DSH-action

For existing workflows, update the Action reference to Lixiaoyiao/DSH-action@the-existing-commit-SHA and keep its immutable commit pin. Use npm create dsh-action for the installer.

中文

Run DeepSeek Harness directly from GitHub pull requests, issues, failed CI jobs, and maintainer-authored automations.

GitHub PR / Issue / CI  →  DeepSeek Harness  →  Review / Diagnose / Fix / Issue → PR

The Action starts a credential-isolated DSH worker, validates its structured result, and lets a trusted Controller publish comments or validated changes. This is a community project, not an official DeepSeek or GitHub product. It is maintained by @Lixiaoyiao.

Quick Start

The Action runs DSH on GitHub-hosted Linux runners. You do not need to install DSH or Docker on your computer. Local DSH runs on your own computer; its keys and settings are separate from the GitHub Action.

1. Install the tools

On Windows, install Node.js 24 or later, Git for Windows, and GitHub CLI. Keep the default installation options. Close and reopen PowerShell, then check:

node --version
npm.cmd --version
git --version
gh --version

Use npm.cmd if PowerShell blocks npm.ps1; no execution-policy change is needed. On macOS and Linux, use npm.

2. Open your repository and sign in

Use the existing local repository folder. You do not need to clone it again.

cd "C:\path\to\your-repository"
git remote -v
gh auth login

Choose GitHub.com and browser sign-in. The origin remote should point to the repository you want to set up. The installer uses that repository; it does not create a new one.

3. Install the workflow and set your key

npm.cmd create dsh-action@latest

The installer asks which workflow to install, starting with read-only @dsh conversation and automatic PR Review, then asks for the DSH composition, with controlled as the default. It creates local workflow files and preserves existing files. Review, commit and push the generated files with your normal Git workflow.

Installer 0.7.4 binds generated workflows to formal Action v0.12.2.

Add the key in Settings → Secrets and variables → Actions → New repository secret on GitHub. Set the name to DEEPSEEK_API_KEY and paste the key as its value. A key stored in local DSH does not configure this secret.

4. Ask @dsh a question

Make sure .github/workflows/dsh-review.yml is on the default branch, usually main. If direct pushes are blocked, submit and merge a PR containing the workflow first.

As a repository collaborator with write access, add a comment in an Issue or PR:

@dsh Help me understand this issue

You can also use @dsh 帮我分析这个问题. Start @dsh on a line outside quotes or code; a fixed subcommand is optional. The Action replies in the thread. Requests such as @dsh Please fix this bug remain read-only in this starter: they produce an analysis or proposed fix without editing files. Follow progress or read failure details under Actions → DSH review.

For automatic review, open a non-draft pull request or push a new commit to an existing one. The Action reviews the PR without changing its files.

Optional: local plugins and other workflows

The terminal choices include read-only conversation + Review, Coding Commands, both, and automatic Session. --advanced enters these questions explicitly. If you already have local DSH plugins, --import-plugins lists them for selection and confirmation in the terminal:

npm.cmd create dsh-action@latest -- --import-plugins

Native mode supports DSH Bundles directly. Controlled mode also needs their exact read-only tool names (plugin__owner__tool). The cloud installs selected packages at exact versions; local settings and keys stay on your computer. Local-only, disabled and incompatible packages show their status. Use --dsh-home "C:\path\to\.dsh" with the import option for another DSH home. Plugin import requires an interactive terminal.

For non-interactive setup, choose the workflow and composition explicitly:

npm.cmd create dsh-action@latest -- --mode both --dsh-mode native

Controlled remains the default. Natural-language writes require both natural-language-write: "true" and allow-write: "true" in a write-capable workflow, repository-specific validation commands, and a clear request such as @dsh Please fix this bug and open a PR. The Commands starter keeps the independent natural-language switch off; legacy fix, implement and task --write retain their existing write requests. Installer 0.7.4 targets Action v0.12.2 and DSH 0.2.1-rc.2. Its build binds the qualified Action commit through DSH_ACTION_RELEASE_SHA; its source tag is create-dsh-action-v0.7.4. Edit the workflow YAML for models, thinking effort and other inputs. See the setup guide for configuration checks, manual setup and recovery.

Manual installation

Add DEEPSEEK_API_KEY under Settings → Secrets and variables → Actions, then create .github/workflows/dsh-review.yml:

name: DSH review

on:
  pull_request_target:
    types: [opened, synchronize, ready_for_review, reopened]
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]

permissions:
  contents: read
  issues: write
  pull-requests: write

concurrency:
  group: dsh-${{ github.event_name == 'pull_request_target' && 'review' || 'chat' }}-${{ github.event.pull_request.number || github.event.issue.number }}
  cancel-in-progress: ${{ github.event_name == 'pull_request_target' }}

jobs:
  review:
    if: >-
      (github.event_name == 'pull_request_target' && github.event.pull_request.draft == false) ||
      (github.event.sender.type != 'Bot' &&
      contains(github.event.comment.body || github.event.review.body, '@dsh'))
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout trusted base or default branch only
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.pull_request.base.sha || github.event.repository.default_branch }}
          persist-credentials: false
          fetch-depth: 1
      - uses: Lixiaoyiao/DSH-action@v0.12.2
        with:
          deepseek-api-key: ${{ secrets.DEEPSEEK_API_KEY }}
          dsh-version: 0.2.1-rc.2
          permission-profile: strict
          isolation: docker
          natural-language-write: "false"
          allow-write: "false"

Comment @dsh Help me understand this issue in an Issue/PR, or open a non-draft PR for automatic review. The Action checks out only the trusted base/default branch, reads pull requests through GitHub APIs, and never executes fork code. issues: write and pull-requests: write let the Controller publish replies; code remains read-only.

