openviking 0.2.3.dev4__tar.gz → 0.2.4.dev33__tar.gz

openviking-0.2.4.dev33/.github/workflows/_build.yml

@@ -0,0 +1,419 @@
+name: 15. _Build Distribution
+
+on:
+  workflow_call:
+    inputs:
+      os_json:
+        description: 'JSON string of runner labels to build on (ubuntu-latest=x86_64, macos-latest=arm64, macos-15-intel=x86_64, windows-latest=x86_64)'
+        required: false
+        type: string
+        default: '["ubuntu-latest", "macos-latest", "macos-15-intel", "windows-latest"]'
+      python_json:
+        description: 'JSON string of Python versions'
+        required: false
+        type: string
+        default: '["3.10", "3.11", "3.12", "3.13"]'
+      build_sdist:
+        description: 'Whether to build source distribution'
+        required: false
+        type: boolean
+        default: true
+      build_wheels:
+        description: 'Whether to build wheel distribution'
+        required: false
+        type: boolean
+        default: true
+  workflow_dispatch:
+    inputs:
+      build_sdist:
+        description: 'Whether to build source distribution'
+        required: false
+        type: boolean
+        default: true
+      build_wheels:
+        description: 'Whether to build wheel distribution'
+        required: false
+        type: boolean
+        default: true
+      os_json:
+        description: 'JSON string of runner labels to build on (ubuntu-latest=x86_64, macos-latest=arm64, macos-15-intel=x86_64, windows-latest=x86_64)'
+        required: false
+        default: '["ubuntu-latest", "macos-latest", "macos-15-intel", "windows-latest"]'
+      python_json:
+        description: 'JSON string of Python versions'
+        required: false
+        default: '["3.10", "3.11", "3.12", "3.13"]'
+
+jobs:
+  build-sdist:
+    name: Build source distribution py3.12
+    if: inputs.build_sdist
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: recursive
+        fetch-depth: 0  # Required for setuptools_scm to detect version from git tags
+
+    - name: Fetch all tags
+      run: git fetch --force --tags
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.12'
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
+
+    - name: Create venv
+      run: uv venv
+
+    - name: Install build dependencies
+      run: uv pip install build setuptools_scm
+
+    - name: Clean workspace (force ignore dirty)
+      shell: bash
+      run: |
+        git reset --hard HEAD
+        git clean -fd
+        # For sdist, ensure local runtime binaries are not packaged even if present
+        rm -rf openviking/bin openviking/lib third_party/agfs/bin || true
+        rm -f openviking/storage/vectordb/*.so openviking/storage/vectordb/*.dylib openviking/storage/vectordb/*.dll openviking/storage/vectordb/*.exe || true
+        rm -rf openviking/_version.py openviking.egg-info
+        # Ignore uv.lock changes to avoid dirty state in setuptools_scm
+        git update-index --assume-unchanged uv.lock || true
+
+    - name: Debug Git and SCM
+      shell: bash
+      run: |
+        echo "=== Git Describe ==="
+        git describe --tags --long --dirty --always
+        echo "=== Setuptools SCM Version ==="
+        uv run --frozen python -m setuptools_scm
+        echo "=== Git Status (Ignored included) ==="
+        git status --ignored
+        echo "=== Check openviking/_version.py ==="
+        if [ -f openviking/_version.py ]; then cat openviking/_version.py; else echo "Not found"; fi
+
+    - name: Build sdist
+      run: uv run --frozen python -m build --sdist
+
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v7
+      with:
+        name: python-package-distributions-sdist
+        path: dist/*.tar.gz
+
+    - name: Display built sdist version
+      continue-on-error: true
+      run: |
+        VERSION=$(ls dist/*.tar.gz | head -n 1 | xargs basename | sed -E 's/^[^-]+-(.+)\.tar\.gz$/\1/')
+        echo "Build Version: $VERSION"
+        echo "::notice::Build sdist Version: $VERSION"
+
+  build-linux:
+    name: Build distribution on Linux (glibc 2.31) py${{ matrix.python-version }}
+    # Only run if inputs.os_json contains 'ubuntu' or 'linux'
+    if: inputs.build_wheels && (contains(inputs.os_json, 'ubuntu') || contains(inputs.os_json, 'linux'))
+    runs-on: ubuntu-latest
+    container: ubuntu:20.04
+    env:
+      DEBIAN_FRONTEND: noninteractive
+      TZ: Etc/UTC
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ${{ fromJson(inputs.python_json) }}
+    
+    steps:
+    - name: Install system dependencies (Linux)
+      run: |
