@plainconceptsplatform/workflows 0.19.2 → 0.20.1

package/loops/actions/apply-agent-output/action.yml

@@ -1,108 +1,108 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent output
-description: Download the agent artifact and apply its safe outputs in one fixed order, so every worker concludes the same way.
-inputs:
-  token:
-    description: GitHub token the writes are made with.
-    required: true
-  artifact-name:
-    description: >-
-      Name of the agent artifact. Callers pass the activation job's artifact_prefix output
-      followed by "agent"; gh-aw derives that prefix from the workflow's inputs, so it is
-      non-empty for every workflow_call worker and the bare name never resolves.
-    required: true
-  merge-pull-request:
-    description: Apply merge_pull_request items.
-    required: false
-    default: 'false'
-  push-to-branch:
-    description: Apply push_to_pull_request_branch items.
-    required: false
-    default: 'false'
-  close-issues:
-    description: Apply close_issue items.
-    required: false
-    default: 'false'
-  create-issues:
-    description: Apply create_issue items.
-    required: false
-    default: 'false'
-  update-issues:
-    description: Apply update_issue items.
-    required: false
-    default: 'false'
-  apply-labels:
-    description: Apply add_labels and remove_labels items.
-    required: false
-    default: 'true'
-  fallback-issue-number:
-    description: Issue an update_issue item targets when it names none.
-    required: false
-    default: ''
-outputs:
-  item-count:
-    description: Number of items the agent produced.
-    value: ${{ steps.output.outputs.item-count }}
-  first-issue-number:
-    description: Issue number of the first issue created, or empty.
-    value: ${{ steps.create-issues.outputs.first-issue-number }}
-runs:
-  using: composite
-  steps:
-    - name: Download agent output
-      id: output
-      uses: ./.github/actions/download-agent-output
-      with:
-        artifact-name: ${{ inputs.artifact-name }}
-
-    - name: Merge pull request
-      if: inputs.merge-pull-request == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/merge-agent-pr
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Push to pull request branch
-      if: inputs.push-to-branch == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/push-agent-branch
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        bundle-file: ${{ steps.output.outputs.bundle-file }}
-        token: ${{ inputs.token }}
-
-    - name: Close issues
-      if: inputs.close-issues == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/close-agent-issues
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Update issues
-      if: inputs.update-issues == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/update-agent-issues
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-        fallback-issue-number: ${{ inputs.fallback-issue-number }}
-
-    - name: Create issues
-      id: create-issues
-      if: inputs.create-issues == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/create-agent-issues
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Post agent comments
-      if: steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/apply-agent-comments
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Apply agent label changes
-      if: inputs.apply-labels == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/apply-agent-labels
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent output
+description: Download the agent artifact and apply its safe outputs in one fixed order, so every worker concludes the same way.
+inputs:
+  token:
+    description: GitHub token the writes are made with.
+    required: true
+  artifact-name:
+    description: >-
+      Name of the agent artifact. Callers pass the activation job's artifact_prefix output
+      followed by "agent"; gh-aw derives that prefix from the workflow's inputs, so it is
+      non-empty for every workflow_call worker and the bare name never resolves.
+    required: true
+  merge-pull-request:
+    description: Apply merge_pull_request items.
+    required: false
+    default: 'false'
+  push-to-branch:
+    description: Apply push_to_pull_request_branch items.
+    required: false
+    default: 'false'
+  close-issues:
+    description: Apply close_issue items.
+    required: false
+    default: 'false'
+  create-issues:
+    description: Apply create_issue items.
+    required: false
+    default: 'false'
+  update-issues:
+    description: Apply update_issue items.
+    required: false
+    default: 'false'
+  apply-labels:
+    description: Apply add_labels and remove_labels items.
+    required: false
+    default: 'true'
+  fallback-issue-number:
+    description: Issue an update_issue item targets when it names none.
+    required: false
+    default: ''
+outputs:
+  item-count:
+    description: Number of items the agent produced.
+    value: ${{ steps.output.outputs.item-count }}
+  first-issue-number:
+    description: Issue number of the first issue created, or empty.
+    value: ${{ steps.create-issues.outputs.first-issue-number }}
+runs:
+  using: composite
+  steps:
+    - name: Download agent output
+      id: output
+      uses: ./.github/actions/download-agent-output
+      with:
+        artifact-name: ${{ inputs.artifact-name }}
+
+    - name: Merge pull request
+      if: inputs.merge-pull-request == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/merge-agent-pr
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Push to pull request branch
+      if: inputs.push-to-branch == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/push-agent-branch
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        bundle-file: ${{ steps.output.outputs.bundle-file }}
+        token: ${{ inputs.token }}
+
+    - name: Close issues
+      if: inputs.close-issues == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/close-agent-issues
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Update issues
+      if: inputs.update-issues == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/update-agent-issues
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+        fallback-issue-number: ${{ inputs.fallback-issue-number }}
+
+    - name: Create issues
+      id: create-issues
+      if: inputs.create-issues == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/create-agent-issues
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Post agent comments
+      if: steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/apply-agent-comments
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Apply agent label changes
+      if: inputs.apply-labels == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/apply-agent-labels
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}

package/loops/actions/assess-blast-radius/action.yml

@@ -0,0 +1,148 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/assess-blast-radius/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Assess blast radius
+description: Classify a pull request's potential impact from its changed paths and diff shape, before any model reads it.
