@plainconceptsplatform/workflows 0.19.2 → 0.20.1

package/loops/actions/download-agent-output/action.yml

@@ -1,53 +1,53 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/download-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Download agent output
-description: Download the agent artifact and expose the output JSON and bundle paths.
-inputs:
-  artifact-name:
-    description: >-
-      Artifact name to download. gh-aw prefixes it with the value it derives from the
-      workflow's inputs, so a workflow_call worker must pass the activation job's
-      artifact_prefix output followed by "agent", not the bare name.
-    required: true
-outputs:
-  output-file:
-    description: Path to agent_output.json, or empty if not found.
-    value: ${{ steps.download.outputs.output-file }}
-  bundle-file:
-    description: Path to the git bundle, or empty if not found.
-    value: ${{ steps.download.outputs.bundle-file }}
-  item-count:
-    description: Number of items in the agent output.
-    value: ${{ steps.download.outputs.item-count }}
-runs:
-  using: composite
-  steps:
-    - name: Download agent artifact
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ inputs.artifact-name }}
-        path: agent-artifact
-    - name: Locate output and bundle
-      id: download
-      shell: bash
-      env:
-        ARTIFACT_NAME: ${{ inputs.artifact-name }}
-      run: |
-        set -euo pipefail
-        OUTPUT_FILE=""
-        BUNDLE_FILE=""
-        ITEM_COUNT="0"
-
-        if [ -f "agent-artifact/agent_output.json" ]; then
-          OUTPUT_FILE="agent-artifact/agent_output.json"
-          ITEM_COUNT=$(jq '.items | length' "$OUTPUT_FILE")
-          BUNDLE_FILE=$(ls agent-artifact/aw-*.bundle 2>/dev/null | head -1 || true)
-        else
-          echo "::error::Artifact '$ARTIFACT_NAME' contained no agent_output.json. Nothing the agent proposed will be applied."
-          exit 1
-        fi
-
-        echo "Artifact '$ARTIFACT_NAME' carries $ITEM_COUNT item(s)."
-
-        echo "output-file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
-        echo "bundle-file=$BUNDLE_FILE" >> "$GITHUB_OUTPUT"
-        echo "item-count=$ITEM_COUNT" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/download-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Download agent output
+description: Download the agent artifact and expose the output JSON and bundle paths.
+inputs:
+  artifact-name:
+    description: >-
+      Artifact name to download. gh-aw prefixes it with the value it derives from the
+      workflow's inputs, so a workflow_call worker must pass the activation job's
+      artifact_prefix output followed by "agent", not the bare name.
+    required: true
+outputs:
+  output-file:
+    description: Path to agent_output.json, or empty if not found.
+    value: ${{ steps.download.outputs.output-file }}
+  bundle-file:
+    description: Path to the git bundle, or empty if not found.
+    value: ${{ steps.download.outputs.bundle-file }}
+  item-count:
+    description: Number of items in the agent output.
+    value: ${{ steps.download.outputs.item-count }}
+runs:
+  using: composite
+  steps:
+    - name: Download agent artifact
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: agent-artifact
+    - name: Locate output and bundle
+      id: download
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.artifact-name }}
+      run: |
+        set -euo pipefail
+        OUTPUT_FILE=""
+        BUNDLE_FILE=""
+        ITEM_COUNT="0"
+
+        if [ -f "agent-artifact/agent_output.json" ]; then
+          OUTPUT_FILE="agent-artifact/agent_output.json"
+          ITEM_COUNT=$(jq '.items | length' "$OUTPUT_FILE")
+          BUNDLE_FILE=$(ls agent-artifact/aw-*.bundle 2>/dev/null | head -1 || true)
+        else
+          echo "::error::Artifact '$ARTIFACT_NAME' contained no agent_output.json. Nothing the agent proposed will be applied."
+          exit 1
+        fi
+
+        echo "Artifact '$ARTIFACT_NAME' carries $ITEM_COUNT item(s)."
+
+        echo "output-file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
+        echo "bundle-file=$BUNDLE_FILE" >> "$GITHUB_OUTPUT"
+        echo "item-count=$ITEM_COUNT" >> "$GITHUB_OUTPUT"

