Documentation
¶
Index ¶
- Constants
- func BuildDefaultDetectionMaxAICreditsExpression(builtinDefault string) string
- func BuildDefaultEvalsMaxAICreditsExpression(builtinDefault string) string
- func BuildDefaultMaxAICreditsExpression(builtinDefault string) string
- func BuildDefaultMaxDailyAICreditsExpression(builtinDefault string) string
- func BuildDefaultMaxTurnsExpression() string
- func BuildDefaultOTLPEndpointExpression() string
- func BuildDefaultOTLPHeadersExpression() string
- func BuildModelOverrideExpression(primaryVar, enterpriseDefaultVar, builtinFallback string) string
- func BuildModelOverrideExpressionEmptyFallback(primaryVar, enterpriseDefaultVar string) string
- func BuildTimeoutMinutesExpression(varName string, builtinDefault int) string
- func ResolveDefaultDetectionModel(fallback string) string
- func ResolveDefaultEvalsModel(fallback string) string
- func ResolveDefaultMaxTurnCacheMisses(fallback int) int
- func ResolveDefaultMaxTurns(fallback string) string
- func ResolveDefaultTimeoutMinutes(fallback int) int
- func ResolveDefaultUTC(fallback string) string
- func ResolvePolicyModelsAllowed() ([]string, bool)
- func ResolvePolicyModelsBlocked() ([]string, bool)
- type EnvGetter
- type Manager
- func (m *Manager) ResolveDefaultDetectionModel(fallback string) string
- func (m *Manager) ResolveDefaultEvalsModel(fallback string) string
- func (m *Manager) ResolveDefaultMaxTurnCacheMisses(fallback int) int
- func (m *Manager) ResolveDefaultMaxTurns(fallback string) string
- func (m *Manager) ResolveDefaultTimeoutMinutes(fallback int) int
- func (m *Manager) ResolveDefaultUTC(fallback string) string
- func (m *Manager) ResolvePolicyModelsAllowed() ([]string, bool)
- func (m *Manager) ResolvePolicyModelsBlocked() ([]string, bool)
Constants ¶
const ( // DefaultMaxDailyAICredits is the enterprise override for the top-level // max-daily-ai-credits guardrail when it is not explicitly configured in // workflow frontmatter. DefaultMaxDailyAICredits = "GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS" // DefaultMaxAICredits is the enterprise override for AWF apiProxy.maxAiCredits // when max-ai-credits is not explicitly configured in workflow frontmatter. DefaultMaxAICredits = "GH_AW_DEFAULT_MAX_AI_CREDITS" // DefaultMaxTurnCacheMisses is the enterprise override for AWF // apiProxy.maxCacheMisses when max-turn-cache-misses is not explicitly configured // in workflow frontmatter. DefaultMaxTurnCacheMisses = "GH_AW_DEFAULT_MAX_TURN_CACHE_MISSES" // DefaultDetectionMaxAICredits is the enterprise override for the // threat-detection AWF apiProxy.maxAiCredits budget when // safe-outputs.threat-detection.max-ai-credits is not explicitly configured. DefaultDetectionMaxAICredits = "GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS" // DefaultEvalsMaxAICredits is the enterprise override for the evals AWF // apiProxy.maxAiCredits budget when evals.max-ai-credits is not explicitly // configured. DefaultEvalsMaxAICredits = "GH_AW_DEFAULT_EVALS_MAX_AI_CREDITS" // DefaultMaxTurns is the enterprise override for max-turns when it is not // explicitly configured in workflow frontmatter. DefaultMaxTurns = "GH_AW_DEFAULT_MAX_TURNS" // DefaultTimeoutMinutes is the GitHub Actions variable used for the default // agentic execution step timeout when top-level timeout-minutes is not set. DefaultTimeoutMinutes = "GH_AW_DEFAULT_TIMEOUT_MINUTES" // DefaultAgentJobTimeoutMinutes is the GitHub Actions variable used for the // default generated agent job timeout when jobs.agent.timeout-minutes is not set. DefaultAgentJobTimeoutMinutes = "GH_AW_DEFAULT_AGENT_JOB_TIMEOUT_MINUTES" // DefaultDetectionJobTimeoutMinutes is the GitHub Actions variable used for the // default generated detection job timeout when jobs.detection.timeout-minutes // is not set. DefaultDetectionJobTimeoutMinutes = "GH_AW_DEFAULT_DETECTION_JOB_TIMEOUT_MINUTES" // DefaultDetectionModel is the enterprise override for selecting the detection // job model when threat-detection.engine.model is not set. DefaultDetectionModel = "GH_AW_DEFAULT_DETECTION_MODEL" // DefaultEvalsModel is the enterprise override for selecting the evals // job model when evals.model is not