@plainconceptsplatform/workflows 0.4.9 → 0.4.10

package/dist/route-processing.test.js

@@ -9,6 +9,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
+    - cron: "*/5 * * * *"
     - cron: "0 */2 * * *"
     - cron: "29 7 * * *"
 
@@ -28,6 +29,7 @@ on:
           - propose
           - audit-close
           - cleanup-artifacts
+          - reconcile-bot-pr-runs
           - stale-recovery
           - validate
 
@@ -71,6 +73,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
 readonly STALE_RECOVERY_CRON="0 */2 * * *"
 readonly PROPOSE_CRON="29 7 * * *"
 
@@ -84,6 +87,7 @@ classify_route() {
         "\$AUDIT_CRON") route="audit" ;;
         "\$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "\$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
+        "\$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
         "\$STALE_RECOVERY_CRON") route="stale-recovery" ;;
         "\$PROPOSE_CRON") route="propose" ;;
         *) error="no route for cron '\${SCHEDULE:-}'" ;;
@@ -106,7 +110,7 @@ classify_route() {
           route="\${OPERATION}"
           trigger_kind="\${INPUT_TRIGGER_KIND:-manual}"
           ;;
-        audit-close | cleanup-artifacts | stale-recovery | validate)
+        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | stale-recovery | validate)
           route="\${OPERATION}"
           ;;
         *)
@@ -131,7 +135,7 @@ set -euo pipefail
 
 echo "── Router wiring ─────────────────────────────────────────────────────────"
 for route in refine implement direct apply-review merge-gate audit propose bot-approve \\
-  audit-close cleanup-artifacts stale-recovery validate; do
+  audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
   if grep -q "route == '\${route}'" "\$ROUTER_YML"; then
     PASS=\$((PASS + 1))
   else

package/loops/actions/classify-route/classify-route.sh

@@ -11,6 +11,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/5 * * * *"
 readonly STALE_RECOVERY_CRON="0 */2 * * *"
 # Daily, but it proposes far less often than daily: the worker holds one open
 # proposal at a time and skips while that slot is filled. The cron is a heartbeat,
@@ -97,6 +98,7 @@ classify_route() {
         "$AUDIT_CRON") route="audit" ;;
         "$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
+        "$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
         "$STALE_RECOVERY_CRON") route="stale-recovery" ;;
         "$PROPOSE_CRON") route="propose" ;;
         *) error="no route for cron '${SCHEDULE:-}'" ;;
@@ -141,7 +143,7 @@ classify_route() {
           route="${OPERATION}"
           trigger_kind="${INPUT_TRIGGER_KIND:-manual}"
           ;;
-        audit-close | cleanup-artifacts | stale-recovery | validate)
+        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | stale-recovery | validate)
           route="${OPERATION}"
           ;;
         *)

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -148,6 +148,8 @@ assert_route "merge-gate dispatch accepts a positive pull request" merge-gate \
   EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7
 assert_route "stale-recovery dispatch needs no numbers" stale-recovery \
   EVENT=workflow_dispatch OPERATION=stale-recovery
+assert_route "reconcile-bot-pr-runs dispatch needs no numbers" reconcile-bot-pr-runs \
+  EVENT=workflow_dispatch OPERATION=reconcile-bot-pr-runs
 assert_route "an unknown operation routes nowhere" none \
   EVENT=workflow_dispatch OPERATION=deploy-everything
 assert "a scheduled audit reports its trigger kind" scheduled \
@@ -184,7 +186,7 @@ for route in refine implement direct apply-review; do
 done
 
 for route in refine implement direct apply-review merge-gate audit propose bot-approve \
-  audit-close cleanup-artifacts stale-recovery validate; do
+  audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
   if grep -q "route == '${route}'" "$ROUTER_YML"; then
     PASS=$((PASS + 1))
   else

package/loops/workflows/work-router.yml

@@ -54,6 +54,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
+    - cron: "*/5 * * * *"
     - cron: "0 */2 * * *"
     - cron: "29 7 * * *"
 
@@ -73,6 +74,7 @@ on:
           - propose
           - audit-close
           - cleanup-artifacts
+          - reconcile-bot-pr-runs
           - stale-recovery
           - validate
       issue-number:
@@ -348,6 +350,84 @@ jobs:
             gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
           done
 
+  reconcile-bot-pr-runs:
+    needs: classify
+    if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+      pull-requests: read
+    steps:
+      # Runs only the default-branch workflow and never checks out pull-request code.
+      # External users cannot impersonate github-actions[bot].
+      - name: Create Platform bot token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          permission-actions: write
+          permission-pull-requests: read
+      - name: Approve checks and dispatch Merge Gate for trusted bot pull requests
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+
+          gh api "repos/$REPO/pulls?state=open&per_page=100" |
+            jq -r --arg repo "$REPO" '
+              .[]
+              | select(
+                  .user.login == "github-actions[bot]"
+                  and .head.repo.full_name == $repo
+                )
+              | [.number, .head.ref] | @tsv
+            ' |
+            while IFS=$'\t' read -r pr_number branch; do
+              gh api "repos/$REPO/actions/runs?status=action_required&branch=$branch" \
+                --jq '.workflow_runs[]
+                  | select(
+                      .event == "pull_request"
+                      and (.name == "App: CI" or .name == "Visual evidence")
+                    )
+                  | .id' |
+                while IFS= read -r run_id; do
+                  echo "Approving trusted bot run $run_id"
+                  gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
+                done
+
+              gate_recorded=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
+                --jq 'any(.[]; .body | contains("<!-- agent-merge-gate -->"))')
+              if [ "$gate_recorded" = "true" ]; then
+                continue
+              fi
+
+              ci=$(gh api "repos/$REPO/actions/runs?branch=$branch&per_page=100" \
+                --jq '[.workflow_runs[]
+                  | select(
+                      .name == "App: CI"
+                      and .event == "pull_request"
+                      and .status == "completed"
+                      and (.conclusion == "success" or .conclusion == "failure")
+                    )
+                  ] | sort_by(.created_at) | last // empty | [.id, .conclusion] | @tsv')
+              if [ -z "$ci" ]; then
+                continue
+              fi
+
+              IFS=$'\t' read -r ci_run_id ci_conclusion <<<"$ci"
+              echo "Dispatching Merge Gate for PR #$pr_number ($ci_conclusion, run $ci_run_id)"
+              gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
+                --method POST \
+                -f ref="$DEFAULT_BRANCH" \
+                -f "inputs[operation]=merge-gate" \
+                -f "inputs[pr-number]=$pr_number" \
+                -f "inputs[ci-conclusion]=$ci_conclusion" \
+                -f "inputs[ci-run-id]=$ci_run_id"
+
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",