@plainconceptsplatform/workflows 0.28.26 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/stack-defaults.js +27 -35
- package/loops/actions/verify-route-matrix/verify-route-matrix.sh +31 -39
- package/loops/scripts/compile-agent-workflows.mjs +362 -346
- package/loops/templates/opencode/opencode.ci.json +45 -36
- package/loops/workflows/shared/opencode-ci.md +1 -1
- package/package.json +1 -1
package/dist/stack-defaults.js
CHANGED
|
@@ -31,31 +31,31 @@ export function generateOpencodeCi(baseContent, inspection) {
|
|
|
31
31
|
if (inspection.stackHints.solutionFiles.length > 0) {
|
|
32
32
|
const solutionPath = inspection.stackHints.solutionFiles[0].replaceAll("\\", "/");
|
|
33
33
|
if (!result.includes("name: Cache NuGet packages")) {
|
|
34
|
-
const nugetCache = ` - name: Cache NuGet packages
|
|
35
|
-
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
36
|
-
with:
|
|
37
|
-
path: ~/.nuget/packages
|
|
38
|
-
key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
|
|
39
|
-
restore-keys: nuget-\${{ runner.os }}-
|
|
40
|
-
|
|
34
|
+
const nugetCache = ` - name: Cache NuGet packages
|
|
35
|
+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
36
|
+
with:
|
|
37
|
+
path: ~/.nuget/packages
|
|
38
|
+
key: nuget-\${{ runner.os }}-\${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
|
|
39
|
+
restore-keys: nuget-\${{ runner.os }}-
|
|
40
|
+
|
|
41
41
|
`;
|
|
42
42
|
result = insertBeforeMarker(result, nugetCache, " - name: Install workspace dependencies");
|
|
43
43
|
}
|
|
44
44
|
if (!result.includes("name: Restore .NET dependencies")) {
|
|
45
|
-
const restore = ` - name: Restore .NET dependencies
|
|
46
|
-
run: dotnet restore ${solutionPath}
|
|
47
|
-
|
|
45
|
+
const restore = ` - name: Restore .NET dependencies
|
|
46
|
+
run: dotnet restore ${solutionPath}
|
|
47
|
+
|
|
48
48
|
`;
|
|
49
49
|
result = insertBeforeMarker(result, restore, " - name: Install workspace dependencies");
|
|
50
50
|
}
|
|
51
51
|
}
|
|
52
52
|
if (inspection.stackHints.openSpec && !result.includes("name: Install OpenSpec CLI")) {
|
|
53
|
-
const openspecStep = ` - name: Install OpenSpec CLI
|
|
54
|
-
run: |
|
|
55
|
-
set -euo pipefail
|
|
56
|
-
npm install -g "@fission-ai/openspec@1.8.0"
|
|
57
|
-
openspec --version
|
|
58
|
-
|
|
53
|
+
const openspecStep = ` - name: Install OpenSpec CLI
|
|
54
|
+
run: |
|
|
55
|
+
set -euo pipefail
|
|
56
|
+
npm install -g "@fission-ai/openspec@1.8.0"
|
|
57
|
+
openspec --version
|
|
58
|
+
|
|
59
59
|
`;
|
|
60
60
|
result = insertBeforeMarker(result, openspecStep, " - name: Install workspace dependencies");
|
|
61
61
|
}
|
|
@@ -74,32 +74,24 @@ export function generateOpencodeConfig(baseContent, inspection) {
|
|
|
74
74
|
try {
|
|
75
75
|
const config = JSON.parse(baseContent);
|
|
76
76
|
const hasDotnet = inspection.stackHints.solutionFiles.length > 0;
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
csharp: { disabled: true },
|
|
83
|
-
fsharp: { disabled: true },
|
|
84
|
-
razor: { disabled: true },
|
|
85
|
-
};
|
|
86
|
-
}
|
|
87
|
-
const agent = config.agent;
|
|
88
|
-
if (agent !== undefined) {
|
|
89
|
-
const agentEntry = agent["ci-workflow-agent"];
|
|
77
|
+
// OpenCode 2 names the agent map `agents` and the prompt `system`. V2 does
|
|
78
|
+
// not run language servers, so there is no lsp block to add or remove.
|
|
79
|
+
const agents = config.agents;
|
|
80
|
+
if (agents !== undefined) {
|
|
81
|
+
const agentEntry = agents["ci-workflow-agent"];
|
|
90
82
|
if (agentEntry !== undefined) {
|
|
91
|
-
let
|
|
83
|
+
let system = agentEntry.system ?? "";
|
|
92
84
|
if (hasDotnet) {
|
|
93
|
-
if (!
|
|
94
|
-
|
|
85
|
+
if (!system.includes(".NET guardrails")) {
|
|
86
|
+
system += "\n\n# .NET guardrails\nFollow Clean Architecture layering: API → Application → Domain. Infrastructure implements Application ports. Application must not reference EF Core or ASP.NET. Use Central Package Management (Directory.Packages.props). Build in Release mode for CI.";
|
|
95
87
|
}
|
|
96
88
|
}
|
|
97
89
|
else {
|
|
98
|
-
if (!
|
|
99
|
-
|
|
90
|
+
if (!system.includes("Node/React rules")) {
|
|
91
|
+
system += "\n\n# Node/React rules\nFollow Feature-Sliced Design import boundaries. Use pnpm, never npm or yarn. All user-facing text must be i18n messages. TypeScript strict mode.";
|
|
100
92
|
}
|
|
101
93
|
}
|
|
102
|
-
agentEntry.
|
|
94
|
+
agentEntry.system = system;
|
|
103
95
|
}
|
|
104
96
|
}
|
|
105
97
|
return JSON.stringify(config, null, 2) + "\n";
