Skip to content

Commit 1f7ec04

Browse files
derekmislerderekmisler
authored
Updated cagent to latest version and updated docs (#18)
1 parent 7db5a1f commit 1f7ec04

File tree

5 files changed

+68
-52
lines changed

5 files changed

+68
-52
lines changed

‎README.md‎

Lines changed: 46 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@ A GitHub Action for running [cagent](https://github.com/docker/cagent) AI agents
55
## Quick Start
66

77
1. **Add the action to your workflow**:
8+
89
```yaml
9-
- uses: docker/cagent-action@v1.0.0
10+
- uses: docker/cagent-action@v1.0.4
1011
with:
1112
agent: docker/code-analyzer
1213
prompt: "Analyze this code"
@@ -15,6 +16,7 @@ A GitHub Action for running [cagent](https://github.com/docker/cagent) AI agents
1516
```
1617
1718
2. **Configure API key** in your repository settings:
19+
1820
- Go to `Settings` → `Secrets and variables` → `Actions`
1921
- Add `ANTHROPIC_API_KEY` with your API key from [Anthropic Console](https://console.anthropic.com/)
2022

@@ -40,7 +42,7 @@ See [security/README.md](security/README.md) for complete security documentation
4042

4143
```yaml
4244
- name: Run CAgent
43-
uses: docker/cagent-action@v1.0.0
45+
uses: docker/cagent-action@v1.0.4
4446
with:
4547
agent: docker/github-action-security-scanner
4648
prompt: "Analyze these commits for security vulnerabilities"
@@ -50,7 +52,7 @@ See [security/README.md](security/README.md) for complete security documentation
5052

5153
### Analyzing Code Changes
5254

53-
```yaml
55+
````yaml
5456
name: Code Analysis
5557
on:
5658
pull_request:
@@ -59,7 +61,7 @@ on:
5961
permissions:
6062
contents: read
6163
pull-requests: write
62-
issues: write # For security incident reporting
64+
issues: write # For security incident reporting
6365

6466
jobs:
6567
analyze:
@@ -76,7 +78,7 @@ jobs:
7678

7779
- name: Analyze Changes
7880
id: analysis
79-
uses: docker/cagent-action@v1.0.0
81+
uses: docker/cagent-action@v1.0.4
8082
with:
8183
agent: docker/code-analyzer
8284
prompt: |
@@ -94,13 +96,13 @@ jobs:
9496
--body-file "${{ steps.analysis.outputs.output-file }}"
9597
env:
9698
GH_TOKEN: ${{ github.token }}
97-
```
99+
````
98100

99101
### Using a Local Agent File
100102

101103
```yaml
102104
- name: Run Custom Agent
103-
uses: docker/cagent-action@v1.0.0
105+
uses: docker/cagent-action@v1.0.4
104106
with:
105107
agent: ./agents/my-agent.yaml
106108
prompt: "Analyze the codebase"
@@ -112,16 +114,16 @@ jobs:
112114

113115
```yaml
114116
- name: Run CAgent with Custom Settings
115-
uses: docker/cagent-action@v1.0.0
117+
uses: docker/cagent-action@v1.0.4
116118
with:
117119
agent: docker/code-analyzer
118120
prompt: "Analyze this codebase"
119121
cagent-version: v1.9.11
120-
mcp-gateway: true # Set to true to install mcp-gateway
122+
mcp-gateway: true # Set to true to install mcp-gateway
121123
mcp-gateway-version: v0.22.0
122-
yolo: false # Require manual approval
123-
timeout: 600 # 10 minute timeout
124-
debug: true # Enable debug logging
124+
yolo: false # Require manual approval
125+
timeout: 600 # 10 minute timeout
126+
debug: true # Enable debug logging
125127
working-directory: ./src
126128
extra-args: "--verbose"
127129
env:
@@ -133,7 +135,7 @@ jobs:
133135
```yaml
134136
- name: Run CAgent
135137
id: agent
136-
uses: docker/cagent-action@v1.0.0
138+
uses: docker/cagent-action@v1.0.4
137139
with:
138140
agent: docker/code-analyzer
139141
prompt: "Analyze this codebase"
@@ -157,34 +159,34 @@ jobs:
157159

