Test
4a34c8e672
Implements AWS AssumeRole-like pattern for Poimen: - User/service requests temporary access with identity + scope - AssumeRoleActivity exchanges credentials with OAuth2 auth server - Returns JWT token valid for limited time (default: 1hr, max: 24hrs) - Token used in all subsequent LLM API calls to api.riotpiao.com Key features: - Credentials from vault/K8s secrets (never hardcoded) - Scope-based access control (llm:read, llm:read llm:write, llm:admin) - Automatic token expiration tracking - Retry support for transient auth failures (2x, 1.5s backoff) - Configurable auth server endpoint Usage pattern: 1. AssumeRoleActivity(identity, scope) → JWT token 2. LLMRouter uses token in LLMAuth config 3. All activity calls validated against token + scopes 4. Workflow optionally refreshes token before expiry Security: - No credentials in code/logs (env or vault only) - Short-lived tokens (1hr default, 24hr max) - Server-enforced scope validation - Token revocation support Activity registered: #10 (authentication category) Knowledge base updated with full activity spec New file: action/assume_role.go (5.2 KB)
495 lines
14 KiB
JSON
495 lines
14 KiB
JSON
{
|
|
"version": "1.0",
|
|
"activities": [
|
|
{
|
|
"name": "CloneRepoActivity",
|
|
"description": "Clone a Git repository to the worker filesystem",
|
|
"category": "repository",
|
|
"inputs": {
|
|
"repo": {
|
|
"type": "string",
|
|
"description": "Git repository URL",
|
|
"required": true
|
|
},
|
|
"branch": {
|
|
"type": "string",
|
|
"description": "Git branch to clone (default: main)",
|
|
"required": false,
|
|
"default": "main"
|
|
},
|
|
"depth": {
|
|
"type": "integer",
|
|
"description": "Shallow clone depth (optional)",
|
|
"required": false
|
|
}
|
|
},
|
|
"outputs": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Local filesystem path where repo was cloned"
|
|
},
|
|
"commit": {
|
|
"type": "string",
|
|
"description": "Current commit hash"
|
|
},
|
|
"branch": {
|
|
"type": "string",
|
|
"description": "Current branch name"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "5m",
|
|
"isFlaky": false,
|
|
"recommendedRetries": 1,
|
|
"retryBackoff": 1.5,
|
|
"dependencies": [],
|
|
"notes": "Network-dependent, may timeout on slow connections"
|
|
}
|
|
},
|
|
{
|
|
"name": "AnalyzeCodeActivity",
|
|
"description": "Analyze code quality, structure, and metrics using ast-grep and pi CLI",
|
|
"category": "analysis",
|
|
"inputs": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Local filesystem path to analyze",
|
|
"required": true
|
|
},
|
|
"language": {
|
|
"type": "string",
|
|
"description": "Programming language (go, python, javascript, etc)",
|
|
"required": false
|
|
},
|
|
"depth": {
|
|
"type": "integer",
|
|
"description": "Analysis depth (1=shallow, 5=deep)",
|
|
"required": false,
|
|
"default": 3
|
|
}
|
|
},
|
|
"outputs": {
|
|
"quality": {
|
|
"type": "number",
|
|
"description": "Quality score 0-1.0"
|
|
},
|
|
"metrics": {
|
|
"type": "object",
|
|
"description": "Code metrics (LOC, complexity, etc)"
|
|
},
|
|
"issues": {
|
|
"type": "array",
|
|
"description": "List of identified issues"
|
|
},
|
|
"summary": {
|
|
"type": "string",
|
|
"description": "Human-readable analysis summary"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "10m",
|
|
"isFlaky": true,
|
|
"recommendedRetries": 3,
|
|
"retryBackoff": 2.0,
|
|
"dependencies": ["CloneRepoActivity"],
|
|
"notes": "CPU-intensive, can timeout on large repos. Flaky on memory pressure."
