Publish docker image (latest) / build-arm64 (push) Has been cancelled
Publish docker image (latest) / build-amd64 (push) Has been cancelled
Build and Deploy Documentation / build (push) Has been cancelled
CI / security-scan (push) Has been cancelled
CI / test-prompt-gateway (push) Has been cancelled
CI / test-model-alias-routing (push) Has been cancelled
CI / test-responses-api-with-state (push) Has been cancelled
CI / e2e-plano-tests (3.10) (push) Has been cancelled
CI / e2e-plano-tests (3.11) (push) Has been cancelled
CI / e2e-plano-tests (3.12) (push) Has been cancelled
CI / e2e-plano-tests (3.13) (push) Has been cancelled
CI / e2e-plano-tests (3.14) (push) Has been cancelled
CI / e2e-demo-preference (push) Has been cancelled
CI / e2e-demo-currency (push) Has been cancelled
Publish docker image (latest) / create-manifest (push) Has been cancelled
* ci: add update-providers workflow
Adds .github/workflows/update-providers.yml so the provider_models.yaml
refresh can be triggered via workflow_dispatch (manual UI / gh CLI) or
repository_dispatch (from the PlanoHelper Slack bot).
The workflow:
- Runs cargo run --bin fetch_models --features model-fetch with all
provider API keys + AWS creds available as env from secrets.
- Opens a PR via peter-evans/create-pull-request scoped to just
crates/hermesllm/src/bin/provider_models.yaml.
- On repository_dispatch, posts the PR link (or failure) back to Slack
via the response_url in the dispatch payload.
Includes keys for the providers fetch_models reads today (OpenAI,
Anthropic, Mistral, DeepSeek, Grok, Moonshot, Dashscope/Qwen, Zhipu,
Xiaomi/Mimo, Google) plus forward-compat env for OpenRouter and Vercel
AI Gateway (added in #902).
The workflow has no push: or schedule: trigger, so landing this is inert
until something dispatches it. Required secrets are documented in
apps/planohelper/README.md (in a follow-up PR).
* fix(fetch_models): preserve existing providers when keys are missing
Previously fetch_models rebuilt provider_models.yaml from scratch on
every run, so running locally (or in CI) without e.g. ANTHROPIC_API_KEY,
GOOGLE_API_KEY, or AWS Bedrock credentials would silently drop those
providers' entries from the file. The user only meant to refresh what
they had keys for.
Now fetch_models loads the existing provider_models.yaml first and
treats each provider independently:
- Successful fetch -> entry replaced with fresh data ("updated")
- Missing API key -> existing entry preserved ("skipped")
- Failed fetch -> existing entry preserved ("failed, kept existing")
- Missing AWS creds -> Amazon entry preserved instead of running
`aws bedrock list-foundation-models` and erroring out
If the file doesn't exist yet it starts fresh, same as before. If the
file exists but can't be parsed, the binary refuses to overwrite it and
exits with an error rather than silently nuking it.
Other changes that come along for the ride:
- HashMap -> BTreeMap for the providers map. Output YAML now has a
stable, alphabetical provider order across runs (eliminates
HashMap-iteration churn in PR diffs). The first PR after this
lands will reorder existing entries one time.
- Per-provider summary at the end (updated / skipped / failed)
so the workflow logs and Slack PR body make it obvious what
actually changed vs. what was left alone.
- File-level usage comment updated to match the new behavior and
list the additional env vars (MISTRAL_API_KEY, MIMO_API_KEY).
No tests existed for this binary; manually verified with `env -i` (no
keys at all) that all 13 existing providers are preserved with their
original model counts.
* feat: add template synchronization utility and CI integration
* refactor: make simple write to CI, no check
* ci: conditionally sync CLI templates on push to main branch
* docs: fix small capitalization
Update all GitHub Actions workflows and Dockerfiles to use Python 3.14
as the default version. Remove the upper bound on requires-python in
model_choice_with_test_harness to allow 3.14+. The CLI's
requires-python stays at >=3.10 for broad compatibility.
* Update GitHub badges after CI workflow consolidation
Fix broken README badges pointing to deleted workflow files (pre-commit.yml,
rust_tests.yml, e2e_tests.yml) and replace with consolidated CI badge. Add
Docker image publish badge and dynamic Trivy security scan badge.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Use existing ADIL_GITHUB_TOKEN secret for security badge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Add Trivy Docker image security scan workflow
Scans the Docker image for CRITICAL and HIGH vulnerabilities using Trivy.
Blocks PRs on failures; runs non-blocking on main for visibility. Results
are uploaded to the GitHub Security tab via SARIF.
* Add explicit permissions to Docker security scan workflow
Set minimal permissions: contents read for checkout, security-events
write for SARIF upload to the GitHub Security tab.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix 27 HIGH vulnerabilities found by Trivy Docker scan
- Install supervisor via pip instead of apt to eliminate 22 Debian
python3.13 package vulnerabilities
- Pin urllib3>=2.6.3 to fix CVE-2025-66418, CVE-2025-66471, CVE-2026-21441
- Add ignore-unfixed to Trivy scan to suppress unfixable glibc CVE-2026-0861
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* cleaning up plano cli commands
* adding support for wildcard model providers
* fixing compile errors
* fixing bugs related to default model provider, provider hint and duplicates in the model provider list
* fixed cargo fmt issues
* updating tests to always include the model id
* using default for the prompt_gateway path
* fixed the model name, as gpt-5-mini-2025-08-07 wasn't in the config
* making sure that all aliases and models match the config
* fixed the config generator to allow for base_url providers LLMs to include wildcard models
* re-ran the models list utility and added a shell script to run it
* updating docs to mention wildcard model providers
* updated provider_models.json to yaml, added that file to our docs for reference
* updating the build docs to use the new root-based build
---------
Co-authored-by: Salman Paracha <salmanparacha@MacBook-Pro-342.local>