package/loops/actions/housekeeping/action.yml

@@ -75,6 +75,12 @@ runs:
           const names = (issue) => issue.labels.map((l) => (typeof l === 'string' ? l : l.name));
 
           const needsHuman = [];
+          // Gate telemetry. Every disposition the gate has ever posted is already on a pull
+          // request, marked, so the rate costs one extra listing rather than a store.
+          const dispositions = {};
+          const autoMerged = [];
+          const reverts = [];
+          const metricsWindowMs = 14 * 24 * 3600000;
           // Stalled work still inside its retry window. Separate from needsHuman because nobody
           // needs to act on it yet, and reported anyway because the alternative is silence: the
           // window is 6 hours and the budget is 3 attempts, so an issue that keeps stalling was
@@ -203,14 +209,45 @@ runs:
               ...context.repo, issue_number: pull.number, per_page: 100,
             });
             const verdict = [...comments].reverse().find((c) => (c.body ?? '').includes('<!-- agent-merge-gate -->') && (c.body ?? '').includes('**Verdict:**'));
-            const parsed = verdict ? /\*\*Verdict:\*\*\s*(\w+)/.exec(verdict.body)?.[1] : undefined;
-            if (parsed && parsed !== 'merge') {
+            const parsed = verdict ? /\*\*Verdict:\*\*\s*([\w-]+)/.exec(verdict.body)?.[1] : undefined;
+            // The gate's dispositions are auto-merge, human-review, owner-review and blocked.
+            // Only the first needs nobody. The character class has to allow the hyphen or every
+            // disposition reads as the bare word "auto" or "human" and nothing matches.
+            if (parsed) dispositions[parsed] = (dispositions[parsed] ?? 0) + 1;
+            if (parsed && parsed !== 'auto-merge') {
               needsHuman.push({ kind: 'pr-parked', pull, verdict: parsed, waited: age(verdict.created_at) });
             } else if (!verdict && age(pull.created_at) > stalePrMs) {
               needsHuman.push({ kind: 'pr-stale', pull, waited: age(pull.created_at) });
             }
           }
 