set. DefaultEvalsModel = "GH_AW_DEFAULT_EVALS_MODEL" // DefaultUTC is the enterprise override for the project home timezone used // when rendering local times in CLI output. DefaultUTC = "GH_AW_DEFAULT_UTC" // DefaultOTLPEndpoint is the GitHub Actions secret or variable used as the // fallback OTLP endpoint when observability.otlp.endpoint is not configured // in workflow frontmatter (or any imported workflow). DefaultOTLPEndpoint = "GH_AW_DEFAULT_OTLP_ENDPOINT" // DefaultOTLPHeaders is the GitHub Actions secret used as the fallback OTLP // exporter headers (comma-separated key=value pairs) that accompany // DefaultOTLPEndpoint. DefaultOTLPHeaders = "GH_AW_DEFAULT_OTLP_HEADERS" // DefaultModelCopilot is the enterprise override for Copilot fallback model selection. DefaultModelCopilot = "GH_AW_DEFAULT_MODEL_COPILOT" // DefaultModelClaude is the enterprise override for Claude fallback model selection. DefaultModelClaude = "GH_AW_DEFAULT_MODEL_CLAUDE" // DefaultModelCodex is the enterprise override for Codex fallback model selection. DefaultModelCodex = "GH_AW_DEFAULT_MODEL_CODEX" // PolicyStrict enables runtime enforcement that workflows must be compiled in strict mode // when GH_AW_POLICY_STRICT is set to the string value "true". PolicyStrict = "GH_AW_POLICY_STRICT" // PolicyModelsAllowed applies experimental models.allowed policy from env. // It intersects with workflow models.allowed and does not change // models.blocked unless PolicyModelsBlocked is also set. PolicyModelsAllowed = "GHAW_POLICY_MODELS_ALLOWED" // PolicyModelsBlocked applies experimental models.blocked policy from env. // It unions with workflow models.blocked and does not change models.allowed // unless PolicyModelsAllowed is also set. PolicyModelsBlocked = "GHAW_POLICY_MODELS_BLOCKED" // PolicyAllowCreatePullRequest controls whether create-pull-request safe-outputs // remain runtime-compliant. Set to the string value "false" to disable the // create_pull_request safe-output tool at runtime. PolicyAllowCreatePullRequest = "GH_AW_POLICY_ALLOW_CREATE_PULL_REQUEST" )
Variables ¶
This section is empty.
Functions ¶
func BuildDefaultDetectionMaxAICreditsExpression ¶ added in v0.79.5
BuildDefaultDetectionMaxAICreditsExpression builds a vars expression that resolves the threat-detection max-ai-credits default at runtime from the GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS GitHub variable, falling back to builtinDefault when the variable is unset.
func BuildDefaultEvalsMaxAICreditsExpression ¶ added in v0.83.0
BuildDefaultEvalsMaxAICreditsExpression builds a vars expression that resolves the evals max-ai-credits default at runtime from the GH_AW_DEFAULT_EVALS_MAX_AI_CREDITS GitHub variable, falling back to builtinDefault when the variable is unset.
func BuildDefaultMaxAICreditsExpression ¶ added in v0.79.3
BuildDefaultMaxAICreditsExpression builds a vars expression that resolves max-ai-credits at runtime from the GH_AW_DEFAULT_MAX_AI_CREDITS GitHub variable, falling back to builtinDefault when the variable is unset. The expression is embedded in the compiled workflow and evaluated by the GitHub Actions runner.
func BuildDefaultMaxDailyAICreditsExpression ¶ added in v0.79.3
BuildDefaultMaxDailyAICreditsExpression builds a vars expression that resolves max-daily-ai-credits at runtime from the GH_AW_DEFAULT_MAX_DAILY_AI_CREDITS GitHub variable, falling back to builtinDefault when the variable is unset.
func BuildDefaultMaxTurnsExpression ¶ added in v0.78.0
func BuildDefaultMaxTurnsExpression() string
BuildDefaultMaxTurnsExpression builds a vars expression that resolves max-turns at runtime from the GH_AW_DEFAULT_MAX_TURNS GitHub variable. An empty string is returned as the fallback so that an unset variable is treated as "no limit".
func BuildDefaultOTLPEndpointExpression ¶ added in v0.87.6
func BuildDefaultOTLPEndpointExpression() string
BuildDefaultOTLPEndpointExpression builds an expression that resolves the OTLP endpoint at runtime from the GH_AW_DEFAULT_OTLP_ENDPOINT GitHub secret, falling back to the variable for compatibility. The expression evaluates to an empty string when both are unset, which downstream runtime code treats as "observability disabled".
