sync-models.yml

name: Sync Model Catalogs

on:
  schedule:
    - cron: "17 * * * *"
  workflow_dispatch:

# sync runs repository code and provider API keys with the built-in token only. It uploads each provider's catalog
# patch as data. publish runs only .github/sync-models/ from this commit with a models.dev automation app token from
# the automation environment: it applies each patch, allowing only catalog TOML, opens or updates the provider's pull
# request and auto-merges safe syncs. The app's pull requests run their checks and its merges deploy as usual.
permissions:
  contents: read

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  providers:
    if: github.repository == 'anomalyco/models.dev'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    outputs:
      matrix: ${{ steps.providers.outputs.matrix }}
    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: dev

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.4

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: List sync providers
        id: providers
        run: |
          matrix="$(bun models:sync --list-providers)"
          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"

  sync:
    needs: providers
    if: github.repository == 'anomalyco/models.dev'
    runs-on: blacksmith-4vcpu-ubuntu-2404
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.providers.outputs.matrix) }}
    # bun models:sync opens an issue for each missing model and dispatches the issue fixer (repository_dispatch needs
    # contents: write). The built-in token can't change dev or workflows; catalog changes still go through publish.
    permissions:
      contents: write
      issues: write

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: dev
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.4

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Sync model catalogs
        run: bun models:sync ${{ matrix.provider }}
        env:
          GH_TOKEN: ${{ github.token }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          BASETEN_API_KEY: ${{ secrets.BASETEN_API_KEY }}
          DEEPINFRA_API_KEY: ${{ secrets.DEEPINFRA_API_KEY }}
          DIGITALOCEAN_API_TOKEN: ${{ secrets.DIGITALOCEAN_API_TOKEN }}
          DIGITALOCEAN_ACCESS_TOKEN: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
          FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}
          HF_TOKEN: ${{ secrets.HF_TOKEN }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          VENICE_API_KEY: ${{ secrets.VENICE_API_KEY }}
          LLMGATEWAY_API_KEY: ${{ secrets.LLMGATEWAY_API_KEY }}
          MERGE_GATEWAY_API_KEY: ${{ secrets.MERGE_GATEWAY_API_KEY }}
          MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
          NOVITA_AI_API_KEY: ${{ secrets.NOVITA_AI_API_KEY }}
          KILO_API_KEY: ${{ secrets.KILO_API_KEY }}
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          GOOGLE_GENERATIVE_AI_API_KEY: ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_AI_SYNC_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_WORKERS_AI_SYNC_ACCOUNT_ID }}
          CLOUDFLARE_WORKERS_AI_SYNC_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_WORKERS_AI_SYNC_ACCOUNT_ID }}
          CLOUDFLARE_WORKERS_AI_SYNC_API_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_AI_SYNC_API_TOKEN }}

      - name: Validate models
        run: bun validate

      - name: Prepare changes
        id: changes
        env:
          OUT: ${{ runner.temp }}/sync
          PROVIDER: ${{ matrix.provider }}
          NAME: ${{ matrix.name }}
        run: |
          set -euo pipefail
          tee -a "$GITHUB_STEP_SUMMARY" < .sync/model-sync-report.md >/dev/null

          if [ -z "$(git status --porcelain -- models providers)" ]; then
            echo "No model catalog changes found."
            exit 0
          fi

          mkdir -p "$OUT"
          git add models providers
          git -c user.name=sync -c user.email=sync@localhost commit -q --no-verify -m sync
          git diff --binary HEAD^ HEAD > "$OUT/changes.patch"
          GITHUB_OUTPUT="$RUNNER_TEMP/auto-merge" bun sync:auto-merge HEAD^ HEAD
          sed -n 's/^safe=//p' "$RUNNER_TEMP/auto-merge" | tr -d '\n' > "$OUT/safe"
          printf '%s' "$PROVIDER" > "$OUT/provider"
          printf '%s' "$NAME" > "$OUT/name"
          cp .sync/model-sync-report.md "$OUT/report.md"
          echo "changed=true" >> "$GITHUB_OUTPUT"

      - name: Upload changes
        if: steps.changes.outputs.changed == 'true'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sync-${{ matrix.provider }}
          path: ${{ runner.temp }}/sync
          if-no-files-found: error
          retention-days: 1

  publish:
    needs: [providers, sync]
    # Runs when some provider syncs failed, so the others still publish.
    if: always() && github.repository == 'anomalyco/models.dev' && needs.providers.result == 'success'
    runs-on: ubuntu-latest
    environment: automation

    steps:
      - name: Create app token
        id: app
        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
        with:
          app-id: ${{ vars.AUTOMATION_APP_ID }}
          private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
          repositories: models.dev
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - name: Check out publish scripts
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: ${{ github.sha }}
          path: trusted
          sparse-checkout: /.github/sync-models/
          sparse-checkout-cone-mode: false
          persist-credentials: false

      # Holds the push credential; nothing from this checkout runs.
      - name: Check out dev
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          ref: dev
          path: repo
          token: ${{ steps.app.outputs.token }}

      - name: Download changes
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: ${{ runner.temp }}/sync
          pattern: sync-*

      - name: Publish
        working-directory: repo
        env:
          GH_TOKEN: ${{ steps.app.outputs.token }}
          GH_REPO: ${{ github.repository }}
          SLUG: ${{ steps.app.outputs.app-slug }}
        run: |
          set -uo pipefail
          BOT_NAME="${SLUG}[bot]"
          BOT_EMAIL="$(gh api "/users/${SLUG}%5Bbot%5D" --jq .id)+${SLUG}[bot]@users.noreply.github.com" || exit 1
          export BOT_NAME BOT_EMAIL
          failed=0
          for dir in "$RUNNER_TEMP"/sync/sync-*/; do
            [ -d "$dir" ] || continue
            bash ../trusted/.github/sync-models/publish.sh "$dir" || failed=1
          done
          exit "$failed"