@plainconceptsplatform/workflows 0.20.2 → 0.20.3

package/loops/actions/collect-app-errors/query-app-errors.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/collect-app-errors/query-app-errors.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+#
+# Ask the Log Analytics workspace what the application threw, and write the rows to a file.
+#
+# Two tables, both named, and never any others. `AppServiceConsoleLogs` and
+# `ContainerAppConsoleLogs` sit in this same workspace and carry raw engine stdout, which is
+# not governed by the no-content rule the application's own telemetry follows. A `union *`
+# here would be a privacy incident rather than a wider query.
+#
+# `AppExceptions` alone was not enough, and the first dry run against a real workspace is what
+# said so: nought exceptions in a day, on a service that had been failing all morning. Nothing
+# in these applications calls RecordException or marks an activity failed. Every failure they
+# actually care about is caught in code and reported through ILogger, so it lands in
+# `AppTraces` at severity Error and never reaches `AppExceptions` at all. Querying only the
+# exception table would have meant a report that ran green every morning and never once saw
+# the thing it was built for.
+#
+# Workspace table names, not the classic ones. These resources are workspace-based
+# (`IngestionMode: LogAnalytics`), so the table is `AppExceptions` and its columns are
+# capitalised: `ProblemId`, not `problemId`. A query written against the classic schema
+# returns an error, or worse, nothing.
+
+set -euo pipefail
+
+WORKSPACE_ID="${1:?workspace id}"
+LOOKBACK_HOURS="${2:?lookback hours}"
+MIN_OCCURRENCES="${3:?minimum occurrences}"
+MAX_ROWS="${4:?maximum rows}"
+OUTPUT="${5:?output file}"
+
+# `sum(ItemCount)`, never `count()`.
+#
+# Telemetry is sampled -- 0.3 in a pre environment -- and every row carries the number of real
+# events it stands for. Counting rows under-reports by roughly the inverse of the ratio, which
+# is how a problem that happened two hundred times reads as sixty and falls under a floor set
+# to catch it.
+# Grouped on the message TEMPLATE, not the message.
+#
+# "Run {RunId} failed" is one problem however many runs hit it; the rendered messages are all
+# different and would group into one finding each. The template is what ILogger was given and
+# what Azure Monitor keeps in OriginalFormat, so it is the closest thing traces have to the
+# exception table's ProblemId. Falling back to the rendered message where it is missing costs
+# some grouping and loses nothing.
+read -r -d '' QUERY <<KQL || true
+let window = ago(${LOOKBACK_HOURS}h);
+let thrown =
+    AppExceptions
+    | where TimeGenerated > window
+    | extend Problem = ProblemId, Kind = ExceptionType, Stack = Details;
+let logged =
+    AppTraces
+    | where TimeGenerated > window
+    | where SeverityLevel >= 3
+    | extend Problem = tostring(coalesce(Properties["OriginalFormat"], Message)),
+             Kind    = tostring(coalesce(Properties["ExceptionType"], "LoggedError")),
+             Stack   = dynamic([]);
+union thrown, logged
+| summarize Occurrences = sum(ItemCount),
+            Operations  = dcount(OperationName),
+            FirstSeen   = min(TimeGenerated),
+            LastSeen    = max(TimeGenerated),
+            AnyDetails  = any(Stack)
+    by ProblemId = Problem, ExceptionType = Kind, OperationName, AppRoleName
+| where Occurrences >= ${MIN_OCCURRENCES}
+| order by Occurrences desc
+| take ${MAX_ROWS}
+KQL
+
+# An empty file rather than a missing one, so the step after this always has something to
+# read and says "nothing to report" rather than failing on a path that is not there.
+echo '[]' > "$OUTPUT"
+
+# A query that will not run is a warning, not a failure.
+#
+# The commonest reason by far is the one grant this needs: the deploy identity can create the
+# workspace and cannot read it, because creating is a control-plane right and querying is a
+# data-plane one. That grant arrives with an infra apply, which is a deliberate act somebody
+# does later, so between installing this and applying that the job would be red every single
+# morning -- and a job that is red every morning is a job somebody switches off, taking the
+# working version with it.
+#
+# Nothing is lost by being quiet here. There is no report to withhold and no half-written
+# issue: there are no rows. The reason is on the run, in the log and in the job summary.
+if ! az monitor log-analytics query \
+  --workspace "$WORKSPACE_ID" \
+  --analytics-query "$QUERY" \
+  --output json > "${OUTPUT}.tmp" 2> "${OUTPUT}.err"; then
+
+  # The reason, without the token the CLI sometimes prints beside it.
+  reason="$(sed -E 's/(Bearer|access_token|client_secret)[^ ]*/\1 [redacted]/gi' "${OUTPUT}.err" | tail -3 | tr '\n' ' ')"
+  rm -f "${OUTPUT}.tmp" "${OUTPUT}.err"
+
+  echo "::warning::The workspace could not be read, so nothing was collected. The identity needs Monitoring Reader on this workspace. ${reason}"
+  exit 0
+fi
+
+mv "${OUTPUT}.tmp" "$OUTPUT"
+rm -f "${OUTPUT}.err"
+
+# Counted here rather than in the step after, so a query that returns nothing is visible in
+# the log at the point it happened instead of looking like a parsing problem later.
+rows="$(python3 -c 'import json,sys; print(len(json.load(open(sys.argv[1]))))' "$OUTPUT" 2>/dev/null || echo 0)"
+echo "The workspace returned ${rows} grouped exception(s) over the last ${LOOKBACK_HOURS}h."

