models-dev-refresh.yml

name: Models.dev Snapshot Refresh

"on":
  schedule:
    # Monthly, 06:00 UTC on the 1st. Data-only refresh of the vendored
    # models.dev snapshot; the PR it opens still goes through normal review.
    - cron: "0 6 1 * *"
  workflow_dispatch:

# The job fetches public catalog data and opens a PR with the diff. It must
# never receive provider API keys or other live-test secrets — only the
# workflow GITHUB_TOKEN, scoped to branch + PR creation.
permissions:
  contents: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  refresh-snapshot:
    name: Refresh vendored models.dev snapshot
    runs-on: ubuntu-latest
    timeout-minutes: 10

    env:
      UV_PYTHON: "3.12"

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Set up uv
        uses: astral-sh/setup-uv@v5
        with:
          enable-cache: true

      - name: Install dependencies
        shell: bash
        # Base dependencies only: the refresh script needs the provider
        # registry and httpx, nothing from the dev/recommended extras.
        run: uv sync --frozen

      - name: Refresh models.dev snapshot
        shell: bash
        run: uv run python scripts/refresh_models_dev_snapshot.py

      - name: Open data-refresh pull request
        uses: peter-evans/create-pull-request@v7
        with:
          branch: data/models-dev-snapshot-refresh
          delete-branch: true
          add-paths: src/opensquilla/provider/models_dev_snapshot.json
          commit-message: Refresh vendored models.dev snapshot
          title: Refresh vendored models.dev snapshot (scheduled data refresh)
          body: |
            Scheduled data-only refresh of the vendored models.dev snapshot
            (`src/opensquilla/provider/models_dev_snapshot.json`), produced by
            `uv run python scripts/refresh_models_dev_snapshot.py`.

            - Scope: vendored model-metadata snapshot only; no runtime code
              changes.
            - Branch target: main
            - Linked issue: None
            - Release notes: not needed (data refresh).
            - Tests: default CI on this PR revalidates the snapshot shape.
            - Safety: **needs human review before merge** — upstream data
              mistakes (context windows, output caps) poison context budgeting
              at runtime. Review the diff line by line; the snapshot is kept
              deliberately small for this reason.
            - Third-party origin: models.dev api.json (MIT, maintained by the
              SST team).