@plainconceptsplatform/workflows 0.4.12 → 0.4.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -35,19 +35,27 @@ classify_route() {
|
|
|
35
35
|
issues)
|
|
36
36
|
if [ "${ACTION:-}" = "labeled" ]; then
|
|
37
37
|
case "${LABEL:-}" in
|
|
38
|
-
|
|
39
|
-
route
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
38
|
+
bot-working)
|
|
39
|
+
# Bot adds bot-working → route based on which work label is present
|
|
40
|
+
if has_label implement; then
|
|
41
|
+
route="implement"
|
|
42
|
+
issue_number="${EVENT_ISSUE_NUMBER:-}"
|
|
43
|
+
elif has_label refine; then
|
|
44
|
+
route="refine"
|
|
45
|
+
refine_mode="first"
|
|
46
|
+
issue_number="${EVENT_ISSUE_NUMBER:-}"
|
|
47
|
+
elif has_label direct; then
|
|
48
|
+
route="direct"
|
|
49
|
+
direct_mode="first"
|
|
50
|
+
issue_number="${EVENT_ISSUE_NUMBER:-}"
|
|
51
|
+
else
|
|
52
|
+
error="bot-working added but no work label (implement/refine/direct) found"
|
|
53
|
+
fi
|
|
46
54
|
;;
|
|
47
|
-
direct)
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
55
|
+
refine | implement | direct)
|
|
56
|
+
# Human adds work label → authorize-bot-work.yml handles this
|
|
57
|
+
# Route to none here; the bot will add bot-working which triggers the actual work
|
|
58
|
+
error="waiting for bot to add bot-working label"
|
|
51
59
|
;;
|
|
52
60
|
esac
|
|
53
61
|
fi
|
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
# Human adds implement/refine/direct label → validates permission → bot adds bot-working
|
|
2
|
+
# This ensures the bot is the actor for all agentic workflows.
|
|
3
|
+
name: "Authorize Bot Work"
|
|
4
|
+
|
|
5
|
+
on:
|
|
6
|
+
issues:
|
|
7
|
+
types: [labeled]
|
|
8
|
+
|
|
9
|
+
permissions:
|
|
10
|
+
contents: read
|
|
11
|
+
|
|
12
|
+
jobs:
|
|
13
|
+
authorize:
|
|
14
|
+
# Only trigger for implement/refine/direct labels, and only if bot-working is NOT already present
|
|
15
|
+
if: >
|
|
16
|
+
(github.event.label.name == 'implement' ||
|
|
17
|
+
github.event.label.name == 'refine' ||
|
|
18
|
+
github.event.label.name == 'direct') &&
|
|
19
|
+
!contains(github.event.issue.labels.*.name, 'bot-working')
|
|
20
|
+
runs-on: ubuntu-latest
|
|
21
|
+
timeout-minutes: 5
|
|
22
|
+
permissions:
|
|
23
|
+
contents: read
|
|
24
|
+
issues: write
|
|
25
|
+
steps:
|
|
26
|
+
- name: Check actor permission
|
|
27
|
+
id: check
|
|
28
|
+
env:
|
|
29
|
+
GH_TOKEN: ${{ github.token }}
|
|
30
|
+
ACTOR: ${{ github.actor }}
|
|
31
|
+
run: |
|
|
32
|
+
set -euo pipefail
|
|
33
|
+
|
|
34
|
+
# Bots don't need validation - they're already authorized
|
|
35
|
+
if [[ "$ACTOR" == *"[bot]"* ]]; then
|
|
36
|
+
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
|
37
|
+
echo "::notice::Bot actor ($ACTOR) - skipping permission check"
|
|
38
|
+
exit 0
|
|
39
|
+
fi
|
|
40
|
+
|
|
41
|
+
permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
|
|
42
|
+
--jq '.permission' 2>/dev/null || echo "none")
|
|
43
|
+
|
|
44
|
+
case "$permission" in
|
|
45
|
+
admin | maintain | write)
|
|
46
|
+
echo "authorized=true" >> "$GITHUB_OUTPUT"
|
|
47
|
+
echo "::notice::$ACTOR has $permission permission - authorized"
|
|
48
|
+
;;
|
|
49
|
+
*)
|
|
50
|
+
echo "authorized=false" >> "$GITHUB_OUTPUT"
|
|
51
|
+
echo "::warning::$ACTOR has '$permission' permission - not authorized"
|
|
52
|
+
;;
|
|
53
|
+
esac
|
|
54
|
+
|
|
55
|
+
- name: Checkout for App token action
|
|
56
|
+
if: steps.check.outputs.authorized == 'true'
|
|
57
|
+
uses: actions/checkout@v4
|
|
58
|
+
with:
|
|
59
|
+
persist-credentials: false
|
|
60
|
+
|
|
61
|
+
- name: Generate App token
|
|
62
|
+
if: steps.check.outputs.authorized == 'true'
|
|
63
|
+
id: app-token
|
|
64
|
+
uses: actions/create-github-app-token@v1
|
|
65
|
+
with:
|
|
66
|
+
app-id: ${{ secrets.BOT_APP_ID }}
|
|
67
|
+
private-key: ${{ secrets.BOT_PRIVATE_KEY }}
|
|
68
|
+
|
|
69
|
+
- name: Bot adds bot-working label
|
|
70
|
+
if: steps.check.outputs.authorized == 'true'
|
|
71
|
+
env:
|
|
72
|
+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
73
|
+
ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
74
|
+
LABEL: ${{ github.event.label.name }}
|
|
75
|
+
run: |
|
|
76
|
+
set -euo pipefail
|
|
77
|
+
|
|
78
|
+
echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
|
|
79
|
+
gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
|
|
80
|
+
|
|
81
|
+
echo "::notice::bot-working label added - bot will now own the $LABEL workflow"
|