@plainconceptsplatform/workflows 0.17.0 → 0.20.0

package/loops/actions/download-agent-output/action.yml

@@ -1,53 +1,53 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/download-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Download agent output
-description: Download the agent artifact and expose the output JSON and bundle paths.
-inputs:
-  artifact-name:
-    description: >-
-      Artifact name to download. gh-aw prefixes it with the value it derives from the
-      workflow's inputs, so a workflow_call worker must pass the activation job's
-      artifact_prefix output followed by "agent", not the bare name.
-    required: true
-outputs:
-  output-file:
-    description: Path to agent_output.json, or empty if not found.
-    value: ${{ steps.download.outputs.output-file }}
-  bundle-file:
-    description: Path to the git bundle, or empty if not found.
-    value: ${{ steps.download.outputs.bundle-file }}
-  item-count:
-    description: Number of items in the agent output.
-    value: ${{ steps.download.outputs.item-count }}
-runs:
-  using: composite
-  steps:
-    - name: Download agent artifact
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ inputs.artifact-name }}
-        path: agent-artifact
-    - name: Locate output and bundle
-      id: download
-      shell: bash
-      env:
-        ARTIFACT_NAME: ${{ inputs.artifact-name }}
-      run: |
-        set -euo pipefail
-        OUTPUT_FILE=""
-        BUNDLE_FILE=""
-        ITEM_COUNT="0"
-
-        if [ -f "agent-artifact/agent_output.json" ]; then
-          OUTPUT_FILE="agent-artifact/agent_output.json"
-          ITEM_COUNT=$(jq '.items | length' "$OUTPUT_FILE")
-          BUNDLE_FILE=$(ls agent-artifact/aw-*.bundle 2>/dev/null | head -1 || true)
-        else
-          echo "::error::Artifact '$ARTIFACT_NAME' contained no agent_output.json. Nothing the agent proposed will be applied."
-          exit 1
-        fi
-
-        echo "Artifact '$ARTIFACT_NAME' carries $ITEM_COUNT item(s)."
-
-        echo "output-file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
-        echo "bundle-file=$BUNDLE_FILE" >> "$GITHUB_OUTPUT"
-        echo "item-count=$ITEM_COUNT" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/download-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Download agent output
+description: Download the agent artifact and expose the output JSON and bundle paths.
+inputs:
+  artifact-name:
+    description: >-
+      Artifact name to download. gh-aw prefixes it with the value it derives from the
+      workflow's inputs, so a workflow_call worker must pass the activation job's
+      artifact_prefix output followed by "agent", not the bare name.
+    required: true
+outputs:
+  output-file:
+    description: Path to agent_output.json, or empty if not found.
+    value: ${{ steps.download.outputs.output-file }}
+  bundle-file:
+    description: Path to the git bundle, or empty if not found.
+    value: ${{ steps.download.outputs.bundle-file }}
+  item-count:
+    description: Number of items in the agent output.
+    value: ${{ steps.download.outputs.item-count }}
+runs:
+  using: composite
+  steps:
+    - name: Download agent artifact
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: agent-artifact
+    - name: Locate output and bundle
+      id: download
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.artifact-name }}
+      run: |
+        set -euo pipefail
+        OUTPUT_FILE=""
+        BUNDLE_FILE=""
+        ITEM_COUNT="0"
+
+        if [ -f "agent-artifact/agent_output.json" ]; then
+          OUTPUT_FILE="agent-artifact/agent_output.json"
+          ITEM_COUNT=$(jq '.items | length' "$OUTPUT_FILE")
+          BUNDLE_FILE=$(ls agent-artifact/aw-*.bundle 2>/dev/null | head -1 || true)
+        else
+          echo "::error::Artifact '$ARTIFACT_NAME' contained no agent_output.json. Nothing the agent proposed will be applied."
+          exit 1
+        fi
+
+        echo "Artifact '$ARTIFACT_NAME' carries $ITEM_COUNT item(s)."
+
+        echo "output-file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
+        echo "bundle-file=$BUNDLE_FILE" >> "$GITHUB_OUTPUT"
+        echo "item-count=$ITEM_COUNT" >> "$GITHUB_OUTPUT"