package/loops/actions/create-agent-issues/action.yml

@@ -1,52 +1,52 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/create-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Create agent issues
-description: Create every create_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-outputs:
-  created-count:
-    description: Number of issues created.
-    value: ${{ steps.create.outputs.created-count }}
-  first-issue-number:
-    description: Issue number of the first issue created, or empty.
-    value: ${{ steps.create.outputs.first-issue-number }}
-runs:
-  using: composite
-  steps:
-    - name: Create issues
-      id: create
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'create_issue');
-
-          const created = [];
-
-          for (const item of items) {
-            if (!item.title) {
-              core.warning(`create_issue item has no title, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const { data } = await github.rest.issues.create({
-              ...context.repo,
-              title: item.title,
-              body: item.body ?? '',
-            });
-
-            created.push(data.number);
-            core.info(`Created #${data.number}: ${item.title}`);
-          }
-
-          core.setOutput('created-count', String(created.length));
-          core.setOutput('first-issue-number', created.length > 0 ? String(created[0]) : '');
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/create-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Create agent issues
+description: Create every create_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+outputs:
+  created-count:
+    description: Number of issues created.
+    value: ${{ steps.create.outputs.created-count }}
+  first-issue-number:
+    description: Issue number of the first issue created, or empty.
+    value: ${{ steps.create.outputs.first-issue-number }}
+runs:
+  using: composite
+  steps:
+    - name: Create issues
+      id: create
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'create_issue');
+
+          const created = [];
+
+          for (const item of items) {
+            if (!item.title) {
+              core.warning(`create_issue item has no title, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const { data } = await github.rest.issues.create({
+              ...context.repo,
+              title: item.title,
+              body: item.body ?? '',
+            });
+
+            created.push(data.number);
+            core.info(`Created #${data.number}: ${item.title}`);
+          }
+
+          core.setOutput('created-count', String(created.length));
+          core.setOutput('first-issue-number', created.length > 0 ? String(created[0]) : '');