+        # Replace archive.ubuntu.com with azure.archive.ubuntu.com for better stability in GH Actions
+        sed -i 's/http:\/\/archive.ubuntu.com\/ubuntu\//http:\/\/azure.archive.ubuntu.com\/ubuntu\//g' /etc/apt/sources.list
+        # Retry apt-get update
+        for i in 1 2 3 4 5; do apt-get update && break || sleep 5; done
+        apt-get install -y \
+          git ca-certificates cmake build-essential tzdata curl \
+          libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev \
+          libffi-dev liblzma-dev libgdbm-dev libnss3-dev libncurses5-dev \
+          libncursesw5-dev tk-dev uuid-dev libexpat1-dev
+        ln -fs /usr/share/zoneinfo/Etc/UTC /etc/localtime
+        dpkg-reconfigure -f noninteractive tzdata
+
+    - uses: actions/checkout@v6
+      with:
+        submodules: recursive
+        fetch-depth: 0  # Required for setuptools_scm to detect version from git tags
+
+    - name: Fetch all tags
+      run: |
+        git config --global --add safe.directory "$GITHUB_WORKSPACE"
+        git fetch --force --tags
+
+    - name: Build CPython (Dynamic Selection)
+      run: |
+        # Map short version to full version for our specific build environment
+        PYTHON_VERSION="${{ matrix.python-version }}"
+        case "$PYTHON_VERSION" in
+          "3.9") PYTHON_FULL="3.9.18" ;;
+          "3.10") PYTHON_FULL="3.10.13" ;;
+          "3.11") PYTHON_FULL="3.11.8" ;;
+          "3.12") PYTHON_FULL="3.12.2" ;;
+          "3.13") PYTHON_FULL="3.13.2" ;;
+          *)
+            echo "Error: Unknown python version $PYTHON_VERSION"
+            exit 1
+            ;;
+        esac
+        
+        PYTHON_PREFIX="/opt/python/${PYTHON_FULL}"
+        PYTHON_BIN="${PYTHON_PREFIX}/bin/python${{ matrix.python-version }}"
+        if [ ! -x "$PYTHON_BIN" ]; then
+          curl -fsSL -o /tmp/Python-${PYTHON_FULL}.tgz \
+            https://www.python.org/ftp/python/${PYTHON_FULL}/Python-${PYTHON_FULL}.tgz
+          tar -xzf /tmp/Python-${PYTHON_FULL}.tgz -C /tmp
+          cd /tmp/Python-${PYTHON_FULL}
+          CFLAGS="-fPIC" \
+          ./configure --prefix="${PYTHON_PREFIX}" --with-ensurepip=install --enable-shared
+          make -j"$(nproc)"
+          make install
+        fi
+        echo "PYTHON_BIN=${PYTHON_BIN}" >> "$GITHUB_ENV"
+        echo "LD_LIBRARY_PATH=${PYTHON_PREFIX}/lib:${LD_LIBRARY_PATH}" >> "$GITHUB_ENV"
+        export LD_LIBRARY_PATH="${PYTHON_PREFIX}/lib:${LD_LIBRARY_PATH}"
+        "$PYTHON_BIN" -V
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: '1.25.1'
+
+    - name: Set up Rust
+      uses: dtolnay/rust-toolchain@v1
+      with:
+        toolchain: stable
+    - name: Install uv
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
+
+    - name: Create venv (Linux)
+      run: uv venv --python "$PYTHON_BIN"
+
+    - name: Seed pip (Linux)
+      run: uv run python -m ensurepip --upgrade
+
+    - name: Install dependencies
+      run: uv sync --frozen
+
+    - name: Install build dependencies
+      run: uv pip install setuptools setuptools_scm pybind11 cmake wheel build
+
+    - name: Build Rust CLI (Linux)
+      run: cargo build --release --target x86_64-unknown-linux-gnu -p ov_cli
+
+    - name: Copy Rust CLI binary (Linux)
+      run: |
+        mkdir -p openviking/bin
+        cp target/x86_64-unknown-linux-gnu/release/ov openviking/bin/
+        chmod +x openviking/bin/ov
+    - name: Clean workspace (force ignore dirty)
+      shell: bash
+      run: |
+        git reset --hard HEAD
+        git clean -fd
+        rm -rf openviking/_version.py openviking.egg-info
+        # Ignore uv.lock changes to avoid dirty state in setuptools_scm
+        git update-index --assume-unchanged uv.lock || true
+
+    - name: Debug Git and SCM
+      shell: bash
+      run: |
+        echo "=== Git Describe ==="
+        git describe --tags --long --dirty --always
+        echo "=== Setuptools SCM Version ==="
+        uv run --frozen python -m setuptools_scm
+        echo "=== Git Status (Ignored included) ==="
+        git status --ignored
+        echo "=== Check openviking/_version.py ==="
+        if [ -f openviking/_version.py ]; then cat openviking/_version.py; else echo "Not found"; fi
+
+    - name: Build package (Wheel Only)
+      run: uv run --frozen python -m build --wheel
+
+    - name: Install patchelf (Linux)
+      run: |
+        PATCHELF_VERSION=0.18.0
+        curl -fsSL -o /tmp/patchelf-${PATCHELF_VERSION}.tar.gz \
+          https://github.com/NixOS/patchelf/releases/download/${PATCHELF_VERSION}/patchelf-${PATCHELF_VERSION}.tar.gz
+        tar -xzf /tmp/patchelf-${PATCHELF_VERSION}.tar.gz -C /tmp
