{ "markdown": "# Deep Agent Action\n\n> An AI coding agent for your GitHub issues and pull requests β€” mention `@agent`, and it plans, edits, runs your toolchain, and opens a PR. Powered by the [Deep Agents](https://www.npmjs.com/package/deepagents) JS harness, running in-process on your runner.\n\n[![CI](https://github.com/dipjyotimetia/deep-agent-action/actions/workflows/ci.yml/badge.svg)](https://github.com/dipjyotimetia/deep-agent-action/actions/workflows/ci.yml)\n[![E2E](https://github.com/dipjyotimetia/deep-agent-action/actions/workflows/e2e.yml/badge.svg)](https://github.com/dipjyotimetia/deep-agent-action/actions/workflows/e2e.yml)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n[![Built with Bun](https://img.shields.io/badge/built%20with-Bun-000000.svg?logo=bun)](https://bun.sh)\n\nComment `@agent fix the failing test` on an issue and get a pull request back. Comment `@agent review` on a PR and get an inline code review. No hosted service, no extra infrastructure β€” the agent runs entirely inside your GitHub Actions runner, using a model provider of your choice.\n\n---\n\n## Table of contents\n\n- [Why this action](#why-this-action)\n- [Features](#features)\n- [Set up with npx](#set-up-with-npx)\n- [Quickstart](#quickstart)\n- [Demo](#demo)\n- [How it works](#how-it-works)\n- [Usage modes](#usage-modes)\n- [Models & providers](#models--providers)\n- [Inputs](#inputs)\n- [Outputs](#outputs)\n- [Per-repo configuration](#per-repo-configuration)\n- [Project Wiki](#project-wiki)\n- [Security](#security)\n- [Examples](#examples)\n- [Troubleshooting](#troubleshooting)\n- [Versioning](#versioning)\n- [Contributing](#contributing)\n- [License](#license)\n\n## Why this action\n\n| | Deep Agent Action |\n| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| **Setup** | Copy one workflow, add one secret. No app install wizard, no hosted backend. |\n| **Where it runs** | In-process on your runner β€” your code never leaves your CI. |\n| **Models** | 8 providers: Anthropic, OpenAI, Azure OpenAI, Google Gemini, OpenRouter, any OpenAI-compatible endpoint, AWS Bedrock, GCP Vertex AI. |\n| **Safety** | Command allow/deny guardrails, secret-free shell, fork-PR protection, permission gating, approval-gated landing by default, protected paths, and optional cost/token spend caps. |\n| **Feedback** | A single sticky comment shows a live plan, progress, the PR link, and token/cost estimates. |\n\n## Features\n\n- πŸ€– **In-runner agent** β€” plans, reads and edits files, runs your toolchain, commits, and opens a PR. No external service.\n- πŸ’¬ **`@agent` triggers** β€” works from issue comments, PR comments, PR review comments, new issues, and new PRs. Manual runs via `workflow_dispatch` too.\n- πŸ”Œ **8 model providers** β€” Anthropic, OpenAI, Azure, Google Gemini, OpenRouter, OpenAI-compatible (Groq, xAI, DeepSeek, Together, Ollama, vLLM, …), AWS Bedrock, GCP Vertex AI.\n- πŸ” **Code review mode** β€” `@agent review` reads the PR diff and posts inline review comments. `@agent review and fix` also applies clean single-line suggestions directly and lands them as a commit.\n- 🏷️ **Label/assignee triggers** β€” `auto_run_label` / `auto_run_assignee` run the agent without a trigger-phrase match; combine with `on: schedule` + `prompt` for unattended maintenance runs (see [`examples/scheduled-maintenance.yml`](examples/scheduled-maintenance.yml)).\n- πŸ” **Issue/PR continuity** β€” a follow-up mention on the same issue reuses the same branch and PR instead of opening a new one each time. A plain `@agent continue` (or `resume`) picks up an incomplete plan where it left off.\n- βœ… **Verified commits** β€” optional `verified_commits: true` lands changes via the GitHub App's `createCommitOnBranch` mutation so they show as \"Verified\".\n- 🧭 **Issue-triage lifecycle** (opt-in) β€” `enable_triage: true` uses visible labels to request reproduction details, re-triage new evidence, and propose a draft fix. External contributors receive safe labels/comments only; a permitted maintainer approves any coding run with `triage: run`.\n- βœ‹ **Human-in-the-loop gate** β€” optionally require approval before changes land (draft PR or proposed branch + compare link).