@plainconceptsplatform/workflows 0.4.8 → 0.4.10

package/dist/catalog-installation.js

@@ -162,16 +162,19 @@ async function preCommitHookUpdate(repositoryPath) {
     const compileLine = "node scripts/compile-agent-workflows.mjs";
     const stageLine = "git add -- .github/workflows/*.lock.yml";
     const actionLockLine = "[ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json";
-    const managedLines = `${compileLine}\n${stageLine}\n${actionLockLine}\n`;
+    const managedLines = `if git diff --cached --name-only -- .github | grep -q .; then\n  ${compileLine}\n  ${stageLine}\n  ${actionLockLine}\nfi\n`;
     if (!await exists(hookPath)) {
         return { target, content: managedLines };
     }
     const content = await readFile(hookPath, "utf8");
     if (content.includes("compile-agent-workflows")) {
-        if (content.includes(stageLine))
+        const legacyLines = `${compileLine}\n${stageLine}\n${actionLockLine}\n`;
+        if (content.includes(managedLines))
             return { target, content };
+        if (content.includes(legacyLines))
+            return { target, content: content.replace(legacyLines, managedLines) };
         const suffix = content.endsWith("\n") || content === "" ? "" : "\n";
-        return { target, content: `${content}${suffix}${stageLine}\n${actionLockLine}\n` };
+        return { target, content: `${content}${suffix}${managedLines}` };
     }
     return { target, content: content.endsWith("\n") || content === ""
             ? `${content}${managedLines}`

package/dist/catalog-installation.test.js

@@ -253,20 +253,20 @@ describe("catalog installation", () => {
         const repositoryPath = await createDirectory({});
         await ensurePreCommitHook(repositoryPath);
         await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
-            .resolves.toBe("node scripts/compile-agent-workflows.mjs\ngit add -- .github/workflows/*.lock.yml\n[ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json\n");
+            .resolves.toBe("if git diff --cached --name-only -- .github | grep -q .; then\n  node scripts/compile-agent-workflows.mjs\n  git add -- .github/workflows/*.lock.yml\n  [ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json\nfi\n");
     });
     it("keeps existing pre-commit commands and appends the compiler once", async () => {
         const repositoryPath = await createDirectory({ ".husky/pre-commit": "pnpm lint\n" });
         await ensurePreCommitHook(repositoryPath);
         await ensurePreCommitHook(repositoryPath);
         await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
-            .resolves.toBe("pnpm lint\nnode scripts/compile-agent-workflows.mjs\ngit add -- .github/workflows/*.lock.yml\n[ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json\n");
+            .resolves.toBe("pnpm lint\nif git diff --cached --name-only -- .github | grep -q .; then\n  node scripts/compile-agent-workflows.mjs\n  git add -- .github/workflows/*.lock.yml\n  [ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json\nfi\n");
     });
     it("upgrades an existing compiler hook to stage generated locks", async () => {
         const repositoryPath = await createDirectory({ ".husky/pre-commit": "node scripts/compile-agent-workflows.mjs\n" });
         await ensurePreCommitHook(repositoryPath);
         await expect(readFile(join(repositoryPath, ".husky", "pre-commit"), "utf8"))
-            .resolves.toContain("git add -- .github/workflows/*.lock.yml");
+            .resolves.toContain("if git diff --cached --name-only -- .github | grep -q .; then");
     });
     it("leaves consumer files untouched when staged workflow compilation fails", async () => {
         const sourcePath = await createDirectory({

package/dist/route-processing.test.js

@@ -9,6 +9,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
+    - cron: "*/5 * * * *"
     - cron: "0 */2 * * *"
     - cron: "29 7 * * *"
 
@@ -28,6 +29,7 @@ on:
           - propose
           - audit-close
           - cleanup-artifacts
+          - reconcile-bot-pr-runs
           - stale-recovery
           - validate
 
@@ -71,6 +73,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
 readonly STALE_RECOVERY_CRON="0 */2 * * *"
 readonly PROPOSE_CRON="29 7 * * *"
 
@@ -84,6 +87,7 @@ classify_route() {
         "\$AUDIT_CRON") route="audit" ;;
         "\$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "\$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
+        "\$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
         "\$STALE_RECOVERY_CRON") route="stale-recovery" ;;
         "\$PROPOSE_CRON") route="propose" ;;
         *) error="no route for cron '\${SCHEDULE:-}'" ;;
@@ -106,7 +110,7 @@ classify_route() {
           route="\${OPERATION}"
           trigger_kind="\${INPUT_TRIGGER_KIND:-manual}"
           ;;
-        audit-close | cleanup-artifacts | stale-recovery | validate)
+        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | stale-recovery | validate)
           route="\${OPERATION}"
           ;;
         *)
@@ -131,7 +135,7 @@ set -euo pipefail
 
 echo "── Router wiring ─────────────────────────────────────────────────────────"
 for route in refine implement direct apply-review merge-gate audit propose bot-approve \\
-  audit-close cleanup-artifacts stale-recovery validate; do
+  audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
   if grep -q "route == '\${route}'" "\$ROUTER_YML"; then
     PASS=\$((PASS + 1))
   else

package/loops/actions/classify-route/classify-route.sh

@@ -11,6 +11,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
 readonly STALE_RECOVERY_CRON="0 */2 * * *"
 # Daily, but it proposes far less often than daily: the worker holds one open
 # proposal at a time and skips while that slot is filled. The cron is a heartbeat,
@@ -97,6 +98,7 @@ classify_route() {
         "$AUDIT_CRON") route="audit" ;;
         "$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
+        "$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
         "$STALE_RECOVERY_CRON") route="stale-recovery" ;;
         "$PROPOSE_CRON") route="propose" ;;
         *) error="no route for cron '${SCHEDULE:-}'" ;;
@@ -141,7 +143,7 @@ classify_route() {
           route="${OPERATION}"
           trigger_kind="${INPUT_TRIGGER_KIND:-manual}"
           ;;
-        audit-close | cleanup-artifacts | stale-recovery | validate)
+        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | stale-recovery | validate)
           route="${OPERATION}"
           ;;
         *)

