Initial plan

chore(deps): bump the actions-minor group across 1 directory with 3 updates
Bumps the actions-minor group with 3 updates in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby), [super-linter/super-linter](https://github.com/super-linter/super-linter) and [actions/publish-action](https://github.com/actions/publish-action). Updates `ruby/setup-ruby` from 1.268.0 to 1.269.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/8aeb6ff8030dd539317f8e1769a044873b56ea71...d697be2f83c6234b20877c3b5eac7a7f342f0d0c) Updates `super-linter/super-linter` from 8.0.0 to 8.3.0 - [Release notes](https://github.com/super-linter/super-linter/releases) - [Changelog](https://github.com/super-linter/super-linter/blob/main/CHANGELOG.md) - [Commits](https://github.com/super-linter/super-linter/compare/5119dcd8011e92182ce8219d9e9efc82f16fddb6...502f4fe48a81a392756e173e39a861f8c8efe056) Updates `actions/publish-action` from 0.3.0 to 0.4.0 - [Commits](https://github.com/actions/publish-action/compare/v0.3.0...v0.4.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.269.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: super-linter/super-linter dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/publish-action dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-03-13 21:29:30 +00:00 · 2026-03-13 21:24:34 +00:00 · 2026-03-13 11:20:50 -10:00 · 2026-03-13 21:15:02 +00:00 · 2026-03-13 11:13:49 -10:00 · 2026-03-13 21:11:33 +00:00
22 changed files with 503 additions and 217 deletions
@@ -43,7 +43,7 @@ jobs:

      - name: Build dist/ Directory
        id: build
-        run: npm run bundle
+        run: npm run package

      # This will fail the workflow if the `dist/` directory is different than
      # expected.
@@ -42,7 +42,7 @@ jobs:

      - name: Setup Ruby
        id: setup-ruby
-        uses: ruby/setup-ruby@8aeb6ff8030dd539317f8e1769a044873b56ea71
+        uses: ruby/setup-ruby@4eb9f110bac952a8b68ecf92e3b5c7a987594ba6
        with:
          ruby-version: ruby

@@ -38,7 +38,7 @@ jobs:

      - name: Lint Codebase
        id: super-linter
-        uses: super-linter/super-linter/slim@5119dcd8011e92182ce8219d9e9efc82f16fddb6
+        uses: super-linter/super-linter/slim@61abc07d755095a68f4987d1c2c3d1d64408f1f9
        env:
          DEFAULT_BRANCH: main
          FILTER_REGEX_EXCLUDE: dist/**/*
@@ -16,6 +16,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Update the ${{ env.TAG_NAME }} tag
-        uses: actions/publish-action@v0.3.0
+        uses: actions/publish-action@v0.4.0
        with:
          source-tag: ${{ env.TAG_NAME }}
@@ -123,6 +123,33 @@ supplied via the `input` parameter in YAML format. Additionally, you can
 provide file-based variables via `file_input`, where each key maps to a file
 path.

+### Prompt.yml with model parameters
+
+You can specify model parameters directly in your `.prompt.yml` files using the
+`modelParameters` key:
+
+```yaml
+messages:
+  - role: system
+    content: Be as concise as possible
+  - role: user
+    content: 'Compare {{a}} and {{b}}, please'
+model: openai/gpt-4o
+modelParameters:
+  maxCompletionTokens: 500
+  temperature: 0.7
+```
+
+| Key                   | Type   | Description                                           |
+| --------------------- | ------ | ----------------------------------------------------- |
+| `maxCompletionTokens` | number | The maximum number of tokens to generate              |
+| `maxTokens`           | number | The maximum number of tokens to generate (deprecated) |
+| `temperature`         | number | The sampling temperature to use (0-1)                 |
+| `topP`                | number | The nucleus sampling parameter to use (0-1)           |
+
+> ![Note]
+> Parameters set in `modelParameters` take precedence over the corresponding action inputs.
+
 ### Using a system prompt file

 In addition to the regular prompt, you can provide a system prompt file instead
@@ -276,23 +303,24 @@ perform actions like searching issues and PRs.
 Various inputs are defined in [`action.yml`](action.yml) to let you configure
 the action:

-| Name                 | Description                                                                                                                                                                                                        | Default                              |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------ |
-| `token`              | Token to use for inference. Typically the GITHUB_TOKEN secret                                                                                                                                                      | `github.token`                       |
-| `prompt`             | The prompt to send to the model                                                                                                                                                                                    | N/A                                  |
-| `prompt-file`        | Path to a file containing the prompt (supports .txt and .prompt.yml formats). If both `prompt` and `prompt-file` are provided, `prompt-file` takes precedence                                                      | `""`                                 |
-| `input`              | Template variables in YAML format for .prompt.yml files (e.g., `var1: value1` on separate lines)                                                                                                                   | `""`                                 |
-| `file_input`         | Template variables in YAML where values are file paths. The file contents are read and used for templating                                                                                                         | `""`                                 |
-| `system-prompt`      | The system prompt to send to the model                                                                                                                                                                             | `"You are a helpful assistant"`      |
-| `system-prompt-file` | Path to a file containing the system prompt. If both `system-prompt` and `system-prompt-file` are provided, `system-prompt-file` takes precedence                                                                  | `""`                                 |
-| `model`              | The model to use for inference. Must be available in the [GitHub Models](https://github.com/marketplace?type=models) catalog                                                                                       | `openai/gpt-4o`                      |
-| `endpoint`           | The endpoint to use for inference. If you're running this as part of an org, you should probably use the org-specific Models endpoint                                                                              | `https://models.github.ai/inference` |
-| `max-tokens`         | The max number of tokens to generate                                                                                                                                                                               | 200                                  |
-| `temperature`        | The sampling temperature to use (0-1)                                                                                                                                                                              | `""`                                 |
-| `top-p`              | The nucleus sampling parameter to use (0-1)                                                                                                                                                                        | `""`                                 |
-| `enable-github-mcp`  | Enable Model Context Protocol integration with GitHub tools                                                                                                                                                        | `false`                              |
-| `github-mcp-token`   | Token to use for GitHub MCP server (defaults to the main token if not specified).                                                                                                                                  | `""`                                 |
-| `custom-headers`     | Custom HTTP headers to include in API requests. Supports both YAML format (`header1: value1`) and JSON format (`{"header1": "value1"}`). Useful for API Management platforms, rate limiting, and request tracking. | `""`                                 |
+| Name                    | Description                                                                                                                                                                                                        | Default                              |
+| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------ |
+| `token`                 | Token to use for inference. Typically the GITHUB_TOKEN secret                                                                                                                                                      | `github.token`                       |
+| `prompt`                | The prompt to send to the model                                                                                                                                                                                    | N/A                                  |
+| `prompt-file`           | Path to a file containing the prompt (supports .txt and .prompt.yml formats). If both `prompt` and `prompt-file` are provided, `prompt-file` takes precedence                                                      | `""`                                 |
+| `input`                 | Template variables in YAML format for .prompt.yml files (e.g., `var1: value1` on separate lines)                                                                                                                   | `""`                                 |
+| `file_input`            | Template variables in YAML where values are file paths. The file contents are read and used for templating                                                                                                         | `""`                                 |
+| `system-prompt`         | The system prompt to send to the model                                                                                                                                                                             | `"You are a helpful assistant"`      |
+| `system-prompt-file`    | Path to a file containing the system prompt. If both `system-prompt` and `system-prompt-file` are provided, `system-prompt-file` takes precedence                                                                  | `""`                                 |
+| `model`                 | The model to use for inference. Must be available in the [GitHub Models](https://github.com/marketplace?type=models) catalog                                                                                       | `openai/gpt-4o`                      |
+| `endpoint`              | The endpoint to use for inference. If you're running this as part of an org, you should probably use the org-specific Models endpoint                                                                              | `https://models.github.ai/inference` |
+| `max-tokens`            | The maximum number of tokens to generate (deprecated, use `max-completion-tokens` instead)                                                                                                                         | 200                                  |
+| `max-completion-tokens` | The maximum number of tokens to generate                                                                                                                                                                           | `""`                                 |
+| `temperature`           | The sampling temperature to use (0-1)                                                                                                                                                                              | `""`                                 |
+| `top-p`                 | The nucleus sampling parameter to use (0-1)                                                                                                                                                                        | `""`                                 |
+| `enable-github-mcp`     | Enable Model Context Protocol integration with GitHub tools                                                                                                                                                        | `false`                              |
+| `github-mcp-token`      | Token to use for GitHub MCP server (defaults to the main token if not specified).                                                                                                                                  | `""`                                 |
+| `custom-headers`        | Custom HTTP headers to include in API requests. Supports both YAML format (`header1: value1`) and JSON format (`{"header1": "value1"}`). Useful for API Management platforms, rate limiting, and request tracking. | `""`                                 |