For production, pin the complete commit published in the corresponding GitHub Release. Resolve the corresponding immutable release tag to its full SHA after qualification; the installer version and its Action binding are independent release identities. See Setup for permissions, pinning, checkout rules, and complete templates.

Core capabilities

Capability	What it does
Pull request review	Reviews new commits, publishes one summary, and adds high-confidence inline findings
General tasks	Answers repository questions or performs an explicitly authorized coding task
CI diagnosis and repair	Reads failed checks and logs; trusted workflows may validate and publish a fix
Issue implementation	Turns an authorized Issue request into a validated branch and pull request
Composition modes	Keeps the existing controlled tool profile by default and offers an experimental native DSH mode
Controlled tools	Adds exact profiles for native, fixed-command, typed Controller GitHub, MCP, Bundle, and Plugin tools
Structured results	Keeps the schema-v1 audit envelope and can validate an optional maintainer-defined task result
Images and binary files	Reads PNG/JPEG/WebP/GIF through official DSH tools, downloads eligible GitHub images, and preserves binary bytes
Explicit Session resume	Continues a completed task in a new Actions run using a verified raw DSH checkpoint and current permissions

The Action provides the experimental dsh-mode: native path over the locked DSH 0.2.1-rc.2 runtime and its official ecosystem composition. Native MCP servers, Profile Bundles, direct Cordis Plugins, repository Skills, Subagents, and Workflows retain DSH-native discovery and behavior. controlled remains the compatible default, so workflows that omit dsh-mode retain their existing composition, permissions, tools, budgets, receipts, and outputs.

Native mode is not an unsafe mode. It returns ownership of DSH's internal headless composition, capability graph, and model-visible inventory to DSH. Native MCP servers load through official @deepseek-ai/dsh-mcp-client; Bundles become official Profile layers; direct Plugins load through Cordis; and repository Skills, Subagents, and Workflows retain DSH-native behavior. Its definition-only extension schema declares owners and process requirements, not Action tools, grants, or per-tool budgets. Dynamic ecosystem tools appear only in runtime observedTools, and native toolPolicy never claims Controller effectiveTools.

The Action still owns trusted-workflow admission, exact package pins, lifecycle-script suppression, runtime inventory audit, Docker and .git-less workspace boundaries, the run-scoped DeepSeek credential proxy, GitHub credential isolation, actor/repository trust, validation and deferred writes, deadlines, cancellation, and secret redaction. Native remains Docker-only. Bridge network and read/write mounts are whole-worker capabilities, not per-extension or per-tool sandboxes. A user-configured GitHub MCP with its own credential is a trusted external extension whose direct effects do not receive the Controller Gateway's binding, revalidation, validation, or deferred-mutation guarantees. Controller-owned command.* and github.* capabilities remain a separate, mode-independent plane.

The Action supports automatic Session creation and continuation by key, retaining explicit save/resume. A trusted workflow discovers the latest successful compatible checkpoint; failed, unknown, missing, expired or corrupt history prevents silent fallback. Matching workflow identity and concurrency bindings serialize one key while allowing different keys to run concurrently. The existing Controller / DSH / Gateway / validation ownership, exact 0.2.1-rc.2 pin and default-off Session path remain. Current authority is recalculated; previous GitHub writes are not replayed. Text file context, offline configuration checks and bounded GitHub diagnostics remain available.

Images and files

Upload a PNG, JPG, WebP or GIF to a GitHub Issue, PR or comment and ask @dsh task --read about it. In an eligible trusted Docker run with workspace.read, the Controller downloads GitHub-hosted images automatically and DSH's official read_image reads them. Repository images use the same tool. Downloads allow 8 image attempts, 4 MiB each and 16 MiB total; skipped or failed images produce a reason in the run logs. Untrusted PRs retain their existing tool permissions.

Binary repository files retain their exact bytes through workspace copies and Git Blob publication. Creating or changing them requires an already authorized binary-capable command or extension and the existing write validation. Session checkpoints also carry the bytes referenced by official image/file attachments. PDF, Word and Excel remain opaque files unless a maintainer configures a suitable DSH extension; the Action does not include a document parser. See file support and limits.

Live runs

These public runs show the comments and Actions logs produced by this repository.

