@plainconceptsplatform/workflows 0.5.1 → 0.16.0

package/dist/workflow-catalog.js

@@ -0,0 +1,57 @@
+export const routeNames = [
+    "refine",
+    "implement",
+    "triage",
+    "apply-review",
+    "merge-gate",
+    "audit",
+    "release",
+];
+export const workflowRoutes = [
+    { name: "refine", worker: "agent-refine.md", description: "Refines an issue into a user story, on a first pass or after the author has answered the bot's questions.", defaultEnabled: true },
+    { name: "implement", worker: "agent-implement.md", description: "Implements an issue and opens a pull request. Stops there: the merge decision belongs to the merge gate.", defaultEnabled: true },
+    { name: "triage", worker: "agent-triage.md", description: "Triages issues opened from outside the organisation: runs 10 checks (template, security, size, danger, duplicates, clarity, reproducibility, acceptance, cross-cutting, product scope). Loops up to 3 rounds. Passes to refine, asks the author for more, parks out-of-scope work open for a maintainer, or closes what is genuinely rejected.", defaultEnabled: true },
+    { name: "apply-review", worker: "agent-apply-review.md", description: "Applies reviewer feedback to an open pull request the bot authored, then pushes the fixes to the same branch.", defaultEnabled: true },
+    { name: "merge-gate", worker: "agent-merge-gate.md", description: "Decides what happens to a bot-authored pull request once CI has reported: merge, hand to a human, or fix CI.", defaultEnabled: true },
+    { name: "audit", worker: "agent-audit.md", description: "Read-only repository audit. Finds 5-7 problems, scores each 1-10, and files a single issue that Refine then sizes and splits.", defaultEnabled: true },
+    { name: "release", worker: "agent-release.md", description: "Writes release notes from the commit log, then a deterministic job bumps the version, tags, and publishes a GitHub Release. Manual dispatch only (operation=release).", defaultEnabled: true },
+];
+export const packageOwnedTargets = [
+    ".github/actions",
+    ".github/workflows/agent-*.md",
+    ".github/workflows/shared/platform-defaults.md",
+    ".github/workflows/shared/opencode-ci.md",
+    ".github/workflows/work-router.yml",
+    "scripts/compile-agent-workflows.mjs",
+    "opencode.ci.json",
+];
+export const mandatoryFiles = [
+    { source: "templates/opencode/opencode.ci.json", target: "opencode.ci.json" },
+    { source: "scripts/compile-agent-workflows.mjs", target: "scripts/compile-agent-workflows.mjs" },
+];
+export const generatedConsumerTargets = [
+    ".github/workflows/agent-*.lock.yml",
+    ".github/aw/actions-lock.json",
+];
+export const templateNames = [
+    "agentics-checks",
+    "agentics-error-report",
+    "agentics-maintenance",
+    "app-ci-dotnet-next",
+    "app-ci-node-monorepo",
+    "bug-report",
+    "feature-request",
+    "github-release",
+    "opencode.ci.json",
+];
+export const catalogTemplates = [
+    { name: "agentics-checks", file: "agentics-checks.yml", description: "Agentics checks: verifies generated agent lockfiles, actionlint, and compile on PRs touching workflow files." },
+    { name: "agentics-error-report", file: "agentics-error-report.yml", description: "Daily error report: classifies the last day of failures in the workflows this package ships and files them upstream so the package gets fixed. Deterministic, no model; sends only package-owned names, conclusions and counts, and refuses to file anything a leak scanner flags." },
+    { name: "agentics-maintenance", file: "agentics-maintenance.yml", description: "Agentic maintenance: scheduled daily maintenance workflow for keeping workflows and actions up to date." },
+    { name: "app-ci-dotnet-next", file: "app-ci-dotnet-next.yml", description: "App CI pipeline for a .NET + Next.js monorepo: build, test, and lint on PRs and schedule." },
+    { name: "app-ci-node-monorepo", file: "app-ci-node-monorepo.yml", description: "App CI pipeline for a Node monorepo: build, test, and lint on PRs and schedule." },
+    { name: "bug-report", file: "bug_report.yml", description: "Bug report issue template: what happened, repro steps, expected behavior, acceptance criteria, environment, logs.", target: ".github/ISSUE_TEMPLATE/bug_report.yml" },
+    { name: "feature-request", file: "feature_request.yml", description: "Feature request issue template scoped to small, well-scoped improvements (Small/Medium only; large work belongs in a planning issue).", target: ".github/ISSUE_TEMPLATE/feature_request.yml" },
+    { name: "github-release", file: "github-release.yml", description: "Publishes or updates a GitHub Release with generated notes whenever a v* tag is pushed." },
+    { name: "opencode.ci.json", file: "opencode.ci.json", description: "Standalone OpenCode CI config: plainconcepts provider, GLM model registration, ci-workflow-agent, and LSP defaults for consumer repositories." },
+];