|
|
}
|
|
},
|
|
{
|
|
"name": "SecurityScanActivity",
|
|
"description": "Run security scanning (SAST) on codebase",
|
|
"category": "security",
|
|
"inputs": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Local filesystem path to scan",
|
|
"required": true
|
|
},
|
|
"severity": {
|
|
"type": "string",
|
|
"description": "Minimum severity level (low, medium, high, critical)",
|
|
"required": false,
|
|
"default": "medium"
|
|
}
|
|
},
|
|
"outputs": {
|
|
"vulnerabilities": {
|
|
"type": "array",
|
|
"description": "List of vulnerabilities found"
|
|
},
|
|
"securityScore": {
|
|
"type": "number",
|
|
"description": "Security score 0-100"
|
|
},
|
|
"riskLevel": {
|
|
"type": "string",
|
|
"description": "Risk level (low, medium, high, critical)"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "8m",
|
|
"isFlaky": false,
|
|
"recommendedRetries": 2,
|
|
"retryBackoff": 1.5,
|
|
"dependencies": ["CloneRepoActivity"],
|
|
"notes": "Network calls for vulnerability databases may timeout"
|
|
}
|
|
},
|
|
{
|
|
"name": "GenerateReportActivity",
|
|
"description": "Generate comprehensive report from analysis and scan results",
|
|
"category": "reporting",
|
|
"inputs": {
|
|
"analysisResult": {
|
|
"type": "object",
|
|
"description": "Output from AnalyzeCodeActivity",
|
|
"required": true
|
|
},
|
|
"securityResult": {
|
|
"type": "object",
|
|
"description": "Output from SecurityScanActivity",
|
|
"required": true
|
|
},
|
|
"format": {
|
|
"type": "string",
|
|
"description": "Report format (markdown, html, json)",
|
|
"required": false,
|
|
"default": "markdown"
|
|
}
|
|
},
|
|
"outputs": {
|
|
"report": {
|
|
"type": "string",
|
|
"description": "Generated report content"
|
|
},
|
|
"reportPath": {
|
|
"type": "string",
|
|
"description": "Path to saved report file"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "2m",
|
|
"isFlaky": false,
|
|
"recommendedRetries": 1,
|
|
"retryBackoff": 1.0,
|
|
"dependencies": ["AnalyzeCodeActivity", "SecurityScanActivity"],
|
|
"notes": "CPU-light, reliable. Depends on upstream results."
|
|
}
|
|
},
|
|
{
|
|
"name": "DeploymentPreCheckActivity",
|
|
"description": "Validate readiness for deployment (linting, tests, etc)",
|
|
"category": "deployment",
|
|
"inputs": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Local filesystem path to check",
|
|
"required": true
|
|
},
|
|
"checkType": {
|
|
"type": "string",
|
|
"description": "Type of check (lint, test, build, all)",
|
|
"required": false,
|
|
"default": "all"
|
|
}
|
|
},
|
|
"outputs": {
|
|
"passed": {
|
|
"type": "boolean",
|
|
"description": "Whether all checks passed"
|
|
},
|
|
"failures": {
|
|
"type": "array",
|
|
"description": "List of failed checks"
|
|
},
|
|
"warnings": {
|
|
"type": "array",
|
|
"description": "List of warnings"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "15m",
|
|
"isFlaky": true,
|
|
"recommendedRetries": 2,
|
|
"retryBackoff": 2.0,
|
|
"dependencies": ["CloneRepoActivity"],
|
|
"notes": "Very flaky - tests are non-deterministic, network issues, race conditions. Retry 2x."
