kolm/.github/workflows/kolm-ci-pipeline.yml at 2804c7352bb2a82926c1edae55ea76cbd17e115a · Kolm-ai/kolm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: kolm CI pipeline (compile → test → publish)
# W211: push trigger removed. Empty KOLM_KEY on push events caused
# kolm whoami → exit 3 on every commit that touched examples/**.jsonl.
# Forks/contributors opt in via workflow_dispatch + a per-fork KOLM_KEY.
on:
  workflow_dispatch:
    inputs:
      task:
        description: Task description
        required: true
        default: "answer support tickets in our brand voice"
      examples:
        description: Examples JSONL path
        required: false
        default: examples/tickets.jsonl
      threshold:
        description: Minimum K-score to publish
        required: false
        default: "0.92"
      visibility:
        description: public / team / private
        required: false
        default: team

jobs:
  compile-test-publish:
    runs-on: ubuntu-latest
    # W211: gate the job on a non-empty KOLM_KEY so a fork without the
    # secret renders the workflow but never fails on it.
    if: ${{ secrets.KOLM_KEY != '' }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Compile
        id: compile
        uses: ./.github/actions/kolm-compile
        with:
          task: ${{ github.event.inputs.task || 'answer support tickets in our brand voice' }}
          examples: ${{ github.event.inputs.examples || 'examples/tickets.jsonl' }}
          base: qwen2.5-7b-instruct
          api-key: ${{ secrets.KOLM_KEY }}
          artifact-name: ${{ github.sha }}.kolm

      - name: Test (regression + adversarial)
        id: test
        uses: ./.github/actions/kolm-test
        with:
          artifact: ${{ steps.compile.outputs.artifact-path }}
          adversarial: "true"
          threshold: ${{ github.event.inputs.threshold || '0.92' }}
          api-key: ${{ secrets.KOLM_KEY }}

      - name: Verify (final seal check)
        uses: ./.github/actions/kolm-verify
        with:
          artifact: ${{ steps.compile.outputs.artifact-path }}
          fail-on-warn: "true"

      - name: Publish
        if: github.ref == 'refs/heads/main' && steps.test.outputs.passed == 'true'
        uses: ./.github/actions/kolm-publish
        with:
          artifact: ${{ steps.compile.outputs.artifact-path }}
          visibility: ${{ github.event.inputs.visibility || 'team' }}
          api-key: ${{ secrets.KOLM_KEY }}

      - name: Summary
        if: always()
        run: |
          echo "## kolm CI run" >> $GITHUB_STEP_SUMMARY
          echo "- Task: ${{ github.event.inputs.task || 'answer support tickets in our brand voice' }}" >> $GITHUB_STEP_SUMMARY
          echo "- K-score: ${{ steps.test.outputs.k-score || steps.compile.outputs.k-score }}" >> $GITHUB_STEP_SUMMARY
          echo "- Job ID: ${{ steps.compile.outputs.job-id }}" >> $GITHUB_STEP_SUMMARY
          echo "- Artifact: ${{ steps.compile.outputs.artifact-path }}" >> $GITHUB_STEP_SUMMARY