@plainconceptsplatform/workflows 0.20.3 → 0.21.0

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -372,6 +372,52 @@ else
 fi
 if [ "$MIRROR_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
+# Third-party action pins are the same shape of problem. Every `uses:` in a package-managed
+# file is pinned to a full commit SHA, and one action must resolve to exactly one SHA across
+# the whole package: the router, the workers, the shared mechanics and the composite actions
+# are installed together, so two pins for one action mean two versions of it run in the same
+# repository, and the older one is invisible until it breaks. That is how the merge-belt
+# dispatchers ran create-github-app-token v2.0.6 for a release while every worker ran v3.2.0:
+# nothing failed, nothing flagged it, and the action that receives the App's private key was
+# the stale one. Templates are excluded: they are consumer-owned from installation and
+# deliberately carry their own versions (the CI templates pin download-artifact v6 while the
+# loops pin v8). A floating tag (`@v4`) is a missing pin and fails the same check.
+PIN_OK=1
+declare -A PIN_SEEN
+PKG_ROOT="$(cd "${HERE}/../../.." && pwd)"
+pin_scan() {
+  local file="$1" line action ref
+  # Resolve to an absolute path so the package-relative name in the failure reads like the
+  # source tree, not like this script's location.
+  file="$(cd "$(dirname "$file")" && pwd)/$(basename "$file")"
+  local shown="${file#"${PKG_ROOT}/"}"
+  # Anchored on the line start so a comment quoting a `uses:` cannot match, and tolerant of
+  # both spellings (`uses:` as a mapping key and `- uses:` as a list item). Local composite
+  # actions (`./.github/actions/...`) and docker refs carry no `@` and never match.
+  local pin_re='^[[:space:]]*-?[[:space:]]*uses:[[:space:]]+([A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+)@([A-Za-z0-9._-]+)'
+  while IFS= read -r line; do
+    [[ "$line" =~ $pin_re ]] || continue
+    action="${BASH_REMATCH[1]}"
+    ref="${BASH_REMATCH[2]}"
+    if [ "${PIN_SEEN[$action]+set}" ] && [ "${PIN_SEEN[$action]}" != "$ref" ]; then
+      PIN_OK=0
+      echo "FAIL: ${shown} pins ${action}@${ref} but ${PIN_SEEN[$action]} is pinned elsewhere; one action, one pin" >&2
+    else
+      PIN_SEEN[$action]="$ref"
+    fi
+    if [ "${#ref}" -ne 40 ]; then
+      PIN_OK=0
+      echo "FAIL: ${shown} uses ${action}@${ref}; a tag is mutable, pin the full commit SHA" >&2
+    fi
+  done < "$file"
+}
+for pin_file in "$ROUTER_YML" "${WORKFLOWS_DIR}"/agent-*.md "${WORKFLOWS_DIR}"/shared/*.md \
+  "${WORKFLOWS_DIR}"/authorize-bot-work.yml "${HERE}/.."/*/action.yml; do
+  [ -f "$pin_file" ] || continue
+  pin_scan "$pin_file"
+done
+if [ "$PIN_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
 # Run the belt's own jq, rather than reading it. The filter that picks which open pull requests
 # the hourly reconcile job acts on was written as
 #   ((env.TRUSTED_BOTS | split(" ")) | index(.user.login) != null)
@@ -841,19 +887,16 @@ if worker_installed implement; then
     PUSH_FALLBACK_OK=0
     echo "FAIL: implement gates a no-pull-request path on code_push_failure_count, which is 0 when gh-aw files the patch as an issue" >&2
   fi
-  for needed in 'PUSH_CONFLICT_COMMENT' 'NO_PULL_REQUEST_COMMENT'; do
-    grep -qF "env.${needed}" "$IMPLEMENT_WORKER_MD" || {
-      PUSH_FALLBACK_OK=0
-      echo "FAIL: implement no longer says env.${needed} on any path" >&2
-    }
-  done
-  # Collapsing them back into one message is the regression this guards: each is defined once in
-  # the env block and printed on exactly one path, so two usages of either means the conditions
-  # have been merged or duplicated.
-  if [ "$(count -cF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ] ||
-     [ "$(count -cF 'env.NO_PULL_REQUEST_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
+  grep -qF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD" || {
+    PUSH_FALLBACK_OK=0
+    echo "FAIL: implement no longer says env.PUSH_CONFLICT_COMMENT on any path" >&2
+  }
+  # Collapsing this back into whatever covers the other endings is the regression this guards: it
+  # is defined once in the env block and printed on exactly one path. The four messages it used to
+  # be paired with are asserted together under "Ways a run ends with nothing".
