@plainconceptsplatform/workflows 0.4.11 → 0.4.12

package/loops/actions/classify-route/classify-route.sh

@@ -11,7 +11,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
-readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/15 * * * *"
 readonly STALE_RECOVERY_CRON="0 */2 * * *"
 # Daily, but it proposes far less often than daily: the worker holds one open
 # proposal at a time and skips while that slot is filled. The cron is a heartbeat,
@@ -78,7 +78,17 @@ classify_route() {
       ;;
 
     pull_request_target)
-      route="bot-approve"
+      if [ "${ACTION:-}" = "labeled" ] && [ "${LABEL:-}" = "merge-gate" ]; then
+        # Human adds merge-gate label to bot PR → triggers merge-gate with human actor
+        # This bypasses gh-aw's bot membership check since the actor is human
+        route="merge-gate"
+        pr_number="${EVENT_PR_NUMBER:-}"
+        # CI status will be fetched by the merge-gate workflow
+        ci_conclusion=""
+        ci_run_id=""
+      else
+        route="bot-approve"
+      fi
       ;;
 
     workflow_run)

package/loops/actions/identify-gate-subject/action.yml

@@ -9,8 +9,9 @@ inputs:
     description: Pull request number to gate.
     required: true
   ci-conclusion:
-    description: Conclusion reported by the CI run that triggered this gate.
-    required: true
+    description: Conclusion reported by the CI run that triggered this gate. If empty, fetches from the PR's latest CI run.
+    required: false
+    default: ''
   linked-issue:
     description: Issue the pull request closes, when the router already resolved it.
     required: false
@@ -30,8 +31,11 @@ outputs:
     description: Issue number the pull request closes.
     value: ${{ steps.identify.outputs.issue }}
   conclusion:
-    description: CI conclusion, passed through unchanged.
+    description: CI conclusion, passed through unchanged or fetched from latest CI run.
     value: ${{ steps.identify.outputs.conclusion }}
+  run-id:
+    description: CI run ID when fetched.
+    value: ${{ steps.identify.outputs.run-id }}
 runs:
   using: composite
   steps:
@@ -87,11 +91,30 @@ runs:
           fi
         fi
 
+        # Fetch CI conclusion if not provided (label-triggered runs)
+        ci_conclusion="$CONCLUSION"
+        ci_run_id=""
+        if [ -z "$ci_conclusion" ]; then
+          head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+          ci_run="$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
+            --jq '[.workflow_runs[] | select(.name == "App: CI" or .name == "CI")] | sort_by(.created_at) | last')"
+          
+          if [ -n "$ci_run" ] && [ "$ci_run" != "null" ]; then
+            ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$ci_run")"
+            ci_run_id="$(jq -r '.id' <<<"$ci_run")"
+            echo "::notice::Fetched CI status: $ci_conclusion (run $ci_run_id)"
+          else
+            ci_conclusion="unknown"
+            echo "::warning::No CI run found for PR #$PR_NUMBER"
+          fi
+        fi
+
         {
           echo "found=true"
           echo "pr=$PR_NUMBER"
           echo "issue=$issue"
-          echo "conclusion=$CONCLUSION"
+          echo "conclusion=$ci_conclusion"
+          echo "run-id=$ci_run_id"
         } >> "$GITHUB_OUTPUT"
 
-        echo "PR #$PR_NUMBER closes #$issue; CI concluded $CONCLUSION"
+        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"

package/loops/workflows/work-router.yml

@@ -37,7 +37,7 @@ on:
     types: [submitted]
 
   pull_request_target:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, labeled]
   workflow_run:
     workflows: ["App: CI", "CI"]
     types: [completed]
@@ -54,7 +54,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
-    - cron: "*/5 * * * *"
+    - cron: "*/15 * * * *"
     - cron: "0 */2 * * *"
     - cron: "29 7 * * *"
 
@@ -356,19 +356,25 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
+      contents: read
       actions: write
       pull-requests: read
+    env:
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
     steps:
-      # Runs only the default-branch workflow and never checks out pull-request code.
-      # External users cannot impersonate github-actions[bot].
-      - name: Create Platform bot token
+      - name: Checkout for App token action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
-          client-id: ${{ secrets.BOT_APP_ID }}
+          app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-          permission-actions: write
-          permission-pull-requests: read
+      # Runs only the default-branch workflow and never checks out pull-request code.
+      # External users cannot impersonate github-actions[bot].
       - name: Approve checks and dispatch Merge Gate for trusted bot pull requests
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -383,6 +389,7 @@ jobs:
               | select(
                   .user.login == "github-actions[bot]"
                   and .head.repo.full_name == $repo
+                  and .mergeable_state != "dirty"
                 )
               | [.number, .head.ref] | @tsv
             ' |
@@ -427,6 +434,7 @@ jobs:
                 -f "inputs[pr-number]=$pr_number" \
                 -f "inputs[ci-conclusion]=$ci_conclusion" \
                 -f "inputs[ci-run-id]=$ci_run_id"
+            done
 
   audit-close:
     needs: classify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",