|
|
}
|
|
},
|
|
{
|
|
"name": "NotifyStatusActivity",
|
|
"description": "Send notifications to Slack, email, or webhook",
|
|
"category": "notification",
|
|
"inputs": {
|
|
"channel": {
|
|
"type": "string",
|
|
"description": "Target channel or email",
|
|
"required": true
|
|
},
|
|
"status": {
|
|
"type": "string",
|
|
"description": "Status to report (success, failure, warning)",
|
|
"required": true
|
|
},
|
|
"message": {
|
|
"type": "string",
|
|
"description": "Message body",
|
|
"required": true
|
|
}
|
|
},
|
|
"outputs": {
|
|
"notificationId": {
|
|
"type": "string",
|
|
"description": "ID of sent notification"
|
|
},
|
|
"timestamp": {
|
|
"type": "string",
|
|
"description": "When notification was sent"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "3m",
|
|
"isFlaky": true,
|
|
"recommendedRetries": 3,
|
|
"retryBackoff": 1.5,
|
|
"dependencies": [],
|
|
"notes": "Network-dependent, may fail due to network or external service issues. Retry 3x."
|
|
}
|
|
},
|
|
{
|
|
"name": "ApproveWorkflowActivity",
|
|
"description": "Human approval step or automated policy check",
|
|
"category": "approval",
|
|
"inputs": {
|
|
"workflowId": {
|
|
"type": "string",
|
|
"description": "ID of workflow awaiting approval",
|
|
"required": true
|
|
},
|
|
"requiredApprovals": {
|
|
"type": "integer",
|
|
"description": "Number of approvals needed (default 1)",
|
|
"required": false,
|
|
"default": 1
|
|
},
|
|
"timeoutMinutes": {
|
|
"type": "integer",
|
|
"description": "Minutes to wait for approval",
|
|
"required": false,
|
|
"default": 60
|
|
}
|
|
},
|
|
"outputs": {
|
|
"approved": {
|
|
"type": "boolean",
|
|
"description": "Whether approved"
|
|
},
|
|
"approver": {
|
|
"type": "string",
|
|
"description": "Who approved (if approved)"
|
|
},
|
|
"timestamp": {
|
|
"type": "string",
|
|
"description": "When approval was given"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "120m",
|
|
"isFlaky": false,
|
|
"recommendedRetries": 1,
|
|
"retryBackoff": 1.0,
|
|
"dependencies": [],
|
|
"notes": "Waits for human input. Long timeout. Cannot retry (user input is irrevocable)."
|
|
}
|
|
},
|
|
{
|
|
"name": "ArchiveResultsActivity",
|
|
"description": "Archive analysis results to cloud storage (S3, GCS)",
|
|
"category": "storage",
|
|
"inputs": {
|
|
"reportPath": {
|
|
"type": "string",
|
|
"description": "Path to report to archive",
|
|
"required": true
|
|
},
|
|
"destination": {
|
|
"type": "string",
|
|
"description": "Cloud destination (s3://bucket/path or gcs://bucket/path)",
|
|
"required": true
|
|
},
|
|
"metadata": {
|
|
"type": "object",
|
|
"description": "Optional metadata tags",
|
|
"required": false
|
|
}
|
|
},
|
|
"outputs": {
|
|
"archiveUrl": {
|
|
"type": "string",
|
|
"description": "URL of archived file"
|
|
},
|
|
"archiveSize": {
|
|
"type": "integer",
|
|
"description": "Size of archived file in bytes"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "5m",
|
|
"isFlaky": true,
|
|
"recommendedRetries": 2,
|
|
"retryBackoff": 1.5,
|
|
"dependencies": [],
|
|
"notes": "Network-dependent. May fail on network issues or service throttling. Retry 2x."
