coder · evgeniy-scherbina · Aug 19, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
@@ -0,0 +1,178 @@
+# Refreshes the AI Gateway price book from live upstream data (models.dev)
+# once a week and opens a pull request when the generated artifacts change.
+#
+# The price book seeds customer-visible cost numbers, so the refresh is never
+# merged automatically. The workflow only ever proposes a change; a human
+# reviews and merges it.
+#
+# Behavior:
+#   - Runs every Thursday. If regeneration produces no diff, the run ends
+#     without opening anything.
+#   - Reuses a single branch and pull request, force-pushing each week, so at
+#     most one refresh PR is open and it always carries the newest snapshot.
+#   - Fails loudly when the generator refuses to run, which it does by design
+#     when upstream drops a model pinned in overrides.jq or curated in
+#     curation.json. Failures are announced in Slack.
+name: aigateway-prices-refresh
+
+on:
+  schedule:
+    # 09:00 UTC every Thursday, leaving three business days before Tuesday releases.
+    - cron: "0 9 * * 4"
+  workflow_dispatch: # allows manual runs for testing
+
+permissions: {}
+
+concurrency:
+  group: aigateway-prices-refresh
+
+env:
+  REFRESH_BRANCH: bot/aigateway-prices-refresh
+  PRICES_FILE: coderd/aibridge/prices/data/prices.json
+  CATALOG_FILE: site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json
+
+jobs:
+  refresh:
+    name: Refresh price book
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up mise tools
+        uses: ./.github/actions/setup-mise
+        with:
+          install-args: "go node pnpm"
+
+      # Needed by catalog generation, which formats its output with biome.
+      - name: Install pnpm dependencies
+        uses: ./.github/actions/pnpm-install
+
+      - name: Snapshot the current price book
+        run: cp "${PRICES_FILE}" "${RUNNER_TEMP}/prices-before.json"
+
+      - name: Regenerate price book and model catalog
+        run: make gen/aibridge-prices
+
+      - name: Detect changes
+        id: detect
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- "${PRICES_FILE}" "${CATALOG_FILE}"; then
+            # exit 0  => NO differences => nothing to propose
+            echo "Price book already matches upstream; nothing to propose."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            # exit 1  => differences found
+            git diff --stat -- "${PRICES_FILE}" "${CATALOG_FILE}"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build pull request body
+        if: steps.detect.outputs.changed == 'true'
+        run: |
+          set -euo pipefail
+          go run ./scripts/aibridgepricesdiff \
+            -old "${RUNNER_TEMP}/prices-before.json" \
+            -new "${PRICES_FILE}" > "${RUNNER_TEMP}/summary.md"
+
+          {
+            cat "${RUNNER_TEMP}/summary.md"
+            echo
+            echo "## Review notes"
+            echo
+            echo "Regenerated by \`make gen/aibridge-prices\` from the live [models.dev](https://models.dev) catalog. Both artifacts come from one snapshot, so they ship together:"
+            echo
+            echo "- \`${PRICES_FILE}\`"
+            echo "- \`${CATALOG_FILE}\`"
+            echo
+            echo "These are customer-visible cost numbers taken from upstream data, so this PR is never merged automatically. The summary above lists what moved; check the diff for exact figures before approving."
+            echo
+            echo "Opened automatically by the [aigateway-prices-refresh workflow](${RUN_URL})."
+          } > "${RUNNER_TEMP}/body.md"
+
+          cat "${RUNNER_TEMP}/body.md"
+        env:
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+      - name: Open or update the refresh pull request
+        if: steps.detect.outputs.changed == 'true'
+        env:
+          # Use cdrci's token instead of the default GITHUB_TOKEN: PRs opened
+          # with GITHUB_TOKEN do not trigger workflow runs, so the refresh
+          # would arrive without CI signal.
+          GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
+          PR_TITLE: "chore: refresh AI model price book"
+        run: |
+          set -euo pipefail
+
+          # persist-credentials is disabled on checkout, so authenticate the
+          # push explicitly.
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git checkout -b "${REFRESH_BRANCH}"
+          git add -- "${PRICES_FILE}" "${CATALOG_FILE}"
+          git commit -m "${PR_TITLE}"
+
+          # Force-push: the branch is regenerated from the newest upstream
+          # snapshot each week, so the previous contents are always stale.
+          git push --force origin "refs/heads/${REFRESH_BRANCH}"
+
+          # REST, not `gh pr`: those go through GraphQL, which needs a read:org
+          # scope that cdrci's token lacks.
