@cxi-lmai/ci-agent-platform 3.0.0

package/payload/ci-templates/github/claude-pipeline.yml

@@ -0,0 +1,141 @@
+# =============================================================================
+# Claude ci-agent-platform: GitHub Actions workflow (tier 1, review + review-fix)
+# =============================================================================
+# Copy this to .github/workflows/claude-pipeline.yml in your project. It mirrors
+# the GitLab review and review-fix jobs. The test-fix job lives in a separate
+# workflow (claude-test-fix.yml) because it hangs off YOUR test workflow.
+#
+# Configuration:
+#   - Repository/org VARIABLES (Settings > Variables): PIPE_TARGET_BRANCH,
+#     PIPE_LABEL_WIP, PIPE_LABEL_STUCK, PIPE_BOT_USER, PIPE_VERIFY_CMD, etc.
+#     Any PIPE_ variable overrides the defaults baked into the scripts.
+#   - SECRETS (Settings > Secrets): ANTHROPIC_API_KEY, and PIPE_BOT_TOKEN
+#     (a bot Personal Access Token). The default GITHUB_TOKEN cannot re-trigger
+#     workflows on its own push, so the fix loop needs a PAT to re-run review.
+#   - Vendor the ci-agent-platform repository's ci-templates/scripts/ into your
+#     repo (see its ci-templates/github/README.md), path set by
+#     PIPE_SCRIPTS_DIR below.
+#
+# on_failure mapping: GitLab's on_failure is `needs` + `if: failure()` here.
+# =============================================================================
+
+name: claude-pipeline
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  PIPE_SCRIPTS_DIR: ".claude-pipeline/scripts"
+  PIPE_PLATFORM: "github"
+  PIPE_CONFIG_PATH: ".claude/pipeline-config.md"
+  PIPE_CONTEXT_DIR: "build/pipeline"
+  PIPE_TARGET_BRANCH: ${{ vars.PIPE_TARGET_BRANCH || github.event.repository.default_branch || 'main' }}
+  PIPE_LABEL_WIP: ${{ vars.PIPE_LABEL_WIP || 'pipe-wip' }}
+  PIPE_LABEL_STUCK: ${{ vars.PIPE_LABEL_STUCK || 'pipe-stuck' }}
+  PIPE_BOT_USER: ${{ vars.PIPE_BOT_USER || '' }}
+  PIPE_VERIFY_CMD: ${{ vars.PIPE_VERIFY_CMD || '' }}
+  PIPE_COMPILE_CMD: ${{ vars.PIPE_COMPILE_CMD || '' }}
+  PIPE_FIX_LOOP_CAP: ${{ vars.PIPE_FIX_LOOP_CAP || '2' }}
+  PIPE_COMMIT_REVIEWFIX: ${{ vars.PIPE_COMMIT_REVIEWFIX || 'Fix review findings' }}
+  PIPE_GIT_NAME: ${{ vars.PIPE_GIT_NAME || 'Pipeline Bot' }}
+  PIPE_GIT_EMAIL: ${{ vars.PIPE_GIT_EMAIL || 'bot@pipeline.ci' }}
+  PIPE_MODEL_REVIEW: ${{ vars.PIPE_MODEL_REVIEW || 'sonnet' }}
+  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'sonnet' }}
+  PIPE_AGENT_ENV_ALLOWLIST: ${{ vars.PIPE_AGENT_ENV_ALLOWLIST || '' }}
+  # Runtime mapping onto the PIPE_ names the scripts read.
+  PIPE_REPO: ${{ github.repository }}
+  PIPE_PROJECT_PATH: ${{ github.repository }}
+  PIPE_SERVER_HOST: "github.com"
+  PIPE_MR_IID: ${{ github.event.pull_request.number }}
+  PIPE_SOURCE_BRANCH: ${{ github.event.pull_request.head.ref }}
+  PIPE_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+  PIPE_PREV_HEAD_SHA: ${{ github.event.before }}
+
+jobs:
+  review:
+    # Only non-draft PRs targeting the integration branch.
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.base.ref == (vars.PIPE_TARGET_BRANCH || github.event.repository.default_branch || 'main')
+    # One review at a time per PR (finding P5): a coder-created PR emits an
+    # `opened` event immediately followed by a `labeled` event (GitHub cannot
+    # attach labels at PR creation), which used to run two identical reviews.
+    # The newer event cancels the stale run. Job-level on purpose: review-fix
+    # must never be cancelled mid-push. The coder also creates its PRs
+    # draft-first (see _ghi_pr_create), so this is a second line of defence.
+    concurrency:
+      group: claude-review-pr-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    runs-on: ubuntu-latest
+    # Hard wall-clock cap on API spend if a claude session hangs or loops.