 ## Outputs

@@ -9,3 +9,4 @@ export const getBooleanInput = vi.fn<typeof core.getBooleanInput>()
 export const setOutput = vi.fn<typeof core.setOutput>()
 export const setFailed = vi.fn<typeof core.setFailed>()
 export const warning = vi.fn<typeof core.warning>()
+export const setSecret = vi.fn<typeof core.setSecret>()
@@ -109,6 +109,7 @@ describe('helpers.ts - inference request building', () => {
        undefined,
        undefined,
        100,
+        undefined,
        'https://api.test.com',
        'test-token',
      )
@@ -122,6 +123,7 @@ describe('helpers.ts - inference request building', () => {
        temperature: undefined,
        topP: undefined,
        maxTokens: 100,
+        maxCompletionTokens: undefined,
        endpoint: 'https://api.test.com',
        token: 'test-token',
        responseFormat: {
@@ -143,6 +145,7 @@ describe('helpers.ts - inference request building', () => {
        undefined,
        undefined,
        100,
+        undefined,
        'https://api.test.com',
        'test-token',
      )
@@ -156,6 +159,7 @@ describe('helpers.ts - inference request building', () => {
        temperature: undefined,
        topP: undefined,
        maxTokens: 100,
+        maxCompletionTokens: undefined,
        endpoint: 'https://api.test.com',
        token: 'test-token',
        responseFormat: undefined,
@@ -150,9 +150,9 @@ X-Custom-Header: custom-value`
        header2: 'value2',
        'X-Custom-Header': 'custom-value',
      })
-      expect(core.info).toHaveBeenCalledWith('Custom header added: header1: value1')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: header2: value2')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: X-Custom-Header: custom-value')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: header1: value1')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: header2: value2')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: X-Custom-Header: custom-value')
    })

    it('parses JSON format headers correctly', () => {
@@ -165,9 +165,9 @@ X-Custom-Header: custom-value`
        header2: 'value2',
        'X-Team': 'engineering',
      })
-      expect(core.info).toHaveBeenCalledWith('Custom header added: header1: value1')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: header2: value2')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: X-Team: engineering')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: header1: value1')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: header2: value2')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: X-Team: engineering')
    })

    it('returns empty object for empty input', () => {
@@ -194,13 +194,13 @@ password: pass123`
      })

      // Sensitive headers should be masked
-      expect(core.info).toHaveBeenCalledWith('Custom header added: Ocp-Apim-Subscription-Key: ***MASKED***')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: X-Api-Token: ***MASKED***')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: Authorization: ***MASKED***')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: password: ***MASKED***')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: Ocp-Apim-Subscription-Key: ***MASKED***')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: X-Api-Token: ***MASKED***')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: Authorization: ***MASKED***')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: password: ***MASKED***')

      // Non-sensitive headers should not be masked
-      expect(core.info).toHaveBeenCalledWith('Custom header added: serviceName: my-service')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: serviceName: my-service')
    })

    it('validates header names and skips invalid ones', () => {
@@ -214,13 +214,11 @@ valid123: value5`

      expect(result).toEqual({
        'valid-header': 'value1',
+        invalid_underscore: 'value3',
        valid123: 'value5',
      })

      expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid header'))
-      expect(core.warning).toHaveBeenCalledWith(
-        expect.stringContaining('Skipping invalid header name: invalid_underscore'),
-      )
      expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('Skipping invalid header name: invalid@header'))
    })

@@ -367,8 +365,8 @@ systemID: terraform-ci`
      })

      // Only the subscription key should be masked
-      expect(core.info).toHaveBeenCalledWith('Custom header added: Ocp-Apim-Subscription-Key: ***MASKED***')
-      expect(core.info).toHaveBeenCalledWith('Custom header added: serviceName: terraform-plan-workflow')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: Ocp-Apim-Subscription-Key: ***MASKED***')
+      expect(core.debug).toHaveBeenCalledWith('Custom header added: serviceName: terraform-plan-workflow')
    })
  })
 })
@@ -31,7 +31,7 @@ describe('inference.ts', () => {
      {role: 'user' as const, content: 'Hello, AI!'},
    ],
    modelName: 'gpt-4',
-    maxTokens: 100,
+    maxCompletionTokens: 100,
    endpoint: 'https://api.test.com',
    token: 'test-token',
  }
@@ -58,7 +58,7 @@ describe('inference.ts', () => {

      expect(result).toBe('Hello, user!')
      expect(core.info).toHaveBeenCalledWith('Running simple inference without tools')
-      expect(core.info).toHaveBeenCalledWith('Model response: Hello, user!')
+      expect(core.debug).toHaveBeenCalledWith('Model response: Hello, user!')

      // Verify the request structure
      expect(mockCreate).toHaveBeenCalledWith({
@@ -136,7 +136,7 @@ describe('inference.ts', () => {
      const result = await simpleInference(mockRequest)

      expect(result).toBeNull()
-      expect(core.info).toHaveBeenCalledWith('Model response: No response content')
+      expect(core.debug).toHaveBeenCalledWith('Model response: No response content')
    })

    it('includes response format when specified', async () => {
@@ -633,4 +633,64 @@ describe('inference.ts', () => {
      expect(result).toBe('{"immediate": "result"}')
    })
  })
+
+  describe('token param routing', () => {
+    it('sends max_tokens when only maxTokens is set', async () => {
+      const requestWithMaxTokens = {
+        ...mockRequest,
+        maxCompletionTokens: undefined,
+        maxTokens: 100,
+      }
+
+      const mockResponse = {
+        choices: [
+          {
+            message: {
+              content: 'Direct max_tokens response',
+            },
+          },
+        ],
+      }
+
+      mockCreate.mockResolvedValueOnce(mockResponse)
+
+      const result = await simpleInference(requestWithMaxTokens)
+
+      expect(result).toBe('Direct max_tokens response')
+      expect(mockCreate).toHaveBeenCalledTimes(1)
+
+      // Should have sent max_tokens directly
+      expect(mockCreate.mock.calls[0][0]).toHaveProperty('max_tokens', 100)
+      expect(mockCreate.mock.calls[0][0]).not.toHaveProperty('max_completion_tokens')
+    })
+
+    it('sends neither token param when both are undefined', async () => {
+      const requestWithNoTokens = {
+        ...mockRequest,
+        maxCompletionTokens: undefined,
+        maxTokens: undefined,
+      }
+
+      const mockResponse = {
+        choices: [
+          {
+            message: {
+              content: 'No token limit response',
+            },
+          },
+        ],
+      }
+
+      mockCreate.mockResolvedValueOnce(mockResponse)
+
+      const result = await simpleInference(requestWithNoTokens)
+
+      expect(result).toBe('No token limit response')
+      expect(mockCreate).toHaveBeenCalledTimes(1)
+
+      const params = mockCreate.mock.calls[0][0]
+      expect(params).not.toHaveProperty('max_tokens')
+      expect(params).not.toHaveProperty('max_completion_tokens')
+    })
+  })
 })
@@ -136,6 +136,7 @@ describe('main.ts', () => {
    await run()

