{"id":51359572,"url":"https://github.com/lightninglabs/gateway-action","last_synced_at":"2026-07-02T22:05:10.867Z","repository":{"id":368791714,"uuid":"1264693607","full_name":"lightninglabs/gateway-action","owner":"lightninglabs","description":"Public entry point for gateway — resolvable from any consumer repo (public or private)","archived":false,"fork":false,"pushed_at":"2026-06-25T17:27:28.000Z","size":29,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-02T08:32:26.159Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lightninglabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-10T05:23:14.000Z","updated_at":"2026-06-25T17:27:11.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/lightninglabs/gateway-action","commit_stats":null,"previous_names":["lightninglabs/gateway-action"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/lightninglabs/gateway-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgateway-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgateway-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgateway-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgateway-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lightninglabs","download_url":"https://codeload.github.com/lightninglabs/gateway-action/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lightninglabs%2Fgateway-action/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35064282,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-02T02:00:06.368Z","response_time":173,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-02T22:05:08.417Z","updated_at":"2026-07-02T22:05:10.850Z","avatar_url":"https://github.com/lightninglabs.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# gateway-action\n\nPublic entry point for **gateway**, the Lightning Labs PR review bot.\n\nThe review runtime lives in the **private** repo\n[`lightninglabs/gateway`](https://github.com/lightninglabs/gateway). GitHub\nonly extends a private repo's actions to *private and internal* org repos, so a\n**public** consumer (e.g. `lightninglabs/neutrino`) cannot resolve\n`lightninglabs/gateway/.github/actions/review@\u003ctag\u003e` — the job fails at setup\nwith:\n\n```\n##[error]Unable to resolve action `lightninglabs/gateway`, not found\n```\n\nThis repo is **public**, so any consumer — public or private — can resolve it.\nAt runtime it pulls the private runtime using a token minted from the\nconsumer-passed App credentials. The review logic, prompts, and skills stay\nprivate; only this thin entry point is public.\n\n## How it works\n\nThe composite action ([`action.yml`](action.yml)) runs three steps:\n\n1. **Mint bootstrap token** — [`bootstrap-token.sh`](bootstrap-token.sh) mints a\n   **least-privilege** installation token (`contents:read` on\n   `lightninglabs/gateway` only) from the consumer's `app_id` / `private_key`.\n   It discovers the gateway installation rather than hardcoding an id. This bit\n   of logic must live here because it runs *before* the private runtime is on\n   disk.\n2. **Checkout runtime** — [`actions/checkout`](https://github.com/actions/checkout)\n   pulls `lightninglabs/gateway` at `runtime_ref` using that bootstrap token.\n3. **Run** — execs `scripts/run-review.sh` from the checked-out tree, the same\n   entry point as the private action. `run-review.sh` mints its *own* token\n   (scoped to the **consumer's** install, with review write perms) — a\n   different installation and scope from the bootstrap token.\n\nTwo tokens, two installations — see [docs/architecture.md](docs/architecture.md)\nfor the full picture. No new trust exposure: the consumer already runs this\nexact runtime today — this only changes *where the entry point resolves*.\n\n## Usage\n\nCopy [`templates/gateway.yml`](templates/gateway.yml) to\n`.github/workflows/gateway.yml` in your consumer repo and fill in the marked\nvalues. Minimal shape:\n\n```yaml\n      - uses: lightninglabs/gateway-action@\u003cCOMMIT_SHA\u003e # vX.Y.Z\n        with:\n          event_name:      ${{ github.event_name }}\n          event_action:    ${{ github.event.action }}\n          repo:            ${{ github.repository }}\n          pr_number:       ${{ github.event.issue.number || github.event.pull_request.number }}\n          actor:           ${{ github.event.sender.login }}\n          comment_body:    ${{ github.event.comment.body }}\n          comment_id:      ${{ github.event.comment.id }}\n          app_id:                  ${{ secrets.GATEWAY_APP_ID }}\n          private_key:             ${{ secrets.GATEWAY_PRIVATE_KEY }}\n          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}\n```\n\n`installation_id` is optional — omit it and the runtime resolves the App install\ncovering this repo from `app_id`/`private_key`. Set it only to pin a specific\ninstallation.\n\nAt least one of `claude_code_oauth_token` or `anthropic_api_key` must be set;\nthe example uses OAuth. To use an Anthropic API key instead (tried first if both\nare set), add `anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}`.\n\nPin `uses:` to a **full commit SHA** with a trailing `# vX.Y.Z` comment — never\na bare tag. Full onboarding (App install, secrets) lives in the private repo's\n`docs/consumer-setup.md`.\n\n## Prerequisites\n\n- The gateway GitHub App is installed on `lightninglabs/gateway` itself (it is,\n  org-wide) and has `contents: read`, so the minted token can read the runtime.\n- The App is installed on the consumer repo, and the org secrets\n  (`GATEWAY_APP_ID`, `GATEWAY_PRIVATE_KEY`, and one of `ANTHROPIC_API_KEY` /\n  `CLAUDE_CODE_OAUTH_TOKEN`) are available to it.\n\n## Versioning\n\nThis repo is versioned in **lockstep** with `lightninglabs/gateway`. Each\nrelease tag here pins the matching gateway runtime ref (the `ref:` on the\ncheckout step in `action.yml`). A given `gateway-action` SHA therefore maps\ndeterministically to one runtime version — consumers track a single version\naxis.\n\n| gateway-action | gateway runtime ref |\n|----------------|---------------------|\n| `v0.4.2`       | `v0.4.2`            |\n\n## License\n\n[MIT](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flightninglabs%2Fgateway-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flightninglabs%2Fgateway-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flightninglabs%2Fgateway-action/lists"}