+    timeout-minutes: 15
+    outputs:
+      has_bugs: ${{ steps.gate.outputs.has_bugs }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          token: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+      - name: Install claude-code
+        run: command -v claude >/dev/null 2>&1 || npm install -g @anthropic-ai/claude-code
+      - name: Run review
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GH_TOKEN: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          PIPE_NO_GATE: "1"            # the gate step below owns the exit code
+        run: bash "$PIPE_SCRIPTS_DIR/review.sh"
+      - name: Gate on the verdict
+        id: gate
+        if: always()
+        run: |
+          HAS_BUGS=$(grep -E '^REVIEW_HAS_BUGS=' "$PIPE_CONTEXT_DIR/review.env" | cut -d= -f2 || echo false)
+          echo "has_bugs=${HAS_BUGS:-false}" >> "$GITHUB_OUTPUT"
+          if [ "${HAS_BUGS:-false}" = "true" ]; then
+            echo "Review found confirmed bugs, failing the check"
+            exit 1
+          fi
+      - name: Upload metrics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: review-metrics
+          path: ${{ env.PIPE_CONTEXT_DIR }}/metrics/
+          if-no-files-found: ignore
+
+  review-fix:
+    needs: review
+    # Runs when review flagged bugs (its job failed / output true) on a wip PR.
+    if: >-
+      always() &&
+      needs.review.outputs.has_bugs == 'true' &&
+      contains(github.event.pull_request.labels.*.name, vars.PIPE_LABEL_WIP || 'pipe-wip')
+    runs-on: ubuntu-latest
+    # Hard wall-clock cap on API spend if a claude session hangs or loops.
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          fetch-depth: 0
+          token: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+      - name: Install claude-code
+        run: command -v claude >/dev/null 2>&1 || npm install -g @anthropic-ai/claude-code
+      - name: Run review-fix
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GH_TOKEN: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          REVIEW_HAS_BUGS: "true"
+        run: bash "$PIPE_SCRIPTS_DIR/review-fix.sh"
+      - name: Upload metrics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: review-fix-metrics
+          path: ${{ env.PIPE_CONTEXT_DIR }}/metrics/
+          if-no-files-found: ignore

package/payload/ci-templates/github/claude-test-fix.yml

@@ -0,0 +1,104 @@
+# =============================================================================
+# Claude ci-agent-platform: GitHub Actions test-fix (tier 1)
+# =============================================================================
+# Copy to .github/workflows/claude-test-fix.yml. It hangs off YOUR test workflow:
+# when that workflow fails on a pull request, this one resolves the PR, downloads
+# the test artifacts, and runs the /fix-tests skill.
+#
+# REQUIRED EDIT: set `workflows:` below to the exact `name:` of your test
+# workflow, and make that workflow upload its test reports / coverage signal as
+# an artifact named `test-reports` (or change PIPE_TEST_ARTIFACT here).
+#
+# Alternative (simpler) wiring: instead of this workflow, add a test-fix JOB to
+# your own test workflow with `needs: [test]` and `if: ${{ failure() }}`, then
+# run the same script. Use that if you prefer everything in one workflow. See the
+# github/README.md note. This workflow_run version keeps the ci-agent-platform
+# repository's CI out of your test workflow file entirely.
+#
+# Limitation: github.event.workflow_run.pull_requests is only populated for
+# same-repo PRs. Fork PRs will be skipped (this is a GitHub security boundary).
