GitHub Action

Install the Codai Resolve action — label an issue codai-fix and get a PR with a verified fix and a public attestation. Inputs, outputs, secrets, permissions and example workflows.

The action lives at dragoscv/resolve-action. It runs on an issues event, submits the issue to Resolve, accepts the quote if your workflow allows it, waits for the verdict, and on success pushes a codai-fix/issue-<N> branch and opens a pull request that links the public attestation. On decline or failure it comments the reason on the issue. Nothing is billed unless a fix was verified.

Usage

.github/workflows/codai-fix.yml

name: codai-fix
on:
  issues:
    types: [labeled]

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  resolve:
    if: github.event.label.name == 'codai-fix'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: dragoscv/resolve-action@v1
        with:
          codai-api-key: ${{ secrets.CODAI_API_KEY }}
          # Optional — auto-pay flat quotes up to a tier ($7 / $19 / $49):
          # auto-accept: 'true'
          # max-tier: 't19'

Add the secret

Create a key at hub.codai.ro → Keys and store it as the repository secret CODAI_API_KEY (Settings → Secrets and variables → Actions). Keys look like codai_xxxxxxxx.

Create the label

Add a label named exactly codai-fix to the repository. The workflow's if: guard means other labels never start a job.

Label an issue

Apply codai-fix to an issue with a clear description of the bug. The action comments within a minute with the triage result; a verified fix arrives as a PR, typically in 5–20 minutes.

Inputs

Prop

Type

Outputs

Prop

Type

Permissions

The workflow needs three write scopes on the default GITHUB_TOKEN:

Scope	Used for
`contents: write`	Push the `codai-fix/issue-<N>` branch with the patch.
`pull-requests: write`	Open the PR against the default branch.
`issues: write`	Comment the quote, the decline reason or the failure reason on the issue.

If your organisation restricts the default token to read-only, either enable Read and write permissions under Settings → Actions → General → Workflow permissions, or pass a fine-grained PAT as github-token.

actions/checkout with fetch-depth: 0 matters: the action commits the patch on top of the checked-out history and needs the full clone to push a branch.

What the action does, step by step

Reads issue.title + issue.body from the event payload (first 50 000 characters) and POSTs them with repo_url: https://github.com/<owner>/<repo> to /v1/resolve/jobs.
Declined → comments Codai Resolve declined this issue (nothing billed) with the reason; status=declined.
Quoted → if auto-accept is off, or the tier is above max-tier, comments the price and how to enable it; status=quoted, nothing runs. Otherwise POST …/accept.
Polls GET /v1/resolve/jobs/{id} every 15 seconds for up to 25 minutes.
Resolved → fetches the attestation, applies patch on a new branch codai-fix/issue-<N>, pushes it, opens the PR (body links the attestation and quotes the repro test), comments on the issue; sets pr-url and attestation-url.
Failed / error → comments Codai Resolve could not verify a fix (nothing billed) with fail_reason.

Example workflows

Pay up to $19 automatically

.github/workflows/codai-fix.yml

name: codai-fix
on:
  issues:
    types: [labeled]
permissions:
  contents: write
  pull-requests: write
  issues: write
jobs:
  resolve:
    if: github.event.label.name == 'codai-fix'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: dragoscv/resolve-action@v1
        with:
          codai-api-key: ${{ secrets.CODAI_API_KEY }}
          auto-accept: 'true'
          max-tier: 't19'

Run on a failing CI job

The action reads the issue from the event payload, so the trigger must be an issues event. To react to a red CI run, have the failing workflow open (or label) an issue, and let the codai-fix workflow above pick it up:

.github/workflows/ci.yml (excerpt)

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pnpm install --frozen-lockfile
      - id: tests
        run: pnpm test
      - name: Ask Resolve to fix it
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh issue create \
            --title "CI failed on ${GITHUB_REF_NAME} (${GITHUB_SHA::7})" \
            --body "Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}
          Job \`test\` failed. Please reproduce and fix." \
            --label codai-fix

Give this job issues: write too. Paste the relevant test output into the body when you can — triage quotes from the text it sees, and a precise failure gets a cheaper tier.

Manual dispatch

workflow_dispatch carries no issue, so the action cannot run under it directly. Wrap it: take an issue number as input and re-label the issue, which fires the issues: labeled workflow.

.github/workflows/codai-fix-manual.yml

name: codai-fix (manual)
on:
  workflow_dispatch:
    inputs:
      issue:
        description: Issue number to send to Resolve
        required: true
permissions:
  issues: write
jobs:
  relabel:
    runs-on: ubuntu-latest
    steps:
      - env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh issue edit ${{ inputs.issue }} --remove-label codai-fix || true
          gh issue edit ${{ inputs.issue }} --add-label codai-fix

Use the outputs

      - id: fix
        uses: dragoscv/resolve-action@v1
        with:
          codai-api-key: ${{ secrets.CODAI_API_KEY }}
      - if: steps.fix.outputs.status == 'resolved'
        run: echo "PR ${{ steps.fix.outputs['pr-url'] }} — proof ${{ steps.fix.outputs['attestation-url'] }}"

Runner time counts against your GitHub Actions minutes while the action polls (up to 25 minutes on a slow job). Resolve itself bills only on a verified fix.