    expect(core.setOutput).toHaveBeenCalled()
+    expect(core.setSecret).toHaveBeenCalledWith('fake-token')
    verifyStandardResponse()
    expect(mockProcessExit).toHaveBeenCalledWith(0)
  })
@@ -168,6 +169,7 @@ describe('main.ts', () => {
      ],
      modelName: 'gpt-4',
      maxTokens: 100,
+      maxCompletionTokens: undefined,
      endpoint: 'https://api.test.com',
      token: 'fake-token',
      responseFormat: undefined,
@@ -198,6 +200,7 @@ describe('main.ts', () => {

    await run()

+    expect(core.setSecret).toHaveBeenCalledWith('fake-token')
    expect(mockConnectToGitHubMCP).toHaveBeenCalledWith('fake-token', '')
    expect(mockMcpInference).toHaveBeenCalledWith(
      expect.objectContaining({
@@ -259,6 +262,7 @@ describe('main.ts', () => {
      ],
      modelName: 'gpt-4',
      maxTokens: 100,
+      maxCompletionTokens: undefined,
      endpoint: 'https://api.test.com',
      token: 'fake-token',
      responseFormat: undefined,
@@ -177,8 +177,8 @@ describe('mcp.ts', () => {
        name: 'test-tool',
        content: JSON.stringify(toolResult.content),
      })
-      expect(core.info).toHaveBeenCalledWith('Executing GitHub MCP tool: test-tool with args: {"param": "value"}')
-      expect(core.info).toHaveBeenCalledWith('GitHub MCP tool test-tool executed successfully')
+      expect(core.debug).toHaveBeenCalledWith('Executing GitHub MCP tool: test-tool with args: {"param": "value"}')
+      expect(core.debug).toHaveBeenCalledWith('GitHub MCP tool test-tool executed successfully')
    })

    it('handles tool execution errors gracefully', async () => {
@@ -135,5 +135,17 @@ describe('prompt.ts', () => {
    it('errors on missing files', () => {
      expect(() => parseFileTemplateVariables('x: ./does-not-exist.txt')).toThrow('was not found')
    })
+
+    it('errors on non-string file paths', () => {
+      expect(() => parseFileTemplateVariables('x: 123')).toThrow(
+        "File template variable 'x' must be a string file path",
+      )
+      expect(() => parseFileTemplateVariables('x: true')).toThrow(
+        "File template variable 'x' must be a string file path",
+      )
+      expect(() => parseFileTemplateVariables('x: { nested: "object" }')).toThrow(
+        "File template variable 'x' must be a string file path",
+      )
+    })
  })
 })
@@ -43,9 +43,13 @@ inputs:
    required: false
    default: ''
  max-tokens:
-    description: The maximum number of tokens to generate
+    description: The maximum number of tokens to generate (deprecated)
    required: false
    default: '200'
+  max-completion-tokens:
+    description: The maximum number of tokens to generate
+    required: false
+    default: ''
  temperature:
    description: The sampling temperature to use (0-1)
    required: false
@@ -58300,6 +58300,19 @@ OpenAI.Responses = Responses;
 OpenAI.Evals = Evals;
 OpenAI.Containers = Containers;

