dsh-github-ci

Readme

# dsh-github-ci

GitHub Actions CI manager for [DeepSeek Harness](https://github.com/deepseek-ai/dsh) — a live pipeline dashboard in the web UI plus a `github_ci` agent tool.

## Features

- **Pipeline dashboard** — floating overlay (or Settings page) with pass/failed/running summary, status badges, and per-run actions
- **Sign in two ways** — GitHub OAuth **device flow** (no client secret; needs an OAuth App with *Enable Device Flow* checked) or a Personal Access Token (`repo` + `workflow` scopes)
- **Repo browser** — list your own repos (private + org) or search any public user/org, pick from a dropdown
- **Run actions** — cancel in-progress runs, rerun failed jobs, open on GitHub
- **Run logs** — failed-step detection with log tails, surfaced to the agent
- **`github_ci` agent tool** — the agent can list workflows/runs, inspect jobs, pull log tails, trigger workflows, cancel and rerun
- **Fix with Agent** — one click drafts a structured debug request (run metadata + failure logs) into the chat composer
- **Bad-credential recovery** — a rejected token flips the panel back to sign-in with a source-specific explanation (OAuth re-auth vs. paste a new PAT)

## Install

```
dsh plugin --profile web add dsh-github-ci
```

From source instead:

```
dsh plugin --profile web add github:knownasmobin/dsh-github-ci
```

## Setup

### Option A — OAuth device flow (recommended)

1. Open [GitHub Developer Settings → OAuth Apps](https://github.com/settings/developers) → **New OAuth App**
2. Name: anything. Homepage / callback URL: `http://127.0.0.1:3080`
3. **Check "Enable Device Flow"** (required — the endpoint returns 404 without it)
4. Register, copy the **Client ID** (no secret needed)
5. Open the panel (⚙ CI in the chat header or sidebar foot) → OAuth tab → paste Client ID → **Start OAuth** → enter the code at the GitHub activation page

The token is stored in the DSH credential store and reused across sessions.

### Option B — Personal Access Token

Generate a token at [github.com/settings/tokens](https://github.com/settings/tokens) with **repo** and **workflow** scopes, then paste it in the panel's PAT tab.

No sign-in is required to browse **public** repositories — anonymous read works out of the box.

## Agent tool

```
github_ci({ action: "list_workflows", owner: "vercel", repo: "next.js" })
github_ci({ action: "get_logs", repo: "owner/repo", run_id: 123456789 })
github_ci({ action: "trigger", owner, repo, workflow_id: "deploy.yml", ref: "main" })
```

Actions: `list_workflows`, `list_runs`, `get_run`, `get_jobs`, `get_logs`, `trigger`, `cancel`, `rerun`.

## How it works

- **Host half** registers REST routes on the harness web server and the `github_ci` model tool; GitHub calls go out via `fetch` with per-request timeouts
- **Client half** mounts the dashboard into shell slots (session header, sidebar, overlay, settings) and bridges prompts into the chat composer
- **Credentials** live in the DSH credential store — never in the source tree

## License

MIT