+  if [ "$(count -cF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
     PUSH_FALLBACK_OK=0
-    echo "FAIL: implement should print each no-pull-request message on exactly one path" >&2
+    echo "FAIL: implement should print the conflicted-push message on exactly one path" >&2
   fi
   # And the two paths must be mutually exclusive, or a conflicted push gets both comments.
   if [ "$(count -cF "process_safe_outputs_items_succeeded != '0'" "$IMPLEMENT_WORKER_MD")" -lt 2 ] ||
@@ -1202,6 +1245,31 @@ echo "── Merge gate validator ───────────────
 # reasoning alone, and the worker has not run in production since, so these fixtures are the only
 # evidence the change is right. Executing the real script is the same technique that finally
 # caught the belt's jq bug, which every reading assertion had walked past.
+# The gate comments on every bot pull request, so anything it writes there is written dozens of
+# times a week. A CODEOWNERS of `* @someone` matches every pull request, so the owners row was
+# naming four people on routine auto-merges and @-mentioning each of them, which notifies them.
+# The row belongs to the disposition that actually wants an owner, and the names go in a code
+# span so the comment reports who owns the area without pinging them: on owner-review the gate
+# requests the review properly, and that is the notification.
+if worker_installed merge-gate; then
+  OWNERS_OK=1
+  if ! grep -q "outcome == 'owner-review'" "$MERGE_GATE_WORKER_MD"; then
+    OWNERS_OK=0
+    echo "FAIL: the gate comment names required owners unconditionally; gate the row on owner-review" >&2
+  fi
+  # Every rendering of required_owners has to sit inside a code span.
+  while IFS= read -r line; do
+    case "$line" in
+      *'`{0}`'*|*'`${{ needs.protected_changes.outputs.required_owners'*) continue ;;
+      *)
+        OWNERS_OK=0
+        echo "FAIL: required_owners is rendered without a code span, so the gate @-mentions people: ${line# }" >&2
+        ;;
+    esac
+  done < <(grep -F 'required_owners' "$MERGE_GATE_WORKER_MD" | grep -vE '^\s*(#|[a-z_]+:)' | grep -F 'Required owners')
+  if [ "$OWNERS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 # Blast radius is the input the merge decision leans on hardest, and it is the one a reader
 # cannot check by eye. These cases are the six real pull requests the redesign was measured
 # against, reduced to their shape: the three that used to be parked for a person purely because
@@ -1872,6 +1940,71 @@ if worker_installed audit; then
   if [ "$AUDIT_EMPTY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+echo "── Ways a run ends with nothing ──────────────────────────────────────────"
+
+# A run can end without a pull request in five ways and they need different answers. One sentence
+# covered all of them, and three issues in two days said "nothing landed": one agent gave up in a
+# minute, one did more work than the run that succeeded the same hour and never asked for a pull
+# request, one was told there was nothing to do. Nobody could act on any of them, and the retry
+# that followed was right for some and wasted on the rest.
+#
+# Asserted because collapsing two of these back together is a one-line edit that turns every run
+# green again while saying less.
+if worker_installed implement; then
+  ENDINGS_OK=1
+  ENDING_MESSAGES="PUSH_CONFLICT_COMMENT OUTPUT_NOT_APPLIED_COMMENT NOOP_COMMENT PATCH_WITHOUT_REQUEST_COMMENT NO_OUTPUT_COMMENT"
+
+  for message in $ENDING_MESSAGES; do
+    # Defined once in the env block and printed on exactly one path. Two usages means two
+    # branches now say the same thing, which is the collapse this guards.
+    if [ "$(count -cF "env.${message}" "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
+      ENDINGS_OK=0
+      echo "FAIL: implement should print ${message} on exactly one path" >&2
+    fi
+  done
+
+  # The sentence that used to cover all five. Its text survives as NO_OUTPUT_COMMENT; the name
+  # coming back means the branches were merged again.
+  if [ "$(count -cF 'NO_PULL_REQUEST_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    ENDINGS_OK=0
+    echo "FAIL: implement still carries NO_PULL_REQUEST_COMMENT, which said the same thing about five different endings" >&2
+  fi
+
+  # What tells them apart. Both are the agent job's own outputs, and gh-aw gates on the first
+  # itself, so losing them means guessing again.