158160
## Inputs
159161

160-
| Input | Description | Required | Default |
161-
|-------|-------------|----------|---------|
162-
| `agent` | Agent identifier (e.g., `docker/code-analyzer`) or path to `.yaml` file | Yes | - |
163-
| `prompt` | Prompt to pass to the agent | No | - |
164-
| `cagent-version` | Version of cagent to use | No | `v1.9.12` |
165-
| `mcp-gateway` | Install mcp-gateway (`true`/`false`) | No | `false` |
166-
| `mcp-gateway-version` | Version of mcp-gateway to use (specifying this will enable mcp-gateway installation) | No | `v0.22.0` |
167-
| `anthropic-api-key` | Anthropic API key | No | `$ANTHROPIC_API_KEY` env var |
168-
| `openai-api-key` | OpenAI API key | No | `$OPENAI_API_KEY` env var |
169-
| `google-api-key` | Google API key for Gemini | No | `GOOGLE_API_KEY` env var |
170-
| `github-token` | GitHub token for API access | No | Auto-provided by GitHub Actions |
171-
| `timeout` | Timeout in seconds for agent execution (0 for no timeout) | No | `0` |
172-
| `debug` | Enable debug mode with verbose logging (`true`/`false`) | No | `false` |
173-
| `working-directory` | Working directory to run the agent in | No | `.` |
174-
| `yolo` | Auto-approve all prompts (`true`/`false`) | No | `true` |
175-
| `extra-args` | Additional arguments to pass to `cagent exec` | No | - |
162+
| Input | Description | Required | Default |
163+
| --------------------- | ------------------------------------------------------------------------------------ | -------- | ------------------------------- |
164+
| `agent` | Agent identifier (e.g., `docker/code-analyzer`) or path to `.yaml` file | Yes | - |
165+
| `prompt` | Prompt to pass to the agent | No | - |
166+
| `cagent-version` | Version of cagent to use | No | `v1.15.6` |
167+
| `mcp-gateway` | Install mcp-gateway (`true`/`false`) | No | `false` |
168+
| `mcp-gateway-version` | Version of mcp-gateway to use (specifying this will enable mcp-gateway installation) | No | `v0.22.0` |
169+
| `anthropic-api-key` | Anthropic API key | No | `$ANTHROPIC_API_KEY` env var |
170+
| `openai-api-key` | OpenAI API key | No | `$OPENAI_API_KEY` env var |
171+
| `google-api-key` | Google API key for Gemini | No | `GOOGLE_API_KEY` env var |
172+
| `github-token` | GitHub token for API access | No | Auto-provided by GitHub Actions |
173+
| `timeout` | Timeout in seconds for agent execution (0 for no timeout) | No | `0` |
174+
| `debug` | Enable debug mode with verbose logging (`true`/`false`) | No | `false` |
175+
| `working-directory` | Working directory to run the agent in | No | `.` |
176+
| `yolo` | Auto-approve all prompts (`true`/`false`) | No | `true` |
177+
| `extra-args` | Additional arguments to pass to `cagent exec` | No | - |
176178

177179
## Outputs
178180

179-
| Output | Description |
180-
|--------|-------------|
181-
| `exit-code` | Exit code from the cagent exec |
182-
| `output-file` | Path to the output log file |
183-
| `cagent-version` | Version of cagent that was used |
184-
| `mcp-gateway-installed` | Whether mcp-gateway was installed (`true`/`false`) |
185-
| `execution-time` | Agent execution time in seconds |
186-
| `secrets-detected` | Whether secrets were detected in output |
187-
| `prompt-suspicious` | Whether suspicious patterns were detected in user prompt |
181+
| Output | Description |
182+
| ----------------------- | -------------------------------------------------------- |
183+
| `exit-code` | Exit code from the cagent exec |
184+
| `output-file` | Path to the output log file |
185+
| `cagent-version` | Version of cagent that was used |
186+
| `mcp-gateway-installed` | Whether mcp-gateway was installed (`true`/`false`) |
187+
| `execution-time` | Agent execution time in seconds |
188+
| `secrets-detected` | Whether secrets were detected in output |
189+
| `prompt-suspicious` | Whether suspicious patterns were detected in user prompt |
188190