package/loops/actions/add-issue-labels/action.yml

@@ -9,7 +9,7 @@ inputs:
     description: Issue or pull request number.
     required: true
   labels:
-    description: Newline-delimited labels to add.
+    description: Labels to add, one per line. A comma-separated list is accepted as well.
     required: true
 runs:
   using: composite
@@ -22,7 +22,27 @@ runs:
       with:
         github-token: ${{ inputs.token }}
         script: |
-          const labels = process.env.LABELS.split(/\r?\n/).filter(Boolean);
+          const labels = process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean);
+          if (labels.length === 0) {
+            core.notice('No labels to add.');
+            return;
+          }
+
+          // Create what does not exist yet, so shipping a new label in the package does not
+          // require a person to go and make it in every repository first. Its sibling
+          // remove-issue-labels has swallowed 404 for a long time; this one had no guard at all,
+          // so a label the package introduced would fail the step in every consumer until
+          // somebody created it by hand. 422 is "already exists", which is the happy path on
+          // every run after the first.
+          for (const name of labels) {
+            try {
+              await github.rest.issues.createLabel({ ...context.repo, name, color: 'ededed' });
+              core.notice(`Created the ${name} label.`);
+            } catch (error) {
+              if (error.status !== 422) throw error;
+            }
+          }
+
           await github.rest.issues.addLabels({
             ...context.repo,
             issue_number: Number(process.env.ISSUE_NUMBER),

package/loops/actions/apply-agent-bundle/apply-bundle.sh

@@ -40,7 +40,20 @@ git fetch --no-tags "$BUNDLE_FILE" "$BUNDLE_REF"
 [ "$(git cat-file -t "$BUNDLE_TIP")" = commit ] || fail "Git bundle ref must point directly to a commit"
 [ "$(git rev-parse FETCH_HEAD)" = "$BUNDLE_TIP" ] || fail "Fetched bundle commit did not match listed bundle ref"
 
-git merge-base --is-ancestor "$TARGET_TIP" "$BUNDLE_TIP" || fail "Git bundle cannot fast-forward $TARGET_BRANCH"
+# Fast-forward only, deliberately: a push that is not one would discard somebody's commits.
+#
+# "Cannot fast-forward" said nothing about why, and there are two reasons: the agent
+# rewrote history (a rebase, an amend, a reset), or somebody pushed to the branch while it
+# was working. Both mean the same thing to git, that the branch carries commits the bundle
+# does not, so the applier cannot tell them apart and does not try. It prints the commits
+# that are missing instead: their authors and dates answer the question immediately.
+if ! git merge-base --is-ancestor "$TARGET_TIP" "$BUNDLE_TIP"; then
+  echo "::error::Nothing was applied. $TARGET_BRANCH is at $TARGET_TIP and the bundle is at $BUNDLE_TIP, which does not contain it, so pushing would drop the commits below. Either the agent rewrote history, which this push refuses, or the branch moved while it was working, in which case nothing is lost and the gate only needs running again on the current head."
+  echo "On $TARGET_BRANCH but missing from the bundle:"
+  git --no-pager log --format="  %h %ad %an  %s" --date=short "$BUNDLE_TIP..$TARGET_TIP" |
+    head -20 || true
+  exit 1
+fi
 git switch --detach "$TARGET_TIP"
 git merge --ff-only "$BUNDLE_TIP"
 git push origin "HEAD:refs/heads/$TARGET_BRANCH"