+/**
+ * Build according to what input was passed, default to max_tokens.
+ * Only one of max_tokens or max_completion_tokens will be set.
+ */
+function buildMaxTokensParam(request) {
+    if (request.maxCompletionTokens != null) {
+        return { max_completion_tokens: request.maxCompletionTokens };
+    }
+    if (request.maxTokens != null) {
+        return { max_tokens: request.maxTokens };
+    }
+    return {};
+}
 /**
 * Simple one-shot inference without tools
 */
@@ -58312,10 +58325,10 @@ async function simpleInference(request) {
    });
    const chatCompletionRequest = {
        messages: request.messages,
-        max_completion_tokens: request.maxTokens,
        model: request.modelName,
        temperature: request.temperature,
        top_p: request.topP,
+        ...buildMaxTokensParam(request), // Note: solution around models using different underlying max tokens properties
    };
    // Add response format if specified
    if (request.responseFormat) {
@@ -58349,10 +58362,10 @@ async function mcpInference(request, githubMcpClient) {
        coreExports.info(`MCP inference iteration ${iterationCount}`);
        const chatCompletionRequest = {
            messages: messages,
-            max_completion_tokens: request.maxTokens,
            model: request.modelName,
            temperature: request.temperature,
            top_p: request.topP,
+            ...buildMaxTokensParam(request), // Note: solution around models using different underlying max tokens properties
        };
        // Add response format if specified (only on final iteration to avoid conflicts with tool calls)
        if (finalMessage && request.responseFormat) {
@@ -61382,7 +61395,8 @@ function validateAndMaskHeaders(headers) {
 /**
 * Build complete InferenceRequest from prompt config and inputs
 */
-function buildInferenceRequest(promptConfig, systemPrompt, prompt, modelName, temperature, topP, maxTokens, endpoint, token, customHeaders) {
+function buildInferenceRequest(promptConfig, systemPrompt, prompt, modelName, temperature, topP, maxTokens, // Deprecated
+maxCompletionTokens, endpoint, token, customHeaders) {
    const messages = buildMessages(promptConfig, systemPrompt, prompt);
    const responseFormat = buildResponseFormat(promptConfig);
    return {
@@ -61390,7 +61404,8 @@ function buildInferenceRequest(promptConfig, systemPrompt, prompt, modelName, te
        modelName,
        temperature,
        topP,
-        maxTokens,
+        maxTokens, // Deprecated
+        maxCompletionTokens,
        endpoint,
        token,
        responseFormat,
@@ -61536,10 +61551,11 @@ async function run() {
        }
        // Get common parameters
        const modelName = promptConfig?.model || coreExports.getInput('model');
-        let maxTokens = promptConfig?.modelParameters?.maxTokens ?? coreExports.getInput('max-tokens');
-        if (typeof maxTokens === 'string') {
-            maxTokens = parseInt(maxTokens, 10);
-        }
+        // Parse token limit inputs
+        const maxCompletionTokensInput = promptConfig?.modelParameters?.maxCompletionTokens ?? coreExports.getInput('max-completion-tokens');
+        const maxCompletionTokens = maxCompletionTokensInput ? Number(maxCompletionTokensInput) : undefined;
+        const maxTokensInput = promptConfig?.modelParameters?.maxTokens ?? coreExports.getInput('max-tokens');
+        const maxTokens = maxCompletionTokens != null ? undefined : maxTokensInput ? Number(maxTokensInput) : undefined;
        const token = process.env['GITHUB_TOKEN'] || coreExports.getInput('token');
        if (token === undefined) {
            throw new Error('GITHUB_TOKEN is not set');
@@ -61557,7 +61573,7 @@ async function run() {
        const customHeadersInput = coreExports.getInput('custom-headers');
        const customHeaders = parseCustomHeaders(customHeadersInput);
        // Build the inference request with pre-processed messages and response format
-        const inferenceRequest = buildInferenceRequest(promptConfig, systemPrompt, prompt, modelName, temperature, topP, maxTokens, endpoint, token, customHeaders);
+        const inferenceRequest = buildInferenceRequest(promptConfig, systemPrompt, prompt, modelName, temperature, topP, maxTokens, maxCompletionTokens, endpoint, token, customHeaders);
        const enableMcp = coreExports.getBooleanInput('enable-github-mcp') || false;
        let modelResponse = null;
        if (enableMcp) {
@@ -9,12 +9,11 @@
      "version": "1.0.0",
      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.11.1",
+        "@actions/core": "^3.0.0",
        "@modelcontextprotocol/sdk": "^1.25.2",
-        "@rollup/rollup-linux-x64-gnu": "4.57.1",
        "@types/tmp": "^0.2.6",
        "js-yaml": "^4.1.1",
-        "openai": "^5.11.0",
+        "openai": "^6.28.0",
        "pkce-challenge": "^5.0.0",
        "tmp": "^0.2.4"
      },
@@ -37,7 +36,7 @@
        "eslint-plugin-prettier": "^5.4.1",
        "prettier": "^3.5.3",
        "prettier-eslint": "^16.4.2",
-        "rollup": "^4.43.0",
+        "rollup": "^4.59.0",
        "typescript": "^5.8.3",
        "vitest": "^3"
      },
@@ -69,6 +68,17 @@
        "unzip-stream": "^0.3.1"
      }
    },
+    "node_modules/@actions/artifact/node_modules/@actions/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
+      }
+    },
    "node_modules/@actions/artifact/node_modules/@actions/github": {
      "version": "5.1.1",
      "resolved": "https://registry.npmjs.org/@actions/github/-/github-5.1.1.tgz",
@@ -283,19 +293,54 @@
      "license": "ISC"
    },
    "node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
+      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
      "license": "MIT",
      "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
+        "@actions/exec": "^3.0.0",
+        "@actions/http-client": "^4.0.0"
+      }
+    },
+    "node_modules/@actions/core/node_modules/@actions/exec": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
+      "license": "MIT",
+      "dependencies": {
+        "@actions/io": "^3.0.2"
+      }
+    },
+    "node_modules/@actions/core/node_modules/@actions/http-client": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
+      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
+      "license": "MIT",
+      "dependencies": {
+        "tunnel": "^0.0.6",
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/core/node_modules/@actions/io": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
+      "license": "MIT"
+    },
+    "node_modules/@actions/core/node_modules/undici": {
+      "version": "6.24.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.0.tgz",
+      "integrity": "sha512-lVLNosgqo5EkGqh5XUDhGfsMSoO8K0BAN0TyJLvwNRSl4xWGZlCVYsAIpa/OpA3TvmnM01GWcoKmc3ZWo5wKKA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
      }
    },
    "node_modules/@actions/exec": {
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@actions/io": "^1.0.1"
@@ -507,6 +552,7 @@
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
@@ -517,6 +563,7 @@
      "version": "1.1.3",
      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "dev": true,
      "license": "MIT"
    },
    "node_modules/@azure/abort-controller": {
@@ -1377,6 +1424,7 @@
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
+      "dev": true,
      "license": "MIT",
      "engines": {
        "node": ">=14"
@@ -1422,6 +1470,17 @@
        "node": "^20 || ^22"
      }
    },
+    "node_modules/@github/local-action/node_modules/@actions/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
+      }
+    },
    "node_modules/@github/local-action/node_modules/undici": {
      "version": "7.10.0",
      "resolved": "https://registry.npmjs.org/undici/-/undici-7.10.0.tgz",
@@ -1643,9 +1702,9 @@
      }
    },
    "node_modules/@modelcontextprotocol/sdk/node_modules/ajv": {
-      "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
      "license": "MIT",
      "dependencies": {
        "fast-deep-equal": "^3.1.3",
@@ -2180,9 +2239,9 @@
      }
    },
    "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.43.0.tgz",
-      "integrity": "sha512-Krjy9awJl6rKbruhQDgivNbD1WuLb8xAclM4IR4cN5pHGAs2oIMMQJEiC3IC/9TZJ+QZkmZhlMO/6MBGxPidpw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
+      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
      "cpu": [
        "arm"
      ],
@@ -2194,9 +2253,9 @@
      ]
    },
    "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.43.0.tgz",
-      "integrity": "sha512-ss4YJwRt5I63454Rpj+mXCXicakdFmKnUNxr1dLK+5rv5FJgAxnN7s31a5VchRYxCFWdmnDWKd0wbAdTr0J5EA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
+      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
      "cpu": [
        "arm64"
      ],
@@ -2208,9 +2267,9 @@
      ]
    },
    "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.43.0.tgz",
-      "integrity": "sha512-eKoL8ykZ7zz8MjgBenEF2OoTNFAPFz1/lyJ5UmmFSz5jW+7XbH1+MAgCVHy72aG59rbuQLcJeiMrP8qP5d/N0A==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
+      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
      "cpu": [
        "arm64"
      ],
@@ -2222,9 +2281,9 @@
      ]
    },
    "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.43.0.tgz",
-      "integrity": "sha512-SYwXJgaBYW33Wi/q4ubN+ldWC4DzQY62S4Ll2dgfr/dbPoF50dlQwEaEHSKrQdSjC6oIe1WgzosoaNoHCdNuMg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
+      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
      "cpu": [
        "x64"
      ],
@@ -2236,9 +2295,9 @@
      ]
    },
    "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.43.0.tgz",
-      "integrity": "sha512-SV+U5sSo0yujrjzBF7/YidieK2iF6E7MdF6EbYxNz94lA+R0wKl3SiixGyG/9Klab6uNBIqsN7j4Y/Fya7wAjQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
+      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
      "cpu": [
        "arm64"
      ],
@@ -2250,9 +2309,9 @@
      ]
    },
    "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.43.0.tgz",
-      "integrity": "sha512-J7uCsiV13L/VOeHJBo5SjasKiGxJ0g+nQTrBkAsmQBIdil3KhPnSE9GnRon4ejX1XDdsmK/l30IYLiAaQEO0Cg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
+      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
      "cpu": [
        "x64"
      ],
@@ -2264,9 +2323,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.43.0.tgz",
-      "integrity": "sha512-gTJ/JnnjCMc15uwB10TTATBEhK9meBIY+gXP4s0sHD1zHOaIh4Dmy1X9wup18IiY9tTNk5gJc4yx9ctj/fjrIw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
+      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
      "cpu": [
        "arm"
      ],
@@ -2278,9 +2337,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.43.0.tgz",
-      "integrity": "sha512-ZJ3gZynL1LDSIvRfz0qXtTNs56n5DI2Mq+WACWZ7yGHFUEirHBRt7fyIk0NsCKhmRhn7WAcjgSkSVVxKlPNFFw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
+      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
      "cpu": [
        "arm"
      ],
@@ -2292,9 +2351,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.43.0.tgz",
-      "integrity": "sha512-8FnkipasmOOSSlfucGYEu58U8cxEdhziKjPD2FIa0ONVMxvl/hmONtX/7y4vGjdUhjcTHlKlDhw3H9t98fPvyA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
+      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
      "cpu": [
        "arm64"
      ],
@@ -2306,9 +2365,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.43.0.tgz",
-      "integrity": "sha512-KPPyAdlcIZ6S9C3S2cndXDkV0Bb1OSMsX0Eelr2Bay4EsF9yi9u9uzc9RniK3mcUGCLhWY9oLr6er80P5DE6XA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
+      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
      "cpu": [
        "arm64"
      ],
@@ -2319,10 +2378,10 @@
