49 lines
2.7 KiB
Markdown
49 lines
2.7 KiB
Markdown
# LAI Coding Automation
|
|
|
|
This service turns explicitly queued Gitea issues into reviewed pull requests. It no longer reads the
|
|
Laravel production database and does not merge changes automatically.
|
|
|
|
## Workflow
|
|
|
|
1. LAI creates one unlabeled Gitea issue for a wrong-answer report.
|
|
2. An administrator reviews it and explicitly applies `ai:queued`, either through the LAI admin dashboard or directly in Gitea.
|
|
3. This worker replaces the label with `ai:running`, clones `main`, and creates `ai/issue-N`.
|
|
4. mini-SWE-agent 2.4.6 implements the issue in a credential-free, unprivileged command environment.
|
|
5. The worker rejects protected paths, symlinks, empty patches, and oversized diffs.
|
|
6. Deterministic setup and test commands run with isolated test database credentials.
|
|
7. A pull request containing `Fixes #N`, the original problem, changed files, and checks is opened.
|
|
8. The issue is labeled `ai:ready` or `ai:failed` and receives a status comment.
|
|
|
|
Normal reports are never selected automatically. The manual `ai:queued` label is the explicit approval and the only worker trigger.
|
|
|
|
Human review and merge are always required.
|
|
|
|
## Security boundary
|
|
|
|
- Gitea and model credentials exist only in the root worker process.
|
|
- Agent-issued commands receive a strict environment without inherited worker variables.
|
|
- The agent runs as the unprivileged `coder` user.
|
|
- Git metadata lives outside the writable worktree, and Git hooks are disabled for commits.
|
|
- The Docker socket is not mounted. Repository cloning and pushing use HTTPS with a temporary
|
|
`GIT_ASKPASS` credential file that is deleted immediately.
|
|
- `.env`, CI, Docker/deployment files, dependencies, generated storage, and symlinks are rejected.
|
|
|
|
The container is the intended execution boundary. Do not run the worker directly on a developer host.
|
|
|
|
## Configuration
|
|
|
|
Copy `.env.example` to `.env` and set `GITEA_TOKEN` plus `MISTRAL_API_KEY`. Existing test database
|
|
settings can be retained. Commands are separated with `;;`. Laravel's default connection uses
|
|
`TEST_DB_NAME`, the ERP connection uses `TEST_CUSTOMER_DB`, and cross-schema cockpit fixtures use
|
|
`TEST_CONFIG_DB`. The worker enables database integration tests and supplies a non-secret
|
|
placeholder AI key so mocked provider-discovery tests execute deterministically. Real Gitea and
|
|
model credentials are never copied into the test or agent command environment.
|
|
|
|
Start the worker with Docker Compose. Use `lai-agent check` inside the image for configuration
|
|
validation, `lai-agent preflight` for clean-clone setup and tests without a model call, or
|
|
`lai-agent once` for a single polling cycle.
|
|
|
|
## Archived implementation
|
|
|
|
The previous database-polling Aider implementation is preserved unchanged in `old_2026-08-31/`.
|