+inputs:
+  token:
+    description: GitHub token with pull-requests read access.
+    required: true
+  pr-number:
+    description: Pull request number to assess.
+    required: true
+  protected-paths:
+    description: Extended regular expression. A match may never auto-merge and forces HIGH.
+    required: true
+  owner-paths:
+    description: Extended regular expression. A match forces HIGH and requires an owner.
+    required: false
+    default: ''
+  sensitive-paths:
+    description: Extended regular expression. A match raises the floor to MEDIUM.
+    required: false
+    default: ''
+  high-files:
+    description: Files changed at or above which the radius is HIGH.
+    required: false
+    default: '20'
+  high-lines:
+    description: Lines changed at or above which the radius is HIGH.
+    required: false
+    default: '800'
+  medium-files:
+    description: Files changed at or above which the radius is MEDIUM.
+    required: false
+    default: '5'
+  medium-lines:
+    description: Lines changed at or above which the radius is MEDIUM.
+    required: false
+    default: '200'
+outputs:
+  level:
+    description: "low, medium or high."
+    value: ${{ steps.assess.outputs.level }}
+  signals:
+    description: One line per signal that fired, in the order the rules ran.
+    value: ${{ steps.assess.outputs.signals }}
+  requires_review:
+    description: Whether a protected path was touched. Kept for the jobs that already read it.
+    value: ${{ steps.assess.outputs.requires_review }}
+  files:
+    description: The protected paths that matched, one per line. Empty when none did.
+    value: ${{ steps.assess.outputs.files }}
+  owner_hits:
+    description: The owner paths that matched, one per line.
+    value: ${{ steps.assess.outputs.owner_hits }}
+  owner_hit:
+    description: Whether an owner path was touched. A scalar, so no caller has to compare a multi-line value to an empty string.
+    value: ${{ steps.assess.outputs.owner_hit }}
+  sensitive_hit:
+    description: Whether a sensitive path was touched.
+    value: ${{ steps.assess.outputs.sensitive_hit }}
+  sensitive_hits:
+    description: The sensitive paths that matched, one per line.
+    value: ${{ steps.assess.outputs.sensitive_hits }}
+  required_owners:
+    description: CODEOWNERS entries covering the changed paths, space separated. Empty when the repository has no CODEOWNERS.
+    value: ${{ steps.assess.outputs.required_owners }}
+  files_changed:
+    description: Number of files in the diff.
+    value: ${{ steps.assess.outputs.files_changed }}
+  lines_changed:
+    description: Additions plus deletions.
+    value: ${{ steps.assess.outputs.lines_changed }}
+runs:
+  using: composite
+  steps:
+    - name: Assess blast radius
+      id: assess
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        PROTECTED_PATHS: ${{ inputs.protected-paths }}
+        OWNER_PATHS: ${{ inputs.owner-paths }}
+        SENSITIVE_PATHS: ${{ inputs.sensitive-paths }}
+        HIGH_FILES: ${{ inputs.high-files }}
+        HIGH_LINES: ${{ inputs.high-lines }}
+        MEDIUM_FILES: ${{ inputs.medium-files }}
+        MEDIUM_LINES: ${{ inputs.medium-lines }}
+      run: |
+        set -euo pipefail
+        # One API call. The job this replaced already paid for it to grep PROTECTED_PATHS, and
+        # the additions and deletions come back in the same payload, so the diff shape costs
+        # nothing extra.
+        gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/files?per_page=100" \
+          --jq '[.[] | {filename, additions, deletions}]' > /tmp/blast-files.json
+
+        files=$(jq -r '.[].filename' /tmp/blast-files.json)
+        files_changed=$(jq -r 'length' /tmp/blast-files.json)
+        lines_changed=$(jq -r '[.[] | .additions + .deletions] | add // 0' /tmp/blast-files.json)
+
+        bash "${{ github.action_path }}/assess-blast-radius.sh" \
+          "$files_changed" "$lines_changed" <<<"$files" > /tmp/blast-out.env
+
+        cat /tmp/blast-out.env >> "$GITHUB_OUTPUT"
+
+        # CODEOWNERS refines who is asked; it never decides whether anyone is. A repository
+        # without the file still gets an owner disposition from OWNER_PATHS, and the comment
+        # names the paths instead of a team.