        "linux"
      ]
    },
-    "node_modules/@rollup/rollup-linux-loongarch64-gnu": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.43.0.tgz",
-      "integrity": "sha512-HPGDIH0/ZzAZjvtlXj6g+KDQ9ZMHfSP553za7o2Odegb/BEfwJcR0Sw0RLNpQ9nC6Gy8s+3mSS9xjZ0n3rhcYg==",
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
+      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
      "cpu": [
        "loong64"
      ],
@@ -2333,10 +2392,38 @@
        "linux"
      ]
    },
-    "node_modules/@rollup/rollup-linux-powerpc64le-gnu": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.43.0.tgz",
-      "integrity": "sha512-gEmwbOws4U4GLAJDhhtSPWPXUzDfMRedT3hFMyRAvM9Mrnj+dJIFIeL7otsv2WF3D7GrV0GIewW0y28dOYWkmw==",
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
+      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
+      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
+      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
      "cpu": [
        "ppc64"
      ],
@@ -2348,9 +2435,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.43.0.tgz",
-      "integrity": "sha512-XXKvo2e+wFtXZF/9xoWohHg+MuRnvO29TI5Hqe9xwN5uN8NKUYy7tXUG3EZAlfchufNCTHNGjEx7uN78KsBo0g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
+      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
      "cpu": [
        "riscv64"
      ],
@@ -2362,9 +2449,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.43.0.tgz",
-      "integrity": "sha512-ruf3hPWhjw6uDFsOAzmbNIvlXFXlBQ4nk57Sec8E8rUxs/AI4HD6xmiiasOOx/3QxS2f5eQMKTAwk7KHwpzr/Q==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
+      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
      "cpu": [
        "riscv64"
      ],
@@ -2376,9 +2463,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.43.0.tgz",
-      "integrity": "sha512-QmNIAqDiEMEvFV15rsSnjoSmO0+eJLoKRD9EAa9rrYNwO/XRCtOGM3A5A0X+wmG+XRrw9Fxdsw+LnyYiZWWcVw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
+      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
      "cpu": [
        "s390x"
      ],
@@ -2390,9 +2477,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ABca4ceT4N+Tv/GtotnWAeXZUZuM/9AQyCyKYyKnpk4yoA7QIAuBt6Hkgpw8kActYlew2mvckXkvx0FfoInnLg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
      "cpu": [
        "x64"
      ],
@@ -2403,9 +2490,9 @@
      ]
    },
    "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.43.0.tgz",
-      "integrity": "sha512-3yATWgdeXyuHtBhrLt98w+5fKurdqvs8B53LaoKD7P7H7FKOONLsBVMNl9ghPQZQuYcceV5CDyPfyfGpMWD9mQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
+      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
      "cpu": [
        "x64"
      ],
@@ -2416,10 +2503,38 @@
        "linux"
      ]
    },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
+      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
+      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
    "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.43.0.tgz",
-      "integrity": "sha512-wVzXp2qDSCOpcBCT5WRWLmpJRIzv23valvcTwMHEobkjippNf+C3ys/+wf07poPkeNix0paTNemB2XrHr2TnGw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
+      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
      "cpu": [
        "arm64"
      ],
@@ -2431,9 +2546,9 @@
      ]
    },
    "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.43.0.tgz",
-      "integrity": "sha512-fYCTEyzf8d+7diCw8b+asvWDCLMjsCEA8alvtAutqJOJp/wL5hs1rWSqJ1vkjgW0L2NB4bsYJrpKkiIPRR9dvw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
+      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
      "cpu": [
        "ia32"
      ],
@@ -2444,10 +2559,24 @@
        "win32"
      ]
    },
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.43.0.tgz",
-      "integrity": "sha512-SnGhLiE5rlK0ofq8kzuDkM0g7FN1s5VYY+YSMTibP7CqShxCQvqtNxTARS4xX4PFJfHjG0ZQYX9iGzI3FQh5Aw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
+      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
      "cpu": [
        "x64"
      ],
@@ -2501,9 +2630,9 @@
      "license": "MIT"
    },
    "node_modules/@types/estree": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
-      "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
      "dev": true,
      "license": "MIT"
    },
@@ -3261,9 +3390,9 @@
      }
    },
    "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -3295,9 +3424,9 @@
      }
    },
    "node_modules/ajv-formats/node_modules/ajv": {
-      "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
      "license": "MIT",
      "dependencies": {
        "fast-deep-equal": "^3.1.3",
@@ -5250,10 +5379,23 @@
      ],
      "license": "BSD-3-Clause"
    },
+    "node_modules/fast-xml-builder": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.0.0.tgz",
+      "integrity": "sha512-fpZuDogrAgnyt9oDDz+5DBz0zgPdPZz6D4IR7iESxRXElrlGTRkHJ9eEt+SACRJwT0FNFrt71DFQIUFBJfX/uQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
    "node_modules/fast-xml-parser": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.2.3.tgz",
-      "integrity": "sha512-OdCYfRqfpuLUFonTNjvd30rCBZUneHpSQkCqfaeWQ9qrKcl6XlWeDBNVwGb+INAIxRshuN2jF+BE0L6gbBO2mw==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.2.tgz",
+      "integrity": "sha512-pw/6pIl4k0CSpElPEJhDppLzaixDEuWui2CUQQBH/ECDf7+y6YwA4Gf7Tyb0Rfe4DIMuZipYj4AEL0nACKglvQ==",
      "dev": true,
      "funding": [
        {
@@ -5263,7 +5405,8 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "strnum": "^2.1.0"
+        "fast-xml-builder": "^1.0.0",
+        "strnum": "^2.1.2"
      },
      "bin": {
        "fxparser": "src/cli/cli.js"
@@ -5819,9 +5962,9 @@
      }
    },
    "node_modules/hono": {
-      "version": "4.11.3",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.3.tgz",
-      "integrity": "sha512-PmQi306+M/ct/m5s66Hrg+adPnkD5jiO6IjA7WhWw0gSBSo1EcRegwuI1deZ+wd5pzCGynCcn2DprnE4/yEV4w==",
+      "version": "4.12.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.7.tgz",
+      "integrity": "sha512-jq9l1DM0zVIvsm3lv9Nw9nlJnMNPOcAtsbsgiUhWcFzPE99Gvo6yRTlszSLLYacMeQ6quHD6hMfId8crVHvexw==",
      "license": "MIT",
      "peer": true,
      "engines": {
@@ -7131,16 +7274,16 @@
      }
    },
    "node_modules/openai": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/openai/-/openai-5.11.0.tgz",
-      "integrity": "sha512-+AuTc5pVjlnTuA9zvn8rA/k+1RluPIx9AD4eDcnutv6JNwHHZxIhkFy+tmMKCvmMFDQzfA/r1ujvPWB19DQkYg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.28.0.tgz",
+      "integrity": "sha512-zDvMITzeZyljUr67n1dSXpPsMvaXY5okNHfq0KHCNRjgTohYvxu3O4oQ/zZrwTJh+c3n0z/O7oSCGwt5hQkBXg==",
      "license": "Apache-2.0",
      "bin": {
        "openai": "bin/cli"
      },
      "peerDependencies": {
        "ws": "^8.18.0",
-        "zod": "^3.23.8"
+        "zod": "^3.25 || ^4.0"
      },
      "peerDependenciesMeta": {
        "ws": {
@@ -7993,9 +8136,9 @@
      }
    },
    "node_modules/qs": {
-      "version": "6.14.1",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
-      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
+      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "side-channel": "^1.1.0"
@@ -8299,13 +8442,13 @@
      }
    },
    "node_modules/rollup": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.43.0.tgz",
-      "integrity": "sha512-wdN2Kd3Twh8MAEOEJZsuxuLKCsBEo4PVNLK6tQWAn10VhsVewQLzcucMgLolRlhFybGxfclbPeEYBaP6RvUFGg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
+      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@types/estree": "1.0.7"
+        "@types/estree": "1.0.8"
      },
      "bin": {
        "rollup": "dist/bin/rollup"
@@ -8315,43 +8458,34 @@
        "npm": ">=8.0.0"
      },
      "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.43.0",
-        "@rollup/rollup-android-arm64": "4.43.0",
-        "@rollup/rollup-darwin-arm64": "4.43.0",
-        "@rollup/rollup-darwin-x64": "4.43.0",
-        "@rollup/rollup-freebsd-arm64": "4.43.0",
-        "@rollup/rollup-freebsd-x64": "4.43.0",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.43.0",
-        "@rollup/rollup-linux-arm-musleabihf": "4.43.0",
-        "@rollup/rollup-linux-arm64-gnu": "4.43.0",
-        "@rollup/rollup-linux-arm64-musl": "4.43.0",
-        "@rollup/rollup-linux-loongarch64-gnu": "4.43.0",
-        "@rollup/rollup-linux-powerpc64le-gnu": "4.43.0",
-        "@rollup/rollup-linux-riscv64-gnu": "4.43.0",
-        "@rollup/rollup-linux-riscv64-musl": "4.43.0",
-        "@rollup/rollup-linux-s390x-gnu": "4.43.0",
-        "@rollup/rollup-linux-x64-gnu": "4.43.0",
-        "@rollup/rollup-linux-x64-musl": "4.43.0",
-        "@rollup/rollup-win32-arm64-msvc": "4.43.0",
-        "@rollup/rollup-win32-ia32-msvc": "4.43.0",
-        "@rollup/rollup-win32-x64-msvc": "4.43.0",
+        "@rollup/rollup-android-arm-eabi": "4.59.0",
+        "@rollup/rollup-android-arm64": "4.59.0",
+        "@rollup/rollup-darwin-arm64": "4.59.0",
+        "@rollup/rollup-darwin-x64": "4.59.0",
+        "@rollup/rollup-freebsd-arm64": "4.59.0",
+        "@rollup/rollup-freebsd-x64": "4.59.0",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
+        "@rollup/rollup-linux-arm-musleabihf": "4.59.0",
+        "@rollup/rollup-linux-arm64-gnu": "4.59.0",
+        "@rollup/rollup-linux-arm64-musl": "4.59.0",
+        "@rollup/rollup-linux-loong64-gnu": "4.59.0",
+        "@rollup/rollup-linux-loong64-musl": "4.59.0",
+        "@rollup/rollup-linux-ppc64-gnu": "4.59.0",
+        "@rollup/rollup-linux-ppc64-musl": "4.59.0",
+        "@rollup/rollup-linux-riscv64-gnu": "4.59.0",
+        "@rollup/rollup-linux-riscv64-musl": "4.59.0",
+        "@rollup/rollup-linux-s390x-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-musl": "4.59.0",
+        "@rollup/rollup-openbsd-x64": "4.59.0",
+        "@rollup/rollup-openharmony-arm64": "4.59.0",
+        "@rollup/rollup-win32-arm64-msvc": "4.59.0",
+        "@rollup/rollup-win32-ia32-msvc": "4.59.0",
+        "@rollup/rollup-win32-x64-gnu": "4.59.0",
+        "@rollup/rollup-win32-x64-msvc": "4.59.0",
        "fsevents": "~2.3.2"
      }
    },
-    "node_modules/rollup/node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.43.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.43.0.tgz",
-      "integrity": "sha512-jAHr/S0iiBtFyzjhOkAics/2SrXE092qyqEg96e90L3t9Op8OTzS6+IX0Fy5wCt2+KqeHAkti+eitV0wvblEoQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
    "node_modules/router": {
      "version": "2.2.0",
      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
@@ -8958,9 +9092,9 @@
      }
    },
    "node_modules/strnum": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.1.1.tgz",
-      "integrity": "sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz",
+      "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==",
      "dev": true,
      "funding": [
        {
@@ -9366,6 +9500,7 @@
      "version": "5.29.0",
      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@fastify/busboy": "^2.0.0"
@@ -23,11 +23,11 @@
  "license": "MIT",
  "prettier": "@github/prettier-config",
  "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^3.0.0",
    "@modelcontextprotocol/sdk": "^1.25.2",
    "@types/tmp": "^0.2.6",
    "js-yaml": "^4.1.1",
-    "openai": "^5.11.0",
+    "openai": "^6.28.0",
    "pkce-challenge": "^5.0.0",
    "tmp": "^0.2.4"
  },
@@ -50,7 +50,7 @@
    "eslint-plugin-prettier": "^5.4.1",
    "prettier": "^3.5.3",
    "prettier-eslint": "^16.4.2",
-    "rollup": "^4.43.0",
+    "rollup": "^4.59.0",
    "typescript": "^5.8.3",
    "vitest": "^3"
  },
@@ -121,9 +121,10 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
  const sensitivePatterns = ['key', 'token', 'secret', 'password', 'authorization']