|
|
@@ -2198,15 +2198,15 @@ echo "── Runner pools ──────────────────
|
|
|
2198
2198
|
# RunnerLandingZone while merge-gate and release stayed on agents-arc: the override reached the
|
|
2199
2199
|
# workers installed at the time and never the ones added later. Nothing reported the split.
|
|
2200
2200
|
#
|
|
2201
|
-
# agent jobs of every worker
|
|
2202
|
-
#
|
|
2203
|
-
#
|
|
2204
|
-
# gate
|
|
2205
|
-
#
|
|
2206
|
-
#
|
|
2207
|
-
#
|
|
2208
|
-
#
|
|
2209
|
-
#
|
|
2201
|
+
# agent jobs of every worker -> agents-arc (the Azure fleet in
|
|
2202
|
+
# agentrunner-pro-rg-01,
|
|
2203
|
+
# runner group `agentic`)
|
|
2204
|
+
# GitHub-hosted gate jobs (where a worker keeps them) -> RunnerLandingZone
|
|
2205
|
+
# ubuntu-latest -> GitHub's own runner, chosen by nobody, left
|
|
2206
|
+
# wherever the package already has it
|
|
2207
|
+
#
|
|
2208
|
+
# Since 0.28.17 every job runs on agents-arc, release and router included; the rule below
|
|
2209
|
+
# still accepts RunnerLandingZone for a stray gate job but requires agents-arc to be named.
|
|
2210
2210
|
AGENT_POOL="agents-arc"
|
|
2211
2211
|
PLUMBING_POOL="RunnerLandingZone"
|
|
2212
2212
|
POOL_OK=1
|
|
@@ -2224,43 +2224,35 @@ for worker_md in "${WORKFLOWS_DIR}"/agent-*.md; do
|
|
|
2224
2224
|
[ -f "$worker_md" ] || continue
|
|
2225
2225
|
worker_name="$(basename "$worker_md" .md)"
|
|
2226
2226
|
want="$AGENT_POOL"
|
|
2227
|
-
[ "$worker_name" = "agent-release" ] && want="$PLUMBING_POOL"
|
|
2228
2227
|
got="$(pools_named "$worker_md" | tr '\n' ' ' | sed 's/ $//')"
|
|
2229
|
-
#
|
|
2230
|
-
#
|
|
2231
|
-
#
|
|
2232
|
-
|
|
2233
|
-
|
|
2234
|
-
|
|
2235
|
-
|
|
2236
|
-
|
|
2237
|
-
|
|
2238
|
-
|
|
2239
|
-
#
|
|
2240
|
-
|
|
2241
|
-
|
|
2242
|
-
|
|
2243
|
-
|
|
2244
|
-
|
|
2245
|
-
# visual-verify gets its agent runs-on from a shared import, not from the .md file,
|
|
2246
|
-
# so the pool check only sees the subject gate job on RunnerLandingZone.
|
|
2247
|
-
if [ "$worker_name" = "agent-visual-verify" ] && echo "$got" | grep -qw "$PLUMBING_POOL"; then
|
|
2248
|
-
:
|
|
2249
|
-
else
|
|
2250
|
-
ok=0
|
|
2251
|
-
fi
|
|
2252
|
-
fi
|
|
2253
|
-
if [ "$ok" -ne 1 ]; then
|
|
2254
|
-
POOL_OK=0
|
|
2255
|
-
echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${AGENT_POOL}' and/or '${PLUMBING_POOL}' (with at least ${AGENT_POOL})" >&2
|
|
2228
|
+
# The package owns which pool every job runs on, and since 0.28.17 every job in
|
|
2229
|
+
# every worker runs on agents-arc, release included. RunnerLandingZone is still
|
|
2230
|
+
# accepted for the occasional GitHub-hosted gate job, but the agent pool must be
|
|
2231
|
+
# present so a worker cannot drift onto a pool no runner carries.
|
|
2232
|
+
allowed_pools="${AGENT_POOL} ${PLUMBING_POOL}"
|
|
2233
|
+
ok=1
|
|
2234
|
+
for p in $got; do
|
|
2235
|
+
case " $allowed_pools " in *" $p "*) ;; *) ok=0 ;; esac
|
|
2236
|
+
done
|
|
2237
|
+
if ! echo "$got" | grep -qw "$AGENT_POOL"; then
|
|
2238
|
+
# visual-verify gets its agent runs-on from a shared import, not from the .md file,
|
|
2239
|
+
# so the pool check only sees the subject gate job on RunnerLandingZone.
|
|
2240
|
+
if [ "$worker_name" = "agent-visual-verify" ] && echo "$got" | grep -qw "$PLUMBING_POOL"; then
|
|
2241
|
+
:
|
|
2242
|
+
else
|
|
2243
|
+
ok=0
|
|
2256
2244
|
fi
|
|
2257
2245
|
fi
|
|
2246
|
+
if [ "$ok" -ne 1 ]; then
|
|
2247
|
+
POOL_OK=0
|
|
2248
|
+
echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${AGENT_POOL}' and/or '${PLUMBING_POOL}' (with at least ${AGENT_POOL})" >&2
|
|
2249
|
+
fi
|
|
2258
2250
|
done
|
|
2259
2251
|
|
|
2260
2252
|
router_pools="$(pools_named "$ROUTER_YML" | tr '\n' ' ' | sed 's/ $//')"
|
|
2261
|
-
if
|
|
2253
|
+
if ! echo "$router_pools" | grep -qw "$AGENT_POOL"; then
|
|
2262
2254
|
POOL_OK=0
|
|
2263
|
-
echo "FAIL: the router names runner pool(s) '${router_pools}' but must name only '${PLUMBING_POOL}'" >&2
|
|
2255
|
+
echo "FAIL: the router names runner pool(s) '${router_pools}' but must name only '${AGENT_POOL}' and/or '${PLUMBING_POOL}' (with at least ${AGENT_POOL})" >&2
|
|
2264
2256
|
fi
|
|
2265
2257
|
|
|
2266
2258
|
# And the pool must not be reintroduced as a per-consumer value: that is the mechanism that let
|
|
@@ -1,347 +1,363 @@
|
|
|
1
|
-
// Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
|
|
2
|
-
|
|
3
|
-
const OPENCODE_VERSION = '
|
|
4
|
-
|
|
5
|
-
import {
|
|
6
|
-
import {
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
//
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
//
|
|
24
|
-
//
|
|
25
|
-
//
|
|
26
|
-
//
|
|
27
|
-
//
|
|
28
|
-
//
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
let
|
|
33
|
-
let
|
|
34
|
-
let
|
|
35
|
-
let
|
|
36
|
-
let
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
if (
|
|
44
|
-
if (
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
if (
|
|
48
|
-
if (
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
process.
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
`
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
}
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
//
|
|
99
|
-
//
|
|
100
|
-
//
|
|
101
|
-
//
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
const
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
//
|
|
117
|
-
//
|
|
118
|
-
//
|
|
119
|
-
//
|
|
120
|
-
//
|
|
121
|
-
//
|
|
122
|
-
//
|
|
123
|
-
//
|
|
124
|
-
|
|
125
|
-
.replace(/
|
|
126
|
-
.replace(/
|
|
127
|
-
.replace(/
|
|
128
|
-
|
|
129
|
-
//
|
|
130
|
-
//
|
|
131
|
-
//
|
|
132
|
-
//
|
|
133
|
-
//
|
|
134
|
-
//
|
|
135
|
-
//
|
|
136
|
-
//
|
|
137
|
-
//
|
|
138
|
-
//
|
|
139
|
-
// the
|
|
140
|
-
//
|
|
141
|
-
//
|
|
142
|
-
//
|
|
143
|
-
//
|
|
144
|
-
//
|
|
145
|
-
//
|
|
146
|
-
//
|
|
147
|
-
//
|
|
148
|
-
//
|
|
149
|
-
//
|
|
150
|
-
//
|
|
151
|
-
//
|
|
152
|
-
//
|
|
153
|
-
//
|
|
154
|
-
//
|
|
155
|
-
//
|
|
156
|
-
//
|
|
157
|
-
//
|
|
158
|
-
//
|
|
159
|
-
//
|
|
160
|
-
//
|
|
161
|
-
//
|
|
162
|
-
//
|
|
163
|
-
|
|
164
|
-
//
|
|
165
|
-
|
|
166
|
-
//
|
|
167
|
-
//
|
|
168
|
-
//
|
|
169
|
-
.
|
|
170
|
-
//
|
|
171
|
-
|
|
172
|
-
//
|
|
173
|
-
//
|
|
174
|
-
//
|
|
175
|
-
//
|
|
176
|
-
//
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
//
|
|
182
|
-
//
|
|
183
|
-
//
|
|
184
|
-
//
|
|
185
|
-
|
|
186
|
-
//
|
|
187
|
-
|
|
188
|
-
//
|
|
189
|
-
//
|
|
190
|
-
//
|
|
191
|
-
//
|
|
192
|
-
//
|
|
193
|
-
.