+        #
+        # The pattern is a gitignore-style glob, not a regex. Stripping a leading slash and a
+        # trailing `/**` and feeding the rest to grep -E was wrong in both directions: `apps/web/`
+        # matched `apps/webhooks/x.ts` because nothing anchored the segment end, `docs/*` matched
+        # `docsecret.md` because `*` applied to the slash, and `*.ts` became `^*.ts`, which GNU
+        # grep parses as a literal with the anchor dropped, so it matched `src/payments/Fee.cs`.
+        # The result was over-broad `required_owners`: teams asked to review changes they do not
+        # own. Translate the glob properly instead.
+        owners=""
+        glob_to_regex() {
+          printf '%s' "$1" | sed -e 's/[.[\$()|+^{}]/\\&/g' \
+                                 -e 's#\*\*/#\x01#g' -e 's#/\*\*#\x02#g' \
+                                 -e 's#\*#[^/]*#g' -e 's#?#[^/]#g' \
+                                 -e 's#\x01#(.*/)?#g' -e 's#\x02#(/.*)?#g'
+        }
+        for candidate in CODEOWNERS .github/CODEOWNERS docs/CODEOWNERS; do
+          [ -f "$candidate" ] || continue
+          # `|| [ -n "$pattern" ]` so a last line with no trailing newline is still read: plain
+          # `while read` returns 1 on EOF and drops it, which silently loses the final rule.
+          while read -r pattern rest || [ -n "$pattern" ]; do
+            case "$pattern" in ''|'#'*) continue ;; esac
+            [ -n "$rest" ] || continue
+            anchored=0
+            case "$pattern" in /*) anchored=1 ;; esac
+            glob="${pattern#/}"; glob="${glob%/}"
+            regex="$(glob_to_regex "$glob")"
+            # A directory rule owns everything beneath it; a file rule matches the path exactly.
+            case "$pattern" in
+              */|*/\*\*) regex="${regex}(/.*)?$" ;;
+              *) regex="${regex}(/.*)?$" ;;
+            esac
+            # An unanchored CODEOWNERS pattern matches at any depth, an anchored one only at the root.
+            if [ "$anchored" -eq 1 ]; then regex="^${regex}"; else regex="(^|/)${regex}"; fi
+            if printf '%s\n' "$files" | grep -qE "$regex"; then
+              owners="$owners $rest"
+            fi
+          done < "$candidate"
+          break
+        done
+        echo "required_owners=$(echo "$owners" | tr -s ' ' | sed 's/^ //;s/ $//')" >> "$GITHUB_OUTPUT"

package/loops/actions/assess-blast-radius/assess-blast-radius.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/assess-blast-radius/assess-blast-radius.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Classify a pull request's blast radius from its changed paths and diff shape.
+#
+# Reads the changed paths on stdin, one per line. Prints GITHUB_OUTPUT lines on stdout.
+# Deliberately model-free: the point of this file is that the most consequential input to the
+# merge decision is computed from facts a shell can check, before any agent reads the diff.
+#
+# Usage: assess-blast-radius.sh <files_changed> <lines_changed> < paths
+# Regexes and thresholds arrive in the environment so the caller and the tests share one contract.
+
+set -euo pipefail
+
+files_changed="${1:-0}"
+lines_changed="${2:-0}"
+
+PROTECTED_PATHS="${PROTECTED_PATHS:-}"
+OWNER_PATHS="${OWNER_PATHS:-}"
+SENSITIVE_PATHS="${SENSITIVE_PATHS:-}"
+HIGH_FILES="${HIGH_FILES:-20}"
+HIGH_LINES="${HIGH_LINES:-800}"
+MEDIUM_FILES="${MEDIUM_FILES:-5}"
+MEDIUM_LINES="${MEDIUM_LINES:-200}"
+
+files="$(cat)"
+
+# An empty regex matches every line in grep -E, which would mark every pull request protected.
+# A list nobody configured must match nothing, not everything.
+#
+# The `|| true` that used to end this function swallowed grep exit 2 (a regex that does not
+# compile) exactly as it swallowed exit 1 (no match), so a consumer typo in PROTECTED_PATHS
+# reported "no protected paths touched" and merged. Consumers are told to edit all three of
+# these, so the typo is the likely case. Each pattern is compiled once below, in this shell,
+# before any of them is used: a `match` failure cannot report itself, because `match` runs
+# inside a command substitution and anything it sets dies with the subshell.
+match() {
+  local pattern="$1"
+  [ -n "$pattern" ] || return 0
+  printf '%s\n' "$files" | grep -E "$pattern" || true
+}
+
+# Compile each configured pattern against nothing. grep exits 2 when the regex is bad, which is
+# distinct from 1 for no match, and that is the whole signal.