+# =============================================================================
+
+name: claude-test-fix
+
+on:
+  workflow_run:
+    workflows: ["CI"]                  # <-- set to your test workflow's name
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: read
+
+env:
+  PIPE_SCRIPTS_DIR: ".claude-pipeline/scripts"
+  PIPE_PLATFORM: "github"
+  PIPE_CONFIG_PATH: ".claude/pipeline-config.md"
+  PIPE_CONTEXT_DIR: "build/pipeline"
+  PIPE_TARGET_BRANCH: ${{ vars.PIPE_TARGET_BRANCH || github.event.repository.default_branch || 'main' }}
+  PIPE_LABEL_WIP: ${{ vars.PIPE_LABEL_WIP || 'pipe-wip' }}
+  PIPE_LABEL_STUCK: ${{ vars.PIPE_LABEL_STUCK || 'pipe-stuck' }}
+  PIPE_BOT_USER: ${{ vars.PIPE_BOT_USER || '' }}
+  PIPE_VERIFY_CMD: ${{ vars.PIPE_VERIFY_CMD || '' }}
+  PIPE_COMPILE_CMD: ${{ vars.PIPE_COMPILE_CMD || '' }}
+  PIPE_TEST_REPORT_GLOB: ${{ vars.PIPE_TEST_REPORT_GLOB || '' }}
+  PIPE_COVERAGE_SIGNAL: ${{ vars.PIPE_COVERAGE_SIGNAL || '' }}
+  PIPE_FIX_LOOP_CAP: ${{ vars.PIPE_FIX_LOOP_CAP || '2' }}
+  PIPE_COMMIT_TESTFIX: ${{ vars.PIPE_COMMIT_TESTFIX || 'Fix test errors' }}
+  PIPE_COMMIT_COVERAGE: ${{ vars.PIPE_COMMIT_COVERAGE || 'Add coverage tests' }}
+  PIPE_GIT_NAME: ${{ vars.PIPE_GIT_NAME || 'Pipeline Bot' }}
+  PIPE_GIT_EMAIL: ${{ vars.PIPE_GIT_EMAIL || 'bot@pipeline.ci' }}
+  PIPE_MODEL_CODE: ${{ vars.PIPE_MODEL_CODE || 'sonnet' }}
+  PIPE_AGENT_ENV_ALLOWLIST: ${{ vars.PIPE_AGENT_ENV_ALLOWLIST || '' }}
+  PIPE_TEST_ARTIFACT: ${{ vars.PIPE_TEST_ARTIFACT || 'test-reports' }}
+  PIPE_REPO: ${{ github.repository }}
+  PIPE_PROJECT_PATH: ${{ github.repository }}
+  PIPE_SERVER_HOST: "github.com"
+  PIPE_SOURCE_BRANCH: ${{ github.event.workflow_run.head_branch }}
+  PIPE_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+
+jobs:
+  test-fix:
+    if: >-
+      github.event.workflow_run.conclusion == 'failure' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.pull_requests[0] != null
+    runs-on: ubuntu-latest
+    # Hard wall-clock cap on API spend if a claude session hangs or loops.
+    timeout-minutes: 20
+    steps:
+      - name: Resolve the pull request
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+        run: |
+          echo "number=${{ github.event.workflow_run.pull_requests[0].number }}" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_branch }}
+          fetch-depth: 0
+          token: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+      - name: Download test artifacts from the failed run
+        uses: actions/download-artifact@v4
+        with:
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          name: ${{ env.PIPE_TEST_ARTIFACT }}
+          path: .
+        continue-on-error: true
+      - name: Install claude-code
+        run: command -v claude >/dev/null 2>&1 || npm install -g @anthropic-ai/claude-code
+      - name: Run test-fix
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GH_TOKEN: ${{ secrets.PIPE_BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          PIPE_MR_IID: ${{ steps.pr.outputs.number }}
+        run: bash "$PIPE_SCRIPTS_DIR/test-fix.sh"
+      - name: Upload metrics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-fix-metrics
+          path: ${{ env.PIPE_CONTEXT_DIR }}/metrics/
+          if-no-files-found: ignore

package/payload/ci-templates/scripts/code.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# Runner for the `code` job (issue -> code loop, coder side). Triggered by the
+# orchestrator with CODER_ISSUE + CODER_BRANCH. Checks out the feature branch,
+# runs the /implement-issue skill (which delegates to the coder agent and drafts
+# the MR/PR body), then pushes and opens the MR/PR, or handles the no-commits
+# case. All reasoning is in the skill; this script does token and git work.
+#
+# Generalized from a single-project original: the delegation prompt and the
+# summary generation moved into the skill, platform calls go through
+# lib/issue-loop.sh, and the coder runs non-root via pipe_run_claude.
+#
+# SECURITY NOTE: the coder agent runs with --dangerously-skip-permissions (it
+# must edit files and run the build unattended). This is a deliberate
+# choice for trusted inputs. Run only on an isolated ephemeral runner and, where
+# the image allows, as an unprivileged user (see pipe_run_claude). This does not
+# make arbitrary public issue or contributor content safe; see the README trust
+# boundary. Do not run this job on a shared or privileged machine.