+          // 5b. The one number this whole gate exists to move. Open pull requests alone would
+          // only ever count the parked ones, because an auto-merged pull request closes within
+          // seconds of its verdict, so the rate would read as zero forever. Closed pull requests
+          // from the digest window are where the merges are.
+          for (const pull of await github.paginate(github.rest.pulls.list, {
+            ...context.repo, state: 'closed', sort: 'updated', direction: 'desc', per_page: 100,
+          })) {
+            if (age(pull.updated_at) > metricsWindowMs) break;
+            // A revert names the pull request it undoes, which is how an escaped defect is
+            // attributed back to the disposition that let it through. Reverts are frequently
+            // opened by a person, so this one line sits above the bot filter.
+            if (pull.merged_at) {
+              const undone = /revert .*#(\d+)/i.exec(pull.title ?? '');
+              if (undone) reverts.push(Number(undone[1]));
+            }
+            if (!isBot(pull.user?.login ?? '')) continue;
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              ...context.repo, issue_number: pull.number, per_page: 100,
+            });
+            const verdict = [...comments].reverse().find((c) => (c.body ?? '').includes('<!-- agent-merge-gate -->') && (c.body ?? '').includes('**Verdict:**'));
+            const parsed = verdict ? /\*\*Verdict:\*\*\s*([\w-]+)/.exec(verdict.body)?.[1] : undefined;
+            if (parsed) dispositions[parsed] = (dispositions[parsed] ?? 0) + 1;
+            // An auto-merge followed by a revert is the number that has to stay at zero while
+            // the rate climbs. Anything else is a rate bought with escaped defects.
+            if (parsed === 'auto-merge' && pull.merged_at) autoMerged.push(pull.number);
+          }
+
           // 6. One digest. Everything above either fixed itself or is listed here, so there is a
           // single place to look instead of four repositories and three label queries.
           // Audit reports nobody actioned. audit-close labels these `stale-audit` once they are
@@ -243,6 +280,21 @@ runs:
               `- #${entry.issue.number} · stalled ${hours(entry.waited)}h ago · attempt ${entry.attempts + 1} of ${maxRetries} due in ~${hours(entry.due)}h · ${entry.issue.title}`);
             return `\n### Retrying by itself, no action needed (${retrying.length})\n\n${rows.join('\n')}\n`;
           };
+          // The gate's own scoreboard. A digest that lists only what went wrong tells you
+          // nothing about whether the thing is getting better.
+          const gateSection = () => {
+            const total = Object.values(dispositions).reduce((a, b) => a + b, 0);
+            if (total === 0) return '';
+            const auto = dispositions['auto-merge'] ?? 0;
+            const rate = Math.round((auto / total) * 100);
+            const rows = Object.entries(dispositions)
+              .sort((a, b) => b[1] - a[1])
+              .map(([name, count]) => `- \`${name}\` · ${count}`);
+            const reverted = autoMerged.filter((number) => reverts.includes(number)).length;
+            return `\n### Merge gate, last ${metricsWindowMs / (24 * 3600000)} days\n\n` +
+              `**${rate}% auto-merged** (${auto} of ${total} dispositions).\n\n${rows.join('\n')}\n\n` +
+              `Auto-merged pull requests later reverted: ${reverted}.\n`;
+          };
           const body = [
             DIGEST_MARKER,
             `_Updated ${new Date().toISOString().slice(0, 16).replace('T', ' ')} UTC. This issue is rewritten by the housekeeping job; edits to it are lost._`,
@@ -251,6 +303,7 @@ runs:
             section('Stalled beyond the retry budget', ['retries-exhausted', 'no-work-label']),
             section('Audit reports nobody actioned', ['stale-audit']),
             retryingSection(),
+            gateSection(),
             needsHuman.length === 0 ? '\nNothing is waiting on a person right now.\n' : '',
             `\n---\n\nThis run retried ${retried} stalled issue(s) and made ${planned.length} change(s) in total.`,
           ].filter(Boolean).join('\n');

package/loops/actions/link-pr-to-issue/action.yml

@@ -1,40 +1,40 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/link-pr-to-issue/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Link pull request to issue
-description: Ensure the pull request body carries a closing reference to its source issue.
-inputs:
-  token:
-    description: GitHub token with pull-requests write access.
-    required: true
-  pr-number:
-    description: Pull request number.
-    required: true
-  issue-number:
-    description: Issue number the pull request should close.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Ensure a closing reference
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-      run: |
-        set -euo pipefail
-
-        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json closingIssuesReferences,body)"
-
-        if [ "$(jq '.closingIssuesReferences | length' <<<"$pr")" -gt 0 ]; then
-          echo "PR #$PR_NUMBER already closes an issue."
-          exit 0
-        fi
-
-        # A closing reference can only be created from the pull request body; there is no
-        # REST or GraphQL mutation for it.
-        body="$(jq -r '.body // ""' <<<"$pr")"
-        printf '%s\n\nCloses #%s\n' "$body" "$ISSUE_NUMBER" > /tmp/pr-body.md
-
-        gh pr edit "$PR_NUMBER" --repo "$REPO" --body-file /tmp/pr-body.md
-        echo "Added 'Closes #$ISSUE_NUMBER' to PR #$PR_NUMBER."
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/link-pr-to-issue/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Link pull request to issue
+description: Ensure the pull request body carries a closing reference to its source issue.
+inputs:
+  token:
+    description: GitHub token with pull-requests write access.
+    required: true
+  pr-number:
+    description: Pull request number.
+    required: true
+  issue-number:
+    description: Issue number the pull request should close.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Ensure a closing reference
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+      run: |
+        set -euo pipefail
+
+        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json closingIssuesReferences,body)"
+
+        if [ "$(jq '.closingIssuesReferences | length' <<<"$pr")" -gt 0 ]; then
+          echo "PR #$PR_NUMBER already closes an issue."
+          exit 0
+        fi
+
+        # A closing reference can only be created from the pull request body; there is no
+        # REST or GraphQL mutation for it.
+        body="$(jq -r '.body // ""' <<<"$pr")"
+        printf '%s\n\nCloses #%s\n' "$body" "$ISSUE_NUMBER" > /tmp/pr-body.md
+
+        gh pr edit "$PR_NUMBER" --repo "$REPO" --body-file /tmp/pr-body.md
+        echo "Added 'Closes #$ISSUE_NUMBER' to PR #$PR_NUMBER."