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
'
|
|
197
|
-
'
|
|
198
|
-
'
|
|
199
|
-
'
|
|
200
|
-
'
|
|
201
|
-
'
|
|
202
|
-
'
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
//
|
|
206
|
-
//
|
|
207
|
-
//
|
|
208
|
-
//
|
|
209
|
-
//
|
|
210
|
-
//
|
|
211
|
-
//
|
|
212
|
-
//
|
|
213
|
-
//
|
|
214
|
-
// the
|
|
215
|
-
//
|
|
216
|
-
.
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
' /tmp/gh-aw/aw
|
|
220
|
-
' /tmp/gh-aw/
|
|
221
|
-
' /tmp/gh-aw/
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
//
|
|
225
|
-
//
|
|
226
|
-
//
|
|
227
|
-
//
|
|
228
|
-
//
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
//
|
|
236
|
-
//
|
|
237
|
-
//
|
|
238
|
-
//
|
|
239
|
-
//
|
|
240
|
-
.
|
|
241
|
-
//
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
|
|
245
|
-
.replaceAll(' OPENAI_BASE_URL:
|
|
246
|
-
' OPENAI_BASE_URL: https://forge.plainconcepts.com/v1'
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
.
|
|
253
|
-
'
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
// "
|
|
258
|
-
|
|
259
|
-
//
|
|
260
|
-
|
|
261
|
-
//
|
|
262
|
-
//
|
|
263
|
-
//
|
|
264
|
-
//
|
|
265
|
-
.
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
1
|
+
// Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
|
|
2
|
+
|
|
3
|
+
const OPENCODE_VERSION = '2.0.22'
|
|
4
|
+
const OPENCODE_PACKAGE = '@opencode/cli'
|
|
5
|
+
import { spawnSync } from "node:child_process";
|
|
6
|
+
import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
7
|
+
import { join } from "node:path";
|
|
8
|
+
|
|
9
|
+
const workflowDirectory = existsSync("loops/workflows") ? "loops/workflows" : ".github/workflows";
|
|
10
|
+
|
|
11
|
+
// On Windows, `gh` resolves to a shim that spawnSync cannot find without a shell.
|
|
12
|
+
// Resolve the full path via `where` so spawnSync works with shell: false (security-safe).
|
|
13
|
+
function resolveGhPath() {
|
|
14
|
+
if (process.platform !== "win32") return "gh";
|
|
15
|
+
const result = spawnSync("where", ["gh"], { encoding: "utf8", shell: false });
|
|
16
|
+
if (result.status === 0) {
|
|
17
|
+
const first = result.stdout.split("\n").map((s) => s.trim()).find(Boolean);
|
|
18
|
+
if (first) return first;
|
|
19
|
+
}
|
|
20
|
+
return "gh";
|
|
21
|
+
}
|
|
22
|
+
|
|
23
|
+
// gh-aw folds a workflow's top-level `if:` into the activation job but computes activation.needs
|
|
24
|
+
// on its own, so a compiled `if:` can read `needs.<job>` for a job activation never waits for.
|
|
25
|
+
// GitHub does not reject that: the reference resolves to '' at runtime and the clause is silently
|
|
26
|
+
// true (agent-merge-gate's protected_changes guard, Pliny-Bot run 34042143350). actionlint would
|
|
27
|
+
// flag it, but it is deliberately not run on generated files (it does not model concurrency.queue
|
|
28
|
+
// or job.workflow_*). This is the one check that reads the locks, and it needs no dependency:
|
|
29
|
+
// gh-aw emits jobs at two spaces, job keys at four, list items at six.
|
|
30
|
+
function undeclaredNeeds(lock) {
|
|
31
|
+
const violations = [];
|
|
32
|
+
let inJobs = false;
|
|
33
|
+
let job = null;
|
|
34
|
+
let inList = false;
|
|
35
|
+
let jobs = 0;
|
|
36
|
+
let needs = new Set();
|
|
37
|
+
let refs = new Set();
|
|
38
|
+
const flush = () => {
|
|
39
|
+
if (!job) return;
|
|
40
|
+
for (const ref of refs) if (!needs.has(ref)) violations.push({ job, ref, needs: [...needs].sort() });
|
|
41
|
+
};
|
|
42
|
+
for (const line of lock.split("\n")) {
|
|
43
|
+
if (/^jobs:\s*$/.test(line)) { inJobs = true; continue; }
|
|
44
|
+
if (inJobs && /^[^\s#]/.test(line)) inJobs = false;
|
|
45
|
+
if (!inJobs) continue;
|
|
46
|
+
const start = line.match(/^ ([a-z_][a-zA-Z0-9_-]*):\s*$/);
|
|
47
|
+
if (start) { flush(); job = start[1]; jobs += 1; needs = new Set(); refs = new Set(); inList = false; continue; }
|
|
48
|
+
if (!job) continue;
|
|
49
|
+
if (/^ needs:\s*$/.test(line)) { inList = true; continue; }
|
|
50
|
+
const inline = line.match(/^ needs:\s*(.+?)\s*$/);
|
|
51
|
+
if (inline) {
|
|
52
|
+
for (const n of inline[1].replace(/[\[\]]/g, "").split(",")) if (n.trim()) needs.add(n.trim());
|
|
53
|
+
inList = false;
|
|
54
|
+
continue;
|
|
55
|
+
}
|
|
56
|
+
if (inList) {
|
|
57
|
+
const item = line.match(/^ - (\S+)\s*$/);
|
|
58
|
+
if (item) { needs.add(item[1]); continue; }
|
|
59
|
+
inList = false;
|
|
60
|
+
}
|
|
61
|
+
for (const m of line.matchAll(/needs\.([a-z_][a-zA-Z0-9_-]*)\./g)) refs.add(m[1]);
|
|
62
|
+
}
|
|
63
|
+
flush();
|
|
64
|
+
return { jobs, violations };
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir", workflowDirectory], {
|
|
68
|
+
stdio: "inherit",
|
|
69
|
+
shell: false,
|
|
70
|
+
});
|
|
71
|
+
|
|
72
|
+
if (compile.error?.code === "ENOENT" || compile.status === null) {
|
|
73
|
+
process.stderr.write("Could not run `gh aw compile`. Install githubnext/gh-aw first.\n");
|
|
74
|
+
process.exit(1);
|
|
75
|
+
}
|
|
76
|
+
|
|
77
|
+
if (compile.status !== 0) process.exit(compile.status ?? 1);
|
|
78
|
+
|
|
79
|
+
function lintLock(file, text) {
|
|
80
|
+
const lint = undeclaredNeeds(text);
|
|
81
|
+
if (lint.jobs === 0) {
|
|
82
|
+
process.stderr.write(
|
|
83
|
+
`${file}: the needs lint found no jobs; the gh-aw lock layout changed. ` +
|
|
84
|
+
`Re-anchor undeclaredNeeds() in loops/scripts/compile-agent-workflows.mjs.\n`,
|
|
85
|
+
);
|
|
86
|
+
process.exitCode = 1;
|
|
87
|
+
}
|
|
88
|
+
for (const v of lint.violations) {
|
|
89
|
+
process.stderr.write(
|
|
90
|
+
`${file}: job "${v.job}" reads needs.${v.ref} but its needs are [${v.needs.join(", ")}]; ` +
|
|
91
|
+
`the reference resolves to '' at runtime. For activation, list the job under on.needs in the ` +
|
|
92
|
+
`source frontmatter; for a custom job, add it to that job's needs.\n`,
|
|
93
|
+
);
|
|
94
|
+
process.exitCode = 1;
|
|
95
|
+
}
|
|
96
|
+
}
|
|
97
|
+
|
|
98
|
+
// gh aw compile leaves a lock alone when its frontmatter and body hashes still match the source.
