Verify the job: Stream a completion with a tool call

Run the job against OpenRouter API with your own account, on your own GitHub Actions runner, and the report card shows it verified. Sourcey never holds your credentials, and a run never changes the grade.

Set it up

Save this as .github/workflows/sourcey-agent-readiness-c21314f54fd12c51eece03e1228c03f94b5616a44c5c408ccd378e184c610a06.yml on your repository's default branch:

name: "Agent Readiness: OpenRouter API / Stream a completion with a tool call"

on:
  schedule:
    - cron: "3 13 22 * *"
  workflow_dispatch:

jobs:
  verify:
    permissions:
      id-token: write
    uses: sourcey/agent-readiness-action/.github/workflows/run.yml@e058e94cee8bbba97b65714cde6cc3ba1df9ce0a # v1.0.4
    with:
      profile: arp_01m4pmaa3hzmehhtgx2ea10thv
      binding: chat-stream-tool
    secrets:
      credentials: ${{ secrets.SOURCEY_AGENT_READINESS_C21314F54FD12C51EECE03E1228C03F94B5616A44C5C408CCD378E184C610A06 }}

In Settings → Secrets and variables → Actions, add the repository secret SOURCEY_AGENT_READINESS_C21314F54FD12C51EECE03E1228C03F94B5616A44C5C408CCD378E184C610A06 with your own values:
```
{
  "api_key": "..."
}
```
Open Actions → Agent Readiness: OpenRouter API / Stream a completion with a tool call → Run workflow to check the job now. After that it runs once a month on its own, at the day and time in the workflow (UTC), which is this job's own so runs spread out.

The card shows the job verified with the date of the last run that did it. When a run doesn't do the job, the workflow fails, so GitHub tells you, and the run's summary says what failed.

The workflow pins the Action's v1.0.4 release by its full commit. Sourcey accepts runs only from releases it tagged, and only on GitHub-hosted runners. GitHub stops the scheduled runs of a public repository that has gone 60 days without a commit, so use one that sees commits, such as your SDK's.

Say the runs are yours

A run from any repository can verify the job. Your own runs count for more: two of them, a while apart, that fail the same way put that failure on the card in place of Job verified until one of yours passes. To make a repository's runs yours, add a DNS TXT record on openrouter.ai:

_sourcey-agent-readiness.openrouter.ai  TXT  "github-owner-id=<owner id> github-repository-id=<repository id>"

This prints the value for a repository:

gh api repos/OWNER/REPO --jq '"github-owner-id=\(.owner.id) github-repository-id=\(.id)"'

What leaves your runner

Your credentials never do. They're held in memory for the run and sent only to the binding's own endpoints.
If a response echoes a credential back, it isn't kept: the run stops there and proves nothing either way. So does a service that answers 429 or 5xx.
Sourcey receives a record of each request, the response bodies with credentials removed, and a signed attestation of the record. It publishes the record, never your repository's name, and keeps the bodies and the attestation private.

The Action's README →