package/loops/actions/create-issue-comment/action.yml

@@ -1,29 +1,29 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/create-issue-comment/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Create issue comment
-description: Create a comment on an issue or pull request.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue or pull request number.
-    required: true
-  body:
-    description: Complete Markdown comment body.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Create comment
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        BODY: ${{ inputs.body }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          await github.rest.issues.createComment({
-            ...context.repo,
-            issue_number: Number(process.env.ISSUE_NUMBER),
-            body: process.env.BODY,
-          });
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/create-issue-comment/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Create issue comment
+description: Create a comment on an issue or pull request.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue or pull request number.
+    required: true
+  body:
+    description: Complete Markdown comment body.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Create comment
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        BODY: ${{ inputs.body }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          await github.rest.issues.createComment({
+            ...context.repo,
+            issue_number: Number(process.env.ISSUE_NUMBER),
+            body: process.env.BODY,
+          });

package/loops/actions/download-agent-output/action.yml

@@ -1,53 +1,53 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/download-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Download agent output
-description: Download the agent artifact and expose the output JSON and bundle paths.
-inputs:
-  artifact-name:
-    description: >-
-      Artifact name to download. gh-aw prefixes it with the value it derives from the
-      workflow's inputs, so a workflow_call worker must pass the activation job's
-      artifact_prefix output followed by "agent", not the bare name.
-    required: true
-outputs:
-  output-file:
-    description: Path to agent_output.json, or empty if not found.
-    value: ${{ steps.download.outputs.output-file }}
-  bundle-file:
-    description: Path to the git bundle, or empty if not found.
-    value: ${{ steps.download.outputs.bundle-file }}
-  item-count:
-    description: Number of items in the agent output.
-    value: ${{ steps.download.outputs.item-count }}
-runs:
-  using: composite
-  steps:
-    - name: Download agent artifact
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ inputs.artifact-name }}
-        path: agent-artifact
-    - name: Locate output and bundle
-      id: download
-      shell: bash
-      env:
-        ARTIFACT_NAME: ${{ inputs.artifact-name }}
-      run: |
-        set -euo pipefail
-        OUTPUT_FILE=""
-        BUNDLE_FILE=""
-        ITEM_COUNT="0"
-
-        if [ -f "agent-artifact/agent_output.json" ]; then
-          OUTPUT_FILE="agent-artifact/agent_output.json"
-          ITEM_COUNT=$(jq '.items | length' "$OUTPUT_FILE")
-          BUNDLE_FILE=$(ls agent-artifact/aw-*.bundle 2>/dev/null | head -1 || true)
-        else
-          echo "::error::Artifact '$ARTIFACT_NAME' contained no agent_output.json. Nothing the agent proposed will be applied."
-          exit 1
-        fi
-
-        echo "Artifact '$ARTIFACT_NAME' carries $ITEM_COUNT item(s)."
-
-        echo "output-file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
-        echo "bundle-file=$BUNDLE_FILE" >> "$GITHUB_OUTPUT"
-        echo "item-count=$ITEM_COUNT" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/download-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Download agent output
+description: Download the agent artifact and expose the output JSON and bundle paths.
+inputs:
+  artifact-name:
+    description: >-
+      Artifact name to download. gh-aw prefixes it with the value it derives from the
+      workflow's inputs, so a workflow_call worker must pass the activation job's
+      artifact_prefix output followed by "agent", not the bare name.
+    required: true
+outputs:
+  output-file:
+    description: Path to agent_output.json, or empty if not found.
+    value: ${{ steps.download.outputs.output-file }}
+  bundle-file:
+    description: Path to the git bundle, or empty if not found.
+    value: ${{ steps.download.outputs.bundle-file }}
+  item-count:
+    description: Number of items in the agent output.
+    value: ${{ steps.download.outputs.item-count }}
+runs:
+  using: composite
+  steps:
+    - name: Download agent artifact
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: agent-artifact
+    - name: Locate output and bundle
+      id: download
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.artifact-name }}
+      run: |
+        set -euo pipefail
+        OUTPUT_FILE=""
+        BUNDLE_FILE=""
+        ITEM_COUNT="0"
+
+        if [ -f "agent-artifact/agent_output.json" ]; then
+          OUTPUT_FILE="agent-artifact/agent_output.json"
+          ITEM_COUNT=$(jq '.items | length' "$OUTPUT_FILE")
+          BUNDLE_FILE=$(ls agent-artifact/aw-*.bundle 2>/dev/null | head -1 || true)
+        else
+          echo "::error::Artifact '$ARTIFACT_NAME' contained no agent_output.json. Nothing the agent proposed will be applied."
+          exit 1
+        fi
+
+        echo "Artifact '$ARTIFACT_NAME' carries $ITEM_COUNT item(s)."
+
+        echo "output-file=$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
+        echo "bundle-file=$BUNDLE_FILE" >> "$GITHUB_OUTPUT"
+        echo "item-count=$ITEM_COUNT" >> "$GITHUB_OUTPUT"

