@plainconceptsplatform/workflows 0.5.1 → 0.16.0

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -33,7 +33,17 @@ env:
   SEED_PROJECT: src/App.Seed
   PRIMARY_DATABASE: app
   DATA_LAYER_DATABASE: numa_dl
-  SQL_SA_PASSWORD: "YourStrong!Passw0rd"
+  # Derived per run rather than written down. The container is ephemeral, bound to a random
+  # host port and reachable only from this job, so the value protects nothing, but a literal
+  # password in a config file is a policy finding wherever it sits, and this file is public.
+  # It has to be a workflow-level expression: service containers receive their environment
+  # before any step runs, so a value generated in a step would arrive too late.
+  #
+  # The same expression is repeated inside the service's `options` above rather than read
+  # from here, because the `env` context is not available in `jobs.<id>.services` — only
+  # inside that service's own `env:`. Written as ${{ env.SQL_SA_PASSWORD }} there, the health
+  # check probes with an empty password and the service never reports healthy.
+  SQL_SA_PASSWORD: "Aa1!${{ github.run_id }}"
   WEB_PACKAGE: "@app/web"
   NPM_REGISTRY_URL: "//npm.pkg.github.com/"
   TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
@@ -66,7 +76,7 @@ jobs:
         # exit code 1". Steps read the assigned port from the job.services context.
           - 1433
         options: >-
-          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P '${{ env.SQL_SA_PASSWORD }}' -Q 'SELECT 1' -C || exit 1"
+          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Aa1!${{ github.run_id }}' -Q 'SELECT 1' -C || exit 1"
           --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
     defaults:
       run:
@@ -266,3 +276,55 @@ jobs:
         with:
           format: cyclonedx-json
           artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+
+  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
+  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
+  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
+  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
+  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
+  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  #
+  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
+  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
+  # whole run fails to start with zero jobs and no annotation when it does.
+  dispatch-merge-gate:
+    name: Dispatch merge gate
+    needs: [api, mutation-api, web, mutation-web]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.type == 'Bot'
+    runs-on: agents-arc
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Dispatch the merge gate with this run's verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          conclusion=success
+          for result in $RESULTS; do
+            case "$result" in
+              failure) conclusion=failure; break ;;
+              cancelled | timed_out) conclusion=cancelled ;;
+            esac
+          done
+          # A cancelled run was superseded by a newer push, whose own run dispatches.
+          if [ "$conclusion" = cancelled ]; then
+            echo "CI was cancelled; not dispatching the merge gate."
+            exit 0
+          fi
+          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -206,3 +206,55 @@ jobs:
         with:
           format: cyclonedx-json
           artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+
+  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
+  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
+  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
+  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
+  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
+  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  #
+  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
+  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
+  # whole run fails to start with zero jobs and no annotation when it does.
+  dispatch-merge-gate:
+    name: Dispatch merge gate
+    needs: [lint, web, mutation-web, e2e, desktop, mobile]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.type == 'Bot'
+    runs-on: agents-arc
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Dispatch the merge gate with this run's verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          conclusion=success
+          for result in $RESULTS; do
+            case "$result" in
+              failure) conclusion=failure; break ;;
+              cancelled | timed_out) conclusion=cancelled ;;
+            esac
+          done
+          # A cancelled run was superseded by a newer push, whose own run dispatches.
+          if [ "$conclusion" = cancelled ]; then
+            echo "CI was cancelled; not dispatching the merge gate."
+            exit 0
+          fi
+          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"

