onyx/.github/workflows/weekly-models-dev-price-sync.yml

### Syncs the models.dev catalog (enriched by litellm and the OpenRouter
### model list, which also marks endpoint-less router models "unbounded")
### into the vendored snapshot at backend/onyx/llm/price_table/ — one file
### per provider, generated by backend/scripts/sync_price_table.py — and
### opens a reviewed PR when upstream data changed.

name: Sync models.dev Price Table

on:
  schedule:
    - cron: "0 15 * * 1" # weekly, Monday 15:00 UTC (off the 14:00 vendored-skills slot)
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: sync-models-dev-price-table
  cancel-in-progress: false

jobs:
  sync-price-table:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Mint GitHub App installation token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ vars.CHERRY_PICK_APP_ID }}
          private-key: ${{ secrets.CHERRY_PICK_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v6
        with:
          persist-credentials: true
          ref: main
          token: ${{ steps.app-token.outputs.token }}

      - name: Configure git identity as App
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          bot_user_id="$(gh api "/users/${APP_SLUG}[bot]" --jq .id)"
          git config user.name "${APP_SLUG}[bot]"
          git config user.email "${bot_user_id}+${APP_SLUG}[bot]@users.noreply.github.com"

      - name: Sync price table from models.dev
        id: sync
        run: |
          python3 backend/scripts/sync_price_table.py
          if [ -n "$(git status --porcelain backend/onyx/llm/price_table)" ]; then
            git add backend/onyx/llm/price_table
            git commit -m "chore: sync models.dev price table" \
              -m "Generated by backend/scripts/sync_price_table.py"
            echo "changed=true" >> "${GITHUB_OUTPUT}"
          fi

      - name: Open or update PR
        id: pr
        if: steps.sync.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        # Fixed branch + force-push: an already-open sync PR should be
        # refreshed with the newest upstream state, not left stale.
        run: |
          branch="auto/models-dev-price-sync"
          title="$(git log -1 --format=%s)"
          git switch -C "${branch}"
          git push --force origin "${branch}"

          pr_number="$(gh pr list --state open --head "${branch}" --json number --jq '.[0].number')"
          if [ -n "${pr_number}" ]; then
            gh pr edit "${pr_number}" --title "${title}"
            echo "Refreshed existing PR #${pr_number} via force-push."
          else
            gh pr create \
              --base main \
              --head "${branch}" \
              --title "${title}" \
              --body "Generated by the [Sync models.dev Price Table workflow run](${RUN_URL}) via \`backend/scripts/sync_price_table.py\`. Review the diff for upstream price/model changes before merging."
            pr_number="$(gh pr list --state open --head "${branch}" --json number --jq '.[0].number')"
          fi
          if [ -n "${pr_number}" ]; then
            gh pr edit "${pr_number}" --add-reviewer rohoswagger \
              || echo "::warning::Could not request review on PR #${pr_number}"
          fi
          echo "pr_number=${pr_number}" >> "${GITHUB_OUTPUT}"

      # Ping the owner in #ai-pr-reviews so the PR gets reviewed. Non-fatal:
      # the PR is the artifact; a Slack hiccup must not fail the run.
      #
      # The job checks out main for the sync, so the action loads from a
      # separate checkout of this run's own sha — which carries the action.
      - name: Checkout Slack actions
        id: slack-actions
        if: steps.pr.outputs.pr_number != ''
        continue-on-error: true # notification-only; a checkout outage must not fail the run
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v6
        with:
          persist-credentials: false
          ref: ${{ github.sha }}
          path: .ci-actions
          sparse-checkout: .github/actions

      - name: Post PR to Slack for review
        if: steps.pr.outputs.pr_number != '' && steps.slack-actions.outcome == 'success'
        continue-on-error: true
        uses: ./.ci-actions/.github/actions/slack-post-message
        with:
          bot-token: ${{ secrets.CVE_REVIEWS_BOT_TOKEN }}
          channel: C0C6T9W2U3X # #ai-pr-reviews
          mention: rohoswagger
          text: |
            models.dev price sync PR ready for review {mention}
            *PR:* <${{ github.server_url }}/${{ github.repository }}/pull/${{ steps.pr.outputs.pr_number }}|#${{ steps.pr.outputs.pr_number }}>
            *Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|workflow run>

  notify-slack-on-failure:
    needs:
      - sync-price-table
    if: always() && needs.sync-price-table.result == 'failure'
    runs-on: ubuntu-latest
    environment: ci-protected
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: .github/actions/slack-notify

      - name: Notify Slack about sync failure
        uses: ./.github/actions/slack-notify
        with:
          webhook-url: ${{ secrets.MONITOR_DEPLOYMENTS_WEBHOOK }}
          title: "🚨 Sync models.dev Price Table workflow failed"
          details: "*The weekly models.dev price table sync failed.* Check the run logs."