+  for signal in 'needs.agent.outputs.output_types' 'needs.agent.outputs.has_patch'; do
+    if [ "$(count -cE "^ *if:.*${signal}" "$IMPLEMENT_WORKER_MD")" -eq 0 ]; then
+      ENDINGS_OK=0
+      echo "FAIL: implement no longer reads ${signal}, so it cannot tell its no-pull-request endings apart" >&2
+    fi
+  done
+
+  # `!x == 'true'` parses as `(!x) == 'true'` in a GitHub expression, which compares a boolean to
+  # a string and is always false. Written wrong here first, and it would have made the
+  # produced-nothing branch unreachable while every other branch still looked right.
+  if [ "$(count -cF "!needs.agent.outputs.has_patch ==" "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    ENDINGS_OK=0
+    echo "FAIL: implement negates has_patch as \`!x == 'true'\`, which binds as \`(!x) == 'true'\` and never matches; use != 'true'" >&2
+  fi
+
+  # A bot that reported nothing to do made a decision. The janitor retries a stalled issue, and
+  # re-running it produces the same answer, so this one path must not be flagged.
+  noop_block=$(awk "/name: Say there was nothing to do/{found=1} found{print} found && /View this workflow run/{exit}" "$IMPLEMENT_WORKER_MD")
+  if [ -n "$noop_block" ] && printf '%s' "$noop_block" | grep -qF 'STALLED_LABEL'; then
+    ENDINGS_OK=0
+    echo "FAIL: implement flags a deliberate noop as stalled, so the janitor will retry a decision until it runs out of attempts" >&2
+  fi
+
+  # The usage artifact carrying the token counts is uploaded by gh-aw's conclusion job, and that
+  # job already depends on conclude. Naming it is a cycle and the worker stops compiling.
+  if [ "$(count -cE "^ *needs:.*conclusion" "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    ENDINGS_OK=0
+    echo "FAIL: implement depends on the conclusion job, which depends on conclude; that cycle does not compile" >&2
+  fi
+
+  if [ "$ENDINGS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 echo "── Runner pools ──────────────────────────────────────────────────────────"
 
 # Where every job runs, stated once and asserted, because GitHub gives a wrong pool no error: a

package/loops/workflows/agent-implement.md

@@ -16,7 +16,25 @@ env:
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
   PR_PENDING_LABEL: pr-pending
-  NO_PULL_REQUEST_COMMENT: "The implementation run finished without producing a pull request. Nothing was lost, but nothing landed either: the issue keeps `implement` and is flagged for a retry."
+  # Five ways a run ends with no pull request, and they are not the same thing. One sentence
+  # covered all of them, which is why three issues in two days said "nothing landed" and none of
+  # them could be acted on: one agent gave up in a minute, another did more work than the run that
+  # succeeded and never asked for a pull request, and a third was told to stop. The retry that
+  # follows is right for some and wasted on the rest. Each is one line: the compiler flattens a
+  # multi-line env value.
+  #
+  # The agent produced nothing at all. Measured on Pliny-Bot #191: the model was called, replied
+  # with almost nothing each time, and emitted no safe output.
+  NO_OUTPUT_COMMENT: "The implementation run produced nothing at all: no patch, and no request to open a pull request. That is a failed run rather than a decision, so the issue keeps `implement` and is flagged for a retry."
+  # The agent wrote the code and never asked for it to be published. Measured on Pliny-Bot #175,
+  # whose run produced more output than the run that succeeded the same hour.
+  PATCH_WITHOUT_REQUEST_COMMENT: "The implementation wrote code but never asked for a pull request, so nothing was published and the patch is only in the run. The work is not lost -- it is in the run's artifacts -- but it has to be asked for again. The issue keeps `implement` and is flagged for a retry."
+  # The agent asked, and the handler did not apply it. Different from a push that conflicted:
+  # there, gh-aw kept the patch as an issue and said so.
+  OUTPUT_NOT_APPLIED_COMMENT: "The implementation asked for a pull request and it was not applied, so the request exists in the run and nothing reached the repository. That is a failure on our side of the handoff rather than the agent's, and it is flagged for a retry."
+  # The agent was asked to do the work and reported there was none. A decision, not a failure:
+  # retrying it produces the same answer, so it is not flagged stalled and the janitor leaves it.
