog:
    if: >-
      github.run_attempt == 1 &&
      github.actor == 'jatmn' &&
      github.triggering_actor == 'jatmn' &&
      github.event.comment.user.id == 12479882 &&
      contains(github.event.comment.body, '@pullfrog')
    runs-on: ubuntu-24.04
    timeout-minutes: 65
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout trusted default branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Verify owner command
        id: authorize
        run: node scripts/pullfrog-command-check.js
      - name: Run Pullfrog
        if: steps.authorize.outputs.authorized == 'true'
        # Keep this bootstrap and PULLFROG_VERSION in the helper in sync.
        uses: pullfrog/pullfrog@5fe4547eb8efd88bdbf9dbc68a38cc3cd0ae7685 # v0.1.97
        with:
          prompt: ${{ steps.authorize.outputs.payload }}
          model: openai/gpt-sol
          status_checks: enabled
          push: restricted
          shell: restricted
        # ChatGPT subscription credentials come from Pullfrog's encrypted store.
        # No provider API keys are passed from GitHub secrets.