  for (const [name, value] of Object.entries(headers)) {
-    // Validate header name (basic HTTP header name validation, RFC 7230: letters, digits, and hyphens)
-    if (!/^[A-Za-z0-9-]+$/.test(name)) {
-      core.warning(`Skipping invalid header name: ${name} (only alphanumeric characters and hyphens allowed)`)
+    // Validate header name (RFC 7230: token = 1*tchar)
+    // tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+    if (!/^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/.test(name)) {
+      core.warning(`Skipping invalid header name: ${name} (contains invalid characters)`)
      continue
    }

@@ -143,9 +144,9 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
    const lowerName = name.toLowerCase()
    const isSensitive = sensitivePatterns.some(pattern => lowerName.includes(pattern))
    if (isSensitive) {
-      core.info(`Custom header added: ${name}: ***MASKED***`)
+      core.debug(`Custom header added: ${name}: ***MASKED***`)
    } else {
-      core.info(`Custom header added: ${name}: ${stringValue}`)
+      core.debug(`Custom header added: ${name}: ${stringValue}`)
    }
  }

@@ -162,7 +163,8 @@ export function buildInferenceRequest(
  modelName: string,
  temperature: number | undefined,
  topP: number | undefined,
-  maxTokens: number,
+  maxTokens: number | undefined, // Deprecated
+  maxCompletionTokens: number | undefined,
  endpoint: string,
  token: string,
  customHeaders?: Record<string, string>,
@@ -175,7 +177,8 @@ export function buildInferenceRequest(
    modelName,
    temperature,
    topP,
-    maxTokens,
+    maxTokens, // Deprecated
+    maxCompletionTokens,
    endpoint,
    token,
    responseFormat,
@@ -12,7 +12,8 @@ interface ChatMessage {
 export interface InferenceRequest {
  messages: Array<{role: 'system' | 'user' | 'assistant' | 'tool'; content: string}>
  modelName: string
-  maxTokens: number
+  maxTokens?: number // Deprecated
+  maxCompletionTokens?: number
  endpoint: string
  token: string
  temperature?: number
@@ -33,6 +34,20 @@ export interface InferenceResponse {
  }>
 }