189191
## Environment Variables
190192

@@ -227,15 +229,15 @@ jobs:
227229
- uses: actions/checkout@v4
228230
229231
- name: Security Review
230-
uses: docker/cagent-action@v1.0.0
232+
uses: docker/cagent-action@v1.0.4
231233
with:
232234
agent: docker/github-action-security-scanner
233235
prompt: "Analyze for security issues"
234236
env:
235237
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
236238
237239
- name: Code Quality Analysis
238-
uses: docker/cagent-action@v1.0.0
240+
uses: docker/cagent-action@v1.0.4
239241
with:
240242
agent: docker/code-quality-analyzer
241243
prompt: "Analyze code quality and best practices"
@@ -251,11 +253,11 @@ on:
251253
workflow_dispatch:
252254
inputs:
253255
agent:
254-
description: 'Agent to run'
256+
description: "Agent to run"
255257
required: true
256-
default: 'docker/code-analyzer'
258+
default: "docker/code-analyzer"
257259
prompt:
258-
description: 'Prompt for the agent'
260+
description: "Prompt for the agent"
259261
required: true
260262
261263
jobs:
@@ -265,15 +267,14 @@ jobs:
265267
- uses: actions/checkout@v4
266268
267269
- name: Run Agent
268-
uses: docker/cagent-action@v1.0.0
270+
uses: docker/cagent-action@v1.0.4
269271
with:
270272
agent: ${{ github.event.inputs.agent }}
271273
prompt: ${{ github.event.inputs.prompt }}
272274
env:
273275
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
274276
```
275277

276-
277278
## Contributing
278279

279280
We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details on:

‎action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ inputs:
1515
cagent-version:
1616
description: "Version of cagent to use"
1717
required: false
18-
default: "v1.9.12"
18+
default: "v1.15.6"
1919
mcp-gateway:
2020
description: "Install mcp-gateway (true/false)"
2121
required: false

‎examples/code-analysis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
- name: Analyze Code Changes
3030
id: analysis
31-
uses: docker/cagent-action@v1.0.0
31+
uses: docker/cagent-action@v1.0.4
3232
with:
3333
agent: docker/code-analyzer
3434
prompt: |

‎security/README.md‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ This directory contains security hardening scripts for the cagent-action GitHub
77
This action includes **built-in security features for all agent executions**:
88

99
1. **Output Scanning** - All agent responses are scanned for leaked secrets:
10+
1011
- API key patterns: `sk-ant-*`, `sk-*`, `sk-proj-*`
1112
- GitHub tokens: `ghp_*`, `gho_*`, `ghu_*`, `ghs_*`, `github_pat_*`
1213
- Environment variable names in output
@@ -57,15 +58,18 @@ The action implements a defense-in-depth approach:
5758
### Shared Patterns (`secret-patterns.sh`)
5859

5960
Central source of truth for secret detection patterns. This file is sourced by:
61+
6062
- `sanitize-output.sh` - Uses `SECRET_PATTERNS` array for comprehensive regex matching
6163
- `action.yml` (Build safe prompt step) - Uses `SECRET_PATTERNS` for prompt verification
6264

6365
**Why shared patterns?**
66+
6467
- **DRY principle**: Single source of truth prevents drift
6568
- **Consistency**: Same patterns across all security layers
6669
- **Maintainability**: Update patterns in one place
6770

6871
**Secret patterns detected:**
72+
6973
```bash
7074
SECRET_PATTERNS=(
7175
'sk-ant-[a-zA-Z0-9_-]{30,}' # Anthropic API keys
@@ -88,11 +92,13 @@ SECRET_PATTERNS=(
8892
**Patterns:** Sources from `secret-patterns.sh` for comprehensive detection
8993