|
|
}
|
|
},
|
|
{
|
|
"name": "RetrieveMemoryActivity",
|
|
"description": "Retrieve relevant knowledge, skills, and lessons from poimen-memory semantic search",
|
|
"category": "memory",
|
|
"inputs": {
|
|
"query": {
|
|
"type": "string",
|
|
"description": "Semantic search query",
|
|
"required": true
|
|
},
|
|
"project": {
|
|
"type": "string",
|
|
"description": "Memory project (default: poimen)",
|
|
"required": false,
|
|
"default": "poimen"
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"description": "Retrieval scope: skills, lessons, references, all",
|
|
"required": false,
|
|
"default": "all"
|
|
},
|
|
"limit": {
|
|
"type": "integer",
|
|
"description": "Max results to return",
|
|
"required": false,
|
|
"default": 10
|
|
},
|
|
"tool": {
|
|
"type": "string",
|
|
"description": "Tool context for skill matching",
|
|
"required": false
|
|
},
|
|
"task": {
|
|
"type": "string",
|
|
"description": "Task description for context retrieval",
|
|
"required": false
|
|
}
|
|
},
|
|
"outputs": {
|
|
"skills": {
|
|
"type": "array",
|
|
"description": "Relevant skills found"
|
|
},
|
|
"lessons": {
|
|
"type": "array",
|
|
"description": "Relevant lessons/knowledge found"
|
|
},
|
|
"references": {
|
|
"type": "array",
|
|
"description": "Reference documents found"
|
|
},
|
|
"totalResults": {
|
|
"type": "integer",
|
|
"description": "Total results found"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "30s",
|
|
"isFlaky": true,
|
|
"recommendedRetries": 2,
|
|
"retryBackoff": 1.5,
|
|
"dependencies": [],
|
|
"notes": "Network-dependent. First activity to run for context-aware routing. Fast timeout."
|
|
}
|
|
},
|
|
{
|
|
"name": "AssumeRoleActivity",
|
|
"description": "Request temporary JWT token for accessing LLM APIs (like AWS AssumeRole)",
|
|
"category": "authentication",
|
|
"inputs": {
|
|
"identity": {
|
|
"type": "string",
|
|
"description": "User/service identity requesting access",
|
|
"required": true,
|
|
"examples": ["[email protected]", "service:poimen-worker"]
|
|
},
|
|
"clientId": {
|
|
"type": "string",
|
|
"description": "OAuth2 client ID (from vault if not provided)",
|
|
"required": false
|
|
},
|
|
"clientSecret": {
|
|
"type": "string",
|
|
"description": "OAuth2 client secret (from vault if not provided)",
|
|
"required": false
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"description": "Scope of access (e.g., 'llm:read' or 'llm:read llm:write')",
|
|
"required": true,
|
|
"examples": ["llm:read", "llm:read llm:write", "llm:admin"]
|
|
},
|
|
"durationSeconds": {
|
|
"type": "integer",
|
|
"description": "Token validity duration in seconds (default: 3600, max: 86400)",
|
|
"required": false,
|
|
"default": 3600
|
|
},
|
|
"authServerUrl": {
|
|
"type": "string",
|
|
"description": "Auth server URL (from AUTH_SERVER_URL env if not provided)",
|
|
"required": false
|
|
}
|
|
},
|
|
"outputs": {
|
|
"token": {
|
|
"type": "string",
|
|
"description": "JWT token for calling api.riotpiao.com"
|
|
},
|
|
"expiresAt": {
|
|
"type": "integer",
|
|
"description": "Token expiration time (Unix timestamp)"
|
|
},
|
|
"expiresIn": {
|
|
"type": "integer",
|
|
"description": "Seconds until token expires"
|
|
},
|
|
"tokenType": {
|
|
"type": "string",
|
|
"description": "Token type (typically 'Bearer')"
|
|
}
|
|
},
|
|
"constraints": {
|
|
"defaultTimeout": "30s",
|
|
"isFlaky": false,
|
|
"recommendedRetries": 2,
|
|
"retryBackoff": 1.5,
|
|
"dependencies": [],
|
|
"notes": "Must run before LLM Router to provide auth token. Call early in workflow."
|
|
}
|
|
}
|
|
],
|
|
"metadata": {
|
|
"totalActivities": 10,
|
|
"lastUpdated": "2025-08-31T00:00:00Z",
|
|
"categories": {
|
|
"repository": 1,
|
|
"analysis": 1,
|
|
"security": 1,
|
|
"reporting": 1,
|
|
"deployment": 1,
|
|
"notification": 1,
|
|
"approval": 1,
|
|
"storage": 1,
|
|
"memory": 1,
|
|
"authentication": 1
|
|
}
|
|
}
|
|
}
|