package/loops/actions/list-open-issues/action.yml

@@ -1,33 +1,33 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/list-open-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: List open issues
-description: |
-  Writes all open issues (number, title, labels) to `/tmp/gh-aw/agent/open-issues.json`
-  so the agent can check for semantic duplicates without spending turns discovering them.
-inputs:
-  token:
-    description: GitHub token with issues:read permission.
-    required: true
-  repo:
-    description: Repository in `owner/name` format.
-    required: true
-  output-path:
-    description: Path to write the JSON output.
-    required: false
-    default: /tmp/gh-aw/agent/open-issues.json
-runs:
-  using: composite
-  steps:
-    - name: List open issues
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ inputs.repo }}
-        OUTPUT_PATH: ${{ inputs.output-path }}
-      run: |
-        set -euo pipefail
-        mkdir -p "$(dirname "$OUTPUT_PATH")"
-        gh issue list --repo "$REPO" --state open --limit 500 \
-          --json number,title,labels \
-          --jq '[.[] | {number, title, labels: [.labels[].name]}]' \
-          > "$OUTPUT_PATH"
-        echo "Wrote $(jq 'length' "$OUTPUT_PATH") open issues to $OUTPUT_PATH"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/list-open-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: List open issues
+description: |
+  Writes all open issues (number, title, labels) to `/tmp/gh-aw/agent/open-issues.json`
+  so the agent can check for semantic duplicates without spending turns discovering them.
+inputs:
+  token:
+    description: GitHub token with issues:read permission.
+    required: true
+  repo:
+    description: Repository in `owner/name` format.
+    required: true
+  output-path:
+    description: Path to write the JSON output.
+    required: false
+    default: /tmp/gh-aw/agent/open-issues.json
+runs:
+  using: composite
+  steps:
+    - name: List open issues
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ inputs.repo }}
+        OUTPUT_PATH: ${{ inputs.output-path }}
+      run: |
+        set -euo pipefail
+        mkdir -p "$(dirname "$OUTPUT_PATH")"
+        gh issue list --repo "$REPO" --state open --limit 500 \
+          --json number,title,labels \
+          --jq '[.[] | {number, title, labels: [.labels[].name]}]' \
+          > "$OUTPUT_PATH"
+        echo "Wrote $(jq 'length' "$OUTPUT_PATH") open issues to $OUTPUT_PATH"