package/loops/actions/housekeeping/action.yml

@@ -75,6 +75,12 @@ runs:
           const names = (issue) => issue.labels.map((l) => (typeof l === 'string' ? l : l.name));
 
           const needsHuman = [];
+          // Gate telemetry. Every disposition the gate has ever posted is already on a pull
+          // request, marked, so the rate costs one extra listing rather than a store.
+          const dispositions = {};
+          const autoMerged = [];
+          const reverts = [];
+          const metricsWindowMs = 14 * 24 * 3600000;
           // Stalled work still inside its retry window. Separate from needsHuman because nobody
           // needs to act on it yet, and reported anyway because the alternative is silence: the
           // window is 6 hours and the budget is 3 attempts, so an issue that keeps stalling was
@@ -203,14 +209,45 @@ runs:
               ...context.repo, issue_number: pull.number, per_page: 100,
             });
             const verdict = [...comments].reverse().find((c) => (c.body ?? '').includes('<!-- agent-merge-gate -->') && (c.body ?? '').includes('**Verdict:**'));
-            const parsed = verdict ? /\*\*Verdict:\*\*\s*(\w+)/.exec(verdict.body)?.[1] : undefined;
-            if (parsed && parsed !== 'merge') {
+            const parsed = verdict ? /\*\*Verdict:\*\*\s*([\w-]+)/.exec(verdict.body)?.[1] : undefined;
+            // The gate's dispositions are auto-merge, human-review, owner-review and blocked.
+            // Only the first needs nobody. The character class has to allow the hyphen or every
+            // disposition reads as the bare word "auto" or "human" and nothing matches.
+            if (parsed) dispositions[parsed] = (dispositions[parsed] ?? 0) + 1;
+            if (parsed && parsed !== 'auto-merge') {
               needsHuman.push({ kind: 'pr-parked', pull, verdict: parsed, waited: age(verdict.created_at) });
             } else if (!verdict && age(pull.created_at) > stalePrMs) {
               needsHuman.push({ kind: 'pr-stale', pull, waited: age(pull.created_at) });
             }
           }
 
+          // 5b. The one number this whole gate exists to move. Open pull requests alone would
+          // only ever count the parked ones, because an auto-merged pull request closes within
+          // seconds of its verdict, so the rate would read as zero forever. Closed pull requests
+          // from the digest window are where the merges are.
+          for (const pull of await github.paginate(github.rest.pulls.list, {
+            ...context.repo, state: 'closed', sort: 'updated', direction: 'desc', per_page: 100,
+          })) {
+            if (age(pull.updated_at) > metricsWindowMs) break;
+            // A revert names the pull request it undoes, which is how an escaped defect is
+            // attributed back to the disposition that let it through. Reverts are frequently
+            // opened by a person, so this one line sits above the bot filter.
+            if (pull.merged_at) {
+              const undone = /revert .*#(\d+)/i.exec(pull.title ?? '');
+              if (undone) reverts.push(Number(undone[1]));
