@plainconceptsplatform/workflows 0.4.11 → 0.4.13

package/loops/actions/classify-route/classify-route.sh

@@ -11,7 +11,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
-readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/15 * * * *"
 readonly STALE_RECOVERY_CRON="0 */2 * * *"
 # Daily, but it proposes far less often than daily: the worker holds one open
 # proposal at a time and skips while that slot is filled. The cron is a heartbeat,
@@ -35,19 +35,27 @@ classify_route() {
     issues)
       if [ "${ACTION:-}" = "labeled" ]; then
         case "${LABEL:-}" in
-          refine)
-            route="refine"
-            refine_mode="first"
-            issue_number="${EVENT_ISSUE_NUMBER:-}"
-            ;;
-          implement)
-            route="implement"
-            issue_number="${EVENT_ISSUE_NUMBER:-}"
+          bot-working)
+            # Bot adds bot-working → route based on which work label is present
+            if has_label implement; then
+              route="implement"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+            elif has_label refine; then
+              route="refine"
+              refine_mode="first"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+            elif has_label direct; then
+              route="direct"
+              direct_mode="first"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+            else
+              error="bot-working added but no work label (implement/refine/direct) found"
+            fi
             ;;
-          direct)
-            route="direct"
-            direct_mode="first"
-            issue_number="${EVENT_ISSUE_NUMBER:-}"
+          refine | implement | direct)
+            # Human adds work label → authorize-bot-work.yml handles this
+            # Route to none here; the bot will add bot-working which triggers the actual work
+            error="waiting for bot to add bot-working label"
             ;;
         esac
       fi
@@ -78,7 +86,17 @@ classify_route() {
       ;;
 
     pull_request_target)
-      route="bot-approve"
+      if [ "${ACTION:-}" = "labeled" ] && [ "${LABEL:-}" = "merge-gate" ]; then
+        # Human adds merge-gate label to bot PR → triggers merge-gate with human actor
+        # This bypasses gh-aw's bot membership check since the actor is human
+        route="merge-gate"
+        pr_number="${EVENT_PR_NUMBER:-}"
+        # CI status will be fetched by the merge-gate workflow
+        ci_conclusion=""
+        ci_run_id=""
+      else
+        route="bot-approve"
+      fi
       ;;
 
     workflow_run)

package/loops/actions/identify-gate-subject/action.yml

@@ -9,8 +9,9 @@ inputs:
     description: Pull request number to gate.
     required: true
   ci-conclusion:
-    description: Conclusion reported by the CI run that triggered this gate.
-    required: true
+    description: Conclusion reported by the CI run that triggered this gate. If empty, fetches from the PR's latest CI run.
+    required: false
+    default: ''
   linked-issue:
     description: Issue the pull request closes, when the router already resolved it.
     required: false
@@ -30,8 +31,11 @@ outputs:
     description: Issue number the pull request closes.
     value: ${{ steps.identify.outputs.issue }}
   conclusion:
-    description: CI conclusion, passed through unchanged.
+    description: CI conclusion, passed through unchanged or fetched from latest CI run.
     value: ${{ steps.identify.outputs.conclusion }}
+  run-id:
+    description: CI run ID when fetched.
+    value: ${{ steps.identify.outputs.run-id }}
 runs:
   using: composite
   steps:
@@ -87,11 +91,30 @@ runs:
           fi
         fi
 
+        # Fetch CI conclusion if not provided (label-triggered runs)
+        ci_conclusion="$CONCLUSION"
+        ci_run_id=""
+        if [ -z "$ci_conclusion" ]; then
+          head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+          ci_run="$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
+            --jq '[.workflow_runs[] | select(.name == "App: CI" or .name == "CI")] | sort_by(.created_at) | last')"
+          
+          if [ -n "$ci_run" ] && [ "$ci_run" != "null" ]; then
+            ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$ci_run")"
+            ci_run_id="$(jq -r '.id' <<<"$ci_run")"
+            echo "::notice::Fetched CI status: $ci_conclusion (run $ci_run_id)"
+          else
+            ci_conclusion="unknown"
+            echo "::warning::No CI run found for PR #$PR_NUMBER"
+          fi
+        fi
+
         {
           echo "found=true"
           echo "pr=$PR_NUMBER"
           echo "issue=$issue"
-          echo "conclusion=$CONCLUSION"
+          echo "conclusion=$ci_conclusion"
+          echo "run-id=$ci_run_id"
         } >> "$GITHUB_OUTPUT"
 