\n- πŸ“Œ **Sticky progress comment** β€” one comment, updated in place, with a live checklist, summary, PR link, and token/cost estimate.\n- πŸ’° **Cost reporting** β€” token usage and an estimated USD cost surfaced in the comment, job summary, and machine-readable output.\n- πŸ›‘ **Spend caps** β€” optional `max_cost_usd` / `max_total_tokens` ceilings stop a run the moment it crosses the limit (counting subagent spend too) and land the partial work as a draft for review.\n- 🧠 **Cross-run memory** β€” a compact history of prior `@agent` turns on the same issue/PR is carried forward as context on the next mention. No backend; stored in the sticky comment.\n- 🧩 **Deepagents memory and skills** β€” repository-local `.deepagents/AGENTS.md` is loaded as read-only guidance, while `.deepagents/skills/` exposes progressive-disclosure `SKILL.md` workflows to the agent.\n- πŸ§‘β€πŸ”¬ **Specialist subagents** β€” opt into named synchronous specialists for focused work, with static model selection, scoped MCP tools, repository skills, structured findings, and the same approval controls.\n- πŸ›‘οΈ **Shell guardrails** β€” an allow-list and an always-on deny-list for shell commands, plus a secret-free environment.\n- 🍴 **Fork-PR protection** β€” fork PRs are denied by default; maintainers opt in per-PR with a label.\n- 🧰 **MCP tools** β€” connect Model Context Protocol servers to extend what the agent can do.\n- πŸš€ **Zero-config** β€” sensible defaults for everything; the only required secret is your model provider key.\n\n## Set up with npx\n\nFrom the root of any Git repository, run:\n\n```sh\nnpx create-deep-agent-action\n```\n\nThe creator writes a least-privilege `.github/workflows/deep-agent.yml`, pinned to an immutable action commit, and a minimal read-only `.deepagents/AGENTS.md` guidance file. It preserves existing files unless you explicitly pass `--force`; it never writes provider keys or changes GitHub repository settings.\n\nAdd `PROVIDER_API_KEY` in **Settings β†’ Secrets and variables β†’ Actions**, then enable **Allow GitHub Actions to create and approve pull requests** under **Settings β†’ Actions β†’ General** if you use the default `GITHUB_TOKEN`. Use `npx create-deep-agent-action --help` for non-interactive model, trigger, target-directory, and guidance options.\n\n## Quickstart\n\n**1. Add the workflow** at `.github/workflows/agent.yml`:\n\n```yaml\nname: Deep Agent\n\non:\n issue_comment:\n types: [created]\n pull_request_review_comment:\n types: [created]\n issues:\n types: [opened, assigned]\n workflow_dispatch:\n inputs:\n prompt:\n description: \"Instruction for the agent\"\n required: true\n\npermissions:\n contents: write\n pull-requests: write\n issues: write\n\n# One agent run per issue/PR thread at a time: simultaneous @agent mentions\n# queue instead of racing the sticky tracking comment (and its memory block).\n# cancel-in-progress stays false so an in-flight run finishes and lands its work.\nconcurrency:\n group: deep-agent-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}\n cancel-in-progress: false\n\njobs:\n agent:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v6\n with:\n fetch-depth: 0\n\n - uses: dipjyotimetia/deep-agent-action@main\n with:\n model: \"claude-sonnet-5\"\n prompt: ${{ github.event.inputs.prompt }}\n env:\n PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}\n```\n\n**2. Add one secret.** In **Settings β†’ Secrets and variables β†’ Actions**, add `PROVIDER_API_KEY` with your model provider's API key (e.g. an Anthropic key for the default model).\n\n**3. Use it.** Open an issue and comment:\n\n```\n@agent add input validation to the signup form and a test for it\n```\n\nThe agent posts a tracking comment, works through a plan, and opens a pull request with the change.\n\n> [!TIP]\n> That's the whole setup. Everything else on this page is optional tuning. For a copy-paste-ready file with inline comments, see [`examples/agent.yml`](examples/agent.yml).\n\n## Demo\n\nWant to see it work before wiring it into your repo? Run the **Demo** workflow (**Actions β†’ Demo β†’ Run workflow**) β€” it runs the agent on a visible task and opens a real pull request you can browse. The [E2E badge](https://github.com/dipjyotimetia/deep-agent-action/actions/workflows/e2e.yml) above also reflects a nightly live run that exercises the implement and approval-gate modes against this repo.