package/loops/actions/link-pr-to-issue/action.yml

@@ -1,40 +1,40 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/link-pr-to-issue/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Link pull request to issue
-description: Ensure the pull request body carries a closing reference to its source issue.
-inputs:
-  token:
-    description: GitHub token with pull-requests write access.
-    required: true
-  pr-number:
-    description: Pull request number.
-    required: true
-  issue-number:
-    description: Issue number the pull request should close.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Ensure a closing reference
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-      run: |
-        set -euo pipefail
-
-        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json closingIssuesReferences,body)"
-
-        if [ "$(jq '.closingIssuesReferences | length' <<<"$pr")" -gt 0 ]; then
-          echo "PR #$PR_NUMBER already closes an issue."
-          exit 0
-        fi
-
-        # A closing reference can only be created from the pull request body; there is no
-        # REST or GraphQL mutation for it.
-        body="$(jq -r '.body // ""' <<<"$pr")"
-        printf '%s\n\nCloses #%s\n' "$body" "$ISSUE_NUMBER" > /tmp/pr-body.md
-
-        gh pr edit "$PR_NUMBER" --repo "$REPO" --body-file /tmp/pr-body.md
-        echo "Added 'Closes #$ISSUE_NUMBER' to PR #$PR_NUMBER."
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/link-pr-to-issue/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Link pull request to issue
+description: Ensure the pull request body carries a closing reference to its source issue.
+inputs:
+  token:
+    description: GitHub token with pull-requests write access.
+    required: true
+  pr-number:
+    description: Pull request number.
+    required: true
+  issue-number:
+    description: Issue number the pull request should close.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Ensure a closing reference
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+      run: |
+        set -euo pipefail
+
+        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json closingIssuesReferences,body)"
+
+        if [ "$(jq '.closingIssuesReferences | length' <<<"$pr")" -gt 0 ]; then
+          echo "PR #$PR_NUMBER already closes an issue."
+          exit 0
+        fi
+
+        # A closing reference can only be created from the pull request body; there is no
+        # REST or GraphQL mutation for it.
+        body="$(jq -r '.body // ""' <<<"$pr")"
+        printf '%s\n\nCloses #%s\n' "$body" "$ISSUE_NUMBER" > /tmp/pr-body.md
+
+        gh pr edit "$PR_NUMBER" --repo "$REPO" --body-file /tmp/pr-body.md
+        echo "Added 'Closes #$ISSUE_NUMBER' to PR #$PR_NUMBER."

