GenAI in CI/CD

name: CI with AI Triage

on:
  pull_request:
  push:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # full history for accurate blame

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install deps
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Run tests (capture log)
        id: run_tests
        run: |
          set -o pipefail
          pytest -q 2>&1 | tee build.log

      # Only runs on FAILURE
      - name: AI triage (only on failure)
        if: failure()
        env:
          LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
          LLM_MODEL: ${{ secrets.LLM_MODEL }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python .github/scripts/ai_triage.py \
            --log build.log \
            --out ai_report.md \
            --max-log-lines 220 \
            --max-diff-lines 260

      - name: Upload AI report artifact
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: ai-triage-report
          path: ai_report.md

#!/usr/bin/env python3
import argparse, os, re, subprocess, sys, requests
from typing import Optional

def run_cmd(cmd: list[str]) -> str:
    p = subprocess.run(cmd, capture_output=True, text=True)
    return (p.stdout or "") + "\n" + (p.stderr or "")

def redact_secrets(text: str) -> str:
    """Basic redaction to avoid leaking tokens/keys in the prompt."""
    patterns = [
        r"AKIA[0-9A-Z]{16}",                                     # AWS access key
        r"(?i)secret[_-]?key\s*=\s*['\"][^'\"]+['\"]",
        r"(?i)api[_-]?key\s*=\s*['\"][^'\"]+['\"]",
        r"(?i)token\s*=\s*['\"][^'\"]+['\"]",
        r"(?i)authorization:\s*bearer\s+[A-Za-z0-9\-\._~\+\/]+=*",
    ]
    for pat in patterns:
        text = re.sub(pat, "[REDACTED]", text)
    return text

def tail_lines(path: str, max_lines: int) -> str:
    with open(path, "r", encoding="utf-8", errors="replace") as f:
        lines = f.readlines()
    return "".join(lines[-max_lines:])

def get_diff(max_lines: int) -> str:
    base_ref = os.getenv("GITHUB_BASE_REF")
    if base_ref:
        run_cmd(["git", "fetch", "origin", base_ref, "--depth=50"])
        diff = run_cmd(["git", "diff", f"origin/{base_ref}...HEAD"])
    else:
        diff = run_cmd(["git", "diff", "HEAD~1..HEAD"])
    dl = diff.splitlines()
    if len(dl) > max_lines:
        dl = dl[:max_lines] + ["\n... [DIFF TRUNCATED] ...\n"]
    return "\n".join(dl)

def call_llm(base_url, api_key, model, prompt):
    url = base_url.rstrip("/") + "/v1/chat/completions"
    r = requests.post(url, headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    }, json={
        "model": model or "default",
        "temperature": 0.2,
        "messages": [
            {"role": "system", "content": "You are a CI/CD and debugging assistant. Be concise and actionable."},
            {"role": "user", "content": prompt},
        ],
    }, timeout=60)
    r.raise_for_status()
    return r.json()["choices"][0]["message"]["content"]

def build_prompt(diff, log_excerpt):
    return f"""Analyze the pipeline failure and return a Markdown report with:
1) Summary of what changed (from DIFF)
2) Probable cause of the error (from LOG)
3) Practical steps to fix (bullet points)
4) If there are alternatives, offer 2 paths (quick vs. correct)
5) If you detect flakiness, say how to confirm.

Do not invent data. If the LOG doesn't have enough info, say exactly what's missing.

=== DIFF (cropped) ===
{diff}

=== LOG (cropped) ===
{log_excerpt}
"""

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--log", required=True)
    ap.add_argument("--out", required=True)
    ap.add_argument("--max-log-lines", type=int, default=200)
    ap.add_argument("--max-diff-lines", type=int, default=250)
    args = ap.parse_args()

    base_url = os.getenv("LLM_BASE_URL")
    api_key  = os.getenv("LLM_API_KEY")
    model    = os.getenv("LLM_MODEL")
    if not base_url or not api_key:
        print("ERROR: set LLM_BASE_URL and LLM_API_KEY as secrets.", file=sys.stderr)
        sys.exit(2)

    diff = redact_secrets(get_diff(args.max_diff_lines))
    log  = redact_secrets(tail_lines(args.log, args.max_log_lines))
    report = call_llm(base_url, api_key, model, build_prompt(diff, log))

    with open(args.out, "w", encoding="utf-8") as f:
        f.write(report.strip() + "\n")
    print(f"AI report written to: {args.out}")

if __name__ == "__main__":
    main()