[rekram1-node]

Groq had no sync module, so prices and limits only changed when someone noticed. Its /v1/models list (needs a key) has pricing, input_cache_read, context_window and max_completion_tokens, so I added an update-only module modeled on Morph.

It only touches priced text models that already have a file: prices, cache read rate and the two limits. Reasoning efforts, service tiers, Responses API tables and web search fees stay as authored. New remote IDs open missing-model issues (skipCreates), nothing is deleted when a model drops out of the list, and speech, transcription and unpriced models (whisper, orpheus, allam) are skipped.

The list gives every model a cache rate at half its input price, including models that Groq's prompt caching page says don't cache (only the gpt-oss models do: https://console.groq.com/docs/prompt-caching). So the sync only updates a cache price the file already has and never adds one. A dry run against the live list is now 0 changes.

The key comes from AWS Secrets Manager as models.dev/release/GROQ_API_KEY, like the other syncs. That secret has to exist before this merges: the fetch step fails when a listed secret is missing, which would stop the whole sync run, not just Groq.

I added a test file and a sync.md section. validate passes.

Source: https://api.groq.com/openai/v1/models

[github-actions]

Action items

• [medium] [possible mistake] providers/groq/models/qwen/qwen3.8-27b.toml:35 - Check: A cache read price must be consistent with the file's cache capability, per AGENTS.md ("A kind that isn't listed isn't supported"). Why: The diff adds cache = { read = 0.4 } to a model whose [capabilities] declares no cache support, so the file now bills cached reads on a model it says doesn't cache. Every other Groq model with a cache price (gpt-oss-120b, gpt-oss-20b, gpt-oss-safeguard-20b) declares cache = { implicit = { ttl = ["2h"] } } and cites the supported-models list at https://console.groq.com/docs/prompt-caching — a page never consulted for qwen3.8. The sync's gate (generates() on supported_features tools/reasoning, packages/core/src/sync/providers/groq.ts:152) is an invented heuristic with no cited Groq documentation behind it, and the PR's own prompt-guard rationale — a rate at exactly half the input price is not necessarily a caching claim — applies equally here, since 0.4 is exactly half of 0.8. Other sync modules (Vercel, Baseten) treat input_cache_read as evidence of caching and author the capability from it. Action: Verify qwen3.8-27b (and any model this sync will price) against Groq's prompt-caching supported-models page. If it caches, author the [capabilities] cache declaration in the file and cite the source in the header (as the gpt-oss files do), ideally deriving it in the sync from a real signal; if it doesn't, don't write the rate for it and narrow the gate.

• [medium] [possible mistake] .github/workflows/sync-models.yml:57 - Check: A new AWS Secrets Manager entry must exist before the workflow that reads it merges. Why: The Groq key is now fetched via aws-secretsmanager-get-secrets as models.dev/release/GROQ_API_KEY. That action fails the whole "Fetch secrets" step when a listed secret is missing (no ignore-if-not-found is set), and that step runs before any provider syncs — so until the secret exists, the six-hourly sync breaks for every provider, not just Groq. The PR body still describes the superseded repo-secret variant from the first commit (secrets.GROQ_API_KEY, "the Groq sync fails on its own and the other providers carry on"), which no longer matches the final diff and understates the blast radius. Action: Confirm models.dev/release/GROQ_API_KEY exists in AWS Secrets Manager before merge (or make the fetch tolerate a missing secret so only the Groq sync fails), and update the PR body's stale secret instructions.

[github-actions]

Action items

• [low] [possible mistake] .github/workflows/sync-models.yml:57 - Check: The PR description must match the merged workflow's credential source. Why: The body says the workflow reads ${{ secrets.GROQ_API_KEY }} and instructs a maintainer to add a GitHub repo secret, but the final diff (patch 2) fetches models.dev/release/GROQ_API_KEY from AWS Secrets Manager like the other providers. Following the body's instruction does nothing — the Groq sync would keep failing with "GROQ_API_KEY is required" — and if the AWS secret doesn't exist when this merges, the shared "Fetch secrets" step can fail for the whole job, not just Groq as the body claims. The body also still describes patch 1's one-line catalog change (qwen/qwen3.8-27b gains cache = { read = 0.4 }, "one added v1 field"), which patch 3 reverted, so the PR actually makes no catalog or v1 change — maintainers sign off v1 changes from this list. Action: Verify models.dev/release/GROQ_API_KEY exists in AWS Secrets Manager before merge (or have a maintainer create it), and update the PR body to describe the AWS secret path and the zero catalog/v1 diff of the final version.
• [low] [possible mistake] packages/core/src/sync/providers/groq.ts:64 (translateModel) - Check: Preservation of hand-authored MIME modality lists, as in the Morph module this is modeled on. Why: Morph's translateModel returns v2Set: { modalities } from context.v2 because "the v1 view reduces MIME types to generic kinds, which can factor a hand-authored format list away against the lab file" (morph.ts:76-81, with a dedicated test). The Groq module omits that guard: factorBaseModel drops the whole [modalities] override whenever a file's v1-reduced kinds equal its lab base's, and patchModelV2 then writes the file with no [modalities] table, silently replacing Groq's hand-authored format list (e.g. the image/bmp/image/tiff/image/heic set documented in providers/groq/models/qwen/qwen3.8-27b.toml:16) with lab inheritance. No current file triggers it (qwen3.8-27b differs from alibaba/qwen3.8-27b at the v1 level because Groq has no video), but any future or edited Groq file whose input kinds match the lab's while its exact formats differ would lose them on the first sync rewrite. Action: Add the same v2Set: { modalities } carry-through (and test) that morph.ts has, or document in the sync.md Groq notes why Groq files can never hit the collapse.

[github-actions]

Action items

• [medium] [possible mistake] .github/workflows/sync-models.yml:57 - Check: The new GROQ_API_KEY,models.dev/release/GROQ_API_KEY entry in the "Fetch secrets" step requires that secret to already exist in AWS Secrets Manager and be readable by the models.dev-release role. Why: The PR body itself states this secret "has to exist before this merges" and provides no evidence it has been created; the fetch step runs before any provider syncs, so a missing secret fails the job and halts the entire scheduled sync workflow (every provider, every 6 hours), not just Groq. Action: Before merging, create/confirm models.dev/release/GROQ_API_KEY in AWS Secrets Manager under the same policy as the other models.dev/release/* keys and note in the PR that it exists; without that confirmation this change breaks all sync automation on its first run.