Merge pull request #148 from dsanders11/feat/prompt-yaml-model-parameters

feat: support modelParameters in prompt.yaml files
chore: update dist
2025-11-24 11:27:47 +11:00 · 2025-11-23 16:19:48 -08:00 · 2025-11-23 16:19:12 -08:00 · 2025-11-23 16:07:11 -08:00 · 2025-11-24 10:22:42 +11:00 · 2025-11-24 10:21:49 +11:00
20 changed files with 1238 additions and 146 deletions
--- a/.github/workflows/check-dist.yml
+++ b/.github/workflows/check-dist.yml
@@ -28,7 +28,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Setup Node.js
        id: setup-node
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Setup Node.js
        id: setup-node
@@ -54,7 +54,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Test Local Action
        id: test-action
@@ -77,7 +77,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Create Prompt File
        run: echo "hello" > prompt.txt
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -30,7 +30,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Initialize CodeQL
        id: initialize
--- a/.github/workflows/licensed.yml
+++ b/.github/workflows/licensed.yml
@@ -27,7 +27,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Setup Node.js
        id: setup-node
@@ -42,11 +42,11 @@ jobs:

      - name: Setup Ruby
        id: setup-ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@829114fc20da43a41d27359103ec7a63020954d4
        with:
          ruby-version: ruby

-      - uses: licensee/setup-licensed@v1.3.2
+      - uses: licensee/setup-licensed@0d52e575b3258417672be0dff2f115d7db8771d8
        with:
          version: 4.x
          github_token: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -21,7 +21,7 @@ jobs:
    steps:
      - name: Checkout
        id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0

--- a/.licenses/npm/@types/tmp.dep.yml
+++ b/.licenses/npm/@types/tmp.dep.yml
@@ -0,0 +1,32 @@
+---
+name: "@types/tmp"
+version: 0.2.6
+type: npm
+summary: TypeScript definitions for tmp
+homepage: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/tmp
+license: mit
+licenses:
+- sources: LICENSE
+  text: |2
+        MIT License
+
+        Copyright (c) Microsoft Corporation.
+
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE
+notices: []
--- a/.licenses/npm/tmp.dep.yml
+++ b/.licenses/npm/tmp.dep.yml
@@ -0,0 +1,32 @@
+---
+name: tmp
+version: 0.2.5
+type: npm
+summary: Temporary file and directory creator
+homepage: http://github.com/raszi/node-tmp
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    The MIT License (MIT)
+
+    Copyright (c) 2014 KARASZI István
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-20.9.0
+24.4.0
--- a/README.md
+++ b/README.md
@@ -162,6 +162,9 @@ This action now supports **read-only** integration with the GitHub-hosted Model
 Context Protocol (MCP) server, which provides access to GitHub tools like
 repository management, issue tracking, and pull request operations.

+> [!NOTE]
+> The GitHub MCP integration requires a Personal Access Token (PAT) and cannot use the built-in `GITHUB_TOKEN`.
+
 ```yaml
 steps:
  - name: AI Inference with GitHub Tools
@@ -209,7 +212,7 @@ the action:
 | `endpoint`           | The endpoint to use for inference. If you're running this as part of an org, you should probably use the org-specific Models endpoint                         | `https://models.github.ai/inference` |
 | `max-tokens`         | The max number of tokens to generate                                                                                                                          | 200                                  |
 | `enable-github-mcp`  | Enable Model Context Protocol integration with GitHub tools                                                                                                   | `false`                              |
-| `github-mcp-token`   | Token to use for GitHub MCP server (defaults to the main token if not specified). Use a separate PAT for tighter security                                     | `""`                                 |
+| `github-mcp-token`   | Token to use for GitHub MCP server (defaults to the main token if not specified). This must be a PAT in order for MCP to work                                 | `""`                                 |

 ## Outputs

--- a/tests/helpers-inference.test.ts
+++ b/tests/helpers-inference.test.ts
@@ -106,6 +106,8 @@ describe('helpers.ts - inference request building', () => {
        undefined,
        undefined,
        'gpt-4',
+        undefined,
+        undefined,
        100,
        'https://api.test.com',
        'test-token',
@@ -117,6 +119,8 @@ describe('helpers.ts - inference request building', () => {
          {role: 'user', content: 'User message'},
        ],
        modelName: 'gpt-4',
+        temperature: undefined,
+        topP: undefined,
        maxTokens: 100,
        endpoint: 'https://api.test.com',
        token: 'test-token',
@@ -136,6 +140,8 @@ describe('helpers.ts - inference request building', () => {
        'System prompt',
        'User prompt',
        'gpt-4',
+        undefined,
+        undefined,
        100,
        'https://api.test.com',
        'test-token',
@@ -147,6 +153,8 @@ describe('helpers.ts - inference request building', () => {
          {role: 'user', content: 'User prompt'},
        ],
        modelName: 'gpt-4',
+        temperature: undefined,
+        topP: undefined,
        maxTokens: 100,
        endpoint: 'https://api.test.com',
        token: 'test-token',
--- a/tests/main.test.ts
+++ b/tests/main.test.ts
@@ -66,7 +66,7 @@ function mockInputs(inputs: Record<string, string> = {}): void {
 */
 function verifyStandardResponse(): void {
  expect(core.setOutput).toHaveBeenNthCalledWith(1, 'response', 'Hello, user!')
-  expect(core.setOutput).toHaveBeenNthCalledWith(2, 'response-file', expect.stringContaining('modelResponse.txt'))
+  expect(core.setOutput).toHaveBeenNthCalledWith(2, 'response-file', expect.stringContaining('modelResponse-'))
 }

 vi.mock('fs', () => ({
@@ -75,6 +75,19 @@ vi.mock('fs', () => ({
  writeFileSync: mockWriteFileSync,
 }))

+// Mocks for tmp module to control temporary file creation and cleanup
+const mockRemoveCallback = vi.fn()
+const mockFileSync = vi.fn().mockReturnValue({
+  name: '/secure/temp/dir/modelResponse-abc123.txt',
+  removeCallback: mockRemoveCallback,
+})
+const mockSetGracefulCleanup = vi.fn()
+
+vi.mock('tmp', () => ({
+  fileSync: mockFileSync,
+  setGracefulCleanup: mockSetGracefulCleanup,
+}))
+
 // Mock MCP and inference modules
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const mockConnectToGitHubMCP = vi.fn() as MockedFunction<any>
@@ -269,4 +282,43 @@ describe('main.ts', () => {
    expect(core.setFailed).toHaveBeenCalledWith(`File for prompt-file was not found: ${promptFile}`)
    expect(mockProcessExit).toHaveBeenCalledWith(1)
  })
+
+  it('creates secure temporary files with proper cleanup', async () => {
+    mockInputs({
+      prompt: 'Test prompt',
+      'system-prompt': 'You are a test assistant.',
+    })
+
+    await run()
+
+    expect(mockSetGracefulCleanup).toHaveBeenCalledOnce()
+
+    expect(mockFileSync).toHaveBeenCalledWith({
+      prefix: 'modelResponse-',
+      postfix: '.txt',
+    })
+
+    expect(core.setOutput).toHaveBeenNthCalledWith(2, 'response-file', '/secure/temp/dir/modelResponse-abc123.txt')
+    expect(mockWriteFileSync).toHaveBeenCalledWith('/secure/temp/dir/modelResponse-abc123.txt', 'Hello, user!', 'utf-8')
+    expect(mockRemoveCallback).toHaveBeenCalledOnce()
+
+    expect(mockProcessExit).toHaveBeenCalledWith(0)
+  })
+
+  it('handles cleanup errors gracefully', async () => {
+    mockRemoveCallback.mockImplementationOnce(() => {
+      throw new Error('Cleanup failed')
+    })
+
+    mockInputs({
+      prompt: 'Test prompt',
+      'system-prompt': 'You are a test assistant.',
+    })
+
+    await run()
+
+    expect(mockRemoveCallback).toHaveBeenCalledOnce()
+    expect(core.warning).toHaveBeenCalledWith('Failed to cleanup temporary file: Error: Cleanup failed')
+    expect(mockProcessExit).toHaveBeenCalledWith(0)
+  })
 })
--- a/action.yml
+++ b/action.yml
@@ -55,7 +55,7 @@ inputs:
    required: false
    default: 'false'
  github-mcp-token:
-    description: The token to use for GitHub MCP server (defaults to GITHUB_TOKEN if not specified)
+    description: The token to use for GitHub MCP server (defaults to the main token if not specified). This must be a PAT for MCP to work.