Scenario	Run
PR review, including a rerun without duplicate comments	PR #3 · Actions run
Diagnosis based on failed checks and logs	Actions run
Fix and validation in trusted write mode	Actions run
Issue implementation followed by a pull request	Issue #4 → PR #5

Natural requests and existing @dsh commands

Write @dsh followed by your request on a non-code line of an Issue or PR comment, PR review, or inline review comment. It may follow context or blank lines. Use one actionable mention per comment. Quoted examples, code blocks, inline code and bot-authored natural requests do not trigger a task. Mid-sentence mentions such as Please ask @dsh about this are ignored.

Command	Purpose
@dsh Explain this failure	Run a general task; read-only unless the workflow explicitly enables write tasks
@dsh Please fix this bug and open a PR	Request a write task only when the workflow enables natural-language writes and normal write gates
@dsh task --read <question>	Explain code, inspect the repository, or answer a general question
@dsh task --write <task>	Request a coding task; every write gate must still pass
@dsh review	Review the current pull request again
@dsh diagnose	Diagnose failed checks and logs
@dsh fix	Repair a same-repository pull request in trusted write mode
@dsh implement	Implement an Issue and open a pull request

The first words task, review, diagnose, fix and implement retain their existing command semantics, case-insensitively. For example, @dsh fix is an explicit write request even when natural-language writes are disabled; the read-only starter denies it. Use @dsh Please fix this bug for a natural request.

--write, fix, and implement request capabilities; they do not grant them. The workflow must explicitly enable write mode and provide Controller-run validation. Natural requests are read-only unless natural-language-write is enabled and the request clearly asks to change code. task-access does not enable natural-language writes. See Usage for commands and automation, and Configuration for the gates.

Maintainers can change the trigger phrase, add label/assignee routes, filter actors or historical comments, select a base branch, and choose a deterministic branch template. These settings change routing and naming only; GitHub authority still comes from the Controller policy and workflow token scopes.

Security

• The Agent receives neither the real GITHUB_TOKEN nor the real DeepSeek key. Only the Controller can call Action-owned github.* mutation APIs; an explicitly configured external GitHub MCP uses its own credential and authority as described below.
• Repository content, diffs, issues, pull requests, comments, logs, model output, and tool output remain untrusted data.
• Fork review uses a .git-less, credential-free worker and must check out only the trusted base SHA with persist-credentials: false.
• Writes require a trusted same-repository context, authorized actors, Docker, allow-write: "true", non-empty fixed validation commands, and successful validation. Protected-path and Validation Integrity checks still apply.
• Typed github.* mutations are exact-ID, entity-bound, deferred until Controller validation, and reconciled with bounded receipts. No arbitrary REST, GraphQL, URL, or credential pass-through exists.
• Validation Integrity provides high-confidence weakening detection plus baseline replay for its supported entrypoints, scripts, test/config weakening, lock/toolchain controls, and known wrappers/interpreters; it is not complete cross-language dependency provenance or a formal proof.
• Validation may use Docker bridge networking. On self-hosted or corporate-network runners, repository validation code may reach runner-accessible network services; use dedicated runners and runner-level segmentation/egress controls.
• An approved Bundle, Plugin, or stdio MCP server is trusted worker code. Controlled ToolRuntime limits model-routed calls; native leaves routing and inventory to DSH. Neither model is a sandbox for extension startup, background work, or direct process I/O, and any bridge/RW capability applies to the whole worker.
• github.* uses the Controller GitHub Gateway. A separately configured GitHub MCP uses its own external credential and is outside the Gateway's binding, revalidation, validation, and deferred-write guarantees.

Read the complete Security policy before enabling write mode, host execution, network access, or third-party extensions.

Documentation

Guide	Contents
Setup · 中文	Installer, manual setup, Secret, permissions, safe checkout, and templates
Usage · 中文	@dsh commands, tasks, review, diagnose, fix, implement, and automation
Configuration	Inputs, permission profiles, tools, validation, extensions, and outputs
Files and images · 中文	Supported types, GitHub downloads, binary bytes, Session attachments, and limits
Architecture · Invariants	Component ownership, authority boundaries, and stable system invariants
Troubleshooting	Denials, Docker, timeouts, cancellation, validation, and extension failures
Security policy	Trust model, credential boundaries, network behavior, and known limitations
Extension contracts	Deep technical contracts for MCP, Profile, Bundle, Plugin, ToolRuntime, and receipts
Maintainer release guide	Local checks, Core E2E, release canary, version updates, and publishing
Contributing · Changelog	Development workflow and release history

Development

Node.js 24 is required.

npm ci
npm run check

See CONTRIBUTING.md. The Marketplace dist/ bundle is committed for releases and must not be edited by hand.

License

MIT. Third-party licenses are listed in THIRD_PARTY_NOTICES.md and BUNDLED_DEPENDENCIES.md.

DeepSeek Harness supplies the headless runtime and official extension mechanisms. The GitHub integration also draws on the MIT-licensed Claude Code Action patterns and the execution/publication separation described by Codex GitHub Action; exact attributions are recorded in the third-party notices.