+            }
+            if (!isBot(pull.user?.login ?? '')) continue;
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo, issue_number: pull.number, per_page: 100,
+            });
+            const verdict = [...comments].reverse().find((c) => (c.body ?? '').includes('<!-- agent-merge-gate -->') && (c.body ?? '').includes('**Verdict:**'));
+            const parsed = verdict ? /\*\*Verdict:\*\*\s*([\w-]+)/.exec(verdict.body)?.[1] : undefined;
+            if (parsed) dispositions[parsed] = (dispositions[parsed] ?? 0) + 1;
+            // An auto-merge followed by a revert is the number that has to stay at zero while
+            // the rate climbs. Anything else is a rate bought with escaped defects.
+            if (parsed === 'auto-merge' && pull.merged_at) autoMerged.push(pull.number);
+          }
+
           // 6. One digest. Everything above either fixed itself or is listed here, so there is a
           // single place to look instead of four repositories and three label queries.
           // Audit reports nobody actioned. audit-close labels these `stale-audit` once they are
@@ -243,6 +280,21 @@ runs:
               `- #${entry.issue.number} · stalled ${hours(entry.waited)}h ago · attempt ${entry.attempts + 1} of ${maxRetries} due in ~${hours(entry.due)}h · ${entry.issue.title}`);
             return `\n### Retrying by itself, no action needed (${retrying.length})\n\n${rows.join('\n')}\n`;
           };
+          // The gate's own scoreboard. A digest that lists only what went wrong tells you
+          // nothing about whether the thing is getting better.
+          const gateSection = () => {
+            const total = Object.values(dispositions).reduce((a, b) => a + b, 0);
+            if (total === 0) return '';
+            const auto = dispositions['auto-merge'] ?? 0;
+            const rate = Math.round((auto / total) * 100);
+            const rows = Object.entries(dispositions)
+              .sort((a, b) => b[1] - a[1])
+              .map(([name, count]) => `- \`${name}\` · ${count}`);
+            const reverted = autoMerged.filter((number) => reverts.includes(number)).length;
+            return `\n### Merge gate, last ${metricsWindowMs / (24 * 3600000)} days\n\n` +
+              `**${rate}% auto-merged** (${auto} of ${total} dispositions).\n\n${rows.join('\n')}\n\n` +
+              `Auto-merged pull requests later reverted: ${reverted}.\n`;
+          };
           const body = [
             DIGEST_MARKER,
             `_Updated ${new Date().toISOString().slice(0, 16).replace('T', ' ')} UTC. This issue is rewritten by the housekeeping job; edits to it are lost._`,
@@ -251,6 +303,7 @@ runs:
             section('Stalled beyond the retry budget', ['retries-exhausted', 'no-work-label']),
             section('Audit reports nobody actioned', ['stale-audit']),
             retryingSection(),
+            gateSection(),
             needsHuman.length === 0 ? '\nNothing is waiting on a person right now.\n' : '',
             `\n---\n\nThis run retried ${retried} stalled issue(s) and made ${planned.length} change(s) in total.`,
           ].filter(Boolean).join('\n');