    required: false
    default: ''

@@ -67,5 +67,5 @@ outputs:
    description: The file path where the response is saved

 runs:
-  using: node20
+  using: node24
  main: dist/index.js
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,9 +11,11 @@
      "dependencies": {
        "@actions/core": "^1.11.1",
        "@modelcontextprotocol/sdk": "^1.15.1",
+        "@types/tmp": "^0.2.6",
        "js-yaml": "^4.1.0",
        "openai": "^5.11.0",
-        "pkce-challenge": "^5.0.0"
+        "pkce-challenge": "^5.0.0",
+        "tmp": "^0.2.4"
      },
      "devDependencies": {
        "@eslint/compat": "^1.3.0",
@@ -24,7 +26,7 @@
        "@rollup/plugin-node-resolve": "^16.0.1",
        "@rollup/plugin-typescript": "^12.1.2",
        "@types/js-yaml": "^4.0.9",
-        "@types/node": "^22.15.31",
+        "@types/node": "^24.1.0",
        "@typescript-eslint/eslint-plugin": "^8.34.0",
        "@typescript-eslint/parser": "^8.32.1",
        "eslint": "^9.29.0",
@@ -39,7 +41,7 @@
        "vitest": "^3"
      },
      "engines": {
-        "node": ">=20"
+        "node": ">=24"
      },
      "optionalDependencies": {
        "@rollup/rollup-linux-x64-gnu": "*"
@@ -2476,13 +2478,13 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "22.15.31",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.15.31.tgz",
-      "integrity": "sha512-jnVe5ULKl6tijxUhvQeNbQG/84fHfg+yMak02cT8QVhBx/F05rAVxCGBYYTh2EKz22D6JF5ktXuNwdx7b9iEGw==",
+      "version": "24.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.1.0.tgz",
+      "integrity": "sha512-ut5FthK5moxFKH2T1CUOC6ctR67rQRvvHdFLCD2Ql6KXmMuCrjsSsRI9UsLCm9M18BMwClv4pn327UvB7eeO1w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "undici-types": "~6.21.0"
+        "undici-types": "~7.8.0"
      }
    },
    "node_modules/@types/resolve": {
@@ -2492,6 +2494,12 @@
      "dev": true,
      "license": "MIT"
    },
+    "node_modules/@types/tmp": {
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/@types/tmp/-/tmp-0.2.6.tgz",
+      "integrity": "sha512-chhaNf2oKHlRkDGt+tiKE2Z5aJ6qalm7Z9rlLdBwmOiAAf09YQvvoLXjWK4HWPF1xU/fqvMgfNfpVoBscA/tKA==",
+      "license": "MIT"
+    },
    "node_modules/@typescript-eslint/eslint-plugin": {
      "version": "8.34.0",
      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.34.0.tgz",
@@ -8943,6 +8951,15 @@
        "node": ">=14.0.0"
      }
    },
+    "node_modules/tmp": {
+      "version": "0.2.5",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
+      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
    "node_modules/to-regex-range": {
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -9207,9 +9224,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "6.21.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
-      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.8.0.tgz",
+      "integrity": "sha512-9UJ2xGDvQ43tYyVMpuHlsgApydB8ZKfVYTsLDhXkFL/6gfkp+U8xTGdh8pMJv1SpZna0zxG1DwsKZsreLbXBxw==",
      "dev": true,
      "license": "MIT"
    },
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
    ".": "./dist/index.js"
  },
  "engines": {
-    "node": ">=20"
+    "node": ">=24"
  },
  "scripts": {
    "bundle": "npm run format:write && npm run package",
@@ -25,9 +25,11 @@
  "dependencies": {
    "@actions/core": "^1.11.1",
    "@modelcontextprotocol/sdk": "^1.15.1",
+    "@types/tmp": "^0.2.6",
    "js-yaml": "^4.1.0",
    "openai": "^5.11.0",
-    "pkce-challenge": "^5.0.0"
+    "pkce-challenge": "^5.0.0",
+    "tmp": "^0.2.4"
  },
  "devDependencies": {
    "@eslint/compat": "^1.3.0",
@@ -38,7 +40,7 @@
    "@rollup/plugin-node-resolve": "^16.0.1",
    "@rollup/plugin-typescript": "^12.1.2",
    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22.15.31",