|
|
99
|
+
// This script then ran over a lock it had already patched: AGENTMEMORY_URL was inserted a second
|
|
100
|
+
// time, the opencode install line was wrapped in itself, and the consumer freshness check could
|
|
101
|
+
// never be clean (Pliny-Bot agentics-checks run 33963600563). The sentinel marks a processed
|
|
102
|
+
// lock; a lock that carries it is linted and otherwise left as it is.
|
|
103
|
+
const SENTINEL = "# post-processed by scripts/compile-agent-workflows.mjs; run it again and nothing changes";
|
|
104
|
+
|
|
105
|
+
for (const file of readdirSync(workflowDirectory)) {
|
|
106
|
+
if (!file.endsWith(".lock.yml")) continue;
|
|
107
|
+
|
|
108
|
+
const path = join(workflowDirectory, file);
|
|
109
|
+
const content = readFileSync(path, "utf8");
|
|
110
|
+
if (content.includes(SENTINEL)) {
|
|
111
|
+
lintLock(file, content);
|
|
112
|
+
continue;
|
|
113
|
+
}
|
|
114
|
+
const patched = content
|
|
115
|
+
.replace(/^(# This file was automatically generated by gh-aw[^\n]*\n)/m, `$1${SENTINEL}\n`)
|
|
116
|
+
// The engine command is normalized to one shape:
|
|
117
|
+
// - OPENCODE_DISABLE_MODELS_FETCH=1: opencode otherwise fetches its model
|
|
118
|
+
// registry from https://models.opencode.ai/api.json at startup and blocks
|
|
119
|
+
// bootstrap on it. Inside the awf sandbox that host is not on the egress
|
|
120
|
+
// allowlist, so the fetch hangs and every agent run stalls right after
|
|
121
|
+
// "init" until the runner kills it. The forge provider declares its models
|
|
122
|
+
// explicitly, so the remote registry is not needed here.
|
|
123
|
+
// - --print-logs + a non-silent level: stripping --print-logs and forcing
|
|
124
|
+
// ERROR hid every engine log, so a stalled bootstrap looked like silence.
|
|
125
|
+
.replace(/opencode run(?: --print-logs)? --log-level (?:DEBUG|ERROR|INFO)/g, "OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --print-logs --log-level INFO")
|
|
126
|
+
.replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
|
|
127
|
+
.replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
|
|
128
|
+
.replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'')
|
|
129
|
+
// The MCP gateway is the only thing the agent publishes on the host loopback, so it is the
|
|
130
|
+
// one thing two runners on the same machine cannot share. Honour an inherited port so each
|
|
131
|
+
// runner service can pick its own; everything else is namespaced by its Docker daemon.
|
|
132
|
+
// awf names its containers awf-agent, awf-squid and awf-api-proxy with no way to change
|
|
133
|
+
// them, so two agent jobs on one host recreate each other's containers and the first dies
|
|
134
|
+
// with exit 137. Giving each runner its own user and daemon isolated the containers but
|
|
135
|
+
// broke everything the runners share through the filesystem: awf and gh-aw both write
|
|
136
|
+
// fixed-name files into /tmp, and a file one user creates cannot be overwritten by the
|
|
137
|
+
// next. Six separate failures came from that. One host lock is the smaller trade: agent
|
|
138
|
+
// jobs run one at a time, every other job still uses all the runners, and every user is
|
|
139
|
+
// the same again. The chain is serial anyway, so in practice this only queues one consumer behind
|
|
140
|
+
// the other. Held for the whole agent run, which is deliberate. The lock lives outside the
|
|
141
|
+
// /tmp/gh-aw namespace on purpose: the keying rewrite below would otherwise make the lock
|
|
142
|
+
// file per job, which is silently no lock at all.
|
|
143
|
+
// Agent jobs run in parallel again. Each runner has its own Docker-in-Docker daemon, so
|
|
144
|
+
// awf's fixed container names (awf-agent, awf-squid, awf-api-proxy, awmg-mcpg) live in
|
|
145
|
+
// separate namespaces and cannot recreate each other. gh-aw detects the tcp DOCKER_HOST
|
|
146
|
+
// and switches to its ARC/DinD path by itself, so no flag is needed here. The host-wide
|
|
147
|
+
// flock this replaces made every agent job wait for the previous one.
|
|
148
|
+
// Three host-global resources were left, and concurrent agent jobs fought over all of them.
|
|
149
|
+
// The global npm install rewrote the opencode binary another job was executing and killed it
|
|
150
|
+
// with SIGKILL mid-run; the warm server and its data directory were shared by every runner.
|
|
151
|
+
//
|
|
152
|
+
// All of these sites are step-level run: or env:, where the runner context is available. It
|
|
153
|
+
// is not available at workflow level, which is what broke the staging path earlier.
|
|
154
|
+
//
|
|
155
|
+
// Install only when the pinned version is missing, and take a lock so two jobs starting at
|
|
156
|
+
// once cannot both write the global prefix.
|
|
157
|
+
// gh-aw pins opencode-ai 1.2.14 at every release checked, up to v0.90.0. That version is
|
|
158
|
+
// from 2026-02-25, and it was the pin the guard used until the OpenCode 2 migration: the
|
|
159
|
+
// harness now ships @opencode/cli at OPENCODE_VERSION above, and the pin is ours to choose
|
|
160
|
+
// because a gh-aw upgrade does not move it.
|
|
161
|
+
// gh-aw defaults NPM_CONFIG_MIN_RELEASE_AGE to 3 days, which blocks any package
|
|
162
|
+
// published in the last three days with ETARGET "No matching version found ... with a
|
|
163
|
+
// date before". Lowered to 1 so a fix released yesterday is usable. This is a
|
|
164
|
+
// supply-chain cooldown: shortening it accepts a newer package sooner.
