Automate OpenRouter API Key Distribution for External Recipe Contributors#3198
Automate OpenRouter API Key Distribution for External Recipe Contributors#3198iandouglas merged 22 commits intomainfrom
Conversation
|
@EbonyLouis still working on this? |
yeah @zanesq there's a part 2 that @iandouglas is not working on! Thanks for checking. We should be merging this soon |
my first part of the integration is added, just waiting on a word from platform security about whether the Dockerfile I reference in my integration here should use a docker registry for the base container, or whether we want to pull training material from other secure storage like S3. |
|
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
|
🔍 Recipe Security Scan Results 📊 Scan Summary:
📋 Individual Recipe Results: 🔗 View detailed scan results in the workflow artifacts. |
|
🔍 Recipe Security Scan Results 📊 Scan Summary:
📋 Individual Recipe Results: 🔗 View detailed scan results in the workflow artifacts. |
|
🔍 Recipe Security Scan Results ❌ Status: BLOCKED - One or more recipes have MEDIUM risk or higher
📊 Scan Summary:
📋 Individual Recipe Results: 🔗 View detailed scan results in the workflow artifacts. |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
|
🔍 Recipe Security Scan Results ✅ Status: APPROVED - All recipes passed security scan 📊 Scan Summary:
📋 Individual Recipe Results: 🔗 View detailed scan results in the workflow artifacts. |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
| run: | | ||
| # Check if recipe files were changed in this push | ||
| if [ "${{ steps.recipe_changes.outputs.recipe_files_changed }}" = "false" ]; then | ||
| # No recipe files were modified in this push - scan skipped | ||
| exit 0 | ||
| fi | ||
|
|
||
| OUT="$RUNNER_TEMP/security-scan" | ||
| SUMMARY_FILE="$OUT/pr_scan_summary.json" | ||
|
|
||
| if [ -f "$SUMMARY_FILE" ]; then | ||
| OVERALL_STATUS=$(jq -r .overall_status "$SUMMARY_FILE") | ||
| echo "📊 Final scan result: $OVERALL_STATUS" | ||
|
|
||
| if [ "$OVERALL_STATUS" = "BLOCKED" ]; then | ||
| echo "::error::One or more recipes have MEDIUM risk or higher - PR merge blocked" | ||
| echo "Repository maintainers can override this decision if needed" | ||
| exit 1 | ||
| elif [ "$OVERALL_STATUS" = "APPROVED" ]; then | ||
| echo "::notice::All recipes APPROVED by security scan" | ||
| else | ||
| echo "::error::Scan did not complete successfully - check artifacts for details" | ||
| exit 1 | ||
| fi | ||
| else | ||
| echo "::error::No scan summary found - scan may have failed completely" | ||
| exit 1 | ||
| fi |
Check failure
Code scanning / Semgrep OSS
Insecure GitHub Actions: Shell Injection via GitHub Context Variables Error
There was a problem hiding this comment.
i fixed this in the next commit
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
|
🔍 Recipe Security Scan Results ❓ Status: UNKNOWN - Could not determine scan results 📊 Scan Summary:
📋 Individual Recipe Results: 🔗 View detailed scan results in the workflow artifacts. |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
…new output change to avoid backslash-n characters
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ create-kafka-topic.yaml: VALID✅ migrate-from-poetry-to-uv.yaml: VALID✅ clean-up-feature-flag.yaml: VALID✅ readme-bot.yaml: VALID❌ pull-request-generator.yaml: INVALID |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ create-kafka-topic.yaml: VALID✅ migrate-from-poetry-to-uv.yaml: VALID✅ clean-up-feature-flag.yaml: VALID✅ readme-bot.yaml: VALID❌ pull-request-generator.yaml: INVALID |
|
❌ Recipe Validation Failed Please fix the validation errors and push your changes: ✅ documentation/src/pages/recipes/data/recipes/create-kafka-topic.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/migrate-from-poetry-to-uv.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/clean-up-feature-flag.yaml: VALID\n✅ documentation/src/pages/recipes/data/recipes/readme-bot.yaml: VALID\n❌ documentation/src/pages/recipes/data/recipes/pull-request-generator.yaml: INVALID\n 📚 Check our Recipe Guide for help with the correct format. |
* main: new recipe to lint-check my code (#4416) removing a leftover syntax error (#4415) Iand/updating recipe validation workflow (#4413) Iand/updating recipe validation workflow (#4410) Fix (Ollama provider): Unsupported operation: streaming not implemented (#4303) change databricks default to claude sonnet 4 (#4405) Iand/updating recipe validation workflow (#4406) Add metrics for recipe metadata in scheduler, UI, and CLI (#4399) Iand/updating recipe validation workflow (#4403) making small updates to recipe validation workflow (#4401) Automate OpenRouter API Key Distribution for External Recipe Contributors (#3198) Enhance `convert_path_with_tilde_expansion` to handle Windows (#4390) make sure all cookbook recipes have a title and version, but no id (#4395) Nest TODO State in session data (#4361) Fast model falls back to regular (#4375) Update windows instructions (#4333)
* main: (40 commits) new recipe to lint-check my code (#4416) removing a leftover syntax error (#4415) Iand/updating recipe validation workflow (#4413) Iand/updating recipe validation workflow (#4410) Fix (Ollama provider): Unsupported operation: streaming not implemented (#4303) change databricks default to claude sonnet 4 (#4405) Iand/updating recipe validation workflow (#4406) Add metrics for recipe metadata in scheduler, UI, and CLI (#4399) Iand/updating recipe validation workflow (#4403) making small updates to recipe validation workflow (#4401) Automate OpenRouter API Key Distribution for External Recipe Contributors (#3198) Enhance `convert_path_with_tilde_expansion` to handle Windows (#4390) make sure all cookbook recipes have a title and version, but no id (#4395) Nest TODO State in session data (#4361) Fast model falls back to regular (#4375) Update windows instructions (#4333) feat: linux computer control for android (termux) (#3890) feat: Added scroll state support for chat-session-list navigation (#4360) docs: typo fix (#4376) blog: goose janitor (#4131) ...
…tors (#3198) Co-authored-by: w. ian douglas <ian.douglas@iandouglas.com>
This PR introduces a fully automated flow to reward community contributors who submit external recipes to the Goose Cookbook.
✅ What’s Included
send_key.py: A Python script that:Updates to
create-recipe-pr.yml:New workflow
send-api-key.yml:Add External Recipe:send_key.pyto deliver the key and confirm via comment📫 Contributor Experience
When a recipe PR is merged:
🔐 Secrets Required
Be sure the following secrets are set in the repo:
PROVISIONING_API_KEY– from OpenRouterTO-DO:
EMAIL_API_KEY– from sendGrid ✅