From 75278171e04dc4b43c0b79c6b82f628a3a754ca9 Mon Sep 17 00:00:00 2001
From: Colin L <colin@colins-mbp-2.lan>
Date: Thu, 30 Apr 2026 07:02:32 -0700
Subject: [PATCH] ci: add Nebius selftest workflow

Runs python start_proxy.py --selftest (which performs a real round
trip to Nebius Token Factory) on:

  - push to main: so the main branch is always known-functional
  - workflow_dispatch: so a maintainer can re-verify on demand

We deliberately don't run on pull_request: PRs from forks don't
receive secrets, so a real-API selftest there would always fail
with a useless "secret not set" error. The existing Test Matrix
workflow already covers PRs with pytest (no API needed).

Required: NEBIUS_API_KEY repository secret. Fails loudly with a
GitHub annotation if the secret is missing rather than silently
skipping. Uses moonshotai/Kimi-K2.5 (live as of writing) to avoid
the model-not-found failure mode that retired model IDs cause.

Depends on: --selftest flag (PR #4) being merged first.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/nebius-selftest.yml | 50 +++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/nebius-selftest.yml

diff --git a/.github/workflows/nebius-selftest.yml b/.github/workflows/nebius-selftest.yml
new file mode 100644
index 00000000..422bcab5
--- /dev/null
+++ b/.github/workflows/nebius-selftest.yml
@@ -0,0 +1,50 @@
+name: Nebius Selftest
+
+# Exercises a real round trip against Nebius Token Factory via
+# `python start_proxy.py --selftest`. Runs on:
+#   - push to main, so the main branch is always known-functional
+#   - manual dispatch, so a maintainer can re-verify on demand
+#
+# Requires the `NEBIUS_API_KEY` repository secret. PRs from forks do NOT
+# get access to secrets and so cannot run this workflow — those PRs are
+# still covered by Test Matrix (pytest, no API).
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  selftest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install runtime dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Verify NEBIUS_API_KEY secret is available
+        run: |
+          if [ -z "${{ secrets.NEBIUS_API_KEY }}" ]; then
+            echo "::error::NEBIUS_API_KEY secret is not configured on this repo." \
+                 "Add it under Settings -> Secrets and variables -> Actions."
+            exit 1
+          fi
+
+      - name: Run --selftest against Nebius
+        env:
+          OPENAI_API_KEY: ${{ secrets.NEBIUS_API_KEY }}
+          OPENAI_BASE_URL: https://api.tokenfactory.nebius.com/v1
+          BIG_MODEL: moonshotai/Kimi-K2.5
+          MIDDLE_MODEL: moonshotai/Kimi-K2.5
+          SMALL_MODEL: moonshotai/Kimi-K2.5
+          VISION_MODEL: Qwen/Qwen2.5-VL-72B-Instruct
+          OBSERVABILITY_ENABLED: "false"
+        run: python start_proxy.py --selftest