|
|
165
|
+
.replace(/NPM_CONFIG_MIN_RELEASE_AGE: ['\"]?3['\"]?/g, "NPM_CONFIG_MIN_RELEASE_AGE: '1'")
|
|
166
|
+
// The MCP gateway runs inside a per-runner Docker-in-Docker daemon. gh-aw publishes it on
|
|
167
|
+
// 127.0.0.1, which is the DinD container's own loopback, while the outer publish forwards to
|
|
168
|
+
// that container's eth0, so the two never meet and gh-aw's health check fails 120 times with
|
|
169
|
+
// ECONNREFUSED. Binding 0.0.0.0 inside the daemon connects them. The host still exposes the
|
|
170
|
+
// port on loopback only, because the DinD container is published as 127.0.0.1:<port>.
|
|
171
|
+
.replaceAll("-p 127.0.0.1:'\"${MCP_GATEWAY_PORT}\"':", "-p '\"${MCP_GATEWAY_PORT}\"':")
|
|
172
|
+
// Each runner needs its own gateway port: four DinD daemons publish through to one host
|
|
173
|
+
// loopback, so two jobs on 8080 would collide. The runner sets it in .env.
|
|
174
|
+
// awf chroots into the Docker daemon's filesystem and requires it to be the runner's own
|
|
175
|
+
// glibc host. A Docker-in-Docker daemon fails with "Detected Alpine/musl host filesystem
|
|
176
|
+
// under /host", and no dind image fixes it: the agent needs the runner's toolchain and
|
|
177
|
+
// workspace, which a separate daemon container never has. So every agent job shares one
|
|
178
|
+
// daemon, awf's container names are fixed, and the jobs must be serialised.
|
|
179
|
+
.replaceAll(' awf --config', ' flock /tmp/agentic-awf.lock awf --config')
|
|
180
|
+
.replaceAll('export MCP_GATEWAY_PORT="8080"', 'export MCP_GATEWAY_PORT="${MCP_GATEWAY_PORT:-8080}"')
|
|
181
|
+
// The agent's safe outputs land in safeoutputs.jsonl, but the collector reads
|
|
182
|
+
// agent_output.json, and nothing in the generated workflow converts one to the other.
|
|
183
|
+
// With the OpenCode engine the tool calls go through the MCP server rather than stdout,
|
|
184
|
+
// so the log parser never produces agent_output.json and the placeholder step writes
|
|
185
|
+
// {"items":[]} over a run that did real work: the job goes green and the pull request
|
|
186
|
+
// is silently dropped. Build the collector's input from what the agent actually emitted.
|
|
187
|
+
.replaceAll("echo '{\"items\":[]}' > /tmp/gh-aw-${{ github.run_id }}/agent_output.json", "if [ -s /tmp/gh-aw-${{ github.run_id }}/safeoutputs.jsonl ]; then jq -s '{items: .}' /tmp/gh-aw-${{ github.run_id }}/safeoutputs.jsonl > /tmp/gh-aw-${{ github.run_id }}/agent_output.json; else echo '{\"items\":[]}' > /tmp/gh-aw-${{ github.run_id }}/agent_output.json; fi")
|
|
188
|
+
// The "Copy Safe Outputs" step runs on the host after the awf container exits. At that
|
|
189
|
+
// point /tmp/gh-aw/ IS the host's /tmp/gh-aw/, where the safeoutputs MCP container wrote
|
|
190
|
+
// patch and bundle files (via the MCP gateway's -v /tmp:/tmp:rw mount). Extend the step
|
|
191
|
+
// to also copy those files to RUNNER_TEMP/gh-aw/ so the upload step can include them.
|
|
192
|
+
// Without this, the upload step's glob /tmp/gh-aw/aw-*.patch runs inside the awf chroot
|
|
193
|
+
// (where /tmp/gh-aw is a different path) and finds nothing. The safe_outputs and conclude
|
|
194
|
+
// jobs then receive no patches in the artifact and silently skip the push.
|
|
195
|
+
.replace(
|
|
196
|
+
' cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n',
|
|
197
|
+
' cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n' +
|
|
198
|
+
' # Copy patch/bundle files generated by the safeoutputs MCP container to\n' +
|
|
199
|
+
' # RUNNER_TEMP/gh-aw/ so the upload step includes them in the artifact.\n' +
|
|
200
|
+
' mkdir -p "${RUNNER_TEMP}/gh-aw"\n' +
|
|
201
|
+
' ls -la /tmp/gh-aw/ 2>/dev/null || true\n' +
|
|
202
|
+
' cp /tmp/gh-aw/aw-*.patch "${RUNNER_TEMP}/gh-aw/" 2>/dev/null || true\n' +
|
|
203
|
+
' cp /tmp/gh-aw/aw-*.bundle "${RUNNER_TEMP}/gh-aw/" 2>/dev/null || true\n' +
|
|
204
|
+
' ls -la "${RUNNER_TEMP}/gh-aw/"aw-* 2>/dev/null || true\n')
|
|
205
|
+
// Add patch/bundle paths to the upload glob so the agent artifact carries what
|
|
206
|
+
// push-agent-branch needs. The anchor is the two adjacent path lines of the
|
|
207
|
+
// "...agent" upload step; the "...agent-output-fallback" upload lists them in the
|
|
208
|
+
// opposite order, so it cannot match. Anchoring matters: the first bare
|
|
209
|
+
// '/tmp/gh-aw/agent_output.json\n' in the file is the placeholder step's echo line,
|
|
210
|
+
// and replacing there corrupted the placeholder into executing the globs as
|
|
211
|
+
// commands while the upload list stayed without bundles. The artifact then carried
|
|
212
|
+
// no bundle, push-agent-branch silently skipped the push, and the gate reported
|
|
213
|
+
// "remediated" on a pull request that was never touched.
|
|
214
|
+
// Only the /tmp/gh-aw globs may be added: a ${{ runner.temp }} path as well would
|
|
215
|
+
// move the upload's least-common-ancestor from /tmp/gh-aw to /, and every file in
|
|
216
|
+
// the artifact (agent_output.json included) would gain a prefix that
|
|
217
|
+
// download-agent-output does not look for.
|
|
218
|
+
.replace(
|
|
219
|
+
' /tmp/gh-aw/safeoutputs.jsonl\n /tmp/gh-aw/agent_output.json\n',
|
|
220
|
+
' /tmp/gh-aw/safeoutputs.jsonl\n' +
|
|
221
|
+
' /tmp/gh-aw/aw-*.patch\n' +
|
|
222
|
+
' /tmp/gh-aw/aw-*.bundle\n' +
|
|
223
|
+
' /tmp/gh-aw/agent_output.json\n')
|
|
224
|
+
// "A failed run is already a red run": report-failure-as-issue: false and
|
|
225
|
+
// GH_AW_REPORT_FAILED_JOBS: "false" were supposed to silence issue creation, but
|
|
226
|
+
// 0.87.5's engine-failure reporter files an "[aw] ... failed" issue anyway (seen as
|
|
227
|
+
// Pliny-Bot #57: an OOM-killed gate produced a fresh issue nobody needs, while the
|
|
228
|
+
// retry belt is the actual remediation). `if: false` keeps the step compiled but
|
|
229
|
+
// never runs it, so the failure stays visible in the run and in the belt's attempt
|
|
230
|
+
// comment, and out of the issue tracker.
|
|
231
|
+
.replace(
|
|
232
|
+
/^([ \t]+)- name: Report failed jobs\n([ \t]*)id: report_failed_jobs\n[ \t]*if: always\(\)\n/m,
|
|
233
|
+
'$1- name: Report failed jobs\n$2id: report_failed_jobs\n$2if: false # never: failures surface in the run and the retry belt\n')
|
|
234
|
+
|
|
235
|
+
// v0.90.0's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
|
|
236
|
+
// Copilot engine: command -v copilot is empty under engine: opencode and cp "" fails the
|
|
237
|
+
// job before the agent starts. OpenCode needs no staging, because npm -g installs it under
|
|
238
|
+
// the tool-cache prefix inside _work, which the dind daemon shares.
|
|
239
|
+
// Centralised AgentMemory: an always-on App Service; the shim proxies to it when the
|
|
240
|
+
// URL is set and authenticates with the HMAC secret. Local development leaves both
|
|
241
|
+
// unset and keeps the local per-run store.
|
|
242
|
+
.replace(/^env:\n/m, 'env:\n AGENTMEMORY_URL: https://agentmemory-pro-01.azurewebsites.net\n')
|
|
243
|
+
// the secret is scoped to the one step that runs the agent (semgrep: a secret in
|
|
244
|
+
// workflow-level env is visible to every job and step)
|
|
245
|
+
.replaceAll(' OPENAI_BASE_URL: http://host.docker.internal:10001',
|
|
246
|
+
' OPENAI_BASE_URL: https://forge.plainconcepts.com/v1')
|
|
247
|
+
.replaceAll(' OPENAI_BASE_URL: https://forge.plainconcepts.com/v1',
|
|
248
|
+
' OPENAI_BASE_URL: https://forge.plainconcepts.com/v1' + '\n' +
|
|
249
|
+
' AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}')
|
|
250
|
+
// the router passes secrets explicitly (semgrep flags secrets: inherit as over-broad),
|
|
251
|
+
// so the callee must declare everything it accepts
|
|
252
|
+
.replace(/^ COPILOT_GITHUB_TOKEN:/m,
|
|
253
|
+
' AGENTMEMORY_SECRET:' + '\n' + ' required: false' + '\n' + ' COPILOT_GITHUB_TOKEN:')
|
|
254
|
+
.replaceAll(' COPILOT_SRC="$(command -v copilot)"',
|
|
255
|
+
' command -v copilot >/dev/null 2>&1 || { echo "no copilot binary (engine is opencode); skipping"; exit 0; }' + '\n' +
|
|
256
|
+
' COPILOT_SRC="$(command -v copilot)"')
|
|
257
|
+
// "A failed run is already a red run": report-failure-as-issue: false silences one
|
|
258
|
+
// reporter, but gh-aw hardcodes a second one (report_failed_jobs) that files an
|
|
259
|
+
// "[aw] Failed jobs" issue per red run. Same philosophy, same off switch.
|
|
260
|
+
.replaceAll('GH_AW_REPORT_FAILED_JOBS: "true"', 'GH_AW_REPORT_FAILED_JOBS: "false"')
|
|
261
|
+
// gh-aw injects this "Restore .NET dependencies" step whenever a consumer's
|
|
262
|
+
// frontend (e.g. VERIFY_COMMANDS) references dotnet. An AI agent can create a
|
|
263
|
+
// .claude/worktrees/agent-XXX/ worktree at restore time — the first .slnx find
|
|
264
|
+
// matches that scratch dir, and the hardcoded path lands in the lock, breaking
|
|
265
|
+
// every agent run with MSB1009. Replace with dynamic discovery that excludes
|
|
266
|
+
// agent scratch directories so a stale worktree never poisons the restore.
|
|
267
|
+
.replace(
|
|
268
|
+
/^( +)- name: Restore \.NET dependencies\n\1 run: dotnet restore .*$/m,
|
|
269
|
+
(_m, indent) =>
|
|
270
|
+
indent + '- name: Restore .NET dependencies\n' + indent +
|
|
271
|
+
' run: |-\n' + indent +
|
|
272
|
+
' SLNX=$(find . -maxdepth 5 -name "*.slnx" -not -path "./.claude/*" -not -path "./.opencode/*" | head -1)\n' + indent +
|
|
271
273
|
' [ -n "$SLNX" ] && dotnet restore "$SLNX" || echo "No .slnx found, skipping restore"')
|
|
272
|
-
.replace(
|
|
273
|
-
/^( +)- name: Setup \.NET\n\1 uses: actions\/setup-dotnet@[^\n]*\n\1 with:\n((?:\1 [^\n]*\n)+)(?!\1 env:)/gm,
|
|
274
|
-
(_m, indent, withBody) =>
|
|
275
|
-
indent + '- name: Setup .NET\n' + indent + ' uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0\n' +
|
|
276
|
-
indent + ' with:\n' + withBody +
|
|
277
|
-
indent + ' env:\n' + indent + ' DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet\n')
|
|
278
|
-
|
|
279
|
-
//
|
|
280
|
-
//
|
|
281
|
-
//
|
|
282
|
-
//
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
|
|
289
|
-
|
|
290
|
-
|
|
291
|
-
|
|
292
|
-
|
|
293
|
-
|
|
294
|
-
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
|
|
305
|
-
|
|
306
|
-
|
|
307
|
-
|
|
308
|
-
|
|
309
|
-
|
|
310
|
-
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
323
|
-
|
|
324
|
-
|
|
325
|
-
|
|
326
|
-
|
|
327
|
-
|
|
328
|
-
|
|
329
|
-
|
|
330
|
-
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
338
|
-
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
|
|
274
|
+
.replace(
|
|
275
|
+
/^( +)- name: Setup \.NET\n\1 uses: actions\/setup-dotnet@[^\n]*\n\1 with:\n((?:\1 [^\n]*\n)+)(?!\1 env:)/gm,
|
|
276
|
+
(_m, indent, withBody) =>
|
|
277
|
+
indent + '- name: Setup .NET\n' + indent + ' uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0\n' +
|
|
278
|
+
indent + ' with:\n' + withBody +
|
|
279
|
+
indent + ' env:\n' + indent + ' DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet\n')
|
|
280
|
+
// OpenCode 2 ships as @opencode/cli, not opencode-ai. gh-aw's engine manifest
|
|
281
|
+
// still names opencode-ai and installs it with --ignore-scripts, which blocks
|
|
282
|
+
// the postinstall that selects the platform binary.
