@plainconceptsplatform/workflows 0.1.0

package/loops/workflows/shared/opencode-ci.md

@@ -0,0 +1,26 @@
+---
+env:
+  AGENTMEMORY_VERSION: "0.9.28"
+  CODEGRAPH_VERSION: "1.5.0"
+  RTK_VERSION: "0.44.1"
+  RTK_SHA256: "986f29704469b3d1051e2474105c6c75ab8b73651068dcd61612c1fb3938ad95"
+description: Shared CI setup for Platform agent workflows.
+
+pre-agent-steps:
+  - name: Create agent scratch directory
+    run: mkdir -p .opencode/.tmp
+  - name: Activate the pnpm version package.json pins
+    run: |
+      set -euo pipefail
+      corepack enable
+      corepack prepare --activate
+      pnpm --version
+  - name: Cache the pnpm store
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.local/share/pnpm/store
+      key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+      restore-keys: pnpm-store-${{ runner.os }}-
+  - name: Install workspace dependencies
+    run: pnpm install --frozen-lockfile
+---

package/loops/workflows/shared/platform-defaults.md

@@ -0,0 +1,14 @@
+---
+env: {}
+description: Shared network and safe-output defaults for catalog agent workflows.
+
+network:
+  allowed:
+    - defaults
+    - forge.plainconcepts.com
+    - node
+    - github
+
+safe-outputs:
+  threat-detection: false
+---