package/loops/actions/list-open-issues/action.yml

@@ -1,33 +1,33 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/list-open-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: List open issues
-description: |
-  Writes all open issues (number, title, labels) to `/tmp/gh-aw/agent/open-issues.json`
-  so the agent can check for semantic duplicates without spending turns discovering them.
-inputs:
-  token:
-    description: GitHub token with issues:read permission.
-    required: true
-  repo:
-    description: Repository in `owner/name` format.
-    required: true
-  output-path:
-    description: Path to write the JSON output.
-    required: false
-    default: /tmp/gh-aw/agent/open-issues.json
-runs:
-  using: composite
-  steps:
-    - name: List open issues
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ inputs.repo }}
-        OUTPUT_PATH: ${{ inputs.output-path }}
-      run: |
-        set -euo pipefail
-        mkdir -p "$(dirname "$OUTPUT_PATH")"
-        gh issue list --repo "$REPO" --state open --limit 500 \
-          --json number,title,labels \
-          --jq '[.[] | {number, title, labels: [.labels[].name]}]' \
-          > "$OUTPUT_PATH"
-        echo "Wrote $(jq 'length' "$OUTPUT_PATH") open issues to $OUTPUT_PATH"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/list-open-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: List open issues
+description: |
+  Writes all open issues (number, title, labels) to `/tmp/gh-aw/agent/open-issues.json`
+  so the agent can check for semantic duplicates without spending turns discovering them.
+inputs:
+  token:
+    description: GitHub token with issues:read permission.
+    required: true
+  repo:
+    description: Repository in `owner/name` format.
+    required: true
+  output-path:
+    description: Path to write the JSON output.
+    required: false
+    default: /tmp/gh-aw/agent/open-issues.json
+runs:
+  using: composite
+  steps:
+    - name: List open issues
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ inputs.repo }}
+        OUTPUT_PATH: ${{ inputs.output-path }}
+      run: |
+        set -euo pipefail
+        mkdir -p "$(dirname "$OUTPUT_PATH")"
+        gh issue list --repo "$REPO" --state open --limit 500 \
+          --json number,title,labels \
+          --jq '[.[] | {number, title, labels: [.labels[].name]}]' \
+          > "$OUTPUT_PATH"
+        echo "Wrote $(jq 'length' "$OUTPUT_PATH") open issues to $OUTPUT_PATH"

package/loops/actions/load-issue-context/action.yml

@@ -1,45 +1,45 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/load-issue-context/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Load issue context
-description: Write issue metadata and comment context to a JSON file.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue number to load.
-    required: true
-  output-path:
-    description: Absolute path where context JSON is written.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Load issue and comments
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        OUTPUT_PATH: ${{ inputs.output-path }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const fs = require('fs');
-          const issueNumber = Number(process.env.ISSUE_NUMBER);
-          const issue = await github.rest.issues.get({ ...context.repo, issue_number: issueNumber });
-          const comments = await github.paginate(github.rest.issues.listComments, {
-            ...context.repo, issue_number: issueNumber, per_page: 100,
-          });
-
-          fs.mkdirSync(require('path').dirname(process.env.OUTPUT_PATH), { recursive: true });
-          fs.writeFileSync(process.env.OUTPUT_PATH, JSON.stringify({
-            number: issue.data.number,
-            title: issue.data.title,
-            body: issue.data.body,
-            author: issue.data.user.login,
-            authorAssociation: issue.data.author_association,
-            labels: issue.data.labels.map(({ name }) => name),
-            comments: comments.map(({ user, author_association, body }) => ({
-              author: user.login,
-              association: author_association,
-              body,
-            })),
-          }, null, 2));
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/load-issue-context/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Load issue context
+description: Write issue metadata and comment context to a JSON file.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue number to load.
+    required: true
+  output-path:
+    description: Absolute path where context JSON is written.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Load issue and comments
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_PATH: ${{ inputs.output-path }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const fs = require('fs');
+          const issueNumber = Number(process.env.ISSUE_NUMBER);
+          const issue = await github.rest.issues.get({ ...context.repo, issue_number: issueNumber });
+          const comments = await github.paginate(github.rest.issues.listComments, {
+            ...context.repo, issue_number: issueNumber, per_page: 100,
+          });
+
+          fs.mkdirSync(require('path').dirname(process.env.OUTPUT_PATH), { recursive: true });
+          fs.writeFileSync(process.env.OUTPUT_PATH, JSON.stringify({
+            number: issue.data.number,
+            title: issue.data.title,
+            body: issue.data.body,
+            author: issue.data.user.login,
+            authorAssociation: issue.data.author_association,
+            labels: issue.data.labels.map(({ name }) => name),
+            comments: comments.map(({ user, author_association, body }) => ({
+              author: user.login,
+              association: author_association,
+              body,
+            })),
+          }, null, 2));