+/**
+ * Build according to what input was passed, default to max_tokens.
+ * Only one of max_tokens or max_completion_tokens will be set.
+ */
+function buildMaxTokensParam(request: InferenceRequest): {max_tokens?: number; max_completion_tokens?: number} {
+  if (request.maxCompletionTokens != null) {
+    return {max_completion_tokens: request.maxCompletionTokens}
+  }
+  if (request.maxTokens != null) {
+    return {max_tokens: request.maxTokens}
+  }
+  return {}
+}
+
 /**
 * Simple one-shot inference without tools
 */
@@ -47,10 +62,10 @@ export async function simpleInference(request: InferenceRequest): Promise<string

  const chatCompletionRequest: OpenAI.Chat.Completions.ChatCompletionCreateParams = {
    messages: request.messages as OpenAI.Chat.Completions.ChatCompletionMessageParam[],
-    max_completion_tokens: request.maxTokens,
    model: request.modelName,
    temperature: request.temperature,
    top_p: request.topP,
+    ...buildMaxTokensParam(request), // Note: solution around models using different underlying max tokens properties
  }

  // Add response format if specified
@@ -61,7 +76,7 @@ export async function simpleInference(request: InferenceRequest): Promise<string

  const response = await chatCompletion(client, chatCompletionRequest, 'simpleInference')
  const modelResponse = response.choices[0]?.message?.content
-  core.info(`Model response: ${modelResponse || 'No response content'}`)
+  core.debug(`Model response: ${modelResponse || 'No response content'}`)
  return modelResponse || null
 }

@@ -95,10 +110,10 @@ export async function mcpInference(

    const chatCompletionRequest: OpenAI.Chat.Completions.ChatCompletionCreateParams = {
      messages: messages as OpenAI.Chat.Completions.ChatCompletionMessageParam[],
-      max_completion_tokens: request.maxTokens,
      model: request.modelName,
      temperature: request.temperature,
      top_p: request.topP,
+      ...buildMaxTokensParam(request), // Note: solution around models using different underlying max tokens properties
    }

    // Add response format if specified (only on final iteration to avoid conflicts with tool calls)
@@ -116,7 +131,7 @@ export async function mcpInference(
      const modelResponse = assistantMessage?.content
      const toolCalls = assistantMessage?.tool_calls

-      core.info(`Model response: ${modelResponse || 'No response content'}`)
+      core.debug(`Model response: ${modelResponse || 'No response content'}`)

      messages.push({
        role: 'assistant',
@@ -181,16 +196,14 @@ async function chatCompletion(
      try {
        response = JSON.parse(response)
      } catch (e) {
-        const preview = response.slice(0, 400)
        throw new Error(
-          `${context}: Chat completion response was a string and not valid JSON (${(e as Error).message}). Preview: ${preview}`,
+          `${context}: Chat completion response was a string and not valid JSON (${(e as Error).message})`,
        )
      }
    }

    if (!response || typeof response !== 'object' || !('choices' in response)) {
-      const preview = JSON.stringify(response)?.slice(0, 800)
-      throw new Error(`${context}: Unexpected response shape (no choices). Preview: ${preview}`)
+      throw new Error(`${context}: Unexpected response shape (no choices)`)
    }

    return response as OpenAI.Chat.Completions.ChatCompletion
@@ -48,19 +48,25 @@ export async function run(): Promise<void> {

    // Get common parameters
    const modelName = promptConfig?.model || core.getInput('model')
-    let maxTokens = promptConfig?.modelParameters?.maxTokens ?? core.getInput('max-tokens')

-    if (typeof maxTokens === 'string') {
-      maxTokens = parseInt(maxTokens, 10)
-    }
+    // Parse token limit inputs
+    const maxCompletionTokensInput =
+      promptConfig?.modelParameters?.maxCompletionTokens ?? core.getInput('max-completion-tokens')
+    const maxCompletionTokens = maxCompletionTokensInput ? Number(maxCompletionTokensInput) : undefined
+
+    const maxTokensInput = promptConfig?.modelParameters?.maxTokens ?? core.getInput('max-tokens')
+    const maxTokens = maxCompletionTokens != null ? undefined : maxTokensInput ? Number(maxTokensInput) : undefined

    const token = process.env['GITHUB_TOKEN'] || core.getInput('token')
    if (token === undefined) {
      throw new Error('GITHUB_TOKEN is not set')
    }
+    core.setSecret(token)

    // Get GitHub MCP token (use dedicated token if provided, otherwise fall back to main token)
    const githubMcpToken = core.getInput('github-mcp-token') || token
+    core.setSecret(githubMcpToken)
+
    const githubMcpToolsets = core.getInput('github-mcp-toolsets')

    const endpoint = core.getInput('endpoint')
@@ -85,6 +91,7 @@ export async function run(): Promise<void> {
      temperature,
      topP,
      maxTokens,
+      maxCompletionTokens,
      endpoint,
      token,
      customHeaders,
@@ -96,7 +96,7 @@ export async function connectToGitHubMCP(token: string, toolsets?: string): Prom
 * Execute a single tool call via GitHub MCP
 */
 export async function executeToolCall(githubMcpClient: Client, toolCall: ToolCall): Promise<ToolResult> {
-  core.info(`Executing GitHub MCP tool: ${toolCall.function.name} with args: ${toolCall.function.arguments}`)
+  core.debug(`Executing GitHub MCP tool: ${toolCall.function.name} with args: ${toolCall.function.arguments}`)

  try {
    const args = JSON.parse(toolCall.function.arguments)
@@ -106,7 +106,7 @@ export async function executeToolCall(githubMcpClient: Client, toolCall: ToolCal
      arguments: args,
    })

-    core.info(`GitHub MCP tool ${toolCall.function.name} executed successfully`)
+    core.debug(`GitHub MCP tool ${toolCall.function.name} executed successfully`)

    return {
      tool_call_id: toolCall.id,
@@ -8,7 +8,8 @@ export interface PromptMessage {
 }