+  NOOP_COMMENT: "The implementation ran and reported there was nothing to do. That is an answer rather than a failure, so the issue is not queued for another attempt. If it is wrong, say what is missing and label it `implement` again."
   # Said when the agent DID write the code and the push failed. gh-aw pushes through the GraphQL
   # signed-commits API, which rebases onto the current parent, so a `main` that moved under a long
   # run conflicts; gh-aw keeps the work by filing the patch as an issue rather than dropping it,
@@ -299,8 +317,83 @@ jobs:
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.PUSH_CONFLICT_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-      - name: Flag a run that produced no pull request
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '')
+      # Which of the remaining four happened, from what the agent itself reported.
+      #
+      # `output_types` and `has_patch` are the agent job's own outputs, and gh-aw gates on the
+      # first of them itself, so they are read here rather than invented. They are also the only
+      # way to tell these apart from `conclude`: the usage artifact that carries the token counts
+      # is uploaded by `conclusion`, and `conclusion` already depends on this job, so naming it is
+      # a dependency cycle that does not compile.
+      #
+      # Ordered most specific first, and each condition excludes the ones above it, so exactly one
+      # of the four fires. Pliny-Bot #191 is the last of them and #175 is the one before it: both
+      # said "nothing landed" and neither could be acted on, while #175's run had produced more
+      # output than the run that succeeded in the same hour.
+      - name: Flag a request that was not applied
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+            ${{ env.STALLED_LABEL }}
+      - name: Say the request was not applied
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.OUTPUT_NOT_APPLIED_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release an issue the agent found nothing to do on
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && contains(needs.agent.outputs.output_types, 'noop')
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+      - name: Take the implement label off a decided issue
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && contains(needs.agent.outputs.output_types, 'noop')
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.IMPLEMENT_LABEL }}
+      - name: Say there was nothing to do
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && contains(needs.agent.outputs.output_types, 'noop')
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.NOOP_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Flag a patch nobody asked to publish
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch == 'true'
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+            ${{ env.STALLED_LABEL }}
+      - name: Say the patch was never asked for
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.PATCH_WITHOUT_REQUEST_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Flag a run that produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -308,15 +401,15 @@ jobs:
           labels: |-
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
-      - name: Say so on the issue
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '')
+      - name: Say the run produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           body: |
             ${{ env.IMPLEMENT_MARKER }}
-            ${{ env.NO_PULL_REQUEST_COMMENT }}
+            ${{ env.NO_OUTPUT_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
   incomplete:
     needs: [agent, safe_outputs, eligibility]

package/loops/workflows/agent-merge-gate.md

@@ -285,7 +285,7 @@ jobs:
             Protected files:
             ${{ needs.protected_changes.outputs.files }}
 
-            Required owners: ${{ needs.protected_changes.outputs.required_owners || 'none configured' }}
+            Required owners: `${{ needs.protected_changes.outputs.required_owners || 'none configured' }}`
 
             **Verdict:** owner-review
 
@@ -439,7 +439,9 @@ jobs:
             | Files / lines | ${{ needs.protected_changes.outputs.files_changed }} / ${{ needs.protected_changes.outputs.lines_changed }} |
             | Protected paths | ${{ needs.protected_changes.outputs.requires_review == 'true' && 'yes' || 'no' }} |
             | Owner paths | ${{ needs.protected_changes.outputs.owner_hit == 'true' && 'yes' || 'no' }} |
-            | Required owners | ${{ needs.protected_changes.outputs.required_owners || 'none configured' }} |
+            ${{ needs.validate_output.outputs.outcome == 'owner-review'
+              && format('| Required owners | `{0}` |', needs.protected_changes.outputs.required_owners != '' && needs.protected_changes.outputs.required_owners || 'none configured, see the matched paths above')
+              || '' }}
 
             Why this blast radius:
             ```

package/loops/workflows/shared/opencode-ci.md

@@ -1,206 +1,206 @@
----
-# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/opencode-ci.md. Update with `workflows update --force`; consumer edits may be overwritten.
-env:
-  AGENTMEMORY_VERSION: "0.9.28"
-  CODEGRAPH_VERSION: "1.6.0"
-  RTK_VERSION: "0.44.1"
-  RTK_SHA256: "986f29704469b3d1051e2474105c6c75ab8b73651068dcd61612c1fb3938ad95"
-description: |
-  Shared CI setup for Platform agent workflows. Installs pinned tooling and merges
-  opencode.ci.json into opencode.jsonc so the CI agent gets its provider and model config.