+    "@types/node": "^24.1.0",
    "@typescript-eslint/eslint-plugin": "^8.34.0",
    "@typescript-eslint/parser": "^8.32.1",
    "eslint": "^9.29.0",
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -82,6 +82,8 @@ export function buildInferenceRequest(
  systemPrompt: string | undefined,
  prompt: string | undefined,
  modelName: string,
+  temperature: number | undefined,
+  topP: number | undefined,
  maxTokens: number,
  endpoint: string,
  token: string,
@@ -92,6 +94,8 @@ export function buildInferenceRequest(
  return {
    messages,
    modelName,
+    temperature,
+    topP,
    maxTokens,
    endpoint,
    token,
--- a/src/inference.ts
+++ b/src/inference.ts
@@ -15,6 +15,8 @@ export interface InferenceRequest {
  maxTokens: number
  endpoint: string
  token: string
+  temperature?: number
+  topP?: number
  responseFormat?: {type: 'json_schema'; json_schema: unknown} // Processed response format for the API
 }

@@ -45,6 +47,8 @@ export async function simpleInference(request: InferenceRequest): Promise<string
    messages: request.messages as OpenAI.Chat.Completions.ChatCompletionMessageParam[],
    max_tokens: request.maxTokens,
    model: request.modelName,
+    temperature: request.temperature,
+    top_p: request.topP,
  }

  // Add response format if specified
@@ -53,21 +57,10 @@ export async function simpleInference(request: InferenceRequest): Promise<string
    chatCompletionRequest.response_format = request.responseFormat as any
  }

-  try {
-    const response = await client.chat.completions.create(chatCompletionRequest)
-
-    if ('choices' in response) {
-      const modelResponse = response.choices[0]?.message?.content
-      core.info(`Model response: ${modelResponse || 'No response content'}`)
-      return modelResponse || null
-    } else {
-      core.error(`Unexpected response format from API: ${JSON.stringify(response)}`)
-      return null
-    }
-  } catch (error) {
-    core.error(`API error: ${error}`)
-    throw error
-  }
+  const response = await chatCompletion(client, chatCompletionRequest, 'simpleInference')
+  const modelResponse = response.choices[0]?.message?.content
+  core.info(`Model response: ${modelResponse || 'No response content'}`)
+  return modelResponse || null
 }

 /**
@@ -101,6 +94,8 @@ export async function mcpInference(
      messages: messages as OpenAI.Chat.Completions.ChatCompletionMessageParam[],
      max_tokens: request.maxTokens,
      model: request.modelName,
+      temperature: request.temperature,
+      top_p: request.topP,
    }

    // Add response format if specified (only on final iteration to avoid conflicts with tool calls)
@@ -112,11 +107,7 @@ export async function mcpInference(
    }

    try {
-      const response = await client.chat.completions.create(chatCompletionRequest)
-
-      if (!('choices' in response)) {
-        throw new Error(`Unexpected response format from API: ${JSON.stringify(response)}`)
-      }
+      const response = await chatCompletion(client, chatCompletionRequest, `mcpInference iteration ${iterationCount}`)

      const assistantMessage = response.choices[0]?.message
      const modelResponse = assistantMessage?.content
@@ -133,20 +124,13 @@ export async function mcpInference(
      if (!toolCalls || toolCalls.length === 0) {
        core.info('No tool calls requested, ending GitHub MCP inference loop')

-        // If we have a response format set and we haven't explicitly run one final message iteration,
-        // do another loop with the response format set
        if (request.responseFormat && !finalMessage) {
          core.info('Making one more MCP loop with the requested response format...')
