agentcore-cli/.github/workflows/agent-restricted.yml at main · CopilotKit/agentcore-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: Restricted Agent

# RESTRICTED ACCESS VERSION
# Only specific users can trigger this workflow manually

on:
  workflow_dispatch:
    inputs:
      prompt:
        description: 'Prompt for the agent'
        required: true
        default: 'What are my active pull requests?'
        type: string
      system_prompt:
        description: 'System prompt'
        required: false
        type: string
      provider:
        description: 'Provider'
        default: 'bedrock'
        required: false
        type: choice
        options:
          - bedrock
          - github
          - openai
          - anthropic
      model:
        description: 'Model ID (e.g., us.anthropic.claude-sonnet-4-5-20250929-v1:0)'
        required: false
        default: 'us.anthropic.claude-sonnet-4-5-20250929-v1:0'
        type: string
      max_tokens:
        description: 'Maximum tokens for model response'
        required: false
        default: '10000'
        type: string
      tools:
        description: 'Tool config (e.g., strands_tools:shell;strands_action:use_github)'
        required: false
        default: 'strands_tools:shell;tools:use_github'
        type: string
      agent_runner:
        description: 'Custom agent runner URL'
        required: false
        type: string

permissions:
  id-token: write
  contents: write
  pull-requests: write
  issues: write

jobs:
  agent:
    runs-on: ubuntu-latest
    steps:
      - name: Check authorization
        env:
          AUTHORIZED_USERS: ${{ secrets.AUTHORIZED_USERS }}
          ACTOR: ${{ github.actor }}
        run: |
          if [[ ",$AUTHORIZED_USERS," != *",$ACTOR,"* ]]; then
            echo "❌ User $ACTOR is NOT authorized"
            exit 1
          fi
          echo "✅ User $ACTOR is authorized"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Run Strands Agent
        uses: ./.github/actions/strands-action
        with:
          prompt: ${{ inputs.prompt }}
          provider: ${{ inputs.provider }}
          model: ${{ inputs.model }}
          max_tokens: ${{ inputs.max_tokens }}
          system_prompt: ${{ inputs.system_prompt }}
          tools: ${{ inputs.tools }}
          agent_runner: ${{ inputs.agent_runner }}
          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
          aws_region: 'us-west-2'
          pat_token: ${{ secrets.PAT_TOKEN }}
        env:
          STRANDS_TOOLS_DIRECTORY: 'true'