package/loops/actions/identify-gate-subject/action.yml

@@ -1,122 +1,134 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Identify gate subject
-description: Confirm the pull request is one we authored, resolve the issue it closes, and check that issue carries the required label.
-inputs:
-  token:
-    description: GitHub token with issues and pull-requests read access.
-    required: true
-  pr-number:
-    description: Pull request number to gate.
-    required: true
-  ci-conclusion:
-    description: Conclusion reported by the CI run that triggered this gate. If empty, fetches from the PR's latest CI run.
-    required: false
-    default: ''
-  linked-issue:
-    description: Issue the pull request closes, when the router already resolved it.
-    required: false
-    default: ''
-  require-label:
-    description: Label the closing issue must carry. Empty disables the check.
-    required: false
-    default: ''
-outputs:
-  found:
-    description: Whether a valid gate subject was found.
-    value: ${{ steps.identify.outputs.found }}
-  pr:
-    description: Pull request number.
-    value: ${{ steps.identify.outputs.pr }}
-  issue:
-    description: Issue number the pull request closes.
-    value: ${{ steps.identify.outputs.issue }}
-  conclusion:
-    description: CI conclusion, passed through unchanged or fetched from latest CI run.
-    value: ${{ steps.identify.outputs.conclusion }}
-  run-id:
-    description: CI run ID when fetched.
-    value: ${{ steps.identify.outputs.run-id }}
-runs:
-  using: composite
-  steps:
-    - name: Identify pull request and closing issue
-      id: identify
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        CONCLUSION: ${{ inputs.ci-conclusion }}
-        LINKED_ISSUE: ${{ inputs.linked-issue }}
-        REQUIRE_LABEL: ${{ inputs.require-label }}
-      run: |
-        set -euo pipefail
-
-        none() {
-          echo "found=false" >> "$GITHUB_OUTPUT"
-          echo "$1"
-          exit 0
-        }
-
-        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
-          --json state,author,closingIssuesReferences,body)"
-
-        [ "$(jq -r '.state' <<<"$pr")" = "OPEN" ] || none "PR #$PR_NUMBER is not open"
-
-        # Use GitHub's bot flag because App login formats differ across APIs.
-        if [ "$(jq -r '.author.is_bot' <<<"$pr")" != "true" ]; then
-          none "PR #$PR_NUMBER was authored by $(jq -r '.author.login' <<<"$pr"), a human."
-        fi
-
-        issue="$LINKED_ISSUE"
-
-        if [ -z "$issue" ]; then
-          issue="$(jq -r '.closingIssuesReferences[0].number // empty' <<<"$pr")"
-        fi
-
-        if [ -z "$issue" ]; then
-          issue="$(jq -r '.body // ""' <<<"$pr" |
-            grep -oiE '(close[sd]?|fixe?[sd]?|resolve[sd]?) +#[0-9]+' |
-            grep -oE '[0-9]+' | head -n 1 || true)"
-        fi
-
-        [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
-
-        if [ -n "$REQUIRE_LABEL" ]; then
-          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
-            --jq '[.labels[].name]')"
-
-          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
-            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
-          fi
-        fi
-
-        # Fetch CI conclusion if not provided (label-triggered runs)
-        ci_conclusion="$CONCLUSION"
-        ci_run_id=""
-        if [ -z "$ci_conclusion" ]; then
-          head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
-          # A run keeps the name it had when it ran, so a repository whose CI was renamed still
-          # carries runs under the old casing. Fold the name before comparing.
-          ci_run="$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
-            --jq '[.workflow_runs[] | select((.name | ascii_downcase) == "app: ci" or (.name | ascii_downcase) == "ci")] | sort_by(.created_at) | last')"
-          
-          if [ -n "$ci_run" ] && [ "$ci_run" != "null" ]; then
-            ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$ci_run")"
-            ci_run_id="$(jq -r '.id' <<<"$ci_run")"
-            echo "::notice::Fetched CI status: $ci_conclusion (run $ci_run_id)"
-          else
-            ci_conclusion="unknown"
-            echo "::warning::No CI run found for PR #$PR_NUMBER"
-          fi
-        fi
-
-        {
-          echo "found=true"
-          echo "pr=$PR_NUMBER"
-          echo "issue=$issue"
-          echo "conclusion=$ci_conclusion"
-          echo "run-id=$ci_run_id"
-        } >> "$GITHUB_OUTPUT"
-
-        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Identify gate subject
+description: Confirm the pull request is one we authored, resolve the issue it closes, and check that issue carries the required label.
+inputs:
+  token:
+    description: GitHub token with issues and pull-requests read access.
+    required: true
+  pr-number:
+    description: Pull request number to gate.
+    required: true
+  ci-conclusion:
+    description: Conclusion reported by the CI run that triggered this gate. If empty, fetches from the PR's latest CI run.