package/loops/workflows/work-router.yml

@@ -0,0 +1,391 @@
+name: "All Work Router"
+
+# Owns every repository automation trigger. Classifies each event into exactly one route,
+# then calls at most one worker or runs one deterministic job. No model runs here.
+
+# GitHub titles an issue-triggered run with the issue title, so every run on one issue reads
+# the same. Name it after the event instead. This is evaluated before any job, so it can
+# describe the trigger but not the route the classifier picks.
+run-name: >-
+  ${{ github.event_name == 'issues'
+  && format('{0} label on #{1} by {2}', github.event.label.name, github.event.issue.number, github.actor)
+  || github.event_name == 'issue_comment'
+  && format('comment on #{0} by {1}', github.event.issue.number, github.actor)
+  || github.event_name == 'pull_request_review'
+  && format('review on PR #{0} by {1}', github.event.pull_request.number, github.actor)
+  || github.event_name == 'pull_request_review_comment'
+  && format('review comment on PR #{0} by {1}', github.event.pull_request.number, github.actor)
+  || github.event_name == 'pull_request_target'
+  && format('PR #{0} {1} by {2}', github.event.pull_request.number, github.event.action, github.actor)
+  || github.event_name == 'workflow_run'
+  && format('CI {0} on {1}', github.event.workflow_run.conclusion, github.event.workflow_run.head_branch)
+  || github.event_name == 'workflow_dispatch'
+  && format('dispatch: {0}', inputs.operation)
+  || github.event_name == 'schedule'
+  && format('schedule {0}', github.event.schedule)
+  || github.event_name }}
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+  workflow_run:
+    workflows: ["App: CI"]
+    types: [completed]
+    branches:
+      - "fix/*"
+      - "bugfix/*"
+      - "feature/*"
+      - "bot/*"
+      - "patch/*"
+      - "hotfix/*"
+
+  # Cron to route mapping lives in .github/actions/classify-route/classify-route.sh.
+  schedule:
+    - cron: "17 1 * * 1"
+    - cron: "43 3 * * *"
+    - cron: "0 6 * * *"
+    - cron: "0 */2 * * *"
+    - cron: "29 7 * * *"
+
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: "Operation to run"
+        required: true
+        type: choice
+        options:
+          - refine
+          - implement
+          - direct
+          - apply-review
+          - merge-gate
+          - audit
+          - propose
+          - audit-close
+          - cleanup-artifacts
+          - stale-recovery
+          - validate
+      issue-number:
+        description: "Issue number (required for refine / implement / direct)"
+        required: false
+        type: string
+      pr-number:
+        description: "Pull request number (required for apply-review / merge-gate)"
+        required: false
+        type: string
+      mode:
+        description: "Refine mode: first or rerefine"
+        required: false
+        type: choice
+        options:
+          - first
+          - rerefine
+      ci-conclusion:
+        description: "CI conclusion for merge-gate dispatch"
+        required: false
+        type: choice
+        options:
+          - success
+          - failure
+          - action_required
+      ci-run-id:
+        description: "CI workflow run ID for merge-gate dispatch"
+        required: false
+        type: string
+      trigger-kind:
+        description: "Audit trigger: scheduled or manual"
+        required: false
+        type: choice
+        options:
+          - manual
+          - scheduled
+
+permissions:
+  contents: read
+
+jobs:
+  # Public repositories must check repository permission before an event can start a model.
+  authorize:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      trusted: ${{ steps.check.outputs.trusted }}
+    steps:
+      - name: Check the actor can start an agent
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+          EVENT: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+
+          # Events with no human actor. `schedule` and `workflow_run` are the fleet triggering
+          # itself; `workflow_dispatch` is already restricted by GitHub to write and above.
+          case "$EVENT" in
+            schedule | workflow_run | workflow_dispatch)
+              echo "trusted=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$EVENT has no untrusted actor."
+              exit 0
+              ;;
+          esac
+
+          if [ "$ACTOR" = "github-actions[bot]" ]; then
+            echo "trusted=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+
+          case "$permission" in
+            admin | maintain | write)
+              echo "trusted=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has $permission permission."
+              ;;
+            *)
+              echo "trusted=false" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has '$permission' permission on this repository. No agent will run."
+              ;;
+          esac
+
+  classify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      route: ${{ steps.route.outputs.route }}
+      issue-number: ${{ steps.route.outputs.issue-number }}
+      pr-number: ${{ steps.route.outputs.pr-number }}
+      linked-issue: ${{ steps.route.outputs.linked-issue }}
+      ci-conclusion: ${{ steps.route.outputs.ci-conclusion }}
+      ci-run-id: ${{ steps.route.outputs.ci-run-id }}
+      refine-mode: ${{ steps.route.outputs.refine-mode }}
+      direct-mode: ${{ steps.route.outputs.direct-mode }}
+      trigger-kind: ${{ steps.route.outputs.trigger-kind }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Classify event into a single route
+        id: route
+        uses: ./.github/actions/classify-route
+        with:
+          token: ${{ github.token }}
+
+  call-refine:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'refine' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-refine.lock.yml
+    concurrency:
+      group: refine-${{ needs.classify.outputs.issue-number }}
+      cancel-in-progress: false
+    # write-all, not a narrower map: every worker's agent job declares `permissions: read-all`,
+    # which requests read on every scope. A caller granting less cannot satisfy it, and GitHub
+    # rejects the call with a startup failure before any job is created. The real boundary is the
+    # worker's own read-all plus safe-outputs, not this grant.
+    permissions: write-all
+    with:
+      issue-number: ${{ needs.classify.outputs.issue-number }}
+      mode: ${{ needs.classify.outputs.refine-mode }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  call-implement:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-implement.lock.yml
+    concurrency:
+      group: write-pipeline-${{ needs.classify.outputs.issue-number }}
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      issue-number: ${{ needs.classify.outputs.issue-number }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  call-direct:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'direct' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-direct.lock.yml
+    concurrency:
+      group: direct-${{ needs.classify.outputs.issue-number }}
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      issue-number: ${{ needs.classify.outputs.issue-number }}
+      mode: ${{ needs.classify.outputs.direct-mode }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  call-apply-review:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'apply-review' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-apply-review.lock.yml
+    concurrency:
+      group: pr-feedback-${{ needs.classify.outputs.pr-number }}
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      pr-number: ${{ needs.classify.outputs.pr-number }}
+      linked-issue: ${{ needs.classify.outputs.linked-issue }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  # Shares the write-pipeline group with implement so the two never race on one issue.
+  # Falls back to the pull request number only when the closing issue cannot be resolved.
+  call-merge-gate:
+    needs: classify
+    if: needs.classify.outputs.route == 'merge-gate'
+    uses: ./.github/workflows/agent-merge-gate.lock.yml
+    concurrency:
+      group: write-pipeline-${{ needs.classify.outputs.linked-issue || format('pr-{0}', needs.classify.outputs.pr-number) }}
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      pr-number: ${{ needs.classify.outputs.pr-number }}
+      linked-issue: ${{ needs.classify.outputs.linked-issue }}
+      ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
+      ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  call-audit:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit'
+    uses: ./.github/workflows/agent-audit.lock.yml
+    concurrency:
+      group: audit
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      trigger-kind: ${{ needs.classify.outputs.trigger-kind }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  call-propose:
+    needs: classify
+    if: needs.classify.outputs.route == 'propose'
+    uses: ./.github/workflows/agent-propose.lock.yml
+    concurrency:
+      group: propose
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      trigger-kind: ${{ needs.classify.outputs.trigger-kind }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+
+  audit-close:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit-close'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: audit-close
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/audit-close
+        with:
+          token: ${{ github.token }}
+
+  cleanup-artifacts:
+    needs: classify
+    if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: cleanup-artifacts
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/cleanup-artifacts
+        with:
+          token: ${{ github.token }}
+          artifact-retention-days: ${{ vars.ARTIFACT_RETENTION_DAYS }}
+
+  stale-recovery:
+    needs: classify
+    if: needs.classify.outputs.route == 'stale-recovery'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: stale-recovery
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+      actions: write
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/stale-recovery
+        with:
+          token: ${{ github.token }}
+          stale-threshold-hours: ${{ vars.STALE_THRESHOLD_HOURS }}
+
+  validate:
+    needs: classify
+    if: needs.classify.outputs.route == 'validate'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/verify-route-matrix
+      - uses: ./.github/actions/verify-composite-actions

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@plainconceptsplatform/workflows",
+  "version": "0.1.0",
+  "description": "Install and update Platform GitHub agentic workflows.",
+  "type": "module",
+  "bin": {
+    "platform-workflows": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "loops"
+  ],
+  "scripts": {
+    "build": "tsc --project tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit --project tsconfig.json",
+    "release": "pnpm build && pnpm test && npm publish --access public",
+    "prepack": "node ./scripts/copy-loops.mjs"
+  },
+  "engines": {
+    "node": ">=20.19"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.0.0"
+  }
+}