+        cd /tmp/patchelf-${PATCHELF_VERSION}
+        ./configure
+        make -j"$(nproc)"
+        make install
+        patchelf --version
+
+    - name: Repair wheels (Linux)
+      run: |
+        uv pip install auditwheel
+        # Repair wheels and output to a temporary directory
+        uv run auditwheel repair dist/*.whl -w dist_fixed
+        # Remove original non-compliant wheels
+        rm dist/*.whl
+        # Move repaired wheels back to dist
+        mv dist_fixed/*.whl dist/
+        rmdir dist_fixed
+
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v7
+      with:
+        name: python-package-distributions-linux-${{ matrix.python-version }}
+        path: dist/
+
+    - name: Display built wheel version
+      continue-on-error: true
+      run: |
+        VERSION=$(ls dist/*.whl | head -n 1 | xargs basename | cut -d- -f2)
+        echo "Build Version: $VERSION"
+        echo "::notice::Build Wheel Version (Linux py${{ matrix.python-version }}): $VERSION"
+
+  build-other:
+    name: Build distribution on ${{ matrix.os == 'macos-latest' && 'macOS arm64 (macos-latest)' || matrix.os == 'macos-15-intel' && 'macOS x86_64 (macos-15-intel)' || matrix.os == 'windows-latest' && 'Windows x86_64 (windows-latest)' || matrix.os }} py${{ matrix.python-version }}
+    # Filter out ubuntu-latest from this job since it's handled by build-linux
+    if: inputs.build_wheels
+    runs-on: ${{ matrix.os || 'ubuntu-latest' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJson(inputs.os_json) }}
+        python-version: ${{ fromJson(inputs.python_json) }}
+        # Exclude ubuntu-latest from this matrix if it was passed in inputs
+        exclude:
+          - os: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: recursive
+        fetch-depth: 0  # Required for setuptools_scm to detect version from git tags
+
+    - name: Fetch all tags
+      run: git fetch --force --tags
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Configure macOS wheel architecture tag
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        if [[ "${{ matrix.os }}" == "macos-15-intel" ]]; then
+          TARGET_ARCH="x86_64"
+        else
+          TARGET_ARCH="arm64"
+        fi
+
+        MACOS_VERSION="$(python - <<'PY'
+        import platform
+        ver = platform.mac_ver()[0].split(".")
+        major = ver[0] if ver and ver[0] else "15"
+        minor = ver[1] if len(ver) > 1 else "0"
+        print(f"{major}.{minor}")
+        PY
+        )"
+
+        echo "ARCHFLAGS=-arch ${TARGET_ARCH}" >> "$GITHUB_ENV"
+        echo "CMAKE_OSX_ARCHITECTURES=${TARGET_ARCH}" >> "$GITHUB_ENV"
+        echo "_PYTHON_HOST_PLATFORM=macosx-${MACOS_VERSION}-${TARGET_ARCH}" >> "$GITHUB_ENV"
+        echo "Configured macOS wheel platform: macosx-${MACOS_VERSION}-${TARGET_ARCH}"
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: '1.25.1'
+
+    - name: Set up Rust
+      uses: dtolnay/rust-toolchain@v1
+      with:
+        toolchain: stable
+    - name: Install uv
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
+
+    - name: Install system dependencies (macOS)
+      if: runner.os == 'macOS'
+      run: brew install cmake
+
+    - name: Install system dependencies (Windows)
+      if: runner.os == 'Windows'
+      run: |
+        choco install cmake --installargs 'ADD_CMAKE_TO_PATH=System'
+        choco install mingw
+
+    - name: Install dependencies
+      run: uv sync --frozen
+
+    - name: Install build dependencies
+      run: uv pip install setuptools setuptools_scm pybind11 cmake wheel build
+
+    - name: Build Rust CLI (macOS/Windows)
+      shell: bash
+      run: |
+        if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
+          cargo build --release --target x86_64-pc-windows-msvc -p ov_cli
+        else
+          cargo build --release -p ov_cli
+        fi
+
+    - name: Copy Rust CLI binary (macOS/Windows)
+      shell: bash
+      run: |
+        mkdir -p openviking/bin
+        if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
+          cp target/x86_64-pc-windows-msvc/release/ov.exe openviking/bin/
+        else
+          cp target/release/ov openviking/bin/
+          chmod +x openviking/bin/ov
+        fi
+    - name: Clean workspace (force ignore dirty)
+      shell: bash
+      run: |
+        git reset --hard HEAD
+        git clean -fd
+        rm -rf openviking/_version.py openviking.egg-info
+        # Ignore uv.lock changes to avoid dirty state in setuptools_scm
+        git update-index --assume-unchanged uv.lock || true
+
+    - name: Debug Git and SCM