+    required: false
+    default: ''
+  ci-run-id:
+    description: CI run ID reported by the run that triggered this gate. If empty, resolved from the PR's latest CI run.
+    required: false
+    default: ''
+  linked-issue:
+    description: Issue the pull request closes, when the router already resolved it.
+    required: false
+    default: ''
+  require-label:
+    description: Label the closing issue must carry. Empty disables the check.
+    required: false
+    default: ''
+outputs:
+  found:
+    description: Whether a valid gate subject was found.
+    value: ${{ steps.identify.outputs.found }}
+  pr:
+    description: Pull request number.
+    value: ${{ steps.identify.outputs.pr }}
+  issue:
+    description: Issue number the pull request closes.
+    value: ${{ steps.identify.outputs.issue }}
+  conclusion:
+    description: CI conclusion, passed through unchanged or fetched from latest CI run.
+    value: ${{ steps.identify.outputs.conclusion }}
+  run-id:
+    description: CI run ID when fetched.
+    value: ${{ steps.identify.outputs.run-id }}
+runs:
+  using: composite
+  steps:
+    - name: Identify pull request and closing issue
+      id: identify
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        CONCLUSION: ${{ inputs.ci-conclusion }}
+        CI_RUN_ID: ${{ inputs.ci-run-id }}
+        LINKED_ISSUE: ${{ inputs.linked-issue }}
+        REQUIRE_LABEL: ${{ inputs.require-label }}
+      run: |
+        set -euo pipefail
+
+        none() {
+          echo "found=false" >> "$GITHUB_OUTPUT"
+          echo "$1"
+          exit 0
+        }
+
+        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
+          --json state,author,closingIssuesReferences,body)"
+
+        [ "$(jq -r '.state' <<<"$pr")" = "OPEN" ] || none "PR #$PR_NUMBER is not open"
+
+        # Use GitHub's bot flag because App login formats differ across APIs.
+        if [ "$(jq -r '.author.is_bot' <<<"$pr")" != "true" ]; then
+          none "PR #$PR_NUMBER was authored by $(jq -r '.author.login' <<<"$pr"), a human."
+        fi
+
+        issue="$LINKED_ISSUE"
+
+        if [ -z "$issue" ]; then
+          issue="$(jq -r '.closingIssuesReferences[0].number // empty' <<<"$pr")"
+        fi
+
+        if [ -z "$issue" ]; then
+          issue="$(jq -r '.body // ""' <<<"$pr" |
+            grep -oiE '(close[sd]?|fixe?[sd]?|resolve[sd]?) +#[0-9]+' |
+            grep -oE '[0-9]+' | head -n 1 || true)"
+        fi
+
+        [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
+
+        if [ -n "$REQUIRE_LABEL" ]; then
+          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
+            --jq '[.labels[].name]')"
+
+          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
+            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
+          fi
+        fi
+
+        # The run ID is what lets the gate read the failing job and its logs, so it has to be
+        # resolved on every path -- not only the label-triggered one. It used to be set inside
+        # `if [ -z "$ci_conclusion" ]`, which meant the caller that *knew* the ID got an empty
+        # one: the router passes ci-conclusion and ci-run-id together, so the branch was skipped
+        # and the value discarded. The gate then wrote `failed-jobs.json` as `[]`, and the agent,
+        # with no failing job name and no logs, escalated to `review`. Pliny-Bot #129 and #131
+        # both stalled on a human that way while CI was legitimately red and remediable.
+        ci_conclusion="$CONCLUSION"
+        ci_run_id="$CI_RUN_ID"
+        if [ -z "$ci_conclusion" ] || [ -z "$ci_run_id" ]; then
+          head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+          # A run keeps the name it had when it ran, so a repository whose CI was renamed still
+          # carries runs under the old casing. Fold the name before comparing.
+          ci_run="$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100"             --jq '[.workflow_runs[] | select((.name | ascii_downcase) == "app: ci" or (.name | ascii_downcase) == "ci")] | sort_by(.created_at) | last')"
+
+          if [ -n "$ci_run" ] && [ "$ci_run" != "null" ]; then
+            [ -n "$ci_conclusion" ] || ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$ci_run")"
+            [ -n "$ci_run_id" ] || ci_run_id="$(jq -r '.id' <<<"$ci_run")"
+            echo "::notice::Resolved CI status: $ci_conclusion (run $ci_run_id)"
+          elif [ -z "$ci_conclusion" ]; then
+            ci_conclusion="unknown"
+            echo "::warning::No CI run found for PR #$PR_NUMBER"
+          else
+            echo "::warning::CI concluded $ci_conclusion but no run was found for PR #$PR_NUMBER; the gate has no failure evidence"
+          fi
+        fi
+
+        {
+          echo "found=true"
+          echo "pr=$PR_NUMBER"
+          echo "issue=$issue"
+          echo "conclusion=$ci_conclusion"
+          echo "run-id=$ci_run_id"
+        } >> "$GITHUB_OUTPUT"
+
+        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"