+set -e
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/pipeline-common.sh
+source "$SCRIPT_DIR/lib/pipeline-common.sh"
+# shellcheck source=lib/issue-loop.sh
+source "$SCRIPT_DIR/lib/issue-loop.sh"
+pipe_defaults
+
+# --- 1. Validate inputs -----------------------------------------------------
+[[ "${CODER_ISSUE:-}" =~ ^[0-9]+$ ]]           || { echo "ERROR: CODER_ISSUE is not a valid issue number"; exit 1; }
+[[ "${CODER_BRANCH:-}" =~ ^[a-z0-9][a-z0-9-]*$ ]] || { echo "ERROR: CODER_BRANCH contains invalid characters"; exit 1; }
+export PIPE_ISSUE_IID="$CODER_ISSUE"
+
+# --- 2. Git identity and feature branch -------------------------------------
+pipe_git_identity
+git fetch origin "$PIPE_TARGET_BRANCH"
+git checkout -B "$CODER_BRANCH" "origin/$PIPE_TARGET_BRANCH"
+
+# --- 3. Fetch the issue and build the coder input ---------------------------
+META=$(issue_meta "$CODER_ISSUE")
+ISSUE_TITLE=$(echo "$META" | jq -r '.title // ""')
+ISSUE_DESC=$(echo "$META"  | jq -r '.description // "(no description)"')
+ISSUE_LABELS=$(echo "$META" | jq -r '.labels // ""')
+pipe_log "Implementing #$CODER_ISSUE: $ISSUE_TITLE"
+
+{
+  echo "# Issue #$CODER_ISSUE"
+  echo
+  echo "Title: $ISSUE_TITLE"
+  echo
+  echo "## Description"
+  echo "$ISSUE_DESC"
+} > "$PIPE_CONTEXT_DIR/coder-input.md"
+
+# --- 4. Run the implement-issue skill (delegates to the coder agent) --------
+rm -f "$PIPE_CONTEXT_DIR/implement.env" "$PIPE_CONTEXT_DIR/mr-summary.md"
+pipe_run_claude coder "/implement-issue" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_CODE" < /dev/null
+
+# --- 5. Authoritative commit count (the runner owns the push decision) -------
+COMMITS=$(git rev-list "origin/$PIPE_TARGET_BRANCH..HEAD" --count 2>/dev/null || echo 0)
+
+# --- 6. No commits: comment on the issue and mark it stuck ------------------
+# issue_implemented is emitted only when commits exist (E2E finding N-7:
+# emitting it before this check produced the metric for stuck runs too).
+if [ "${COMMITS:-0}" = "0" ]; then
+  pipe_log "Coder made no commits, marking #$CODER_ISSUE stuck"
+  pipe_metric_event coder issue_stuck \
+    "$(jq -n --argjson i "$CODER_ISSUE" '{issue_iid: $i, reason: "no_commits"}')"
+  # The agent's own account of why it stopped is the most useful thing in a
+  # stuck comment, and it was being read and then dropped.
+  EXPL=$(head -c 3000 "$PIPE_CONTEXT_DIR/implement.env" 2>/dev/null || true)
+  issue_comment "$CODER_ISSUE" "🤖 **Coder agent made no commits for issue #$CODER_ISSUE.**
+
+The implementation agent ran but produced no commits. A human needs to take over.
+${EXPL:+
+What the agent reported before stopping:
+
+\`\`\`
+$EXPL
+\`\`\`
+}
+${PIPE_JOB_URL:+CI job: $PIPE_JOB_URL}"
+  issue_set_labels "$CODER_ISSUE" "$PIPE_LABEL_STUCK" "$PIPE_LABEL_READY,$PIPE_LABEL_WIP"
+  exit 0
+fi
+
+pipe_metric_event coder issue_implemented \
+  "$(jq -n --argjson i "$CODER_ISSUE" --argjson c "${COMMITS:-0}" '{issue_iid: $i, commits: $c}')"
+
+# --- 7. Push the branch -----------------------------------------------------
+git push -u origin "$CODER_BRANCH"
+
+# --- 8. Open the MR/PR ------------------------------------------------------
+SUMMARY=$(head -c 6000 "$PIPE_CONTEXT_DIR/mr-summary.md" 2>/dev/null || true)
+[ -z "$SUMMARY" ] && SUMMARY="Implemented by the ci-agent-platform coder agent."
+
+# Inherit the issue labels onto the MR/PR: drop the ready label, add wip.
+MR_LABELS=$( { echo "$ISSUE_LABELS" | tr ',' '\n' | grep -vxF "$PIPE_LABEL_READY" | grep -v '^$'; echo "$PIPE_LABEL_WIP"; } \
+  | awk '!seen[$0]++' | paste -sd, - )
+
+MR_TITLE="Resolve \"$ISSUE_TITLE\""
+MR_DESC="Closes #$CODER_ISSUE
+
+$SUMMARY
+
+---
+🤖 Implemented by the ci-agent-platform coder"
+
+# Ensure the MR/PR labels exist (repo/project may not have them yet).
+issue_ensure_label "$PIPE_LABEL_WIP" "#3498DB" "Pipeline is working on this change"
+
+MR_URL=$(mr_create "$CODER_BRANCH" "$PIPE_TARGET_BRANCH" "$MR_TITLE" "$MR_DESC" "$MR_LABELS")
+if [ -n "$MR_URL" ]; then
+  pipe_log "Opened MR/PR: $MR_URL"
+else
+  pipe_log "WARNING: MR/PR creation returned no URL (it may already exist for this branch)"
+fi