package/loops/actions/audit-close/action.yml

@@ -1,128 +1,180 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/audit-close/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Close audit reports
-description: Close open audit reports once every issue they reference is closed.
-inputs:
-  token:
-    description: GitHub token with issues write access.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Close every report whose referenced issues are all closed
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const reports = await github.paginate(github.rest.issues.listForRepo, {
-            ...context.repo,
-            state: 'open',
-            labels: 'audit',
-            per_page: 100,
-          });
-
-          if (reports.length === 0) {
-            core.info('No open audit reports.');
-            return;
-          }
-
-          // Skip `owner/repo#12` and `abc#12`: only a bare `#12` references this repository.
-          const referencedIssues = (body) => {
-            const matches = (body ?? '').matchAll(/(?:^|[^A-Za-z0-9_/])#(\d+)/g);
-            return [...new Set([...matches].map((match) => Number(match[1])))];
-          };
-
-          let closed = 0;
-          let keptOpen = 0;
-
-          for (const report of reports.sort((a, b) => a.number - b.number)) {
-            const refs = referencedIssues(report.body).filter((n) => n !== report.number);
-
-            const stillOpen = [];
-            const unknown = [];
-            let closedRefs = 0;
-            let resolved = 0;
-
-            for (const ref of refs) {
-              let state;
-
-              try {
-                ({ data: { state } } = await github.rest.issues.get({
-                  ...context.repo,
-                  issue_number: ref,
-                }));
-              } catch (error) {
-                if (error.status === 404) {
-                  core.info(`#${report.number}: ignoring #${ref}, not an issue in this repository`);
-                  continue;
-                }
-                unknown.push(ref);
-                resolved += 1;
-                continue;
-              }
-
-              resolved += 1;
-              if (state === 'closed') closedRefs += 1;
-              else stillOpen.push(ref);
-            }
-
-            if (stillOpen.length > 0) {
-              core.info(`#${report.number}: kept open, still-open references: ${stillOpen.join(', ')}`);
-              keptOpen += 1;
-              continue;
-            }
-
-            if (unknown.length > 0) {
-              core.info(`#${report.number}: kept open, undetermined references: ${unknown.join(', ')}`);
-              keptOpen += 1;
-              continue;
-            }
-
-            const reason = resolved === 0
-              ? 'This report references no issues.'
-              : `All ${closedRefs} referenced issue(s) are closed.`;
-
-            // Do not close if there are open PRs that close this issue.
-            // The audit report may have spawned implement workers whose PRs
-            // are still under review — closing the report prematurely is misleading.
-            const openPRs = await github.paginate(github.rest.pulls.list, {
-              ...context.repo,
-              state: 'open',
-              per_page: 100,
-            });
-
-            const closesThisReport = openPRs.some((pr) => {
-              const body = pr.body ?? '';
-              const patterns = [
-                new RegExp(`(?:^|[^A-Za-z0-9_/])#(?:closes?|fixes?|resolves?|closed?)\\s+#${report.number}\\b`, 'i'),
-                new RegExp(`(?:^|[^A-Za-z0-9_/])#${report.number}\\b`),
-              ];
-              return patterns.some((p) => p.test(body));
-            });
-
-            if (closesThisReport) {
-              core.info(`#${report.number}: kept open, has open PR(s) that close it.`);
-              keptOpen += 1;
-              continue;
-            }
-
-            await github.rest.issues.createComment({
-              ...context.repo,
-              issue_number: report.number,
-              body: `Closed automatically by \`Work Router: audit-close\`. ${reason}`,
-            });
-
-            await github.rest.issues.update({
-              ...context.repo,
-              issue_number: report.number,
-              state: 'closed',
-              state_reason: 'completed',
-            });
-
-            core.info(`#${report.number}: closed. ${reason}`);
-            closed += 1;
-          }
-
-          await core.summary
-            .addHeading('Audit close', 2)
-            .addList([`Reports closed: ${closed}`, `Reports left open: ${keptOpen}`])
-            .write();
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/audit-close/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Close audit reports
+description: Close open audit reports once every issue they reference is closed.
+inputs:
+  token:
+    description: GitHub token with issues write access.
+    required: true
+  stale-after-days:
+    description: >-
+      How long a report may sit open before it is marked stale-audit. A stale report stops
+      counting against the audit's backpressure and is listed for a person instead.
+    required: false
+    default: '14'
+runs:
+  using: composite
+  steps:
+    - name: Close every report whose referenced issues are all closed
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        STALE_AFTER_DAYS: ${{ inputs.stale-after-days }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const reports = await github.paginate(github.rest.issues.listForRepo, {
+            ...context.repo,
+            state: 'open',
+            labels: 'audit',
+            per_page: 100,
+          });
+
+          if (reports.length === 0) {
+            core.info('No open audit reports.');
+            return;
+          }
+
+          const STALE_LABEL = 'stale-audit';
+          const staleAfterMs = Number(process.env.STALE_AFTER_DAYS) * 86400 * 1000;
+
+          // One list for every report. This used to be fetched inside the loop, so a repository
+          // with three open reports paid for three full pull-request listings each night.
+          const openPRs = await github.paginate(github.rest.pulls.list, {
+            ...context.repo,
+            state: 'open',
+            per_page: 100,
+          });
+
+          // Skip `owner/repo#12` and `abc#12`: only a bare `#12` references this repository.
+          const referencedIssues = (body) => {