-
-          // Add a user message requesting JSON format and try again
          messages.push({
            role: 'user',
            content: `Please provide your response in the exact ${request.responseFormat.type} format specified.`,
          })
-
          finalMessage = true
-
-          // Continue the loop to get a properly formatted response
          continue
        } else {
          return modelResponse || null
@@ -154,13 +138,8 @@ export async function mcpInference(
      }

      core.info(`Model requested ${toolCalls.length} tool calls`)
-
-      // Execute all tool calls via GitHub MCP
      const toolResults = await executeToolCalls(githubMcpClient.client, toolCalls as ToolCall[])
-
-      // Add tool results to the conversation
      messages.push(...toolResults)
-
      core.info('Tool results added, continuing conversation...')
    } catch (error) {
      core.error(`OpenAI API error: ${error}`)
@@ -178,3 +157,43 @@ export async function mcpInference(

  return lastAssistantMessage?.content || null
 }
+
+/**
+ * Wrapper around OpenAI chat.completions.create with defensive handling for cases where
+ * the SDK returns a raw string (e.g., unexpected content-type or streaming body) instead of
+ * a parsed object. Ensures an object with a 'choices' array is returned or throws a descriptive error.
+ */
+async function chatCompletion(
+  client: OpenAI,
+  params: OpenAI.Chat.Completions.ChatCompletionCreateParams,
+  context: string,
+): Promise<OpenAI.Chat.Completions.ChatCompletion> {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let response: any = await client.chat.completions.create(params)
+    core.debug(`${context}: raw response typeof=${typeof response}`)
+
+    if (typeof response === 'string') {
+      // Attempt to parse if we unexpectedly received a string
+      try {
+        response = JSON.parse(response)
+      } catch (e) {
+        const preview = response.slice(0, 400)
+        throw new Error(
+          `${context}: Chat completion response was a string and not valid JSON (${(e as Error).message}). Preview: ${preview}`,
+        )
+      }
+    }
+
+    if (!response || typeof response !== 'object' || !('choices' in response)) {
+      const preview = JSON.stringify(response)?.slice(0, 800)
+      throw new Error(`${context}: Unexpected response shape (no choices). Preview: ${preview}`)
+    }
+
+    return response as OpenAI.Chat.Completions.ChatCompletion
+  } catch (err) {
+    // Re-throw after logging for upstream handling
+    core.error(`${context}: chatCompletion failed: ${err}`)
+    throw err
+  }
+}
--- a/src/main.ts
+++ b/src/main.ts
@@ -1,7 +1,6 @@
 import * as core from '@actions/core'
 import * as fs from 'fs'
-import * as os from 'os'
-import * as path from 'path'
+import * as tmp from 'tmp'
 import {connectToGitHubMCP} from './mcp.js'
 import {simpleInference, mcpInference} from './inference.js'
 import {loadContentFromFileOrInput, buildInferenceRequest} from './helpers.js'
@@ -13,14 +12,17 @@ import {
  parseFileTemplateVariables,
 } from './prompt.js'

-const RESPONSE_FILE = 'modelResponse.txt'
-
 /**
 * The main function for the action.
 *
 * @returns Resolves when the action is complete.