-
-  Consumer-specific steps (NuGet, .NET restore, OpenSpec, etc.) should be added after the
-  shared baseline in the consumer copy. The merge step below is package-owned and required
-  for the agent to resolve its provider and its models.
-
-# Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
-# OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
-# package-owned and required for the agent to resolve its provider and models. Do not
-# remove it.
-pre-agent-steps:
-  - name: Create agent scratch directory
-    run: mkdir -p .opencode/.tmp
-
-  - name: Install the Docker Compose plugin
-    # The ARC runner image ships the docker CLI without the compose plugin, and awf drives its
-    # sandbox with `docker compose up`. User-space install; no root required.
-    run: |
-      set -euo pipefail
-      if docker compose version >/dev/null 2>&1; then
-        echo "compose already present"; exit 0
-      fi
-      mkdir -p "$HOME/.docker/cli-plugins"
-      curl -sSfL "https://github.com/docker/compose/releases/download/v2.39.2/docker-compose-linux-x86_64"         -o "$HOME/.docker/cli-plugins/docker-compose"
-      chmod +x "$HOME/.docker/cli-plugins/docker-compose"
-      docker compose version
-
-  - name: Install ripgrep
-    run: |
-      set -euo pipefail
-
-      if command -v rg > /dev/null 2>&1; then
-        echo "ripgrep already installed: $(rg --version | head -1)"
-        exit 0
-      fi
-
-      # ARC runner pods have no root, so ripgrep comes from its release tarball into a
-      # user-writable prefix instead of apt.
-      mkdir -p "$HOME/.local/bin"
-      curl -sSfL https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz         | tar -xz --strip-components=1 -C "$HOME/.local/bin" --wildcards "*/rg"
-      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-      rg --version
-
-  - name: Activate the pnpm version package.json pins
-    run: |
-      set -euo pipefail
-      corepack enable
-      corepack prepare --activate
-      pnpm --version
-
-  - name: Cache the pnpm store
-    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-    with:
-      path: ~/.local/share/pnpm/store
-      key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
-      restore-keys: pnpm-store-${{ runner.os }}-
-
-  - name: Install RTK
-    run: |
-      set -euo pipefail
-
-      if command -v rtk > /dev/null 2>&1 && rtk --version 2>/dev/null | grep -q "${RTK_VERSION}"; then
-        echo "RTK ${RTK_VERSION} already installed"
-        exit 0
-      fi
-
-      tarball="$RUNNER_TEMP/rtk.tar.gz"
-      curl -fsSL -o "$tarball" \
-        "https://github.com/rtk-ai/rtk/releases/download/v${RTK_VERSION}/rtk-x86_64-unknown-linux-musl.tar.gz"
-      echo "${RTK_SHA256}  $tarball" | sha256sum --check --strict
-
-      tar -xzf "$tarball" -C "$RUNNER_TEMP"
-      mkdir -p "$HOME/.local/bin"
-      install -m 0755 "$RUNNER_TEMP/rtk" "$HOME/.local/bin/rtk"
-      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-
-      rtk --version
-      rtk init -g --opencode --auto-patch
-
-  - name: Install agentmemory
-    run: |
-      set -euo pipefail
-
-      if command -v agentmemory > /dev/null 2>&1 && agentmemory --version 2>/dev/null | grep -q "${AGENTMEMORY_VERSION}"; then
-        echo "agentmemory ${AGENTMEMORY_VERSION} already installed"
-        exit 0
-      fi
-
-      npm install -g "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}"
-      agentmemory --version
-
-  - name: Restore the CodeGraph index
-    # Ephemeral ARC runners start empty, so without this every run rebuilds the whole graph.
-    # actions/cache is repository-scoped by design, which keeps consumers isolated, and
-    # each run saves an immutable snapshot under its own key at job end (the action's built-in
-    # post step), so two concurrent runs never write the same entry: the newest snapshot simply
-    # wins the next restore. The index lives in .codegraph inside the checkout plus a small
-    # registry in ~/.codegraph.
