@plainconceptsplatform/workflows 0.4.12 → 0.4.15

package/loops/actions/classify-route/classify-route.sh

@@ -35,19 +35,27 @@ classify_route() {
     issues)
       if [ "${ACTION:-}" = "labeled" ]; then
         case "${LABEL:-}" in
-          refine)
-            route="refine"
-            refine_mode="first"
-            issue_number="${EVENT_ISSUE_NUMBER:-}"
-            ;;
-          implement)
-            route="implement"
-            issue_number="${EVENT_ISSUE_NUMBER:-}"
+          bot-working)
+            # Bot adds bot-working → route based on which work label is present
+            if has_label implement; then
+              route="implement"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+            elif has_label refine; then
+              route="refine"
+              refine_mode="first"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+            elif has_label direct; then
+              route="direct"
+              direct_mode="first"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+            else
+              error="bot-working added but no work label (implement/refine/direct) found"
+            fi
             ;;
-          direct)
-            route="direct"
-            direct_mode="first"
-            issue_number="${EVENT_ISSUE_NUMBER:-}"
+          refine | implement | direct)
+            # Human adds work label → authorize-bot-work.yml handles this
+            # Route to none here; the bot will add bot-working which triggers the actual work
+            error="waiting for bot to add bot-working label"
             ;;
         esac
       fi

package/loops/workflows/agent-apply-review.md

@@ -7,6 +7,7 @@ env:
   REVIEW_MARKER: "<!-- agent-apply-review -->"
   INCOMPLETE_COMMENT: "Automated review feedback ended without an outcome. The issue remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"

package/loops/workflows/agent-direct.md

@@ -8,6 +8,7 @@ env:
   DIRECT_MARKER: "<!-- agent-direct -->"
   INCOMPLETE_COMMENT: "Automated direct execution ended without an outcome. The direct label remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
 description: |
   Executes a free-form instruction from an issue body and posts the results back on the same
   issue. The issue body IS the prompt — the agent does whatever the maintainer asked for and

package/loops/workflows/agent-implement.md

@@ -12,6 +12,7 @@ env:
   IMPLEMENT_MARKER: "<!-- agent-implement -->"
   INCOMPLETE_COMMENT: "Automated implementation ended without an outcome. The implement label remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/implementation-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
 description: |
   Implements an issue and opens a pull request. Stops there: the merge decision belongs to
   `agent-merge-gate.md`, which runs once CI has reported. Replaces the `impl-*` chain in

package/loops/workflows/agent-merge-gate.md

@@ -1,13 +1,15 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-merge-gate.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
-  REPO_RULES: "Make a risk-based merge decision for the selected bot pull request. Merge only when CI is green and no risk indicators are present. Flag security, schema, auth, or calculation changes for human review. Do not merge protected file changes."
+  VERIFY_COMMANDS: "dotnet restore apps/api/Numa.slnx && dotnet build apps/api/Numa.slnx -c Release --no-restore && dotnet test apps/api/tests/Numa.UnitTests/Numa.UnitTests.csproj -c Release --no-build && dotnet test apps/api/tests/Numa.ParityTests/Numa.ParityTests.csproj -c Release --no-build"
+  REPO_RULES: "Make a risk-based merge decision for the selected bot pull request. Merge only when CI is green and no risk indicators are present. Risk indicators for Numa: changes to QuoteCalculator or calculation waterfall, audit appender or hash chain, JWT issuance or permission checks, EF migrations or entity configurations, decimal precision or money handling, quote lifecycle transitions. Any of these require human review. Do not merge protected file changes."
   WORKING_LABEL: bot-working
   IMPLEMENT_LABEL: implement
   REVIEW_LABEL: review
   GATE_MARKER: "<!-- agent-merge-gate -->"
   INCOMPLETE_COMMENT: "Automated CI failure remediation ended without an outcome. The issue remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -152,7 +154,7 @@ jobs:
           body: |
             ${{ env.GATE_MARKER }}
             PR #${{ needs.subject.outputs.pr }} changes protected files and cannot be auto-merged.
-            Review the pull request before merging it manually.
+            The `review` label is set: a human must merge this PR manually.
 
