update-models.yml

# Weekly refresh of the vendored LiteLLM model catalog
# (src/common/utils/tokens/models.json) via scripts/update_models.ts, which
# validates pricing shape and curated-model coverage before writing (#3727).
# Opens or updates a bot PR only when the data changed.
# SETUP: reuses the auto-cleanup GitHub App credentials (XUM_APP_ID and
# XUM_APP_PRIVATE_KEY) so the PR triggers CI.

name: Update Models

on:
  schedule:
    - cron: "0 6 * * 1" # Weekly, Mondays 6 AM UTC
  workflow_dispatch: {}

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: update-models
  cancel-in-progress: true

jobs:
  update-models:
    runs-on: ubuntu-latest
    steps:
      - name: Check required secrets
        id: precheck
        env:
          XUM_APP_ID: ${{ secrets.XUM_APP_ID }}
          XUM_APP_PRIVATE_KEY: ${{ secrets.XUM_APP_PRIVATE_KEY }}
        run: |
          if [ -z "$XUM_APP_ID" ] || [ -z "$XUM_APP_PRIVATE_KEY" ]; then
            echo "Skipping (missing XUM_APP_ID / XUM_APP_PRIVATE_KEY)."
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
        id: app-token
        if: ${{ steps.precheck.outputs.enabled == 'true' }}
        with:
          # Use a GitHub App token so PR events trigger CI. PRs opened via
          # GITHUB_TOKEN intentionally do not trigger other workflows.
          app-id: ${{ secrets.XUM_APP_ID }}
          private-key: ${{ secrets.XUM_APP_PRIVATE_KEY }}

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        if: ${{ steps.precheck.outputs.enabled == 'true' }}
        with:
          # Pin to main so a workflow_dispatch from a feature branch cannot leak
          # unrelated commits into the shared bot/update-models branch.
          ref: refs/heads/main
          token: ${{ steps.app-token.outputs.token }}

      - uses: oven-sh/setup-bun@b7a1c7ccf290d58743029c4f6903da283811b979 # v2.1.0
        if: ${{ steps.precheck.outputs.enabled == 'true' }}
        with:
          bun-version: 1.4.3

      - name: Update models.json
        if: ${{ steps.precheck.outputs.enabled == 'true' }}
        # Go through the Makefile target (which installs dependencies first) so
        # automation and local refreshes share one entry point.
        run: make update-models

      - name: Push branch and open PR if changed
        if: ${{ steps.precheck.outputs.enabled == 'true' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          if git diff --quiet -- src/common/utils/tokens/models.json; then
            echo "models.json already up to date; no PR needed."
            exit 0
          fi

          git config user.name "mux-bot[bot]"
          git config user.email "264182336+mux-bot[bot]@users.noreply.github.com"
          git checkout -B bot/update-models
          git add src/common/utils/tokens/models.json
          # Attribution footer per .xum/skills/pull-requests: automation
          # commits use the workflow marker instead of model/thinking/cost.
          footer="---

          _Automated by the \`update-models\` workflow (GitHub Actions)._

          <!-- xum-attribution: workflow=update-models -->"
          git commit -m "🤖 chore: refresh models.json from LiteLLM" -m "$footer"
          git push --force origin bot/update-models

          open_prs=$(gh pr list --head bot/update-models --state open --json number --jq length)
          if [ "$open_prs" = "0" ]; then
            gh pr create \
              --title "🤖 chore: refresh models.json from LiteLLM" \
              --body "Automated weekly refresh of the vendored LiteLLM model catalog via \`make update-models\` (#3727).

          $footer" \
              --base main \
              --head bot/update-models
          else
            echo "Existing open PR for bot/update-models updated by push."
          fi