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -148,6 +148,8 @@ assert_route "merge-gate dispatch accepts a positive pull request" merge-gate \
   EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7
 assert_route "stale-recovery dispatch needs no numbers" stale-recovery \
   EVENT=workflow_dispatch OPERATION=stale-recovery
+assert_route "reconcile-bot-pr-runs dispatch needs no numbers" reconcile-bot-pr-runs \
+  EVENT=workflow_dispatch OPERATION=reconcile-bot-pr-runs
 assert_route "an unknown operation routes nowhere" none \
   EVENT=workflow_dispatch OPERATION=deploy-everything
 assert "a scheduled audit reports its trigger kind" scheduled \
@@ -184,7 +186,7 @@ for route in refine implement direct apply-review; do
 done
 
 for route in refine implement direct apply-review merge-gate audit propose bot-approve \
-  audit-close cleanup-artifacts stale-recovery validate; do
+  audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
   if grep -q "route == '${route}'" "$ROUTER_YML"; then
     PASS=$((PASS + 1))
   else

package/loops/workflows/agent-apply-review.md

@@ -23,6 +23,7 @@ name: "Agent: Apply Review"
 # Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
 # This workflow receives the classified inputs and runs rung 3+.
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-audit.md

@@ -24,6 +24,7 @@ name: "Agent: Audit"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-direct.md

@@ -25,6 +25,7 @@ description: |
 name: "Agent: Direct"
 
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-implement.md

@@ -28,6 +28,7 @@ name: "Agent: Implement Issue"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-merge-gate.md

@@ -25,6 +25,7 @@ name: "Agent: Merge Gate"
 # Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
 # This workflow receives the classified inputs and runs rung 3+.
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-propose.md

@@ -37,6 +37,7 @@ name: "Agent: Propose Feature"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared, see shared/platform-defaults.md.
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-refine.md

@@ -33,6 +33,7 @@ description: |
 name: "Agent: Refine Issue"
 
 imports:
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.86.2
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/work-router.yml

@@ -54,6 +54,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
+    - cron: "*/5 * * * *"
     - cron: "0 */2 * * *"
     - cron: "29 7 * * *"
 
@@ -73,6 +74,7 @@ on:
           - propose
           - audit-close
           - cleanup-artifacts
+          - reconcile-bot-pr-runs
           - stale-recovery
           - validate
       issue-number:
@@ -348,6 +350,84 @@ jobs:
             gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
           done
 
+  reconcile-bot-pr-runs:
+    needs: classify
+    if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      # Runs only the default-branch workflow and never checks out pull-request code.
+      # External users cannot impersonate github-actions[bot].
+      - name: Create Platform bot token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          permission-actions: write
+          permission-pull-requests: read
+      - name: Approve checks and dispatch Merge Gate for trusted bot pull requests
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+
+          gh api "repos/$REPO/pulls?state=open&per_page=100" |
+            jq -r --arg repo "$REPO" '
+              .[]
+              | select(
+                  .user.login == "github-actions[bot]"
+                  and .head.repo.full_name == $repo
+                )
+              | [.number, .head.ref] | @tsv
+            ' |
+            while IFS=$'\t' read -r pr_number branch; do
+              gh api "repos/$REPO/actions/runs?status=action_required&branch=$branch" \
+                --jq '.workflow_runs[]
+                  | select(
+                      .event == "pull_request"
+                      and (.name == "App: CI" or .name == "Visual evidence")
+                    )
+                  | .id' |
+                while IFS= read -r run_id; do
+                  echo "Approving trusted bot run $run_id"
+                  gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
+                done
+
+              gate_recorded=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
+                --jq 'any(.[]; .body | contains("<!-- agent-merge-gate -->"))')
+              if [ "$gate_recorded" = "true" ]; then
+                continue
+              fi
+
+              ci=$(gh api "repos/$REPO/actions/runs?branch=$branch&per_page=100" \
+                --jq '[.workflow_runs[]
+                  | select(
+                      .name == "App: CI"
+                      and .event == "pull_request"
+                      and .status == "completed"
+                      and (.conclusion == "success" or .conclusion == "failure")
+                    )
+                  ] | sort_by(.created_at) | last // empty | [.id, .conclusion] | @tsv')
+              if [ -z "$ci" ]; then
+                continue
+              fi
+
+              IFS=$'\t' read -r ci_run_id ci_conclusion <<<"$ci"
+              echo "Dispatching Merge Gate for PR #$pr_number ($ci_conclusion, run $ci_run_id)"
+              gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
+                --method POST \
+                -f ref="$DEFAULT_BRANCH" \
+                -f "inputs[operation]=merge-gate" \
+                -f "inputs[pr-number]=$pr_number" \
+                -f "inputs[ci-conclusion]=$ci_conclusion" \
+                -f "inputs[ci-run-id]=$ci_run_id"
+
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",