             Protected files:
             ${{ needs.protected_changes.outputs.files }}
@@ -164,6 +166,7 @@ jobs:
     permissions:
       contents: read
       issues: write
+      pull-requests: read
     steps:
       - name: Checkout workflow actions
         if: needs.subject.outputs.conclusion == 'failure'
@@ -177,7 +180,22 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-      - name: Mark the failed implementation issue as in progress
+      - name: Check for merge conflicts
+        if: needs.subject.outputs.conclusion == 'failure'
+        id: conflicts
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ needs.subject.outputs.pr }}
+        run: |
+          set -euo pipefail
+          mergeable=$(gh pr view "$PR" --repo "$REPO" --json mergeable --jq '.mergeable')
+          if [ "$mergeable" = "CONFLICTING" ]; then
+            echo "has_conflicts=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Mark the issue as in progress
         if: needs.subject.outputs.conclusion == 'failure'
         uses: ./.github/actions/add-issue-labels
         with:
@@ -191,6 +209,16 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.REVIEW_LABEL }}
+      - name: Comment on issue - problems found, solving them
+        if: needs.subject.outputs.conclusion == 'failure'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          body: |
+            ${{ env.GATE_MARKER }}
+            Problems found in PR #${{ needs.subject.outputs.pr }}. ${{ steps.conflicts.outputs.has_conflicts == 'true' && 'Merge conflicts detected.' || '' }} CI concluded with **${{ needs.subject.outputs.conclusion }}**.
+            Bot is working on fixing it.
   conclude:
     needs: [activation, subject, protected_changes, agent, safe_outputs]
     if: >
@@ -270,6 +298,7 @@ jobs:
           issue-number: ${{ needs.subject.outputs.issue }}
           body: |
             ${{ env.GATE_MARKER }}
+            Bot could not resolve PR #${{ needs.subject.outputs.pr }} automatically. The `review` label is set: a human must take over.
             ${{ env.INCOMPLETE_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 

package/loops/workflows/agent-refine.md

@@ -13,6 +13,7 @@ env:
   INCOMPLETE_COMMENT: "Automated refinement ended without an outcome. The refine label remains for a retry."
   SAFE_OUTPUT_COMMENT_PREFIX: "Refinement update"
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   REFINE_ISSUE_PATH: /tmp/gh-aw/refine-issue.json
   REFINE_COMMENTS_PATH: /tmp/gh-aw/refine-comments.json
   GIT_AUTHOR_NAME: "github-actions[bot]"

package/loops/workflows/authorize-bot-work.yml

@@ -0,0 +1,81 @@
+# Human adds implement/refine/direct label → validates permission → bot adds bot-working
+# This ensures the bot is the actor for all agentic workflows.
+name: "Authorize Bot Work"
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  authorize:
+    # Only trigger for implement/refine/direct labels, and only if bot-working is NOT already present
+    if: >
+      (github.event.label.name == 'implement' ||
+       github.event.label.name == 'refine' ||
+       github.event.label.name == 'direct') &&
+      !contains(github.event.issue.labels.*.name, 'bot-working')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Check actor permission
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          
+          # Bots don't need validation - they're already authorized
+          if [[ "$ACTOR" == *"[bot]"* ]]; then
+            echo "authorized=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Bot actor ($ACTOR) - skipping permission check"
+            exit 0
+          fi
+          
+          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+          
+          case "$permission" in
+            admin | maintain | write)
+              echo "authorized=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has $permission permission - authorized"
+              ;;
+            *)
+              echo "authorized=false" >> "$GITHUB_OUTPUT"
+              echo "::warning::$ACTOR has '$permission' permission - not authorized"
+              ;;
+          esac
+
+      - name: Checkout for App token action
+        if: steps.check.outputs.authorized == 'true'
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Generate App token
+        if: steps.check.outputs.authorized == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Bot adds bot-working label
+        if: steps.check.outputs.authorized == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABEL: ${{ github.event.label.name }}
+        run: |
+          set -euo pipefail
+          
+          echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
+          gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
+          
+          echo "::notice::bot-working label added - bot will now own the $LABEL workflow"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.12",
+  "version": "0.4.15",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",