 export interface ModelParameters {
-  maxTokens?: number
+  maxTokens?: number // Deprecated
+  maxCompletionTokens?: number
  temperature?: number
  topP?: number
 }
Author	SHA1	Message	Date
copilot-swe-agent[bot]	ca8fe74af9	Initial plan	2026-03-13 21:29:30 +00:00
dependabot[bot]	6a8dd37d6c	chore(deps): bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby), [super-linter/super-linter](https://github.com/super-linter/super-linter) and [actions/publish-action](https://github.com/actions/publish-action). Updates `ruby/setup-ruby` from 1.268.0 to 1.269.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/8aeb6ff8030dd539317f8e1769a044873b56ea71...d697be2f83c6234b20877c3b5eac7a7f342f0d0c) Updates `super-linter/super-linter` from 8.0.0 to 8.3.0 - [Release notes](https://github.com/super-linter/super-linter/releases) - [Changelog](https://github.com/super-linter/super-linter/blob/main/CHANGELOG.md) - [Commits](https://github.com/super-linter/super-linter/compare/5119dcd8011e92182ce8219d9e9efc82f16fddb6...502f4fe48a81a392756e173e39a861f8c8efe056) Updates `actions/publish-action` from 0.3.0 to 0.4.0 - [Commits](https://github.com/actions/publish-action/compare/v0.3.0...v0.4.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.269.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: super-linter/super-linter dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/publish-action dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 21:24:34 +00:00
Johan Jansson	09488142e3	Merge pull request #174 from actions/dependabot/npm_and_yarn/qs-6.14.2 chore(deps): bump qs from 6.14.1 to 6.14.2	2026-03-13 11:20:50 -10:00
dependabot[bot]	c729573012	chore(deps): bump qs from 6.14.1 to 6.14.2 Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.14.2. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 21:15:02 +00:00
Johan Jansson	fa073b82c5	Merge pull request #179 from actions/dependabot/npm_and_yarn/rollup-4.59.0 chore(deps-dev): bump rollup from 4.43.0 to 4.59.0	2026-03-13 11:13:49 -10:00
dependabot[bot]	1157ae8180	chore(deps-dev): bump rollup from 4.43.0 to 4.59.0 Bumps [rollup](https://github.com/rollup/rollup) from 4.43.0 to 4.59.0. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](https://github.com/rollup/rollup/compare/v4.43.0...v4.59.0) --- updated-dependencies: - dependency-name: rollup dependency-version: 4.59.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 21:11:33 +00:00
Johan Jansson	39e1ff891d	Merge pull request #181 from actions/dependabot/npm_and_yarn/ajv-6.14.0 chore(deps-dev): bump ajv from 6.12.6 to 6.14.0	2026-03-13 11:10:15 -10:00
dependabot[bot]	2da133cc84	chore(deps-dev): bump ajv from 6.12.6 to 6.14.0 Bumps [ajv](https://github.com/ajv-validator/ajv) from 6.12.6 to 6.14.0. - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](https://github.com/ajv-validator/ajv/compare/v6.12.6...v6.14.0) --- updated-dependencies: - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 21:08:59 +00:00
Johan Jansson	121a7cf487	Merge pull request #161 from actions/dependabot/npm_and_yarn/actions/core-2.0.2 chore(deps): bump @actions/core from 1.11.1 to 2.0.2	2026-03-13 11:07:38 -10:00
dependabot[bot]	e06ed630a2	chore(deps): bump @actions/core from 1.11.1 to 2.0.2 Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.11.1 to 2.0.2. - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) --- updated-dependencies: - dependency-name: "@actions/core" dependency-version: 2.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 21:05:29 +00:00
Johan Jansson	230b1cd3d0	Merge pull request #140 from actions/dependabot/npm_and_yarn/openai-6.7.0 chore(deps): bump openai from 5.11.0 to 6.7.0	2026-03-13 11:03:23 -10:00
dependabot[bot]	3d8acac3cb	chore(deps): bump openai from 5.11.0 to 6.7.0 Bumps [openai](https://github.com/openai/openai-node) from 5.11.0 to 6.7.0. - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/master/CHANGELOG.md) - [Commits](https://github.com/openai/openai-node/compare/v5.11.0...v6.7.0) --- updated-dependencies: - dependency-name: openai dependency-version: 6.7.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 21:02:13 +00:00
Johan Jansson	d46015cb8d	Merge pull request #189 from actions/dependabot/npm_and_yarn/hono-4.12.7 chore(deps): bump hono from 4.11.3 to 4.12.7	2026-03-13 10:11:39 -10:00
dependabot[bot]	b44f5a29f4	chore(deps): bump hono from 4.11.3 to 4.12.7 Bumps [hono](https://github.com/honojs/hono) from 4.11.3 to 4.12.7. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.11.3...v4.12.7) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-13 20:10:04 +00:00
Johan Jansson	a6d96d58d5	Merge pull request #186 from Pet3cy/security-fix-mcp-token-exposure-9299248942858101367 Security fix mcp token exposure 9299248942858101367	2026-03-13 10:03:38 -10:00
Johan Jansson	4eebe5ea25	Merge branch 'main' into security-fix-mcp-token-exposure-9299248942858101367	2026-03-13 10:00:12 -10:00
Johan Jansson	cf1eafb00d	Merge pull request #190 from actions/try-to-fix-ci-error Fix CI error: Check Transpiled JavaScript / Check dist	2026-03-13 09:59:59 -10:00
Johan Jansson	debf34cf91	Fix CI error: Check Transpiled JavaScript / Check dist	2026-03-13 09:49:01 -10:00
Johan Jansson	541dd69625	Merge branch 'main' into security-fix-mcp-token-exposure-9299248942858101367	2026-03-13 09:33:41 -10:00
Johan Jansson	f65d1a34dc	Merge pull request #182 from actions/dependabot/npm_and_yarn/fast-xml-parser-5.4.2 chore(deps-dev): bump fast-xml-parser from 5.2.3 to 5.4.2	2026-03-13 09:32:38 -10:00
google-labs-jules[bot]	9d962e5274	🔒 [security fix] Mask sensitive tokens in GitHub Actions logs - Added `core.setSecret(token)` to mask the primary GitHub token. - Added `core.setSecret(githubMcpToken)` to mask the GitHub MCP token. - Updated `__fixtures__/core.ts` to include the `setSecret` mock. - Updated `__tests__/main.test.ts` to verify `setSecret` is called for the tokens.	2026-03-10 22:44:58 +00:00
dependabot[bot]	8b38b47848	chore(deps-dev): bump fast-xml-parser from 5.2.3 to 5.4.2 Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.2.3 to 5.4.2. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.2.3...v5.4.2) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-03 13:20:56 +00:00
Pet3cy	b7792492cd	Merge pull request #12 from Pet3cy/fix-testing-improvement-parse-file-template-variables-6142620025282989819 🧪 [testing improvement] validate non-string file paths in parseFileTemplateVariables	2026-02-25 05:12:54 +01:00
google-labs-jules[bot]	a2600c61b7	test: validate non-string file paths in parseFileTemplateVariables Add test cases to verify that `parseFileTemplateVariables` correctly throws an error when a non-string value (e.g. number, boolean, object) is provided as a file path in the input YAML. This ensures the existing validation is properly tested. Co-authored-by: Pet3cy <169947521+Pet3cy@users.noreply.github.com>	2026-02-25 04:12:17 +00:00
Pet3cy	306ffe21b9	Merge pull request #11 from Pet3cy/relax-header-validation-16962389466518057682 🧹 Relax overly restrictive HTTP header name validation	2026-02-24 18:45:30 +01:00
google-labs-jules[bot]	326b9a12f4	chore: relax HTTP header name validation to match RFC 7230 Updated the regex in `src/helpers.ts` to allow all valid characters in an HTTP token (RFC 7230, section 3.2.6), including symbols like `_`, `.`, `!`, and `*`. Previously, the validation was overly restrictive, only allowing alphanumeric characters and hyphens. Also updated the corresponding unit test in `__tests__/helpers.test.ts` to reflect the change.	2026-02-24 17:44:57 +00:00
Pet3cy	8207a8ca01	Merge pull request #10 from Pet3cy/security-fix-sensitive-data-exposure-logs-8322086360319645856 🔒 [security fix] Fix sensitive data exposure in MCP Inference logs	2026-02-24 18:42:50 +01:00
google-labs-jules[bot]	c6c19e0fb7	🔒 [security fix] Fix sensitive data exposure in logs - Change core.info to core.debug for model responses in src/inference.ts - Change core.info to core.debug for tool execution details in src/mcp.ts - Change core.info to core.debug for custom header logging in src/helpers.ts - Remove sensitive response previews from error messages in src/inference.ts - Update tests to reflect changes from core.info to core.debug	2026-02-24 17:42:20 +00:00
Stephanie Giang	e09e659817	Merge pull request #173 from GitPaulo/main Support passing max_tokens and max_completion_tokens	2026-02-24 10:40:15 -05:00
Paulo Santos	e608d2ba8a	update dist	2026-02-15 00:26:15 +00:00
Paulo Santos	27965bc3a4	updated docs for missing prompt.yml model parameters	2026-02-15 00:23:47 +00:00
Paulo Santos	a8bddad5e5	update dist	2026-02-13 12:41:36 +00:00
Paulo Santos	672ba8a3ac	missed comment	2026-02-13 12:38:48 +00:00
Paulo Santos	3a80d137e1	update comments	2026-02-13 12:36:47 +00:00
Paulo Santos	074e8b294d	copilot review: add test for coverage of no params passed	2026-02-13 12:31:45 +00:00
Paulo Santos	f1ca66fc66	build dist	2026-02-13 12:16:03 +00:00
Paulo Santos	6360e0db9b	implement passing two action input properties to cover all model scenarios	2026-02-13 12:15:12 +00:00