package/loops/templates/opencode/opencode.ci.json

@@ -7,7 +7,7 @@
     "ci-workflow-agent": {
       "description": "Executes GitHub Agentic Workflow tasks in CI.",
       "mode": "primary",
-      "prompt": "You execute the GitHub Agentic Workflow task in the user prompt. Read AGENTS.md before any non-trivial change. Load only skills the workflow task explicitly names via skill(); when a workflow says load @skill-name, call skill(\"skill-name\"), the @ prefix is just a hint to use the skill tool. Execute only the requested task and required commands. Do not probe or inspect unrelated commands. The GitHub CLI is intentionally unauthenticated: never use `gh` for GitHub reads or writes. Read supplied workflow files first, then use the GitHub MCP tools only when fresh GitHub data is required. Use direct `safeoutputs` commands for GitHub writes. For syntax-only validation of a conventional GitHub Actions YAML file, use Ruby's standard YAML library; do not probe, install, or fall back through PyYAML, js-yaml, actionlint, or Docker. A task is complete only after every required Safe Outputs command succeeds. After the final required Safe Outputs command, stop immediately without further tools, prose, or model turns. Use `mcpscripts` only when the runtime explicitly lists it as available.\n\nOUTPUT DISCIPLINE: Do not narrate. Do not explain what you are about to do before doing it. Do not write prose between tool calls. Call tools silently. The only prose you produce is the final result or a brief error explanation when something fails. Never output sentences like 'Let me check...', 'Now I will...', 'I have enough context...', or 'Next I need to...'. If you are about to call a tool, just call it. If you must think, use the todowrite tool, not prose.\n\nMEMORY: agentmemory is the shared long-term store. Start non-trivial tasks by calling its recall/search tool with the key concepts of the task (component names, error text) and reuse what it returns instead of rediscovering it. Before finishing, store 1-3 concise memories of durable non-obvious learnings: architecture constraints, root causes and their fixes, decisions and their why. Skip trivia the repo already documents. Never store secrets or tokens."
+      "prompt": "You execute the GitHub Agentic Workflow task in the user prompt. Read AGENTS.md before any non-trivial change. Load only skills the workflow task explicitly names via skill(); when a workflow says load @skill-name, call skill(\"skill-name\"), the @ prefix is just a hint to use the skill tool. Execute only the requested task and required commands. Do not probe or inspect unrelated commands. The GitHub CLI is intentionally unauthenticated: never use `gh` for GitHub reads or writes. Read supplied workflow files first, then use the GitHub MCP tools only when fresh GitHub data is required. Use direct `safeoutputs` commands for GitHub writes. Each safe-output type has a small per-run allowance, and a call that fails still spends it: never send an empty, partial or test payload to discover what a tool accepts, because that probe can be recorded as a success, take the allowance with it, and leave the real call refused as over the limit, ending a run that did all the work and published none of it. Call each safe-output tool once, with the complete final payload, only when you are ready to commit to the outcome. For syntax-only validation of a conventional GitHub Actions YAML file, use Ruby's standard YAML library; do not probe, install, or fall back through PyYAML, js-yaml, actionlint, or Docker. A task is complete only after every required Safe Outputs command succeeds. After the final required Safe Outputs command, stop immediately without further tools, prose, or model turns. Use `mcpscripts` only when the runtime explicitly lists it as available.\n\nOUTPUT DISCIPLINE: Do not narrate. Do not explain what you are about to do before doing it. Do not write prose between tool calls. Call tools silently. The only prose you produce is the final result or a brief error explanation when something fails. Never output sentences like 'Let me check...', 'Now I will...', 'I have enough context...', or 'Next I need to...'. If you are about to call a tool, just call it. If you must think, use the todowrite tool, not prose.\n\nMEMORY: agentmemory is the shared long-term store. Start non-trivial tasks by calling its recall/search tool with the key concepts of the task (component names, error text) and reuse what it returns instead of rediscovering it. Before finishing, store 1-3 concise memories of durable non-obvious learnings: architecture constraints, root causes and their fixes, decisions and their why. Skip trivia the repo already documents. Never store secrets or tokens."
     }
   },
   "permission": {
@@ -30,9 +30,9 @@
   },
   "provider": {
     "forge": {
-      "api": "{env:FORGE_API_URL}",
+      "api": "{env:OPENAI_BASE_URL}",
       "options": {
-        "apiKey": "{env:FORGE_API_KEY}"
+        "apiKey": "{env:OPENAI_API_KEY}"
       },
       "models": {
         "glm-5-3": {

package/loops/templates/opencode/opencode.ci.json.md

@@ -17,7 +17,10 @@ repository root as `opencode.ci.json`.
 ### Provider
 
 - The `forge` provider is OpenAI-compatible and reads its endpoint from
-  `FORGE_API_URL` and its key from `FORGE_API_KEY` at runtime.
+  `OPENAI_BASE_URL` and its key from `OPENAI_API_KEY` at runtime. Those are the
+  two variables every worker's agent job sets (`engine.env` in the worker and
+  the `OPENAI_API_KEY` secret), so the file works with no consumer wiring. An
+  earlier template read `FORGE_API_URL`/`FORGE_API_KEY`, which nothing set.
 - Each consumer configures its own router endpoint, credential, model IDs, and
   capabilities. The workflow package does not assume a particular gateway
   host, authentication system, or model vendor.