Repository navigation
Description
Warning
threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.
Details
The threat detection engine failed to produce results.
Review the workflow run logs for details.
Summary
Analyzed live model inventories from OpenAI, Anthropic, Gemini, Copilot SDK, and Copilot (reflect) against the built-in alias mapping and pricing payload. The alias file (pkg/workflow/data/model_aliases.json) is already well-maintained and covers nearly all current model generations (sonnet-6x, gpt-5.6, gemini-3.x, etc.). One clear gap was found: grok-4.5 (xAI's Grok model, served through Copilot) has no alias coverage and is missing from models.json pricing data entirely, despite being actively served by Copilot with full billing metadata available.
- Providers queried: OpenAI, Anthropic, Gemini, Copilot SDK, Copilot (reflect)
- Total models found: 222 (OpenAI) + 10 (Anthropic) + 50 (Gemini) + 22 (Copilot SDK) + 37 (Copilot reflect)
- Proposed alias changes: 1
- Pricing gaps found: 1 (missing model)
Provider Model Counts
| Provider | Models Available | Status |
|---|---|---|
| openai | 222 | ✅ ok |
| anthropic | 10 | ✅ ok |
| gemini | 50 | ✅ ok |
| copilot-sdk | 22 | ✅ ok |
| copilot (reflect) | 37 | ✅ ok |
Raw API Fields Discovered
- Copilot SDK / reflect:
billing.tokenPrices(inputPrice/outputPrice/cachePrice per-million-token, pluslongContexttier pricing),capabilities.limits.max_context_window_tokens,capabilities.supports.vision/tool_calls/reasoning_effort,modelPickerCategory,modelPickerPriceCategory,policy.state. - Anthropic:
display_name,created_at,type— no direct pricing field (matches known family-based pricing tiers already inmodels.json). - Gemini:
input_token_limit,output_token_limit,supported_generation_methods,version— useful as a complexity/pricing-tier proxy, no direct cost field. - OpenAI:
owned_by,created— used for naming-convention cross-checks only. - Docs pricing table (
https://docs.github.com/en/copilot/reference/copilot-billing/models-and-pricing): confirms GPT family pricing tiers (Default vs Long context) matchingmodels.json; does not list Anthropic/Gemini/xAI models (rendered separately or omitted from the public table).
models.json Pricing Analysis
Missing from models.json
| Model ID | Provider | Inferred Pricing | Basis |
|---|---|---|---|
grok-4.5 |
copilot (xAI) | input $0.20/M, output $0.60/M, cache-read $0.05/M (long-context: input $0.40/M, output $1.20/M, cache-read $0.10/M above 200K tokens) | Copilot SDK billing.tokenPrices (inputPrice: 200, outputPrice: 600, cachePrice/cacheReadPrice: 50, longContext.inputPrice: 400, longContext.outputPrice: 1200), corroborated by reflect endpoint model list |
Historical entries not currently returned
These model IDs remain in pkg/cli/data/models.json but are absent from all live inventories this run. Retained as historical records — no removal proposed:
claude-fable-5, claude-opus-4.5, claude-sonnet-4, gemini-2.5-pro, gemini-3-flash-preview, gpt-4.1, gpt-5.2, gpt-5.2-codex, gpt-5.4-nano (intentionally deprecated/excluded per policy), kimi-k2.7-code, raptor-mini
Inferred vs stored pricing discrepancies
None found. All GA models present in both models.json and current live inventories (gpt-5.4, gpt-5.5, gpt-5.3-codex, gpt-5-mini, claude-sonnet-4.5, claude-haiku-4.5, etc.) have pricing consistent with the Copilot SDK/reflect tokenPrices and the docs pricing table within rounding tolerance.
Proposed Alias Updates
1. What: Add a new grok alias family
Why: grok-4.5 is actively served by Copilot (confirmed in both Copilot SDK models and the live reflect endpoint model list) but has zero alias coverage today — it only matches the catch-all any alias, with no semantic or family-specific alias, and it's also absent from models.json pricing data.
Syntax:
{
"grok": ["copilot/*grok*", "openai/*grok*"]
}Also add grok-4.5 (and its github/grok-4.5 mirror) with the pricing shown above to pkg/cli/data/models.json and actions/setup/js/models.json (keeping the two mirrored files identical), using provider_type: "openai"-style entry consistent with other Copilot-routed non-Anthropic models (needs a maintainer decision on exact provider_type/wire_api since Grok is not currently modeled as its own provider in the schema — the two files today only have anthropic/openai/github-copilot provider buckets).
Full Model Lists by Provider
Anthropic (10): claude-haiku-4-5-20251001, claude-opus-4-1-20250805, claude-opus-4-5-20251101, claude-opus-4-6, claude-opus-4-7, claude-opus-4-8, claude-opus-5, claude-sonnet-4-5-20250929, claude-sonnet-4-6, claude-sonnet-5
Copilot SDK (22): auto, claude-haiku-4.5, claude-opus-4.6, claude-opus-4.7, claude-opus-4.8, claude-opus-5, claude-sonnet-4.5, claude-sonnet-4.6, claude-sonnet-5, gemini-3.1-pro-preview, gemini-3.5-flash, gemini-3.6-flash, gpt-5-mini, gpt-5.3-codex, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, grok-4.5, mai-code-1-flash-picker
Copilot (reflect, 37): claude-haiku-4.5, claude-opus-4.6/4.7/4.8, claude-sonnet-4.5/4.6/5, gemini-2.5-pro, gemini-3-flash-preview, gpt-3.5-turbo(-0613), gpt-4(-0613), gpt-4-o-preview, gpt-4.1(-2025-04-14), gpt-4o(-2024-05-13/08-06/11-20), gpt-4o-mini(-2024-07-18), gpt-5-mini, gpt-5.3-codex, gpt-5.4(-mini), gpt-5.5, gpt-5.6-luna/sol/terra, grok-4.5, mai-code-1-flash-picker, text-embedding-3-small(-inference), text-embedding-ada-002, trajectory-compaction
OpenAI (222) and Gemini (50) lists omitted for brevity — no new families found requiring alias changes.
Notes
pkg/cli/data/models.jsonandactions/setup/js/models.jsonremain byte-identical (verified via diff) — any pricing update must preserve this parity, e.g. viamake refresh-models-jsonfollowed by manual addition of the Grok entry (models.dev does not yet listgrok-4.5under GitHub Copilot as of this run).gpt-4o-mini,gpt-4.1,gpt-4o, andgpt-5.4-nanocontinue to be treated as intentionally deprecated per standing policy and are excluded from the gap tables above even though they still appear in the live reflect model list.- All other alias families (
sonnet,sonnet-6x,haiku,opus,gpt-5*variants,gemini-*variants,kimi,mai-code,raptor-mini, task-oriented aliases likesummarization,coding,reasoning,vision,image-generation) already have adequate wildcard coverage for all models observed in this run — no changes needed there.
Warning
Firewall blocked 7 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcollector.githubapp.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "collector.githubapp.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
Generated by 📦 Daily Model Inventory Checker · aut00 · 50.6 AIC · ⊞ 12.5K · ◷
- expires on Aug 5, 2026, 4:18 PM UTC-08:00
Activity