\n\nSee [docs/demo.md](docs/demo.md) for a walkthrough, sample output, and the `result_json` shape.\n\n## How it works\n\n```\nGitHub event (comment / issue / PR / dispatch)\n β”‚\n β–Ό\n1. Route ─ is there a trigger phrase or explicit prompt? ── no ─▢ no-op (exit)\n β”‚ yes\n β–Ό\n2. Authorize ─ human actor? sufficient permission? fork allowed? ── no ─▢ refuse (comment)\n β”‚ yes\n β–Ό\n3. Acknowledge ─ πŸ‘€ reaction + create/reuse the sticky tracking comment\n β”‚\n β–Ό\n4. Run the agent\n β”œβ”€ agent mode β†’ edit files, run toolchain, commit\n └─ review mode β†’ read the PR diff, collect findings\n β”‚\n β–Ό\n5. Land the result\n β”œβ”€ open a PR / push to the PR branch (or a draft PR / proposed branch if approval is required)\n └─ post inline review comments\n β”‚\n β–Ό\n6. Finalize ─ update the sticky comment (status, plan, activity, PR link, tokens/cost) + emit outputs + audit artifact\n```\n\nThe agent only acts when it is both **triggered** (a mention or explicit prompt) and **authorized** (a human collaborator with write/admin access). Secrets are never exposed to the agent's shell. See the [security model](docs/security.md) for the full picture.\n\n## Usage modes\n\n| You want to… | Where | Comment |\n| ------------------ | -------------------------------- | -------------------------------------------------------------- |\n| Implement a change | An **issue** | `@agent implement X` β†’ opens a PR |\n| Fix / extend a PR | A **pull request** | `@agent address the review feedback` β†’ pushes to the PR branch |\n| Get a code review | A **pull request** | `@agent review` β†’ posts inline comments |\n| Run unattended | **Actions tab** β†’ _Run workflow_ | provide a `prompt` input (no mention needed) |\n\nThe agent enters **review mode** automatically when the instruction starts with `review` on a pull request; otherwise it implements. Review mode can read and search the checkout but has no shell or repository-edit tool. Its JSON handoff is written to isolated temporary storage outside the repository. When suggestions are applied, only non-symlink regular files from GitHub's changed-file list are eligible; unsafe findings remain comments.\n\n## Models & providers\n\nSet the `model` input (default `claude-sonnet-5`). A bare model name infers the provider (`claude…` β†’ Anthropic, `gpt…`/`o…` β†’ OpenAI, `gemini…` β†’ Google); otherwise prefix it with `provider:`.\n\n| Provider | Example `model` | Auth |\n| ----------------- | --------------------------------------------------- | -------------------------------------------- |\n| Anthropic | `claude-sonnet-5` | `PROVIDER_API_KEY` (or `ANTHROPIC_API_KEY`) |\n| OpenAI | `openai:gpt-5` | `PROVIDER_API_KEY` (or `OPENAI_API_KEY`) |\n| Azure OpenAI | `azure:` | `AZURE_OPENAI_*` env vars |\n| Google Gemini | `google:gemini-2.5-pro` | `PROVIDER_API_KEY` (or `GOOGLE_API_KEY`) |\n| OpenRouter | `openrouter:openai/gpt-4o` | `PROVIDER_API_KEY` (or `OPENROUTER_API_KEY`) |\n| OpenAI-compatible | `openai-compatible:llama-3.1-70b` + `base_url` | `PROVIDER_API_KEY` |\n| AWS Bedrock | `bedrock:anthropic.claude-3-5-sonnet-20241022-v2:0` | AWS env chain (`AWS_REGION`, …) |\n| GCP Vertex AI | `vertexai:gemini-2.5-pro` | ADC / `GOOGLE_APPLICATION_CREDENTIALS` |\n\nFull per-provider setup (env vars, regions, credentials) is in [docs/providers.md](docs/providers.md).\n\n## Inputs\n\nAll inputs are optional.