+          owner="${GITHUB_REPOSITORY%%/*}"
+          pr_number="$(gh api "repos/${GITHUB_REPOSITORY}/pulls?state=open&base=main&head=${owner}:${REFRESH_BRANCH}" --jq '.[0].number // empty')"
+          if [ -n "${pr_number}" ]; then
+            gh api --method PATCH "repos/${GITHUB_REPOSITORY}/pulls/${pr_number}" \
+              -f title="${PR_TITLE}" \
+              -f body="$(cat "${RUNNER_TEMP}/body.md")" \
+              --silent
+            echo "Updated existing PR #${pr_number}."
+          else
+            gh api --method POST "repos/${GITHUB_REPOSITORY}/pulls" \
+              -f title="${PR_TITLE}" \
+              -f head="${REFRESH_BRANCH}" \
+              -f base=main \
+              -f body="$(cat "${RUNNER_TEMP}/body.md")" \
+              --jq '.html_url'
+          fi
+
+      - name: Send Slack notification
+        if: failure() || steps.detect.outputs.changed == 'false'
+        env:
+          JOB_STATUS: ${{ job.status }}
+          PRICE_BOOK_CHANGED: ${{ steps.detect.outputs.changed }}
+          SLACK_WEBHOOK: ${{ secrets.AIGATEWAY_PRICES_SLACK_WEBHOOK }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          if [ -z "${SLACK_WEBHOOK}" ]; then
+            echo "::error::AIGATEWAY_PRICES_SLACK_WEBHOOK is not set; the notification could not be sent."
+            exit 1
+          fi
+
+          if [ "${JOB_STATUS}" = "failure" ]; then
+            # printf, not a double-quoted literal: bash leaves \n as two
+            # characters, and jq --arg then escapes the backslash, so Slack
+            # would print \n as text instead of breaking the line.
+            text="$(printf ':warning: *AI model price book refresh failed.*\nThe generator fails by design when upstream drops a model pinned in scripts/aibridgepricesgen/overrides.jq or curated in curation.json. Logs: %s' "${RUN_URL}")"
+          elif [ "${PRICE_BOOK_CHANGED}" = "false" ]; then
+            text=":white_check_mark: *AI Gateway price book refresh completed.* No generated changes were found. Run: ${RUN_URL}"
+          else
+            echo "::error::Unexpected notification state: status=${JOB_STATUS}, changed=${PRICE_BOOK_CHANGED}"
+            exit 1
+          fi
+
+          payload="$(jq -nc --arg text "${text}" '{text: $text}')"
+          curl -fsSL -X POST -H 'Content-type: application/json' -d "${payload}" "${SLACK_WEBHOOK}"
+          echo "Sent Slack notification"
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -40,3 +40,10 @@ coderd/database/queries/ai_provider_keys.sql @ibetitsmike @johnstcn
 coderd/database/queries/aicostcontrol.sql @ibetitsmike @johnstcn
 codersdk/aiproviders.go @ibetitsmike @johnstcn
 codersdk/aiproviders_bedrock.go @ibetitsmike @johnstcn
+
+# Generated price book and frontend model catalog. The
+# aigateway-prices-refresh workflow proposes updates to both from live
+# models.dev data, and they carry customer-visible cost numbers, so every
+# refresh needs a review from someone who owns them.
+coderd/aibridge/prices/data/prices.json @evgeniy-scherbina @ssncferreira @johnstcn
+site/src/pages/AgentsPage/components/ChatModelAdminPanel/knownModels/knownModelsGenerated.json @evgeniy-scherbina @ssncferreira @johnstcn
diff --git a/scripts/aibridgepricesdiff/main.go b/scripts/aibridgepricesdiff/main.go
@@ -0,0 +1,198 @@
+// aibridgepricesdiff renders a human-readable Markdown summary of the
+// difference between two AI Gateway price seed files (the prices.json produced
+// by aibridgepricesgen).
+//
+// The price refresh workflow uses it to fill the pull request body, so
+// a reviewer sees at a glance which models appeared, which disappeared, and
+// which repriced. Exact figures are deliberately left to the pull request
+// diff, which is the source of truth.
+//
+// Usage:
+//
+//	aibridgepricesdiff -old <path> -new <path>
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+
+	"golang.org/x/xerrors"
+)
+
+// priceRow mirrors the seed file schema written by aibridgepricesgen. Pointer
+// fields preserve the distinction between "not populated by upstream" (null)
+// and "explicitly zero" (0).
+type priceRow struct {
+	Provider        string `json:"provider"`
+	Model           string `json:"model"`
+	InputPrice      *int64 `json:"input_price"`
+	OutputPrice     *int64 `json:"output_price"`
+	CacheReadPrice  *int64 `json:"cache_read_price"`
+	CacheWritePrice *int64 `json:"cache_write_price"`
+}
+
+// modelKey identifies a model across the two snapshots.