-    uses: actions/cache@v4
-    with:
-      path: |
-        .codegraph
-        ~/.codegraph
-      key: codegraph-${{ github.repository_id }}-${{ github.run_id }}
-      restore-keys: |
-        codegraph-${{ github.repository_id }}-
-
-  - name: Install codegraph and index the repository
-    continue-on-error: true
-    run: |
-      set -euo pipefail
-
-      if command -v codegraph > /dev/null 2>&1 && codegraph --version 2>/dev/null | grep -q "${CODEGRAPH_VERSION}"; then
-        echo "codegraph ${CODEGRAPH_VERSION} already installed"
-      else
-        npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
-      fi
-
-      codegraph init
-
-  - name: Install OpenSpec CLI
-    run: |
-      set -euo pipefail
-
-      if command -v openspec > /dev/null 2>&1 && openspec --version 2>/dev/null | grep -q "1.8.0"; then
-        echo "openspec 1.8.0 already installed"
-        exit 0
-      fi
-
-      npm install -g "@fission-ai/openspec@1.8.0"
-      openspec --version
-
-  # NOTE: playwright-cli and SQL Server startup steps are not part of the shared CI
-  # baseline. The agent path captures no visual evidence: it cannot reach a browser
-  # from inside the awf sandbox, and a screenshot with no baseline to compare against
-  # gated nothing. Run /ops-evidence locally when a change warrants screenshots. If
-  # you need playwright-cli or SQL Server inside the agent sandbox for other reasons,
-  # add them as consumer-specific steps after the shared baseline.
-
-  - name: Setup .NET
-    # Ephemeral VMs carry no SDK; the old host had it baked in, and GitHub-hosted images made
-    # the dependency invisible. setup-dotnet caches per run from the MS CDN.
-    uses: actions/setup-dotnet@v5
-    with:
-      dotnet-version: 10.0.x
-    env:
-      # the default /usr/share/dotnet needs root; the tool cache belongs to the runner user
-      DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
-
-  - name: Cache NuGet packages
-    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-    with:
-      path: ~/.nuget/packages
-      key: nuget-${{ runner.os }}-${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
-      restore-keys: nuget-${{ runner.os }}-
-
-  - name: Install workspace dependencies
-    run: pnpm install --frozen-lockfile
-
-  - name: Merge the CI-only OpenCode provider into opencode.jsonc
-    run: |
-      set -euo pipefail
-
-      CONFIG=opencode.jsonc
-      FRAGMENT=opencode.ci.json
-
-      [ -f "$FRAGMENT" ] || { echo "::error::$FRAGMENT is missing from the checkout"; exit 1; }
-
-      # Pure JSON on purpose, not JSONC: jq cannot parse `//` comments, and a naive
-      # comment-stripper would corrupt the `http://` inside the provider's api URL.
-      jq -e . "$FRAGMENT" > /dev/null \
-        || { echo "::error::$FRAGMENT is not valid JSON. Comments are not allowed in it."; exit 1; }
-
-      # Despite the .jsonc name, this file is committed in this repository and is read by
-      # jq below, so it must contain no comments. A single `//` line fails the merge with
-      # "Invalid numeric literal", which names neither the file nor the reason.
-      if [ -f "$CONFIG" ] && ! jq -e . "$CONFIG" > /dev/null 2>&1; then
-        echo "::error::$CONFIG is tracked and must be comment-free JSON: jq cannot parse it."
-        exit 1
-      fi
-
-      # opencode.jsonc is untracked in most repositories, so it usually does not exist here.
-      # Create it from the fragment when absent, merge when a checkout did provide one.
-      if [ -f "$CONFIG" ]; then
-        merged=$(jq -s '.[0] * .[1]' "$CONFIG" "$FRAGMENT")
-      else
-        merged=$(jq -S . "$FRAGMENT")
-      fi
-
-      printf '%s\n' "$merged" > "$CONFIG"
-
-      # gh-aw's own "Write OpenCode Config" step runs next and merges its base config with
-      # `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
-      # nor this provider, so both survive and `awf-proxy` is added alongside.
-      echo "Wrote $CONFIG from $FRAGMENT:"
-      jq -r '"  model: \(.model // "unset")", "  plugins: \(.plugin // [] | join(", "))", "  providers: \(.provider // {} | keys | join(", "))"' "$CONFIG"
----
+---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/opencode-ci.md. Update with `workflows update --force`; consumer edits may be overwritten.
+env:
+  AGENTMEMORY_VERSION: "0.9.28"
+  CODEGRAPH_VERSION: "1.6.0"
+  RTK_VERSION: "0.44.1"
+  RTK_SHA256: "986f29704469b3d1051e2474105c6c75ab8b73651068dcd61612c1fb3938ad95"
+description: |
+  Shared CI setup for Platform agent workflows. Installs pinned tooling and merges
+  opencode.ci.json into opencode.jsonc so the CI agent gets its provider and model config.
+
+  Consumer-specific steps (NuGet, .NET restore, OpenSpec, etc.) should be added after the
+  shared baseline in the consumer copy. The merge step below is package-owned and required
+  for the agent to resolve its provider and its models.
+
+# Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
+# OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
+# package-owned and required for the agent to resolve its provider and models. Do not
+# remove it.
+pre-agent-steps:
+  - name: Create agent scratch directory
+    run: mkdir -p .opencode/.tmp
+
+  - name: Install the Docker Compose plugin
+    # The ARC runner image ships the docker CLI without the compose plugin, and awf drives its
+    # sandbox with `docker compose up`. User-space install; no root required.
+    run: |
+      set -euo pipefail
+      if docker compose version >/dev/null 2>&1; then
+        echo "compose already present"; exit 0
+      fi
+      mkdir -p "$HOME/.docker/cli-plugins"
+      curl -sSfL "https://github.com/docker/compose/releases/download/v2.39.2/docker-compose-linux-x86_64"         -o "$HOME/.docker/cli-plugins/docker-compose"
+      chmod +x "$HOME/.docker/cli-plugins/docker-compose"
+      docker compose version
+
+  - name: Install ripgrep
+    run: |
+      set -euo pipefail
+
+      if command -v rg > /dev/null 2>&1; then
+        echo "ripgrep already installed: $(rg --version | head -1)"
+        exit 0
+      fi
+
+      # ARC runner pods have no root, so ripgrep comes from its release tarball into a
+      # user-writable prefix instead of apt.
+      mkdir -p "$HOME/.local/bin"
+      curl -sSfL https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz         | tar -xz --strip-components=1 -C "$HOME/.local/bin" --wildcards "*/rg"
+      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      rg --version
+
+  - name: Activate the pnpm version package.json pins
+    run: |
+      set -euo pipefail
+      corepack enable
+      corepack prepare --activate
+      pnpm --version
+
+  - name: Cache the pnpm store
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.local/share/pnpm/store
+      key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+      restore-keys: pnpm-store-${{ runner.os }}-
+
+  - name: Install RTK
+    run: |
+      set -euo pipefail
+
+      if command -v rtk > /dev/null 2>&1 && rtk --version 2>/dev/null | grep -q "${RTK_VERSION}"; then
+        echo "RTK ${RTK_VERSION} already installed"
+        exit 0
+      fi
+
+      tarball="$RUNNER_TEMP/rtk.tar.gz"
+      curl -fsSL -o "$tarball" \
+        "https://github.com/rtk-ai/rtk/releases/download/v${RTK_VERSION}/rtk-x86_64-unknown-linux-musl.tar.gz"
+      echo "${RTK_SHA256}  $tarball" | sha256sum --check --strict
+
+      tar -xzf "$tarball" -C "$RUNNER_TEMP"
+      mkdir -p "$HOME/.local/bin"
+      install -m 0755 "$RUNNER_TEMP/rtk" "$HOME/.local/bin/rtk"
+      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      rtk --version
+      rtk init -g --opencode --auto-patch
+
+  - name: Install agentmemory
+    run: |
+      set -euo pipefail
+
+      if command -v agentmemory > /dev/null 2>&1 && agentmemory --version 2>/dev/null | grep -q "${AGENTMEMORY_VERSION}"; then
+        echo "agentmemory ${AGENTMEMORY_VERSION} already installed"
+        exit 0
+      fi
+
+      npm install -g "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}"
+      agentmemory --version
+
+  - name: Restore the CodeGraph index
+    # Ephemeral ARC runners start empty, so without this every run rebuilds the whole graph.
+    # actions/cache is repository-scoped by design, which keeps consumers isolated, and
+    # each run saves an immutable snapshot under its own key at job end (the action's built-in
+    # post step), so two concurrent runs never write the same entry: the newest snapshot simply
+    # wins the next restore. The index lives in .codegraph inside the checkout plus a small
+    # registry in ~/.codegraph.
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: |
+        .codegraph
+        ~/.codegraph
+      key: codegraph-${{ github.repository_id }}-${{ github.run_id }}
+      restore-keys: |
+        codegraph-${{ github.repository_id }}-
+
+  - name: Install codegraph and index the repository
+    continue-on-error: true
+    run: |
+      set -euo pipefail
+
+      if command -v codegraph > /dev/null 2>&1 && codegraph --version 2>/dev/null | grep -q "${CODEGRAPH_VERSION}"; then
+        echo "codegraph ${CODEGRAPH_VERSION} already installed"
+      else
+        npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
+      fi
+
+      codegraph init
+
+  - name: Install OpenSpec CLI
+    run: |
+      set -euo pipefail
+
+      if command -v openspec > /dev/null 2>&1 && openspec --version 2>/dev/null | grep -q "1.8.0"; then
+        echo "openspec 1.8.0 already installed"
+        exit 0
+      fi
+
+      npm install -g "@fission-ai/openspec@1.8.0"
+      openspec --version
+
+  # NOTE: playwright-cli and SQL Server startup steps are not part of the shared CI
+  # baseline. The agent path captures no visual evidence: it cannot reach a browser
+  # from inside the awf sandbox, and a screenshot with no baseline to compare against
+  # gated nothing. Run /ops-evidence locally when a change warrants screenshots. If
+  # you need playwright-cli or SQL Server inside the agent sandbox for other reasons,
+  # add them as consumer-specific steps after the shared baseline.
+
+  - name: Setup .NET
+    # Ephemeral VMs carry no SDK; the old host had it baked in, and GitHub-hosted images made
+    # the dependency invisible. setup-dotnet caches per run from the MS CDN.
+    uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+    with:
+      dotnet-version: 10.0.x
+    env:
+      # the default /usr/share/dotnet needs root; the tool cache belongs to the runner user
+      DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
+
+  - name: Cache NuGet packages
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.nuget/packages
+      key: nuget-${{ runner.os }}-${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
+      restore-keys: nuget-${{ runner.os }}-
+
+  - name: Install workspace dependencies
+    run: pnpm install --frozen-lockfile
+
+  - name: Merge the CI-only OpenCode provider into opencode.jsonc
+    run: |
+      set -euo pipefail
+
+      CONFIG=opencode.jsonc
+      FRAGMENT=opencode.ci.json
+
+      [ -f "$FRAGMENT" ] || { echo "::error::$FRAGMENT is missing from the checkout"; exit 1; }
+
+      # Pure JSON on purpose, not JSONC: jq cannot parse `//` comments, and a naive
+      # comment-stripper would corrupt the `http://` inside the provider's api URL.
+      jq -e . "$FRAGMENT" > /dev/null \
+        || { echo "::error::$FRAGMENT is not valid JSON. Comments are not allowed in it."; exit 1; }
+
+      # Despite the .jsonc name, this file is committed in this repository and is read by
+      # jq below, so it must contain no comments. A single `//` line fails the merge with
+      # "Invalid numeric literal", which names neither the file nor the reason.
+      if [ -f "$CONFIG" ] && ! jq -e . "$CONFIG" > /dev/null 2>&1; then
+        echo "::error::$CONFIG is tracked and must be comment-free JSON: jq cannot parse it."
+        exit 1
+      fi
+
+      # opencode.jsonc is untracked in most repositories, so it usually does not exist here.
+      # Create it from the fragment when absent, merge when a checkout did provide one.
+      if [ -f "$CONFIG" ]; then
+        merged=$(jq -s '.[0] * .[1]' "$CONFIG" "$FRAGMENT")
+      else
+        merged=$(jq -S . "$FRAGMENT")
+      fi
+
+      printf '%s\n' "$merged" > "$CONFIG"
+
+      # gh-aw's own "Write OpenCode Config" step runs next and merges its base config with
+      # `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
+      # nor this provider, so both survive and `awf-proxy` is added alongside.
+      echo "Wrote $CONFIG from $FRAGMENT:"
+      jq -r '"  model: \(.model // "unset")", "  plugins: \(.plugin // [] | join(", "))", "  providers: \(.provider // {} | keys | join(", "))"' "$CONFIG"
+---

package/loops/workflows/work-router.yml

@@ -698,7 +698,7 @@ jobs:
           persist-credentials: false
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
@@ -896,7 +896,7 @@ jobs:
           persist-credentials: false
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.20.3",
+  "version": "0.21.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",