\n\n| Input | Description | Default |\n| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- |\n| `trigger_phrase` | Phrase that triggers the agent in issue/PR/comment bodies. | `@agent` |\n| `prompt` | Explicit instruction (e.g. for `workflow_dispatch`); bypasses the trigger phrase. | β€” |\n| `model` | Model id, optionally provider-prefixed. See [Models & providers](#models--providers). | `claude-sonnet-5` |\n| `base_url` | Endpoint URL for the `openai-compatible` provider. | β€” |\n| `mcp_config` | MCP servers JSON: `{ \"mcpServers\": { name: { command, args, env } \\| { url } } }`. | β€” |\n| `harness_profile` | Strict deepagents harness-profile JSON (`systemPromptSuffix`, tool overrides, excluded tools/middleware, or general-purpose subagent settings). | β€” |\n| `filesystem_permissions` | Strict deepagents filesystem-rule JSON with `operations`, absolute glob `paths`, and optional `mode`. Built-in filesystem writes to `.deepagents/` stay denied. | β€” |\n| `subagents` | Strict JSON specialist declarations. Each requires `name`, `description`, `systemPrompt`, and an explicit MCP-tool allow-list; optional model, repository skills, deny-only filesystem rules, and `findings` response mode. | β€” |\n| `allowed_permissions` | Comma-separated repo permission levels allowed to trigger the agent. | `write,admin` |\n| `allowed_commands` | Comma/newline-separated allow-list of shell commands. | a common dev toolchainΒΉ |\n| `denied_commands` | Extra command names to block (merged with the built-in deny-list). | β€” |\n| `fork_allow_label` | Label a write-access user applies to authorize the agent on a fork PR. If unset, fork PRs never run. | β€” |\n| `auto_run_label` | Label that, when applied to an issue, runs the agent without a trigger-phrase match. | β€” |\n| `auto_run_assignee` | GitHub username that, when assigned to an issue, runs the agent without a trigger-phrase match. | β€” |\n| `auto_run_default_instruction` | Fallback instruction for an auto-run event when the issue has no usable title/body text. | β€” |\n| `shell_timeout_seconds` | Max seconds for a single shell command. | `600` |\n| `comment_debounce_ms` | Minimum interval between tracking-comment progress edits. | `8000` |\n| `provider_api_key` | Model provider API key. Also read from `PROVIDER_API_KEY` / `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` / `GOOGLE_API_KEY` / `OPENROUTER_API_KEY`. | β€” |\n| `app_id` | GitHub App id used to mint a scoped installation token. Also read from `APP_ID`. | β€” |\n| `app_private_key` | GitHub App private key (PEM). Also read from `APP_PRIVATE_KEY`. | β€” |\n| `github_token` | Token for GitHub API/git operations. | `${{ github.token }}` |\n| `require_push_approval` | Gate landing of changes behind human review (draft PR / proposed branch). | `true` |\n| `protected_paths` | Extra repository-relative globs the agent may modify during a run but can never publish. Agent guidance and repo config paths are always protected. | β€” |\n| `verified_commits` | Land via the GitHub App's `createCommitOnBranch` GraphQL mutation so commits show as \"Verified\". Requires `app_id`/`app_private_key`. | `false` |\n| `enable_triage` | Enable the label-backed lifecycle for unmentioned issues. | `false` |\n| `triage_label_*` | Names for visible lifecycle labels, including needs-reproduction, needs-maintainer, and fix-proposed. Labels must already exist in the target repository. | `triage: …` |\n| `triage_run_label` | Maintainer-applied label that authorizes an agentic triage run for an external issue. | `triage: run` |\n| `triage_bot_logins` | Additional bot logins whose comments never cause re-triage. | β€” |\n| `triage_max_failed_attempts` | Bounded automatic retries after unexpected triage failures. | `3` |\n| `triage_model` | Model used for lifecycle classification. | `model` |\n| `max_cost_usd` | Abort the run once estimated spend reaches this many USD; partial work lands as a draft. Requires a known model price β€” pair with `max_total_tokens` for unpriced models. | β€” (no cap) |\n| `max_total_tokens` | Abort once cumulative billed tokens (input + output) reach this many; partial work lands as a draft. Re-counted each model call as context grows, so set it generously. | β€” (no cap) |\n| `max_runtime_minutes` | Abort the agent once it has run this many minutes; partial work lands as a draft (like a budget stop). A job-level `timeout-minutes` still applies but kills the run without landing anything. | β€” (no cap) |\n| `recursion_limit` | Max agent super-steps per run. Raise for long multi-step tasks that reach the recursion ceiling. | `150` |\n| `max_repeated_tool_calls` | Stop a no-progress loop when the same tool call repeats without a todo update. | `8` |\n\nΒΉ Default `allowed_commands`: `git, ls, cat, mkdir, touch, cp, mv, node, npm, npx, pnpm, yarn, bun, python, python3, pip, pytest, go, make, cargo, rustc, sed, grep, find, echo`. Always-on deny-list: `curl, wget, nc, ncat, ssh, scp, sudo, su, telnet, dd, mkfs, shutdown, reboot`. See [docs/configuration.md](docs/configuration.md).