Temporary live test

Author: rgarcia

.github/workflows/llm-credentials-livetest.yml

@@ -0,0 +1,35 @@
+name: llm-credentials-livetest
+on:
+  push:
+    branches: [hypeship/llm-credentials-livetest]
+permissions:
+  contents: read
+  id-token: write
+jobs:
+  refresh:
+    strategy:
+      matrix:
+        model: [openai/gpt-6-luna, anthropic/claude-haiku-5-5]
+    runs-on: ubuntu-latest
+    env:
+      PI_TELEMETRY: '0'
+      PI_SKIP_VERSION_CHECK: '1'
+    steps:
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '22'
+      - run: npm install -g --ignore-scripts @earendil-works/pi-coding-agent >/dev/null
+      - uses: kernel/security-workflows/.github/actions/llm-credentials@hypeship/llm-credentials-livetest
+        with:
+          model: ${{ matrix.model }}
+      - name: Wait past the first credential's expiry
+        run: sleep 400
+      - name: Call the model with refreshed credentials
+        env:
+          MODEL: ${{ matrix.model }}
+        run: |
+          test -z "${ANTHROPIC_API_KEY:-}${OPENAI_API_KEY:-}"
+          stat -c '%y %n' "$RUNNER_TEMP/anthropic-identity-token" ~/.pi/agent/auth.json 2>/dev/null || true
+          cat "$RUNNER_TEMP/llm-credentials.log" 2>/dev/null || true
+          echo "Reply with exactly: refreshed ok" | pi --print --no-session --no-tools --no-mcp \
+            --no-extensions --no-skills --no-context-files --model "$MODEL"

.github/workflows/pr-risk-wif-livetest.yml

@@ -0,0 +1,16 @@
+name: pr-risk-wif-livetest
+on:
+  pull_request:
+    branches: [hypeship/llm-credentials-livetest]
+permissions:
+  contents: read
+  pull-requests: read
+  id-token: write
+jobs:
+  classify:
+    uses: ./.github/workflows/pr-risk.yml
+    with:
+      security-workflows-ref: hypeship/llm-credentials-livetest
+    secrets:
+      ADMIN_APP_ID: ${{ secrets.ADMIN_APP_ID }}
+      ADMIN_APP_PRIVATE_KEY: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}

.github/workflows/pr-risk.yml

@@ -100,7 +100,7 @@ jobs:
       # `uses` can't take an expression, so this follows main rather than security-workflows-ref.
       - name: Model credentials
         if: steps.gather.outputs.eligible == 'true'
-        uses: kernel/security-workflows/.github/actions/llm-credentials@main
+        uses: kernel/security-workflows/.github/actions/llm-credentials@hypeship/llm-credentials-livetest
         with:
           model: ${{ inputs.model }}