package/loops/actions/load-issue-context/action.yml

@@ -1,45 +1,45 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/load-issue-context/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Load issue context
-description: Write issue metadata and comment context to a JSON file.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue number to load.
-    required: true
-  output-path:
-    description: Absolute path where context JSON is written.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Load issue and comments
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        OUTPUT_PATH: ${{ inputs.output-path }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const fs = require('fs');
-          const issueNumber = Number(process.env.ISSUE_NUMBER);
-          const issue = await github.rest.issues.get({ ...context.repo, issue_number: issueNumber });
-          const comments = await github.paginate(github.rest.issues.listComments, {
-            ...context.repo, issue_number: issueNumber, per_page: 100,
-          });
-
-          fs.mkdirSync(require('path').dirname(process.env.OUTPUT_PATH), { recursive: true });
-          fs.writeFileSync(process.env.OUTPUT_PATH, JSON.stringify({
-            number: issue.data.number,
-            title: issue.data.title,
-            body: issue.data.body,
-            author: issue.data.user.login,
-            authorAssociation: issue.data.author_association,
-            labels: issue.data.labels.map(({ name }) => name),
-            comments: comments.map(({ user, author_association, body }) => ({
-              author: user.login,
-              association: author_association,
-              body,
-            })),
-          }, null, 2));
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/load-issue-context/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Load issue context
+description: Write issue metadata and comment context to a JSON file.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue number to load.
+    required: true
+  output-path:
+    description: Absolute path where context JSON is written.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Load issue and comments
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_PATH: ${{ inputs.output-path }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const fs = require('fs');
+          const issueNumber = Number(process.env.ISSUE_NUMBER);
+          const issue = await github.rest.issues.get({ ...context.repo, issue_number: issueNumber });
+          const comments = await github.paginate(github.rest.issues.listComments, {
+            ...context.repo, issue_number: issueNumber, per_page: 100,
+          });
+
+          fs.mkdirSync(require('path').dirname(process.env.OUTPUT_PATH), { recursive: true });
+          fs.writeFileSync(process.env.OUTPUT_PATH, JSON.stringify({
+            number: issue.data.number,
+            title: issue.data.title,
+            body: issue.data.body,
+            author: issue.data.user.login,
+            authorAssociation: issue.data.author_association,
+            labels: issue.data.labels.map(({ name }) => name),
+            comments: comments.map(({ user, author_association, body }) => ({
+              author: user.login,
+              association: author_association,
+              body,
+            })),
+          }, null, 2));

package/loops/actions/merge-agent-pr/action.yml

@@ -1,49 +1,49 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-agent-pr/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Merge agent pull request
-description: Read merge_pull_request from agent_output.json and merge the PR via gh.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with pull-requests:write and contents:write.
-    required: true
-  repo:
-    description: Target repository in owner/name format.
-    required: false
-    default: ${{ github.repository }}
-runs:
-  using: composite
-  steps:
-    - name: Merge pull request
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        REPO: ${{ inputs.repo }}
-      run: |
-        set -euo pipefail
-        [ -f "$OUTPUT_FILE" ] || exit 0
-
-        jq -c '.items[] | select(.type == "merge_pull_request")' "$OUTPUT_FILE" | while read -r item; do
-          PR_NUM=$(echo "$item" | jq -er '.pr_number // .item_number // empty')
-          [[ "$PR_NUM" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid pull request number: $PR_NUM"; exit 1; }
-
-          HEAD_SHA=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          [[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || { echo "::error::Invalid pull request head SHA for #$PR_NUM"; exit 1; }
-
-          HEAD_REF=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefName --jq '.headRefName')
-
-          gh pr merge "$PR_NUM" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
-
-          # Delete the branch, because nothing else ever has: four repositories had accumulated
-          # 47 non-main branches, every one the head of a pull request merged or closed months
-          # ago. Done after the merge and with its failure swallowed rather than through
-          # `gh pr merge --delete-branch`, which also tries to delete the local branch and can
-          # turn a completed merge into a red step. `delete_branch_on_merge` on the repository
-          # does the same job, but only where someone remembered to switch it on.
-          if [ -n "$HEAD_REF" ] && [ "$HEAD_REF" != "null" ]; then
-            gh api -X DELETE "repos/$REPO/git/refs/heads/$HEAD_REF" >/dev/null 2>&1 ||
-              echo "::notice::branch $HEAD_REF was already gone or is protected"
-          fi
-        done
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-agent-pr/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Merge agent pull request
+description: Read merge_pull_request from agent_output.json and merge the PR via gh.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with pull-requests:write and contents:write.
+    required: true
+  repo:
+    description: Target repository in owner/name format.
+    required: false
+    default: ${{ github.repository }}
+runs:
+  using: composite
+  steps:
+    - name: Merge pull request
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        REPO: ${{ inputs.repo }}
+      run: |
+        set -euo pipefail
+        [ -f "$OUTPUT_FILE" ] || exit 0
+
+        jq -c '.items[] | select(.type == "merge_pull_request")' "$OUTPUT_FILE" | while read -r item; do
+          PR_NUM=$(echo "$item" | jq -er '.pr_number // .item_number // empty')
+          [[ "$PR_NUM" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid pull request number: $PR_NUM"; exit 1; }
+
+          HEAD_SHA=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefOid --jq '.headRefOid')
+          [[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || { echo "::error::Invalid pull request head SHA for #$PR_NUM"; exit 1; }
+
+          HEAD_REF=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefName --jq '.headRefName')
+
+          gh pr merge "$PR_NUM" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
+
+          # Delete the branch, because nothing else ever has: four repositories had accumulated
+          # 47 non-main branches, every one the head of a pull request merged or closed months
+          # ago. Done after the merge and with its failure swallowed rather than through
+          # `gh pr merge --delete-branch`, which also tries to delete the local branch and can
+          # turn a completed merge into a red step. `delete_branch_on_merge` on the repository
+          # does the same job, but only where someone remembered to switch it on.
+          if [ -n "$HEAD_REF" ] && [ "$HEAD_REF" != "null" ]; then
+            gh api -X DELETE "repos/$REPO/git/refs/heads/$HEAD_REF" >/dev/null 2>&1 ||
+              echo "::notice::branch $HEAD_REF was already gone or is protected"
+          fi
+        done