\n\n> [!IMPORTANT]\n> The action opens pull requests with the `GITHUB_TOKEN`. For that to work, enable **Settings β†’ Actions β†’ General β†’ Workflow permissions β†’ \"Allow GitHub Actions to create and approve pull requests\"** (otherwise you'll see _\"GitHub Actions is not permitted to create or approve pull requests\"_). Alternatively, use a GitHub App (`app_id` + `app_private_key`), which doesn't require this setting.\n\n> [!NOTE]\n> PRs opened with the default `GITHUB_TOKEN` also do **not** trigger your other CI workflows. If you need the agent's PRs to run CI, configure a GitHub App (`app_id` + `app_private_key`). See [examples/github-app.yml](examples/github-app.yml).\n\n## Outputs\n\n| Output | Description |\n| ---------------- | ----------------------------------------------------------------------------------------------------------- |\n| `status` | Run outcome: `success` \\| `skipped` \\| `refused` \\| `failed`. |\n| `pr_url` | URL of the opened pull request (or compare link), if any. |\n| `branch` | Branch the agent pushed to, if any. |\n| `budget_stopped` | `true` when a cost/token cap stopped the run early (partial work opened for review). |\n| `timed_out` | `true` when `max_runtime_minutes` stopped the run early (partial work opened for review). |\n| `stalled` | `true` when a no-progress loop or recursion ceiling stopped the run early (partial work opened for review). |\n| `audit_artifact` | Invocation-unique name of the uploaded audit-record artifact. |\n| `result_json` | Machine-readable run record (plan, files changed, tokens, cost, outcome). |\n\nEvery run also writes a job summary and uploads an invocation-scoped `deep-agent-run-` artifact as an audit record. Its exact name is exposed through the `audit_artifact` output, so parallel jobs, matrix jobs, and repeated action steps cannot replace each other's records.\n\n## Per-repo configuration\n\nCommit an optional `.github/deep-agent.yml` to add repository guidance without giving repository content authority over execution policy:\n\n```yaml\n# .github/deep-agent.yml\nsystem_prompt: |\n This is a TypeScript monorepo managed with pnpm. Always co-locate tests with\n the code they cover, and never edit files under generated/.\n```\n\nAll execution, landing, budget, filesystem, MCP, and subagent controls belong in the invoking workflow. Full field reference in [docs/configuration.md](docs/configuration.md).\n\n## Project Wiki\n\nThe repository's detailed code documentation lives in [`openwiki/`](openwiki/) and is published to the [GitHub Wiki](https://github.com/dipjyotimetia/deep-agent-action/wiki) after review.\n\nA weekly workflow runs OpenWiki through OpenRouter and maintains one `openwiki/update` pull request. Merging reviewed documentation into `main` invokes the immutable [`openwiki-github-wiki-action`](https://github.com/dipjyotimetia/openwiki-github-wiki-action) release, which treats `openwiki/` as canonical and replaces the generated Wiki pages. The publisher never runs a model or publishes an unreviewed update.\n\nBoth workflows mint short-lived credentials from the dedicated OpenWiki Publisher GitHub App. Configure `OPENWIKI_APP_CLIENT_ID` as a repository variable and `OPENWIKI_APP_PRIVATE_KEY` as a repository secret; the App needs **Contents: Read and write** and **Pull requests: Read and write** for this combined workflow. Create the Wiki's first `Home` page in GitHub once before the first publication.\n\n## Security\n\nThe agent runs untrusted, model-generated commands, so the action is defensive by default:\n\n- **Permission gating** β€” only human collaborators with `write`/`admin` (configurable) can trigger it; bot accounts are ignored to prevent loops.\n- **Fork-PR protection** β€” fork PRs are denied unless a maintainer applies the `fork_allow_label`.\n- **Secret-free shell** β€” the agent's shell sees an allow-listed, secret-free environment; provider keys and `GITHUB_TOKEN` are never exposed to it.