-        echo "PR #$PR_NUMBER closes #$issue; CI concluded $CONCLUSION"
+        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"

package/loops/workflows/authorize-bot-work.yml

@@ -0,0 +1,81 @@
+# Human adds implement/refine/direct label → validates permission → bot adds bot-working
+# This ensures the bot is the actor for all agentic workflows.
+name: "Authorize Bot Work"
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  authorize:
+    # Only trigger for implement/refine/direct labels, and only if bot-working is NOT already present
+    if: >
+      (github.event.label.name == 'implement' ||
+       github.event.label.name == 'refine' ||
+       github.event.label.name == 'direct') &&
+      !contains(github.event.issue.labels.*.name, 'bot-working')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Check actor permission
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          
+          # Bots don't need validation - they're already authorized
+          if [[ "$ACTOR" == *"[bot]"* ]]; then
+            echo "authorized=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Bot actor ($ACTOR) - skipping permission check"
+            exit 0
+          fi
+          
+          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+          
+          case "$permission" in
+            admin | maintain | write)
+              echo "authorized=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has $permission permission - authorized"
+              ;;
+            *)
+              echo "authorized=false" >> "$GITHUB_OUTPUT"
+              echo "::warning::$ACTOR has '$permission' permission - not authorized"
+              ;;
+          esac
+
+      - name: Checkout for App token action
+        if: steps.check.outputs.authorized == 'true'
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Generate App token
+        if: steps.check.outputs.authorized == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Bot adds bot-working label
+        if: steps.check.outputs.authorized == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABEL: ${{ github.event.label.name }}
+        run: |
+          set -euo pipefail
+          
+          echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
+          gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
+          
+          echo "::notice::bot-working label added - bot will now own the $LABEL workflow"

package/loops/workflows/work-router.yml

@@ -37,7 +37,7 @@ on:
     types: [submitted]
 
   pull_request_target:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, labeled]
   workflow_run:
     workflows: ["App: CI", "CI"]
     types: [completed]
@@ -54,7 +54,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
-    - cron: "*/5 * * * *"
+    - cron: "*/15 * * * *"
     - cron: "0 */2 * * *"
     - cron: "29 7 * * *"
 
@@ -356,19 +356,25 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
+      contents: read
       actions: write
       pull-requests: read
+    env:
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
     steps:
-      # Runs only the default-branch workflow and never checks out pull-request code.
-      # External users cannot impersonate github-actions[bot].
-      - name: Create Platform bot token
+      - name: Checkout for App token action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         with:
-          client-id: ${{ secrets.BOT_APP_ID }}
+          app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-          permission-actions: write
-          permission-pull-requests: read
+      # Runs only the default-branch workflow and never checks out pull-request code.
+      # External users cannot impersonate github-actions[bot].
       - name: Approve checks and dispatch Merge Gate for trusted bot pull requests
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -383,6 +389,7 @@ jobs:
               | select(
                   .user.login == "github-actions[bot]"
                   and .head.repo.full_name == $repo
+                  and .mergeable_state != "dirty"
                 )
               | [.number, .head.ref] | @tsv
             ' |
@@ -427,6 +434,7 @@ jobs:
                 -f "inputs[pr-number]=$pr_number" \
                 -f "inputs[ci-conclusion]=$ci_conclusion" \
                 -f "inputs[ci-run-id]=$ci_run_id"
+            done
 
   audit-close:
     needs: classify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",