+      shell: bash
+      run: |
+        echo "=== Git Describe ==="
+        git describe --tags --long --dirty --always
+        echo "=== Setuptools SCM Version ==="
+        uv run --frozen python -m setuptools_scm
+        echo "=== Git Status (Ignored included) ==="
+        git status --ignored
+        echo "=== Check openviking/_version.py ==="
+        if [ -f openviking/_version.py ]; then cat openviking/_version.py; else echo "Not found"; fi
+
+    - name: Build package (Wheel Only)
+      run: uv run --frozen python -m build --wheel
+
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v7
+      with:
+        name: python-package-distributions-${{ matrix.os == 'macos-latest' && 'macos-arm64' || matrix.os == 'macos-15-intel' && 'macos-x86_64' || matrix.os == 'windows-latest' && 'windows-x86_64' || matrix.os }}-${{ matrix.python-version }}
+        path: dist/
+
+    - name: Display built wheel version
+      shell: bash
+      continue-on-error: true
+      run: |
+        VERSION=$(ls dist/*.whl | head -n 1 | xargs basename | cut -d- -f2)
+        echo "Build Version: $VERSION"
+        echo "::notice::Build Wheel Version (${{ matrix.os == 'macos-latest' && 'macOS arm64 (macos-latest)' || matrix.os == 'macos-15-intel' && 'macOS x86_64 (macos-15-intel)' || matrix.os == 'windows-latest' && 'Windows x86_64 (windows-latest)' || matrix.os }} py${{ matrix.python-version }}): $VERSION"

openviking-0.2.4.dev33/.github/workflows/_publish.yml

@@ -0,0 +1,157 @@
+name: 16. _Publish Distribution
+
+on:
+  workflow_call:
+    inputs:
+      target:
+        description: 'Publish Target'
+        required: false
+        type: string
+        default: 'pypi'  # Callers (like release.yml) typically want PyPI
+      build_run_id:
+        description: 'Build Workflow Run ID (Optional, defaults to current run)'
+        required: false
+        type: string
+        default: ''
+  workflow_dispatch:
+    inputs:
+      target:
+        description: 'Select where to publish'
+        required: true
+        type: choice
+        default: 'testpypi'
+        options:
+        - testpypi
+        - pypi
+        - both
+      build_run_id:
+        description: 'Build Workflow Run ID (Required for manual dispatch, find it in the Build run URL)'
+        required: true
+        type: string
+
+jobs:
+  permission-check:
+    name: Check write permission
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      allowed: ${{ steps.check.outputs.allowed }}
+    steps:
+    - name: Verify actor permission
+      id: check
+      uses: actions/github-script@v8
+      with:
+        script: |
+          // Only check permission for manual dispatch
+          if (context.eventName !== 'workflow_dispatch') {
+            core.setOutput('allowed', 'true');
+            return;
+          }
+          const { owner, repo } = context.repo;
+          const actor = context.actor;
+          const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+            owner,
+            repo,
+            username: actor,
+          });
+          const perm = data.permission;
+          core.info(`Actor ${actor} permission: ${perm}`);
+          const allowed = ['admin', 'maintain', 'write'].includes(perm);
+          core.setOutput('allowed', allowed ? 'true' : 'false');
+          if (!allowed) {
+            core.setFailed(`User ${actor} does not have write permission`);
+          }
+
+  publish-testpypi:
+    name: Publish to TestPyPI
+    needs: [permission-check]
+    if: >-
+      needs.permission-check.outputs.allowed == 'true' &&
+      (inputs.target == 'testpypi' || inputs.target == 'both')
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/openviking
+    permissions:
+      id-token: write
+      actions: read  # Required for downloading artifacts from other runs
+
+    steps:
+    - name: Download all the dists (Same Run)
+      if: inputs.build_run_id == ''
+      uses: actions/download-artifact@v8
+      with:
+        pattern: python-package-distributions-*
+        path: dist/
+        merge-multiple: true
+
+    - name: Download all the dists (Cross Run)
+      if: inputs.build_run_id != ''
+      uses: actions/download-artifact@v8
+      with:
+        run-id: ${{ inputs.build_run_id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        pattern: python-package-distributions-*
+        path: dist/
+        merge-multiple: true
+
+    - name: Publish distribution to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        skip-existing: true
+        verbose: true
+
+    - name: Display published version