\n- **Command guardrails** β€” an allow-list plus an always-on deny-list (network/privilege tools are blocked even if allow-listed), enforced at the shared backend for the main agent and delegated subagents.\n- **Human-approval gate** β€” landing is approval-gated by default; set `require_push_approval: false` only for deliberate direct updates.\n- **Repository guidance boundary** β€” only `.deepagents/AGENTS.md` and `.deepagents/skills/` are loaded by deepagents; their built-in filesystem writes are denied, protected paths cannot be published, and issue/PR text remains separate untrusted data.\n\nThis is a guardrail model, not a sandbox: allowed commands execute directly on the runner. Run it on the providers and repos you trust. See [docs/security.md](docs/security.md) for the full threat model, and [SECURITY.md](SECURITY.md) to report a vulnerability.\n\n## Examples\n\nReady-to-copy workflows live in [`examples/`](examples/):\n\n| Example | What it shows |\n| ----------------------------------------------------------------- | -------------------------------------------------------------------- |\n| [`agent.yml`](examples/agent.yml) | The all-in-one starting point. |\n| [`review.yml`](examples/review.yml) | Code-review-only setup for pull requests. |\n| [`approval-gate.yml`](examples/approval-gate.yml) | Require human approval before changes land. |\n| [`multi-provider.yml`](examples/multi-provider.yml) | OpenAI, Bedrock, Vertex, OpenRouter, and OpenAI-compatible variants. |\n| [`mcp-tools.yml`](examples/mcp-tools.yml) | Extend the agent with MCP servers. |\n| [`github-app.yml`](examples/github-app.yml) | Use a GitHub App so the agent's PRs trigger your CI. |\n| [`issue-automation.yml`](examples/issue-automation.yml) | Turn issue comments/labels into PRs. |\n| [`scheduled-maintenance.yml`](examples/scheduled-maintenance.yml) | Unattended `schedule`-triggered runs (e.g. dependency upgrades). |\n\n## Troubleshooting\n\nA few common cases β€” full guide in [docs/troubleshooting.md](docs/troubleshooting.md).\n\n- **Nothing happened.** Check the workflow listens to the event you used (e.g. `issue_comment`), the comment contains the exact trigger phrase at a word boundary, and the run wasn't a no-op in the Actions log.\n- **\"Request not authorized.\"** The actor needs `write`/`admin` access (per `allowed_permissions`), or it's a fork PR without the `fork_allow_label`, or the actor is a bot.\n- **The agent's PR didn't run my CI.** Expected with the default `GITHUB_TOKEN` β€” switch to a GitHub App (see [examples/github-app.yml](examples/github-app.yml)).\n- **Cost shows tokens but no `$`.** The model name isn't in the estimate table; usage is still reported. See [`src/agent/cost.ts`](src/agent/cost.ts).\n\n## Versioning\n\n### v2 migration\n\n- Move every execution/security setting from `.github/deep-agent.yml` into the calling workflow; the repository file now supports only `system_prompt`.\n- Replace global `apply_suggestions: true` with an explicit `@agent review and fix` request.\n- Remove `interrupt_on` and the reserved bridge inputs; an ephemeral runner cannot provide durable tool approval or hosted execution.\n- Review any automation that expected direct landing: `require_push_approval` now defaults to `true`.\n\nPin to a ref you trust. `@main` tracks the latest:\n\n```yaml\n- uses: dipjyotimetia/deep-agent-action@main\n```\n\nFor reproducible builds, pin to a commit SHA:\n\n```yaml\n- uses: dipjyotimetia/deep-agent-action@\n```\n\n## Contributing\n\nContributions are welcome. The action is TypeScript run directly on [Bun](https://bun.sh) β€” no build/bundle step. See [CONTRIBUTING.md](CONTRIBUTING.md) for the dev loop, project layout, and how to add a provider. For an audit of the feature surface β€” strengths, recently closed gaps, and the roadmap β€” see [docs/feature-review.md](docs/feature-review.md).\n\n## License\n\n[MIT](LICENSE) Β© Dipjyoti Metia\n", "bytes": 32699, "sha": "b07b125a541e860428facbd3f55cbadee1820f9bc48572db83213f899d06efc8", "repo_slug": "dipjyotimetia/deep-agent-action", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/okf_dipjyotimetia_deep_agent_action_openwiki_6dd5777f/readme" }