Skip to content

ci: run the affected evals on pull requests and every eval weekly - #119

Draft
JakeSCahill wants to merge 1 commit into
mainfrom
ci/evals
Draft

JakeSCahill wants to merge 1 commit into
mainfrom
ci/evals

Conversation

@JakeSCahill

Copy link
Copy Markdown
Contributor

Adds .github/workflows/evals.yml, which runs the skill evals in CI.

  • Pull requests from branches of this repository run the cases the change reaches, in the baseline, skill, and installed arms, 3 runs each. A skill change runs its suite. A suite edit runs that suite. A change to redpanda-docs runs every suite's How to work cases. A change to the runner, its scripts, or the workflow runs a two-case smoke set. A pull request runs at most 20 cases; the cap drops only advisory cases.
  • The check fails when a How to work case (the case ids in each skill's SOURCES.md "How to work" table) is passed by the baseline in more than a third of its runs, is passed by the skill or installed arm in fewer than two thirds, or has too many errored runs to tell. Other cases are reported only.
  • Pull requests from forks cannot get the workflow's credentials. They get a notice, and a maintainer runs the cases.
  • A weekly sweep (and manual runs) runs every suite in every arm and lists any How to work case whose baseline now passes.
  • Results go to the job summary and to artifacts. Subject responses are not printed to the log, and the runner now redacts credentials from an errored run's reason.

Model calls go through the Redpanda AI Gateway with a token minted per job from GitHub OIDC; there is no API key fallback. All actions are pinned by commit SHA, checkouts do not persist credentials, and only the job that runs the evals can request an OIDC token.

evals/scripts/ci.mjs holds the selection and the gating rule, with tests in evals/scripts/ci.test.mjs (node --test evals/scripts/ci.test.mjs).

Needs, before the evals can run: this repository's AWS role and its two secrets, and the gateway agent. Until then the eval jobs fail at authentication.

Draft until the credentials exist.

Same-repository pull requests run the cases their change can reach in
the baseline, skill, and installed arms, 3 runs each. A How to work case
named in a skill's SOURCES.md fails the check when the baseline passes
it, when a skill arm fails it, or when too many runs errored to tell.
Other cases are reported only. Harness and workflow changes run a small
smoke set chosen by rule. Fork pull requests get a notice.

A weekly sweep runs every suite in every arm and lists any How to work
case whose baseline now passes. Results go to the job summary and to
artifacts only.

Model calls go through the AI Gateway with a per-job token minted from
OIDC and Secrets Manager, with no API key fallback. The runner now
redacts credentials from a run's error reason.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant