@plainconceptsplatform/workflows 0.28.25 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/stack-defaults.js +27 -35
- package/loops/actions/verify-route-matrix/verify-route-matrix.sh +31 -39
- package/loops/scripts/compile-agent-workflows.mjs +349 -346
- package/loops/templates/agentics/agentics-checks.yml +1 -1
- package/loops/templates/agentics/agentics-maintenance.yml +5 -5
- package/loops/templates/opencode/opencode.ci.json +45 -36
- package/loops/workflows/agent-apply-review.md +1 -1
- package/loops/workflows/agent-audit.md +1 -1
- package/loops/workflows/agent-implement.md +1 -1
- package/loops/workflows/agent-merge-gate.md +1 -1
- package/loops/workflows/agent-refine.md +1 -1
- package/loops/workflows/agent-release.md +1 -1
- package/loops/workflows/agent-triage.md +1 -1
- package/loops/workflows/agent-visual-verify.md +1 -1
- package/loops/workflows/shared/opencode-ci.md +1 -1
- package/package.json +1 -1
|
@@ -25,7 +25,7 @@ env:
|
|
|
25
25
|
# Must match the version the locks were compiled with (first line of every .lock.yml) and the
|
|
26
26
|
# `github/gh-aw/...@vX` import pin in every worker. A different compiler regenerates every lock
|
|
27
27
|
# and the freshness diff measures the version, not the change under review.
|
|
28
|
-
GH_AW_VERSION: v0.
|
|
28
|
+
GH_AW_VERSION: v0.87.5
|
|
29
29
|
ACTIONLINT_VERSION: 1.7.7
|
|
30
30
|
ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
|
|
31
31
|
SHELLCHECK_VERSION: 0.10.0
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
|
|
2
|
-
# Derived from the gh-aw v0.
|
|
2
|
+
# Derived from the gh-aw v0.87.5 maintenance workflow.
|
|
3
3
|
# Copy provenance is documented in docs/ownership.md.
|
|
4
4
|
name: Agentic Maintenance
|
|
5
5
|
|
|
@@ -53,7 +53,7 @@ jobs:
|
|
|
53
53
|
discussions: write
|
|
54
54
|
steps:
|
|
55
55
|
- name: Setup Scripts
|
|
56
|
-
uses: github/gh-aw-actions/setup@
|
|
56
|
+
uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
|
|
57
57
|
with:
|
|
58
58
|
destination: ${{ runner.temp }}/gh-aw/actions
|
|
59
59
|
- name: Close expired discussions
|
|
@@ -71,7 +71,7 @@ jobs:
|
|
|
71
71
|
issues: write
|
|
72
72
|
steps:
|
|
73
73
|
- name: Setup Scripts
|
|
74
|
-
uses: github/gh-aw-actions/setup@
|
|
74
|
+
uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
|
|
75
75
|
with:
|
|
76
76
|
destination: ${{ runner.temp }}/gh-aw/actions
|
|
77
77
|
- name: Close expired issues
|
|
@@ -89,7 +89,7 @@ jobs:
|
|
|
89
89
|
pull-requests: write
|
|
90
90
|
steps:
|
|
91
91
|
- name: Setup Scripts
|
|
92
|
-
uses: github/gh-aw-actions/setup@
|
|
92
|
+
uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
|
|
93
93
|
with:
|
|
94
94
|
destination: ${{ runner.temp }}/gh-aw/actions
|
|
95
95
|
- name: Close expired pull requests
|
|
@@ -107,7 +107,7 @@ jobs:
|
|
|
107
107
|
actions: write
|
|
108
108
|
steps:
|
|
109
109
|
- name: Setup Scripts
|
|
110
|
-
uses: github/gh-aw-actions/setup@
|
|
110
|
+
uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
|
|
111
111
|
with:
|
|
112
112
|
destination: ${{ runner.temp }}/gh-aw/actions
|
|
113
113
|
- name: Cleanup outdated cache-memory entries
|
|
@@ -1,54 +1,60 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://opencode.ai/config.json",
|
|
3
3
|
"model": "forge/glm-5-2",
|
|
4
|
-
"plugin": [],
|
|
5
4
|
"default_agent": "ci-workflow-agent",
|
|
6
|
-
"
|
|
5
|
+
"agents": {
|
|
7
6
|
"ci-workflow-agent": {
|
|
8
7
|
"description": "Executes GitHub Agentic Workflow tasks in CI.",
|
|
9
8
|
"mode": "primary",
|
|
10
|
-
"
|
|
9
|
+
"system": "You execute the GitHub Agentic Workflow task in the user prompt. Read AGENTS.md before any non-trivial change. Load only skills the workflow task explicitly names via skill(); when a workflow says load @skill-name, call skill(\"skill-name\"), the @ prefix is just a hint to use the skill tool. Execute only the requested task and required commands. Do not probe or inspect unrelated commands. The GitHub CLI is intentionally unauthenticated: never use `gh` for GitHub reads or writes. Read supplied workflow files first, then use the GitHub MCP tools only when fresh GitHub data is required. Use direct `safeoutputs` commands for GitHub writes. Each safe-output type has a small per-run allowance, and a call that fails still spends it: never send an empty, partial or test payload to discover what a tool accepts, because that probe can be recorded as a success, take the allowance with it, and leave the real call refused as over the limit, ending a run that did all the work and published none of it. Call each safe-output tool once, with the complete final payload, only when you are ready to commit to the outcome. For syntax-only validation of a conventional GitHub Actions YAML file, use Ruby's standard YAML library; do not probe, install, or fall back through PyYAML, js-yaml, actionlint, or Docker. A task is complete only after every required Safe Outputs command succeeds. After the final required Safe Outputs command, stop immediately without further tools, prose, or model turns. Use `mcpscripts` only when the runtime explicitly lists it as available.\n\nOUTPUT DISCIPLINE: Do not narrate. Do not explain what you are about to do before doing it. Do not write prose between tool calls. Call tools silently. The only prose you produce is the final result or a brief error explanation when something fails. Never output sentences like 'Let me check...', 'Now I will...', 'I have enough context...', or 'Next I need to...'. If you are about to call a tool, just call it. If you must think, use the todowrite tool, not prose.\n\nMEMORY: agentmemory is the shared long-term store. Start non-trivial tasks by calling its recall/search tool with the key concepts of the task (component names, error text) and reuse what it returns instead of rediscovering it. Before finishing, store 1-3 concise memories of durable non-obvious learnings: architecture constraints, root causes and their fixes, decisions and their why. Skip trivia the repo already documents. Never store secrets or tokens."
|
|
11
10
|
},
|
|
12
11
|
"finding-verifier": {
|
|
13
12
|
"description": "Use to verify a single claim about a code change: whether a suspected defect is real. Reads the code fresh and tries to disprove the claim, with no sight of the reasoning that produced it. Returns whether it is verified, and the evidence.",
|
|
14
13
|
"mode": "subagent",
|
|
15
|
-
"
|
|
16
|
-
"
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
"external_directory": {
|
|
22
|
-
"/tmp/**": "allow",
|
|
23
|
-
"/home/runner/work/_temp/gh-aw/**": "allow"
|
|
14
|
+
"system": "You are handed ONE claim about a code change and asked whether it is real. You did not write it and you have not seen the reasoning behind it. Your job is to try to DISPROVE it.\n\nRead the code the claim names, and the code around it. Run the test or the command that would settle it if one exists. Follow the path from entry point to the line in question and check whether the condition the claim depends on can actually hold.\n\nAnswer with a JSON object and nothing else:\n{\"verified\": true|false, \"verification\": \"the command you ran and what it printed, or the code path quoted end to end\", \"severity\": \"critical|high|medium|low\", \"reason\": \"one sentence\"}\n\n`verified: true` means you demonstrated the problem, not that you failed to rule it out. If you could not reproduce it, if the guard the claim says is missing is actually present upstream, or if the claim is about style, taste or a hypothetical caller that does not exist in this repository, answer `verified: false` and say why. Disagreeing with the claim is a useful result and costs you nothing. Do not soften a real defect and do not manufacture one. Never edit a file, never push, never call a safe output.",
|
|
15
|
+
"request": {
|
|
16
|
+
"body": {
|
|
17
|
+
"temperature": 0
|
|
18
|
+
}
|
|
19
|
+
}
|
|
24
20
|
}
|
|
25
21
|
},
|
|
26
|
-
"
|
|
27
|
-
|
|
28
|
-
"
|
|
22
|
+
"permissions": [
|
|
23
|
+
{
|
|
24
|
+
"action": "read",
|
|
25
|
+
"resource": "*",
|
|
26
|
+
"effect": "allow"
|
|
29
27
|
},
|
|
30
|
-
|
|
31
|
-
"
|
|
28
|
+
{
|
|
29
|
+
"action": "external_directory",
|
|
30
|
+
"resource": "/tmp/**",
|
|
31
|
+
"effect": "allow"
|
|
32
32
|
},
|
|
33
|
-
|
|
34
|
-
"
|
|
33
|
+
{
|
|
34
|
+
"action": "external_directory",
|
|
35
|
+
"resource": "/home/runner/work/_temp/gh-aw/**",
|
|
36
|
+
"effect": "allow"
|
|
35
37
|
}
|
|
36
|
-
|
|
37
|
-
"
|
|
38
|
+
],
|
|
39
|
+
"providers": {
|
|
38
40
|
"forge": {
|
|
39
|
-
"
|
|
40
|
-
"
|
|
41
|
+
"package": "aisdk:@ai-sdk/openai-compatible",
|
|
42
|
+
"settings": {
|
|
43
|
+
"baseURL": "{env:OPENAI_BASE_URL}",
|
|
41
44
|
"apiKey": "{env:OPENAI_API_KEY}"
|
|
42
45
|
},
|
|
43
46
|
"models": {
|
|
44
47
|
"glm-5-2": {
|
|
45
48
|
"name": "GLM 5.3",
|
|
46
|
-
"
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
49
|
+
"capabilities": {
|
|
50
|
+
"tools": true,
|
|
51
|
+
"input": [
|
|
52
|
+
"text",
|
|
53
|
+
"image"
|
|
54
|
+
],
|
|
55
|
+
"output": [
|
|
56
|
+
"text"
|
|
57
|
+
]
|
|
52
58
|
},
|
|
53
59
|
"limit": {
|
|
54
60
|
"context": 1048576,
|
|
@@ -58,12 +64,15 @@
|
|
|
58
64
|
},
|
|
59
65
|
"quasar-438b": {
|
|
60
66
|
"name": "GLM 5.2",
|
|
61
|
-
"
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
+
"capabilities": {
|
|
68
|
+
"tools": true,
|
|
69
|
+
"input": [
|
|
70
|
+
"text",
|
|
71
|
+
"image"
|
|
72
|
+
],
|
|
73
|
+
"output": [
|
|
74
|
+
"text"
|
|
75
|
+
]
|
|
67
76
|
},
|
|
68
77
|
"limit": {
|
|
69
78
|
"context": 1048576,
|
|
@@ -74,4 +83,4 @@
|
|
|
74
83
|
}
|
|
75
84
|
}
|
|
76
85
|
}
|
|
77
|
-
}
|
|
86
|
+
}
|
|
@@ -43,7 +43,7 @@ name: "Agent: Apply Review"
|
|
|
43
43
|
# Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
|
|
44
44
|
# This workflow receives the classified inputs and runs rung 3+.
|
|
45
45
|
imports:
|
|
46
|
-
- github/gh-aw/.github/workflows/shared/opencode.md@v0.
|
|
46
|
+
- github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
|
|
47
47
|
- shared/platform-defaults.md
|
|
48
48
|
- shared/opencode-ci.md
|
|
49
49
|
|
|
@@ -30,7 +30,7 @@ name: "Agent: Audit"
|
|
|
30
30
|
# Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
|
|
31
31
|
# permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
|
|
32
32
|
imports:
|
|
33
|
-
- github/gh-aw/.github/workflows/shared/opencode.md@v0.
|
|
33
|
+
- github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
|
|
34
34
|
- shared/platform-defaults.md
|
|
35
35
|
- shared/opencode-ci.md
|
|
36
36
|
|
|
@@ -79,7 +79,7 @@ name: "Agent: Implement Issue"
|
|
|
79
79
|
# Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
|
|
80
80
|
# permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
|
|
81
81
|
imports:
|
|
82
|
-
- github/gh-aw/.github/workflows/shared/opencode.md@v0.
|
|
82
|
+
- github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
|
|
83
83
|
- shared/platform-defaults.md
|
|
84
84
|
- shared/opencode-ci.md
|
|
85
85
|
|
|
@@ -98,7 +98,7 @@ name: "Agent: Merge Gate"
|
|
|
98
98
|
# Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
|
|
99
99
|
# This workflow receives the classified inputs and runs rung 3+.
|
|
100
100
|
imports:
|
|
101
|
-
- github/gh-aw/.github/workflows/shared/opencode.md@v0.
|
|
101
|
+
- github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
|
|
102
102
|
- shared/platform-defaults.md
|
|
103
103
|
- shared/opencode-ci.md
|
|
104
104
|
|
|
@@ -28,7 +28,7 @@ name: "Agent: Visual Verify"
|
|
|
28
28
|
|
|
29
29
|
# Standalone worker called directly from merge-gate's conclude job. Not a router route.
|
|
30
30
|
imports:
|
|
31
|
-
- github/gh-aw/.github/workflows/shared/opencode.md@v0.
|
|
31
|
+
- github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
|
|
32
32
|
- shared/platform-defaults.md
|
|
33
33
|
- shared/opencode-ci.md
|
|
34
34
|
|
|
@@ -202,5 +202,5 @@ pre-agent-steps:
|
|
|
202
202
|
# `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
|
|
203
203
|
# nor this provider, so both survive and `awf-proxy` is added alongside.
|
|
204
204
|
echo "Wrote $CONFIG from $FRAGMENT:"
|
|
205
|
-
jq -r '" model: \(.model // "unset")", " plugins: \(.
|
|
205
|
+
jq -r '" model: \(.model // "unset")", " plugins: \(.plugins // [] | join(", "))", " providers: \(.providers // {} | keys | join(", "))"' "$CONFIG"
|
|
206
206
|
---
|