|
|
283
|
+
//
|
|
284
|
+
// The whole guard is replaced, not just the install inside it. gh-aw emits
|
|
285
|
+
// opencode --version | grep -qF '<gh-aw pin>' || sh -c 'npm install … opencode-ai@<pin>'
|
|
286
|
+
// and rewriting only the inner install left the outer grep on gh-aw's pin while
|
|
287
|
+
// the image carries ours: the grep never matched, so the guard re-ran the install
|
|
288
|
+
// on every job, and a lock already wearing the sentinel was never revisited. The
|
|
289
|
+
// first pattern below collapses that shape — outer guard, wrapper and all — to a
|
|
290
|
+
// single clean guard; the second handles a bare install the outer guard is absent from.
|
|
291
|
+
.replace(
|
|
292
|
+
/opencode --version[^\n]*grep -qF '[0-9][0-9.]*' \|\|[^\n]*?npm install --ignore-scripts -g opencode-ai@[0-9][0-9.]*[^\n]*/g,
|
|
293
|
+
() =>
|
|
294
|
+
"opencode --version 2>/dev/null | grep -qF '" + OPENCODE_VERSION + "' || " +
|
|
295
|
+
"flock /tmp/opencode-install.lock npm install -g " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION +
|
|
296
|
+
" # " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION)
|
|
297
|
+
.replace(
|
|
298
|
+
/npm install --ignore-scripts -g opencode-ai@([0-9][0-9.]*)/g,
|
|
299
|
+
() =>
|
|
300
|
+
"opencode --version 2>/dev/null | grep -qF '" + OPENCODE_VERSION + "' || " +
|
|
301
|
+
"flock /tmp/opencode-install.lock npm install -g " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION +
|
|
302
|
+
" # " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION)
|
|
303
|
+
.replace(/opencode-ai@[0-9][0-9.]*/g, OPENCODE_PACKAGE + '@' + OPENCODE_VERSION)
|
|
304
|
+
.replace(/opencode-ai\b/g, OPENCODE_PACKAGE)
|
|
305
|
+
// One warm server per runner, on its own port, with its own data directory. Keyed on the
|
|
306
|
+
// runner rather than the run so a runner keeps its server warm between its own jobs.
|
|
307
|
+
// No double quotes here: the enclosing run: is a double-quoted YAML scalar, so a quote
|
|
308
|
+
// would have to be escaped. The default has no spaces, so bare is safe shell.
|
|
309
|
+
.replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}');
|
|
310
|
+
|
|
311
|
+
let rewritten = patched;
|
|
312
|
+
// A queued implement executes hours after its run was created, but actions/checkout
|
|
313
|
+
// without a ref checks out github.sha, which GitHub pins at run creation. Five children
|
|
314
|
+
// queued together at 02:01 all carried the 02:01 base; once the first sibling merged,
|
|
315
|
+
// every later push became a rebase onto a moved parent, which gh-aw's signed-commit
|
|
316
|
+
// push cannot do (it dies with "cannot rebase: You have unstaged changes" and files the
|
|
317
|
+
// pull request as an issue instead of a pull request). Checking out the branch tip at
|
|
318
|
+
// execution time makes the commit parent current main; the implement-global queue
|
|
319
|
+
// already keeps sibling merges out of the window while the agent runs.
|
|
320
|
+
if (file === "agent-implement.lock.yml") {
|
|
321
|
+
const start = rewritten.indexOf("\n agent:\n");
|
|
322
|
+
const rest = start === -1 ? "" : rewritten.slice(start + 1);
|
|
323
|
+
const next = rest.search(/\n [a-z_][a-zA-Z_-]*:\n/);
|
|
324
|
+
if (start !== -1 && next !== -1) {
|
|
325
|
+
const end = start + 1 + next;
|
|
326
|
+
const span = rewritten.slice(start, end).replace(
|
|
327
|
+
/(uses: actions\/checkout@[^\n]*\n(\s+)with:\n(?:\2 [^\n]+\n)*)/,
|
|
328
|
+
(whole, _block, indent) =>
|
|
329
|
+
whole.includes("ref:") ? whole : whole + indent + " ref: ${{ github.event.repository.default_branch }}\n",
|
|
330
|
+
);
|
|
331
|
+
rewritten = rewritten.slice(0, start) + span + rewritten.slice(end);
|
|
332
|
+
}
|
|
333
|
+
}
|
|
334
|
+
|
|
335
|
+
// Guard the two rewrites the compiled agent jobs cannot work without. The anchors are
|
|
336
|
+
// upstream template text: when a gh-aw upgrade reshapes either step, the silent
|
|
337
|
+
// failure mode returns (an artifact with no bundle, a skipped push, a green gate on
|
|
338
|
+
// an untouched pull request). Failing the compile is the only loud signal there is.
|
|
339
|
+
for (const check of [
|
|
340
|
+
{ name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1 if: always\(\)\n\1 continue-on-error: true\n\1 uses: actions\/upload-artifact@[^\n]*\n\1 with:\n\1 name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1 path: \|\n(?:\1 [^\n]*\n)*\1 \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
|
|
341
|
+
{ name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1 if: always\(\)\n\1 run: \|\n\1 if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1 echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1 fi\n/ },
|
|
342
|
+
{ name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
|
|
343
|
+
]) {
|
|
344
|
+
if (!check.ok.test(rewritten)) {
|
|
345
|
+
process.stderr.write(
|
|
346
|
+
`compile patch "${check.name}" no longer matches in ${file}: the gh-aw template changed. ` +
|
|
347
|
+
`Re-anchor the rewrite in loops/scripts/compile-agent-workflows.mjs, or agent pushes are silently dropped.\n`,
|
|
348
|
+
);
|
|
349
|
+
process.exitCode = 1;
|
|
350
|
+
}
|
|
351
|
+
}
|
|
352
|
+
|
|
353
|
+
if (!rewritten.includes(SENTINEL)) {
|
|
354
|
+
process.stderr.write(
|
|
355
|
+
`${file}: the generated-file header changed and the post-processing sentinel was not placed; ` +
|
|
356
|
+
`re-anchor the SENTINEL insert in loops/scripts/compile-agent-workflows.mjs.\n`,
|
|
357
|
+
);
|
|
358
|
+
process.exitCode = 1;
|
|
359
|
+
}
|
|
360
|
+
lintLock(file, rewritten);
|
|
361
|
+
|
|
362
|
+
if (rewritten !== content) writeFileSync(path, rewritten);
|
|
363
|
+
}
|
|
@@ -1,54 +1,60 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://opencode.ai/config.json",
|
|
3
3
|
"model": "forge/glm-5-2",
|
|
4
|
-
"plugin": [],
|
|
5
4
|
"default_agent": "ci-workflow-agent",
|
|
6
|
-
"
|
|
5
|
+
"agents": {
|
|
7
6
|
"ci-workflow-agent": {
|
|
8
7
|
"description": "Executes GitHub Agentic Workflow tasks in CI.",
|
|
9
8
|
"mode": "primary",
|
|
10
|
-
"
|
|
9
|
+
"system": "You execute the GitHub Agentic Workflow task in the user prompt. Read AGENTS.md before any non-trivial change. Load only skills the workflow task explicitly names via skill(); when a workflow says load @skill-name, call skill(\"skill-name\"), the @ prefix is just a hint to use the skill tool. Execute only the requested task and required commands. Do not probe or inspect unrelated commands. The GitHub CLI is intentionally unauthenticated: never use `gh` for GitHub reads or writes. Read supplied workflow files first, then use the GitHub MCP tools only when fresh GitHub data is required. Use direct `safeoutputs` commands for GitHub writes. Each safe-output type has a small per-run allowance, and a call that fails still spends it: never send an empty, partial or test payload to discover what a tool accepts, because that probe can be recorded as a success, take the allowance with it, and leave the real call refused as over the limit, ending a run that did all the work and published none of it. Call each safe-output tool once, with the complete final payload, only when you are ready to commit to the outcome. For syntax-only validation of a conventional GitHub Actions YAML file, use Ruby's standard YAML library; do not probe, install, or fall back through PyYAML, js-yaml, actionlint, or Docker. A task is complete only after every required Safe Outputs command succeeds. After the final required Safe Outputs command, stop immediately without further tools, prose, or model turns. Use `mcpscripts` only when the runtime explicitly lists it as available.\n\nOUTPUT DISCIPLINE: Do not narrate. Do not explain what you are about to do before doing it. Do not write prose between tool calls. Call tools silently. The only prose you produce is the final result or a brief error explanation when something fails. Never output sentences like 'Let me check...', 'Now I will...', 'I have enough context...', or 'Next I need to...'. If you are about to call a tool, just call it. If you must think, use the todowrite tool, not prose.\n\nMEMORY: agentmemory is the shared long-term store. Start non-trivial tasks by calling its recall/search tool with the key concepts of the task (component names, error text) and reuse what it returns instead of rediscovering it. Before finishing, store 1-3 concise memories of durable non-obvious learnings: architecture constraints, root causes and their fixes, decisions and their why. Skip trivia the repo already documents. Never store secrets or tokens."