 */
 export async function run(): Promise<void> {
+  let responseFile: tmp.FileResult | null = null
+
+  // Set up graceful cleanup for temporary files on process exit
+  tmp.setGracefulCleanup()
+
  try {
    const promptFilePath = core.getInput('prompt-file')
    const inputVariables = core.getInput('input')
@@ -51,7 +53,11 @@ export async function run(): Promise<void> {

    // Get common parameters
    const modelName = promptConfig?.model || core.getInput('model')
-    const maxTokens = parseInt(core.getInput('max-tokens'), 10)
+    let maxTokens = promptConfig?.modelParameters?.maxTokens ?? core.getInput('max-tokens')
+
+    if (typeof maxTokens === 'string') {
+      maxTokens = parseInt(maxTokens, 10)
+    }

    const token = process.env['GITHUB_TOKEN'] || core.getInput('token')
    if (token === undefined) {
@@ -69,6 +75,8 @@ export async function run(): Promise<void> {
      systemPrompt,
      prompt,
      modelName,
+      promptConfig?.modelParameters?.temperature,
+      promptConfig?.modelParameters?.topP,
      maxTokens,
      endpoint,
      token,
@@ -93,11 +101,16 @@ export async function run(): Promise<void> {

    core.setOutput('response', modelResponse || '')

-    const responseFilePath = path.join(tempDir(), RESPONSE_FILE)
-    core.setOutput('response-file', responseFilePath)
+    // Create a secure temporary file instead of using the temp directory directly
+    responseFile = tmp.fileSync({
+      prefix: 'modelResponse-',
+      postfix: '.txt',
+    })
+
+    core.setOutput('response-file', responseFile.name)

    if (modelResponse && modelResponse !== '') {
-      fs.writeFileSync(responseFilePath, modelResponse, 'utf-8')
+      fs.writeFileSync(responseFile.name, modelResponse, 'utf-8')
    }
  } catch (error) {
    if (error instanceof Error) {
@@ -107,13 +120,18 @@ export async function run(): Promise<void> {
    }
    // Force exit to prevent hanging on open connections
    process.exit(1)
+  } finally {
+    // Explicit cleanup of temporary file if it was created
+    if (responseFile) {
+      try {
+        responseFile.removeCallback()
+      } catch (cleanupError) {
+        // Log cleanup errors but don't fail the action
+        core.warning(`Failed to cleanup temporary file: ${cleanupError}`)
+      }
+    }
  }

  // Force exit to prevent hanging on open connections
  process.exit(0)
 }
-
-function tempDir(): string {
-  const tempDirectory = process.env['RUNNER_TEMP'] || os.tmpdir()
-  return tempDirectory
-}
--- a/src/prompt.ts
+++ b/src/prompt.ts
@@ -7,9 +7,16 @@ export interface PromptMessage {
  content: string
 }

+export interface ModelParameters {
+  maxTokens?: number
+  temperature?: number
+  topP?: number
+}
+
 export interface PromptConfig {
  messages: PromptMessage[]
  model?: string
+  modelParameters?: ModelParameters
  responseFormat?: 'text' | 'json_schema'
  jsonSchema?: string
 }
@@ -101,11 +108,8 @@ export function loadPromptFile(filePath: string, templateVariables: TemplateVari

  const fileContent = fs.readFileSync(filePath, 'utf-8')

-  // Apply template variable substitution
-  const processedContent = replaceTemplateVariables(fileContent, templateVariables)
-
  try {
-    const config = yaml.load(processedContent) as PromptConfig
+    const config = yaml.load(fileContent) as PromptConfig

    if (!config.messages || !Array.isArray(config.messages)) {
      throw new Error('Prompt file must contain a "messages" array')
@@ -121,6 +125,14 @@ export function loadPromptFile(filePath: string, templateVariables: TemplateVari
      }
    }

+    // Prepare messages by replacing template variables with actual content
+    config.messages = config.messages.map(msg => {
+      return {
+        ...msg,