+      run: |
+        # Get version from the first wheel file found
+        VERSION=$(ls dist/*.whl | head -n 1 | xargs basename | cut -d- -f2)
+        echo "Published to TestPyPI (or already existed) with version: $VERSION"
+        echo "::notice::Published to TestPyPI (or already existed) with version: $VERSION"
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: [permission-check]
+    if: >-
+      needs.permission-check.outputs.allowed == 'true' &&
+      (inputs.target == 'pypi' || inputs.target == 'both')
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/openviking
+    permissions:
+      id-token: write
+      actions: read  # Required for downloading artifacts from other runs
+
+    steps:
+    - name: Download all the dists (Same Run)
+      if: inputs.build_run_id == ''
+      uses: actions/download-artifact@v8
+      with:
+        pattern: python-package-distributions-*
+        path: dist/
+        merge-multiple: true
+
+    - name: Download all the dists (Cross Run)
+      if: inputs.build_run_id != ''
+      uses: actions/download-artifact@v8
+      with:
+        run-id: ${{ inputs.build_run_id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        pattern: python-package-distributions-*
+        path: dist/
+        merge-multiple: true
+
+    - name: Publish distribution to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        skip-existing: true
+        verbose: true
+
+    - name: Display published version
+      run: |
+        # Get version from the first wheel file found
+        VERSION=$(ls dist/*.whl | head -n 1 | xargs basename | cut -d- -f2)
+        echo "Published to PyPI (or already existed) with version: $VERSION"
+        echo "::notice::Published to PyPI (or already existed) with version: $VERSION"

openviking-0.2.4.dev33/.github/workflows/build-docker-image.yml

@@ -0,0 +1,65 @@
+name: Build and Push Docker Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "application version for OpenViking"
+        required: true
+        type: string
+  push:
+    branches: [ "main" ]
+    tags: [ "v*.*.*" ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.ref_type == 'tag' || github.event_name == 'workflow_dispatch' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            # fallback to 0.0.0 if no version is provided
+            OPENVIKING_VERSION=${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.version) || (github.ref_type == 'tag' && github.ref_name) || '0.0.0' }}

openviking-0.2.4.dev33/.github/workflows/pr-review.yml

@@ -0,0 +1,41 @@
+name: PR Review (Doubao)
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  issue_comment:
+
+jobs:
+  pr_review:
+    if: ${{ github.event.sender.type != 'Bot' }}
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+      contents: write
+    steps:
+      - name: PR Agent
+        uses: qodo-ai/pr-agent@main
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENAI_KEY: ${{ secrets.DOUBAO_API_KEY }}
+          OPENAI.API_BASE: "https://ark.cn-beijing.volces.com/api/v3"
+          config.model: "openai/doubao-seed-2-0-code-preview-260215"
+          config.custom_model_max_tokens: 131072
+          github_action_config.auto_review: "true"
+          github_action_config.auto_describe: "false"
+          github_action_config.auto_improve: "true"
+          pr_reviewer.extra_instructions: >
+            Classify each finding with a severity tag:
+            [Bug] = Must fix: behavioral regression, logic error, security vulnerability, data loss/corruption, resource leak, API contract violation.
+            [Suggestion] = Recommended: missing tests, dead code, inconsistency, poor observability, unclear intent, unrelated changes, performance issues (N+1 queries, redundant computation in loops, unnecessary large object copies, unbounded collection growth).
+
+            Review focus areas:
+            1. Control Flow - are all branches reachable? errors propagated correctly? unintended fall-through?
+            2. Data Flow - input validated at boundaries? implicit type coercion? null/empty handled?
+            3. Integration Points - API changes backward compatible? config defaults sensible? dependencies pinned?
+            4. Concurrency - shared state synchronized? execution order assumptions valid? cleanup in all paths?
+
+            Be specific: reference exact variable names, function calls, conditions.
+            When suggesting a fix, include a code block with the recommended change.
+            Match the language of the PR (Chinese PR = Chinese comments, English PR = English comments).