+type modelKey struct {
+	provider string
+	model    string
+}
+
+func (r priceRow) key() modelKey {
+	return modelKey{provider: r.Provider, model: r.Model}
+}
+
+func (k modelKey) String() string {
+	return k.provider + "/" + k.model
+}
+
+func less(a, b modelKey) bool {
+	if a.provider != b.provider {
+		return a.provider < b.provider
+	}
+	return a.model < b.model
+}
+
+// diff is the full comparison between two snapshots
+type diff struct {
+	added   []modelKey
+	removed []modelKey
+	changed []modelKey
+}
+
+func (d diff) empty() bool {
+	return len(d.added) == 0 && len(d.removed) == 0 && len(d.changed) == 0
+}
+
+func main() {
+	oldPath := flag.String("old", "", "path to the previous prices.json (required)")
+	newPath := flag.String("new", "", "path to the refreshed prices.json (required)")
+	flag.Parse()
+	if err := run(*oldPath, *newPath, os.Stdout); err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "aibridgepricesdiff: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run(oldPath, newPath string, w io.Writer) error {
+	if oldPath == "" || newPath == "" {
+		return xerrors.New("-old and -new are both required")
+	}
+	oldRows, err := readRows(oldPath)
+	if err != nil {
+		return xerrors.Errorf("read %s: %w", oldPath, err)
+	}
+	newRows, err := readRows(newPath)
+	if err != nil {
+		return xerrors.Errorf("read %s: %w", newPath, err)
+	}
+	_, err = io.WriteString(w, render(compare(oldRows, newRows)))
+	return err
+}
+
+func readRows(path string) ([]priceRow, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	var rows []priceRow
+	if err := json.Unmarshal(data, &rows); err != nil {
+		return nil, xerrors.Errorf("parse: %w", err)
+	}
+	return rows, nil
+}
+
+// compare classifies every model as added, removed, or changed.
+func compare(oldRows, newRows []priceRow) diff {
+	oldByKey := make(map[modelKey]priceRow, len(oldRows))
+	for _, r := range oldRows {
+		oldByKey[r.key()] = r
+	}
+
+	var d diff
+	seen := make(map[modelKey]struct{}, len(newRows))
+	for _, r := range newRows {
+		seen[r.key()] = struct{}{}
+		prev, ok := oldByKey[r.key()]
+		switch {
+		case !ok:
+			d.added = append(d.added, r.key())
+		case !samePrices(prev, r):
+			d.changed = append(d.changed, r.key())
+		}
+	}
+	for _, r := range oldRows {
+		if _, ok := seen[r.key()]; !ok {
+			d.removed = append(d.removed, r.key())
+		}
+	}
+
+	for _, keys := range [][]modelKey{d.added, d.removed, d.changed} {
+		sort.Slice(keys, func(i, j int) bool { return less(keys[i], keys[j]) })
+	}
+	return d
+}
+
+// samePrices reports whether two rows for the same model carry identical
+// prices. A price moving to or from null counts as a change.
+func samePrices(a, b priceRow) bool {
+	return equalPrice(a.InputPrice, b.InputPrice) &&
+		equalPrice(a.OutputPrice, b.OutputPrice) &&
+		equalPrice(a.CacheReadPrice, b.CacheReadPrice) &&
+		equalPrice(a.CacheWritePrice, b.CacheWritePrice)
+}
+
+func equalPrice(a, b *int64) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	return *a == *b
+}
+
+// render writes the Markdown summary: counts, then the models in each
+// category. Empty categories are omitted.
+func render(d diff) string {
+	var b strings.Builder
+	write := func(format string, args ...any) {
+		_, _ = fmt.Fprintf(&b, format, args...)
+	}
+
+	write("## Price book changes\n\n")
+	if d.empty() {
+		write("No price changes.\n")
+		return b.String()
+	}
+
+	write("%s added, %s removed, %s changed.\n",
+		plural(len(d.added), "model"),
+		plural(len(d.removed), "model"),
+		plural(len(d.changed), "model"),
+	)
+
+	renderList := func(heading string, keys []modelKey) {
+		if len(keys) == 0 {
+			return
+		}
+		write("\n<details>\n<summary>%s</summary>\n\n", heading)
+		for _, k := range keys {
+			write("- %s\n", k)
+		}
+		write("</details>\n")
+	}
+	renderList("Added", d.added)
+	renderList("Removed", d.removed)
+	renderList("Changed", d.changed)
+
+	return b.String()
+}
+
+func plural(n int, noun string) string {
+	if n == 1 {
+		return fmt.Sprintf("%d %s", n, noun)
+	}
+	return fmt.Sprintf("%d %ss", n, noun)
+}