+        content: replaceTemplateVariables(msg.content, templateVariables),
+      }
+    })
+
    return config
  } catch (error) {
    throw new Error(`Failed to parse prompt file: ${error instanceof Error ? error.message : 'Unknown error'}`)
Author	SHA1	Message	Date
Sean Goedecke	5022b33bc1	Merge pull request #148 from dsanders11/feat/prompt-yaml-model-parameters feat: support modelParameters in prompt.yaml files	2025-11-24 11:27:47 +11:00
David Sanders	c9e14713bc	chore: update dist	2025-11-23 16:19:48 -08:00
David Sanders	39308142df	chore: apply code review comment Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-11-23 16:19:12 -08:00
David Sanders	48f0edec4d	feat: support modelParameters in prompt.yaml files	2025-11-23 16:07:11 -08:00
Sean Goedecke	36ea1371dc	Merge pull request #136 from dsanders11/fix/template-substition fix: do template substition after parsing prompt YAML	2025-11-24 10:22:42 +11:00
Sean Goedecke	de16a30c20	Merge branch 'main' into fix/template-substition	2025-11-24 10:21:49 +11:00
Sean Goedecke	dd3dff10ba	Merge pull request #147 from srt32/patch-1 Clarify PAT requirement for github-mcp-token	2025-11-24 10:18:50 +11:00
Simon Taranto	4bb01ee5ee	Clarify PAT requirement for github-mcp-token I mistakenly read the description of the mcp-token field to mean I needed a "PAT for MCP" as if there were a PAT permission for MCP. This change clarifies the language.	2025-11-21 13:36:45 -05:00
David Sanders	af1c1c29a3	fix: do template substition after parsing prompt YAML	2025-10-20 21:32:06 -07:00
Sean Goedecke	83bb5ca3e8	Merge pull request #93 from FidelusAleksander/main docs: update documentation on mcp usage	2025-08-26 18:13:39 +10:00
Aleksander Fidelus	4d2337d006	Merge branch 'actions:main' into main	2025-08-25 11:08:41 +02:00
Yuzuki	7ba7530ad4	Merge pull request #94 from actions/dependabot/github_actions/actions/checkout-5 chore(deps): bump actions/checkout from 4 to 5	2025-08-25 14:00:39 +10:00
Yuzuki	4d7d83c494	Merge branch 'main' into dependabot/github_actions/actions/checkout-5	2025-08-25 13:55:57 +10:00
Sean Goedecke	a1c1182922	Merge pull request #97 from actions/sgoedecke/defensive-parsing Parse inference response format defensively	2025-08-25 08:47:18 +10:00
Sean Goedecke	dfaa426c29	Parse inference response format defensively	2025-08-22 22:34:18 +00:00
FidelusAleksander	7fa0024f13	docs: run prettier	2025-08-18 14:42:29 +02:00
dependabot[bot]	fc6f9a0800	chore(deps): bump actions/checkout from 4 to 5 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-18 03:58:02 +00:00
FidelusAleksander	a1d07305b7	docs: update github-mcp-token description	2025-08-15 08:22:55 +02:00
FidelusAleksander	6e0d8949d8	docs: update documentation on mcp usage	2025-08-15 07:52:22 +02:00
Sean Goedecke	f347eae8eb	Merge pull request #91 from JessRudder/secure-tmp-files Uses tmp library to ensure more secure tmp file creation	2025-08-14 07:15:18 +10:00
Jess Rudder	07fe2f30ad	Merge branch 'main' into secure-tmp-files	2025-08-13 14:11:23 -07:00
Jess Rudder	1843310df4	Add license info	2025-08-13 21:07:21 +00:00
Sean Goedecke	c72cb2ef9c	Merge pull request #90 from garman/pin-to-sha Pin two imported actions to a set sha	2025-08-14 06:58:03 +10:00
Jessica Rudder	a2fd223fcf	Properly clean up tmp files	2025-08-12 14:31:05 -07:00
Jessica Rudder	3ba8e1b39d	Replace manual tmp file creation with tmp library which uses security best practices	2025-08-12 13:49:47 -07:00
Daniel Garman	52e5222a82	pin to a sha	2025-08-12 15:04:16 -04:00
Sean Goedecke	a62dfeda7b	Merge pull request #79 from salmanmkc/node24 Node 24	2025-08-11 21:13:39 +10:00
Salman Chishti	48235f7026	Merge branch 'main' into node24	2025-08-11 11:52:36 +01:00
Salman Muin Kayser Chishti	9bbcef8fa4	node 24	2025-08-01 12:13:15 +01:00
@@ -1 +1 @@
 .9.0
 .4.0