package/loops/actions/push-agent-branch/action.yml

@@ -1,45 +1,45 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/push-agent-branch/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Push agent branch
-description: Read push_to_pull_request_branch from agent_output.json and fast-forward from its git bundle.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  bundle-file:
-    description: Path to the git bundle from the agent artifact.
-    required: false
-    default: ''
-  token:
-    description: GitHub token with contents:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Configure git credentials
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-      run: |
-        git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
-    - name: Read pull request branch
-      id: request
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        BUNDLE_FILE: ${{ inputs.bundle-file }}
-      run: |
-        set -euo pipefail
-        [ -f "$OUTPUT_FILE" ] || exit 0
-
-        ITEM=$(jq -c '.items[] | select(.type == "push_to_pull_request_branch")' "$OUTPUT_FILE")
-        [ -n "$ITEM" ] || exit 0
-
-        BRANCH=$(echo "$ITEM" | jq -r '.branch')
-        echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
-    - name: Apply bundle to pull request branch
-      if: steps.request.outputs.branch != '' && inputs.bundle-file != ''
-      uses: ./.github/actions/apply-agent-bundle
-      with:
-        bundle-file: ${{ inputs.bundle-file }}
-        target-branch: ${{ steps.request.outputs.branch }}
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/push-agent-branch/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Push agent branch
+description: Read push_to_pull_request_branch from agent_output.json and fast-forward from its git bundle.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  bundle-file:
+    description: Path to the git bundle from the agent artifact.
+    required: false
+    default: ''
+  token:
+    description: GitHub token with contents:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Configure git credentials
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+      run: |
+        git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
+    - name: Read pull request branch
+      id: request
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        BUNDLE_FILE: ${{ inputs.bundle-file }}
+      run: |
+        set -euo pipefail
+        [ -f "$OUTPUT_FILE" ] || exit 0
+
+        ITEM=$(jq -c '.items[] | select(.type == "push_to_pull_request_branch")' "$OUTPUT_FILE")
+        [ -n "$ITEM" ] || exit 0
+
+        BRANCH=$(echo "$ITEM" | jq -r '.branch')
+        echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+    - name: Apply bundle to pull request branch
+      if: steps.request.outputs.branch != '' && inputs.bundle-file != ''
+      uses: ./.github/actions/apply-agent-bundle
+      with:
+        bundle-file: ${{ inputs.bundle-file }}
+        target-branch: ${{ steps.request.outputs.branch }}