func BuildDefaultOTLPHeadersExpression ¶ added in v0.87.6
func BuildDefaultOTLPHeadersExpression() string
BuildDefaultOTLPHeadersExpression builds a secrets expression that resolves the OTLP exporter headers at runtime from the GH_AW_DEFAULT_OTLP_HEADERS GitHub secret. The expression evaluates to an empty string when the secret is unset.
func BuildModelOverrideExpression ¶
BuildModelOverrideExpression builds a vars expression with primary model var, enterprise default model var, and built-in fallback model.
func BuildModelOverrideExpressionEmptyFallback ¶
BuildModelOverrideExpressionEmptyFallback builds a vars expression with primary model var, enterprise default model var, and empty string fallback.
func BuildTimeoutMinutesExpression ¶ added in v0.87.5
BuildTimeoutMinutesExpression builds a GitHub Actions expression that resolves a default timeout from an Actions variable at runtime, falling back to the compiled-in default when the variable is unset.
func ResolveDefaultDetectionModel ¶
ResolveDefaultDetectionModel is a convenience wrapper that delegates to the default process-environment Manager.
func ResolveDefaultEvalsModel ¶ added in v0.83.0
ResolveDefaultEvalsModel is a convenience wrapper that delegates to the default process-environment Manager.
func ResolveDefaultMaxTurnCacheMisses ¶ added in v0.80.7
ResolveDefaultMaxTurnCacheMisses is a convenience wrapper that delegates to the default process-environment Manager.
func ResolveDefaultMaxTurns ¶
ResolveDefaultMaxTurns is a convenience wrapper that delegates to the default process-environment Manager.
func ResolveDefaultTimeoutMinutes ¶
ResolveDefaultTimeoutMinutes is a convenience wrapper that delegates to the default process-environment Manager.
func ResolveDefaultUTC ¶ added in v0.77.5
ResolveDefaultUTC is a convenience wrapper that delegates to the default process-environment Manager.
func ResolvePolicyModelsAllowed ¶ added in v0.82.1
ResolvePolicyModelsAllowed is a convenience wrapper that delegates to the default process-environment Manager.
func ResolvePolicyModelsBlocked ¶ added in v0.82.1
ResolvePolicyModelsBlocked is a convenience wrapper that delegates to the default process-environment Manager.
Types ¶
type EnvGetter ¶ added in v0.82.3
EnvGetter is a function type for looking up environment variables. It mirrors the signature of os.Getenv and is used to decouple library logic from direct process-environment access.
type Manager ¶ added in v0.82.3
type Manager struct {
// contains filtered or unexported fields
}
Manager resolves enterprise env-var overrides through an injected EnvGetter. Construct one with New for explicit env control (e.g., in tests); package-level Resolve* convenience functions delegate to a default Manager backed by os.Getenv.
func New ¶ added in v0.82.3
New creates a Manager using the provided EnvGetter for environment lookups.
func (*Manager) ResolveDefaultDetectionModel ¶ added in v0.82.3
ResolveDefaultDetectionModel returns fallback when the env var is unset, otherwise returns the trimmed override value.
func (*Manager) ResolveDefaultEvalsModel ¶ added in v0.83.0
ResolveDefaultEvalsModel returns fallback when the env var is unset, otherwise returns the trimmed override value.
func (*Manager) ResolveDefaultMaxTurnCacheMisses ¶ added in v0.82.3
ResolveDefaultMaxTurnCacheMisses returns fallback when the env var is unset/invalid, otherwise returns the parsed override.
func (*Manager) ResolveDefaultMaxTurns ¶ added in v0.82.3
ResolveDefaultMaxTurns returns fallback when the env var is unset/invalid, otherwise returns the parsed override as a string.
func (*Manager) ResolveDefaultTimeoutMinutes ¶ added in v0.82.3
ResolveDefaultTimeoutMinutes returns fallback when the env var is unset/invalid, otherwise returns the parsed override.
func (*Manager) ResolveDefaultUTC ¶ added in v0.82.3
ResolveDefaultUTC returns fallback when the env var is unset, otherwise returns the trimmed override value.
func (*Manager) ResolvePolicyModelsAllowed ¶ added in v0.82.3
ResolvePolicyModelsAllowed returns configured allowed model policy entries. When the env var is unset/empty, ok=false and callers should use frontmatter policy.
func (*Manager) ResolvePolicyModelsBlocked ¶ added in v0.82.3
ResolvePolicyModelsBlocked returns configured blocked model policy entries. When the env var is unset/empty, ok=false and callers should use frontmatter policy.