package/loops/actions/link-pr-to-issue/action.yml

@@ -1,40 +1,40 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/link-pr-to-issue/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Link pull request to issue
-description: Ensure the pull request body carries a closing reference to its source issue.
-inputs:
-  token:
-    description: GitHub token with pull-requests write access.
-    required: true
-  pr-number:
-    description: Pull request number.
-    required: true
-  issue-number:
-    description: Issue number the pull request should close.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Ensure a closing reference
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-      run: |
-        set -euo pipefail
-
-        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json closingIssuesReferences,body)"
-
-        if [ "$(jq '.closingIssuesReferences | length' <<<"$pr")" -gt 0 ]; then
-          echo "PR #$PR_NUMBER already closes an issue."
-          exit 0
-        fi
-
-        # A closing reference can only be created from the pull request body; there is no
-        # REST or GraphQL mutation for it.
-        body="$(jq -r '.body // ""' <<<"$pr")"
-        printf '%s\n\nCloses #%s\n' "$body" "$ISSUE_NUMBER" > /tmp/pr-body.md
-
-        gh pr edit "$PR_NUMBER" --repo "$REPO" --body-file /tmp/pr-body.md
-        echo "Added 'Closes #$ISSUE_NUMBER' to PR #$PR_NUMBER."
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/link-pr-to-issue/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Link pull request to issue
+description: Ensure the pull request body carries a closing reference to its source issue.
+inputs:
+  token:
+    description: GitHub token with pull-requests write access.
+    required: true
+  pr-number:
+    description: Pull request number.
+    required: true
+  issue-number:
+    description: Issue number the pull request should close.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Ensure a closing reference
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+      run: |
+        set -euo pipefail
+
+        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json closingIssuesReferences,body)"
+
+        if [ "$(jq '.closingIssuesReferences | length' <<<"$pr")" -gt 0 ]; then
+          echo "PR #$PR_NUMBER already closes an issue."
+          exit 0
+        fi
+
+        # A closing reference can only be created from the pull request body; there is no
+        # REST or GraphQL mutation for it.
+        body="$(jq -r '.body // ""' <<<"$pr")"
+        printf '%s\n\nCloses #%s\n' "$body" "$ISSUE_NUMBER" > /tmp/pr-body.md
+
+        gh pr edit "$PR_NUMBER" --repo "$REPO" --body-file /tmp/pr-body.md
+        echo "Added 'Closes #$ISSUE_NUMBER' to PR #$PR_NUMBER."

package/loops/actions/list-open-issues/action.yml

@@ -1,33 +1,33 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/list-open-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: List open issues
-description: |
-  Writes all open issues (number, title, labels) to `/tmp/gh-aw/agent/open-issues.json`
-  so the agent can check for semantic duplicates without spending turns discovering them.
-inputs:
-  token:
-    description: GitHub token with issues:read permission.
-    required: true
-  repo:
-    description: Repository in `owner/name` format.
-    required: true
-  output-path:
-    description: Path to write the JSON output.
-    required: false
-    default: /tmp/gh-aw/agent/open-issues.json
-runs:
-  using: composite
-  steps:
-    - name: List open issues
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ inputs.repo }}
-        OUTPUT_PATH: ${{ inputs.output-path }}
-      run: |
-        set -euo pipefail
-        mkdir -p "$(dirname "$OUTPUT_PATH")"
-        gh issue list --repo "$REPO" --state open --limit 500 \
-          --json number,title,labels \
-          --jq '[.[] | {number, title, labels: [.labels[].name]}]' \
-          > "$OUTPUT_PATH"
-        echo "Wrote $(jq 'length' "$OUTPUT_PATH") open issues to $OUTPUT_PATH"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/list-open-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: List open issues
+description: |
+  Writes all open issues (number, title, labels) to `/tmp/gh-aw/agent/open-issues.json`
+  so the agent can check for semantic duplicates without spending turns discovering them.
+inputs:
+  token:
+    description: GitHub token with issues:read permission.
+    required: true
+  repo:
+    description: Repository in `owner/name` format.
+    required: true
+  output-path:
+    description: Path to write the JSON output.
+    required: false
+    default: /tmp/gh-aw/agent/open-issues.json
+runs:
+  using: composite
+  steps:
+    - name: List open issues
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ inputs.repo }}
+        OUTPUT_PATH: ${{ inputs.output-path }}
+      run: |
+        set -euo pipefail
+        mkdir -p "$(dirname "$OUTPUT_PATH")"
+        gh issue list --repo "$REPO" --state open --limit 500 \
+          --json number,title,labels \
+          --jq '[.[] | {number, title, labels: [.labels[].name]}]' \
+          > "$OUTPUT_PATH"
+        echo "Wrote $(jq 'length' "$OUTPUT_PATH") open issues to $OUTPUT_PATH"