@plainconceptsplatform/workflows 0.16.4 → 0.19.2

package/loops/workflows/agent-release.md

@@ -29,8 +29,8 @@ on:
         type: string
         default: "auto"
 
-runs-on: agents-arc
-runs-on-slim: agents-arc
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -98,7 +98,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: write
     steps:
@@ -205,7 +205,7 @@ jobs:
     if: >
       always() &&
       (needs.agent.result != 'success' || needs.safe_outputs.result != 'success')
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     steps:

package/loops/workflows/agent-triage.md

@@ -70,9 +70,41 @@ on:
         required: false
         type: string
         default: first
+  # The gate job that the top-level `if:` reads. gh-aw folds that `if:` into the generated
+  # activation job but gives activation no dependency on the job, so the reference resolves
+  # to '' and the clause is false -- the agent would never run. The package's own validator
+  # catches it after compilation; this is the line it asks for, the same one the merge gate
+  # uses for protected_changes.
+  needs: [still_open]
 
 jobs:
+  # A route dispatched while the issue was open must not execute after it has been closed. The
+  # classifier can only see `github.event.issue.state`, which is the state when the event fired
+  # and is absent on a workflow_dispatch, and this fleet queues for a runner for ten minutes and
+  # more. Numa #659 was closed one second after a comment dispatched refine; the run reached
+  # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
+  # and gate both the reservation and the agent on it.
+  still_open:
+    runs-on: agents-arc
+    permissions:
+      contents: read
+      issues: read
+    outputs:
+      open: ${{ steps.state.outputs.open }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Read the issue state
+        id: state
+        uses: ./.github/actions/require-open-issue
+        with:
+          token: ${{ github.token }}
+          issue-number: ${{ inputs.issue-number }}
   reserve:
+    needs: [still_open]
+    if: needs.still_open.outputs.open == 'true'
     runs-on: agents-arc
     permissions:
       contents: read
@@ -296,7 +328,7 @@ jobs:
             ${{ env.INCOMPLETE_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 
-if: inputs.issue-number != ''
+if: inputs.issue-number != '' && needs.still_open.outputs.open == 'true'
 
 runs-on: agents-arc
 runs-on-slim: agents-arc

package/loops/workflows/work-router.yml

@@ -242,7 +242,7 @@ permissions:
 jobs:
   # Public repositories must check repository permission before an event can start a model.
   authorize:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -345,7 +345,7 @@ jobs:
           esac
 
   classify:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -402,7 +402,7 @@ jobs:
   check-implement-pr:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 3
     permissions:
       contents: read
@@ -493,7 +493,7 @@ jobs:
   dispatch-triage:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       actions: write
@@ -621,7 +621,7 @@ jobs:
     if: >
       needs.classify.outputs.route == 'bot-approve' &&
         (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       actions: write
@@ -678,7 +678,7 @@ jobs:
           github.event.pull_request.head.repo.full_name == github.repository
         )
       )
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     permissions:
       contents: read
@@ -871,7 +871,7 @@ jobs:
   reconcile-bot-pr-runs:
     needs: classify
     if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -1079,12 +1079,26 @@ jobs:
                 -f "inputs[ci-conclusion]=$ci_conclusion" \
                 -f "inputs[ci-run-id]=$ci_run_id" \
                 -f "inputs[attempts_so_far]=$attempts"
+
+              # One gate per tick, because that is all the concurrency group can hold. The gate
+              # runs in `merge-belt`, and GitHub keeps only the most recent *pending* run in a
+              # group -- `cancel-in-progress: false` does not change that, it only protects a run
+              # that has already started. A tick that dispatched three gates therefore ran the
+              # last and silently cancelled the other two: no comment, no attempt recorded, and
+              # nothing on the pull request to say it had been passed over. Seen on Pliny-Bot,
+              # where dispatching a gate for PR #135 cancelled the one queued for PR #136.
+              #
+              # Stopping here loses nothing: every pull request eligible this tick is still
+              # eligible next tick, and a run that never started consumes no attempt. The belt
+              # now does one thing and says so, instead of appearing to start work it discarded.
+              echo "One gate dispatched this tick; any other eligible pull request waits for the next one."
+              break
             done
 
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: audit-close
@@ -1109,7 +1123,7 @@ jobs:
   cleanup-artifacts:
     needs: classify
     if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: cleanup-artifacts
@@ -1133,7 +1147,7 @@ jobs:
   housekeeping:
     needs: classify
     if: needs.classify.outputs.route == 'housekeeping' && !github.event.repository.fork
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: housekeeping
@@ -1172,7 +1186,7 @@ jobs:
   validate:
     needs: classify
     if: needs.classify.outputs.route == 'validate'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     permissions:
       contents: read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.16.4",
+  "version": "0.19.2",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -26,7 +26,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc --project tsconfig.build.json",
+    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
     "test": "vitest run",
     "typecheck": "tsc --noEmit --project tsconfig.json",
     "release": "pnpm build && pnpm test && npm publish --access public",