9094
**Usage:**
95+
9196
```bash
9297
./sanitize-output.sh output-file.txt
9398
```
9499

95100
**Outputs:**
101+
96102
- `leaked=true/false` to `$GITHUB_OUTPUT`
97103
- Exits with code 1 if secrets detected
98104

@@ -101,6 +107,7 @@ SECRET_PATTERNS=(
101107
**Purpose:** Input sanitization for PR diffs and user prompts
102108

103109
**Function:**
110+
104111
- Removes code comments from diffs (prevents hidden instructions)
105112
- Detects HIGH-RISK patterns (blocks execution)
106113
- Instruction override attempts ("ignore previous instructions")
@@ -112,11 +119,13 @@ SECRET_PATTERNS=(
112119
- API key variable names in configuration
113120

114121
**Usage:**
122+
115123
```bash
116124
./sanitize-input.sh input-file.txt output-file.txt
117125
```
118126

119127
**Outputs:**
128+
120129
- `blocked=true/false` to `$GITHUB_OUTPUT`
121130
- `risk-level=low/medium/high` to `$GITHUB_OUTPUT`
122131
- Exits with code 1 if HIGH-RISK patterns detected
@@ -153,6 +162,7 @@ cd tests
153162
### Test Coverage
154163

155164
**test-security.sh** (13 tests):
165+
156166
1. Clean input (should pass)
157167
2. Prompt injection in comment (should block)
158168
3. Clean output (should pass)
@@ -169,6 +179,7 @@ cd tests
169179
14. High risk input - behavioral injection (should block)
170180

171181
**test-exploits.sh** (6 tests):
182+
172183
1. Prompt injection via comment (should be stripped)
173184
2. High-risk behavioral injection (should be blocked)
174185
3. Output token leak (should be blocked)
@@ -185,7 +196,7 @@ All tests must pass before deployment.
185196
```yaml
186197
- name: Run Agent
187198
id: agent
188-
uses: docker/cagent-action@v1.0.0
199+
uses: docker/cagent-action@v1.0.4
189200
with:
190201
agent: my-agent
191202
prompt: "Analyze the logs"
@@ -204,6 +215,7 @@ All tests must pass before deployment.
204215
```
205216
206217
All executions automatically include:
218+
207219
- Prompt sanitization warnings
208220
- Output scanning for secrets
209221
- Incident issue creation if secrets detected
@@ -216,6 +228,7 @@ All executions automatically include:
216228
When adding new secret patterns:
217229
218230
1. **Update `secret-patterns.sh`** with new regex pattern:
231+
219232
```bash
220233
SECRET_PATTERNS=(
221234
# ... existing patterns ...
@@ -224,11 +237,13 @@ When adding new secret patterns:
224237
```
225238

226239
2. **Add to `SECRET_PREFIXES`** if needed for quick checks:
240+
227241
```bash
228242
SECRET_PREFIXES='(sk-ant-|...|new-provider-)'
229243
```
230244

231245
3. **Run tests** to verify:
246+
232247
```bash
233248
cd tests
234249
./test-security.sh
@@ -253,9 +268,9 @@ Before deploying changes:
253268

254269
The action provides security-related outputs that can be checked in subsequent steps:
255270

256-
| Output | Description |
257-
|--------|-------------|
258-
| `secrets-detected` | `true` if secrets were detected in output |
271+
| Output | Description |
272+
| ------------------- | ----------------------------------------------------- |
273+
| `secrets-detected` | `true` if secrets were detected in output |
259274
| `prompt-suspicious` | `true` if suspicious patterns were detected in prompt |
260275

261276
## Reporting Security Issues

‎tests/test-job-summary.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ echo "---"
3535
echo "| Agent | \`agents/security-scanner.yaml\` |"
3636
echo "| Exit Code | 0 |"
3737
echo "| Execution Time | 45s |"
38-
echo "| CAgent Version | v1.6.6 |"
38+
echo "| CAgent Version | v1.15.6 |"
3939
echo "| MCP Gateway | false |"
4040
echo ""
4141
echo "✅ **Status:** Success"

0 commit comments

Comments
 (0)