Skip to content

fix(evaluators): add Luna API URL override#237

Draft
abhinav-galileo wants to merge 6 commits into
mainfrom
abhi/luna-internal-api-url
Draft

fix(evaluators): add Luna API URL override#237
abhinav-galileo wants to merge 6 commits into
mainfrom
abhi/luna-internal-api-url

Conversation

@abhinav-galileo

@abhinav-galileo abhinav-galileo commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Prefer GALILEO_LUNA_API_URL before GALILEO_API_URL for Luna scorer calls; this URL is optional and only needed for custom scorer API endpoints.
  • Infer Luna auth from exactly one configured credential; keep the legacy auth-mode env override undocumented.
  • Support optional CA-file verification and bounded HTTP connection pooling.
  • Update Luna examples to distinguish required OSS API-key setup from deployment-managed internal auth settings. OSS users do not need to set GALILEO_API_SECRET_KEY; internal-auth deployments inject it.

Checks

  • make test
  • make lint
  • make typecheck
  • uv run --with ruff ruff check --config pyproject.toml examples/galileo_luna

@codecov

codecov Bot commented Jun 11, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 96.15385% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
...src/agent_control_evaluator_galileo/luna/client.py 96.15% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

- Verify TLS against an optional CA bundle (ca_file arg or GALILEO_LUNA_CA_FILE) so internal API endpoints with internally-issued certificates work in internal auth mode.
- Bound connection pooling (keepalive expiry 1s, connection limits) so requests do not reuse sockets the server already closed, and retry the idempotent scorer invoke once on connection errors.
- Deprecate GALILEO_LUNA_AUTH_MODE; the auth mode is inferred from the configured credential, and setting both credentials remains an explicit error.
- Trim whitespace when resolving API base URLs from the environment.
- Update the Luna example README and cover URL precedence, TLS, retry, and deprecation with tests.
@abhinav-galileo abhinav-galileo changed the title fix(evaluator-galileo): prefer cluster API URL for internal Luna auth fix(evaluator-galileo): use internal API URL for Luna auth Jun 11, 2026
@abhinav-galileo abhinav-galileo changed the title fix(evaluator-galileo): use internal API URL for Luna auth fix(evaluators): use internal API URL for Luna auth Jun 11, 2026
@abhinav-galileo abhinav-galileo changed the title fix(evaluators): use internal API URL for Luna auth fix(evaluators): add Luna API URL override Jun 11, 2026
@abhinav-galileo abhinav-galileo marked this pull request as ready for review June 11, 2026 17:23
value = os.getenv("GALILEO_LUNA_AUTH_MODE")
if value is None or value.strip() == "":
return None
warnings.warn(

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warnings.warn(..., DeprecationWarning) is filtered out by default in production Python, so an operator still relying on GALILEO_LUNA_AUTH_MODE likely never sees the notice. Consider also emitting logger.warning(...) so the deprecation actually surfaces in logs (the class already logs the selected auth mode right after).

@abhinav-galileo abhinav-galileo marked this pull request as draft June 12, 2026 18:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants