AI Insights

On the Workflow Detail Reliability tab, each flagged metric gains a “Why did duration spike?” button. It explains the outliers from surrounding metadata — baseline statistics, when the workflow file last changed, and the mix of triggers — then suggests one concrete check you can run yourself.

The request is lazy — opening the Reliability tab costs nothing until you click. Results are cached for 30 minutes.

When a workflow has 3 or more recent failures, the Reliability tab offers “Suggest why this is failing” — up to three ranked likely causes, each with the evidence behind it and a confidence level. Below that threshold the feature stays quiet: speculating about one flaky run is noise, and the floor is enforced server-side, not just hidden in the UI.

Cost is kept proportional to the problem: job detail is fetched only for runs that actually failed, capped at 10, and the GitHub fan-out is cached separately from the generation. This surface is rate-limited to 10 requests/minute — half the others.

What data leaves your instance

This is the part worth reading carefully. Prompts are assembled server-side from a typed snapshot that allowlists its fields — anything not in the list cannot be sent, and the test suite fails the build if a forbidden field appears.

In organization mode, Settings → AI Provider lets a team point GitDash at its own account: provider, model, API key, and an optional base URL for a gateway or regional endpoint. Useful when the deployment's default key belongs to someone else, or when you want a larger model than the operator chose.

In standalone mode the section does not appear at all. A self-hosted personal instance is meant to work from the environment defaults with no setup, so there is nothing to configure.

The key is write-only: encrypted at rest with the same AES-256-GCM helper used for email credentials, never returned to the browser, shown only as a masked hint. Leaving the field blank keeps the stored key. Base URLs must be https, because that URL carries the key. Changes take effect within 30 seconds.

Providers and keys

Three providers are supported and tried in order; any without a key is skipped, so configuring one is enough. No vendor SDK is installed — the layer talks to each endpoint with plain fetch. Keys are read server-side only and never reach the browser: /api/ai/status reports which providers are configured, never the key material.

Cost and rate limiting

Calls are cached for 15 minutes and fingerprinted on the snapshot, so unchanged metrics reuse the previous generation. Requests are rate-limited to 20/minute per token, and a daily token budget stops runaway usage.

How it fails