+for name in PROTECTED_PATHS OWNER_PATHS SENSITIVE_PATHS; do
+  pattern="${!name}"
+  [ -n "$pattern" ] || continue
+  if printf '' | grep -E "$pattern" >/dev/null 2>&1; then :; elif [ "$?" -gt 1 ]; then
+    echo "assess-blast-radius: ${name} is not a valid extended regular expression: ${pattern}" >&2
+    exit 2
+  fi
+done
+
+protected_hits="$(match "$PROTECTED_PATHS")"
+owner_hits="$(match "$OWNER_PATHS")"
+sensitive_hits="$(match "$SENSITIVE_PATHS")"
+
+# A threshold that is not a number turns its comparison into a shell error that `set -e` does
+# not catch, because the test is an `if` condition: `HIGH_FILES=twenty` printed a diagnostic to
+# stderr and quietly produced `level=low` for a diff of any size.
+for threshold in HIGH_FILES HIGH_LINES MEDIUM_FILES MEDIUM_LINES files_changed lines_changed; do
+  case "${!threshold}" in
+    ""|*[!0-9]*)
+      echo "assess-blast-radius: ${threshold} must be a whole number, got '${!threshold}'" >&2
+      exit 2
+      ;;
+  esac
+done
+
+signals=""
+add_signal() { signals="${signals}${signals:+$'\n'}$1"; }
+
+level=low
+
+if [ -n "$protected_hits" ]; then
+  level=high
+  add_signal "protected paths touched ($(printf '%s\n' "$protected_hits" | tr '\n' ' ' | sed 's/ $//'))"
+fi
+
+if [ -n "$owner_hits" ]; then
+  level=high
+  add_signal "owner paths touched ($(printf '%s\n' "$owner_hits" | tr '\n' ' ' | sed 's/ $//'))"
+fi
+
+if [ "$files_changed" -ge "$HIGH_FILES" ]; then
+  level=high
+  add_signal "$files_changed files changed, at or above the high threshold of $HIGH_FILES"
+fi
+
+if [ "$lines_changed" -ge "$HIGH_LINES" ]; then
+  level=high
+  add_signal "$lines_changed lines changed, at or above the high threshold of $HIGH_LINES"
+fi
+
+if [ "$level" != high ]; then
+  if [ -n "$sensitive_hits" ]; then
+    level=medium
+    add_signal "sensitive paths touched ($(printf '%s\n' "$sensitive_hits" | tr '\n' ' ' | sed 's/ $//'))"
+  fi
+  if [ "$files_changed" -ge "$MEDIUM_FILES" ]; then
+    level=medium
+    add_signal "$files_changed files changed, at or above the medium threshold of $MEDIUM_FILES"
+  fi
+  if [ "$lines_changed" -ge "$MEDIUM_LINES" ]; then
+    level=medium
+    add_signal "$lines_changed lines changed, at or above the medium threshold of $MEDIUM_LINES"
+  fi
+fi
+
+[ -n "$signals" ] || signals="no blast-radius signal fired: $files_changed files, $lines_changed lines, no configured path matched"
+
+# A fixed heredoc delimiter is a fail-open here. Every multi-line value below is built from
+# paths the pull request chose, so a path that is exactly the delimiter closes its block early
+# and every line after it is read as a new output -- including `level=low`, which is emitted
+# above and would be overridden by the later value. The shipped regexes cannot match a bare
+# delimiter, but a consumer who writes a loose one can, and the failure is silent and merges.
+# A per-run delimiter removes the class rather than the instance, which is what GitHub
+# documents for exactly this reason.
+DELIM="BLASTEOF_$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+
+emit_block() {
+  local name="$1" value="$2"
+  printf '%s<<%s\n%s\n%s\n' "$name" "$DELIM" "$value" "$DELIM"
+}
+
+echo "level=$level"
+echo "files_changed=$files_changed"
+echo "lines_changed=$lines_changed"
+# Emitted as plain scalars, not left for the caller to derive by comparing a heredoc block to
+# an empty string. Whether the runner renders an empty block as "" or as a newline is not
+# something this repository can test off-runner, and a caller that guessed wrong would have sent
+# every pull request to owner review. A shell that already knows the answer should just say it.
+echo "requires_review=$([ -n "$protected_hits" ] && echo true || echo false)"
+echo "owner_hit=$([ -n "$owner_hits" ] && echo true || echo false)"
+echo "sensitive_hit=$([ -n "$sensitive_hits" ] && echo true || echo false)"
+emit_block signals "$signals"
+emit_block files "$protected_hits"
+emit_block owner_hits "$owner_hits"
+emit_block sensitive_hits "$sensitive_hits"