|
|
11
10
|
},
|
|
12
11
|
"finding-verifier": {
|
|
13
12
|
"description": "Use to verify a single claim about a code change: whether a suspected defect is real. Reads the code fresh and tries to disprove the claim, with no sight of the reasoning that produced it. Returns whether it is verified, and the evidence.",
|
|
14
13
|
"mode": "subagent",
|
|
15
|
-
"
|
|
16
|
-
"
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
"external_directory": {
|
|
22
|
-
"/tmp/**": "allow",
|
|
23
|
-
"/home/runner/work/_temp/gh-aw/**": "allow"
|
|
14
|
+
"system": "You are handed ONE claim about a code change and asked whether it is real. You did not write it and you have not seen the reasoning behind it. Your job is to try to DISPROVE it.\n\nRead the code the claim names, and the code around it. Run the test or the command that would settle it if one exists. Follow the path from entry point to the line in question and check whether the condition the claim depends on can actually hold.\n\nAnswer with a JSON object and nothing else:\n{\"verified\": true|false, \"verification\": \"the command you ran and what it printed, or the code path quoted end to end\", \"severity\": \"critical|high|medium|low\", \"reason\": \"one sentence\"}\n\n`verified: true` means you demonstrated the problem, not that you failed to rule it out. If you could not reproduce it, if the guard the claim says is missing is actually present upstream, or if the claim is about style, taste or a hypothetical caller that does not exist in this repository, answer `verified: false` and say why. Disagreeing with the claim is a useful result and costs you nothing. Do not soften a real defect and do not manufacture one. Never edit a file, never push, never call a safe output.",
|
|
15
|
+
"request": {
|
|
16
|
+
"body": {
|
|
17
|
+
"temperature": 0
|
|
18
|
+
}
|
|
19
|
+
}
|
|
24
20
|
}
|
|
25
21
|
},
|
|
26
|
-
"
|
|
27
|
-
|
|
28
|
-
"
|
|
22
|
+
"permissions": [
|
|
23
|
+
{
|
|
24
|
+
"action": "read",
|
|
25
|
+
"resource": "*",
|
|
26
|
+
"effect": "allow"
|
|
29
27
|
},
|
|
30
|
-
|
|
31
|
-
"
|
|
28
|
+
{
|
|
29
|
+
"action": "external_directory",
|
|
30
|
+
"resource": "/tmp/**",
|
|
31
|
+
"effect": "allow"
|
|
32
32
|
},
|
|
33
|
-
|
|
34
|
-
"
|
|
33
|
+
{
|
|
34
|
+
"action": "external_directory",
|
|
35
|
+
"resource": "/home/runner/work/_temp/gh-aw/**",
|
|
36
|
+
"effect": "allow"
|
|
35
37
|
}
|
|
36
|
-
|
|
37
|
-
"
|
|
38
|
+
],
|
|
39
|
+
"providers": {
|
|
38
40
|
"forge": {
|
|
39
|
-
"
|
|
40
|
-
"
|
|
41
|
+
"package": "aisdk:@ai-sdk/openai-compatible",
|
|
42
|
+
"settings": {
|
|
43
|
+
"baseURL": "{env:OPENAI_BASE_URL}",
|
|
41
44
|
"apiKey": "{env:OPENAI_API_KEY}"
|
|
42
45
|
},
|
|
43
46
|
"models": {
|
|
44
47
|
"glm-5-2": {
|
|
45
48
|
"name": "GLM 5.3",
|
|
46
|
-
"
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
49
|
+
"capabilities": {
|
|
50
|
+
"tools": true,
|
|
51
|
+
"input": [
|
|
52
|
+
"text",
|
|
53
|
+
"image"
|
|
54
|
+
],
|
|
55
|
+
"output": [
|
|
56
|
+
"text"
|
|
57
|
+
]
|
|
52
58
|
},
|
|
53
59
|
"limit": {
|
|
54
60
|
"context": 1048576,
|
|
@@ -58,12 +64,15 @@
|
|
|
58
64
|
},
|
|
59
65
|
"quasar-438b": {
|
|
60
66
|
"name": "GLM 5.2",
|
|
61
|
-
"
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
+
"capabilities": {
|
|
68
|
+
"tools": true,
|
|
69
|
+
"input": [
|
|
70
|
+
"text",
|
|
71
|
+
"image"
|
|
72
|
+
],
|
|
73
|
+
"output": [
|
|
74
|
+
"text"
|
|
75
|
+
]
|
|
67
76
|
},
|
|
68
77
|
"limit": {
|
|
69
78
|
"context": 1048576,
|
|
@@ -74,4 +83,4 @@
|
|
|
74
83
|
}
|
|
75
84
|
}
|
|
76
85
|
}
|
|
77
|
-
}
|
|
86
|
+
}
|
|
@@ -202,5 +202,5 @@ pre-agent-steps:
|
|
|
202
202
|
# `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
|
|
203
203
|
# nor this provider, so both survive and `awf-proxy` is added alongside.
|
|
204
204
|
echo "Wrote $CONFIG from $FRAGMENT:"
|
|
205
|
-
jq -r '" model: \(.model // "unset")", " plugins: \(.
|
|
205
|
+
jq -r '" model: \(.model // "unset")", " plugins: \(.plugins // [] | join(", "))", " providers: \(.providers // {} | keys | join(", "))"' "$CONFIG"
|
|
206
206
|
---
|