+            const matches = (body ?? '').matchAll(/(?:^|[^A-Za-z0-9_/])#(\d+)/g);
+            return [...new Set([...matches].map((match) => Number(match[1])))];
+          };
+
+          // Only a real closing keyword counts. There were two patterns here and both were
+          // wrong in opposite directions: the first required the literal text `#closes #12`,
+          // which nothing has ever written, so it matched nothing; the second matched a bare
+          // `#12` anywhere in any open pull request body, so one passing mention of the report
+          // pinned it open for as long as that pull request stayed open. A report referenced
+          // by a merged-and-closed chain then never closed, and the three of them silently
+          // used up the audit backpressure.
+          const closesReport = (number) => {
+            const pattern = new RegExp(`(?:clos(?:e|es|ed)|fix(?:es|ed)?|resolves?)\\s+#${number}\\b`, 'i');
+            return openPRs.some((pr) => pattern.test(pr.body ?? ''));
+          };
+
+          let closed = 0;
+          let keptOpen = 0;
+          let stale = 0;
+
+          const markStale = async (report, why) => {
+            if (report.labels.some((l) => (typeof l === 'string' ? l : l.name) === STALE_LABEL)) return;
+            if (Date.now() - new Date(report.created_at).getTime() < staleAfterMs) return;
+            // Creating the label is idempotent; 422 means it already exists.
+            await github.rest.issues.createLabel({
+              ...context.repo,
+              name: STALE_LABEL,
+              color: 'd4c5f9',
+              description: 'Audit report nobody actioned; no longer blocks the next audit',
+            }).catch((error) => { if (error.status !== 422) throw error; });
+            await github.rest.issues.addLabels({
+              ...context.repo, issue_number: report.number, labels: [STALE_LABEL],
+            });
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: report.number,
+              body: `Labelled \`${STALE_LABEL}\` after ${process.env.STALE_AFTER_DAYS} days: ${why} This report no longer counts against the audit backpressure, so the next audit can run, and it is listed in the housekeeping digest for a person to pick up or close.`,
+            });
+            core.info(`#${report.number}: marked ${STALE_LABEL}. ${why}`);
+            stale += 1;
+          };
+
+          for (const report of reports.sort((a, b) => a.number - b.number)) {
+            const refs = referencedIssues(report.body).filter((n) => n !== report.number);
+
+            const stillOpen = [];
+            const unknown = [];
+            let closedRefs = 0;
+            let resolved = 0;
+
+            for (const ref of refs) {
+              let state;
+
+              try {
+                ({ data: { state } } = await github.rest.issues.get({
+                  ...context.repo,
+                  issue_number: ref,
+                }));
+              } catch (error) {
+                if (error.status === 404) {
+                  core.info(`#${report.number}: ignoring #${ref}, not an issue in this repository`);
+                  continue;
+                }
+                unknown.push(ref);
+                resolved += 1;
+                continue;
+              }
+
+              resolved += 1;
+              if (state === 'closed') closedRefs += 1;
+              else stillOpen.push(ref);
+            }
+
+            // A report referencing nothing is a report nothing was done about. Refine turns a
+            // report into children and writes their numbers into it; a body with no bare `#N`
+            // means refine never ran, or ran and produced nothing. Closing that as `completed`
+            // used to throw the finding away silently and was the single most common way an
+            // audit ended: every finding closed, nothing implemented. Leave it open, and once
+            // it is past its budget mark it stale so it stops blocking the next audit.
+            if (resolved === 0) {
+              core.info(`#${report.number}: kept open, references no issues, so no work was done on it`);
+              keptOpen += 1;
+              await markStale(report, 'it references no issues, so nothing was ever implemented from it.');
+              continue;
+            }
+
+            if (stillOpen.length > 0) {
+              core.info(`#${report.number}: kept open, still-open references: ${stillOpen.join(', ')}`);
+              keptOpen += 1;
+              await markStale(report, `its children are still open (${stillOpen.map((n) => `#${n}`).join(', ')}).`);
+              continue;
+            }
+
+            if (unknown.length > 0) {
+              core.info(`#${report.number}: kept open, undetermined references: ${unknown.join(', ')}`);
+              keptOpen += 1;
+              continue;
+            }
+
+            // The report may have spawned implement workers whose pull requests are still under
+            // review; closing it while they are open would be misleading.
+            if (closesReport(report.number)) {
+              core.info(`#${report.number}: kept open, an open pull request closes it`);
+              keptOpen += 1;
+              continue;
+            }
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: report.number,
+              body: `Closed automatically by \`Work Router: audit-close\`. All ${closedRefs} referenced issue(s) are closed.`,
+            });
+
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: report.number,
+              state: 'closed',
+              state_reason: 'completed',
+            });
+
+            core.info(`#${report.number}: closed. All ${closedRefs} referenced issue(s) are closed.`);
+            closed += 1;
+          }
+
+          await core.summary
+            .addHeading('Audit close', 2)
+            .addList([
+              `Reports closed: ${closed}`,
+              `Reports left open: ${keptOpen}`,
+              `Reports marked stale: ${stale}`,
+            ])
+            .write();

package/loops/actions/classify-route/action.yml

@@ -24,6 +24,12 @@ outputs:
   ci-run-id:
     description: Workflow run ID of that CI run.
     value: ${{ steps.classify.outputs.ci-run-id }}
+  merge-gate-attempts:
+    description: Failed merge-gate attempts already made against this CI verdict.
+    value: ${{ steps.classify.outputs.merge-gate-attempts }}
+  implement-attempts:
+    description: Implement runs already made for this issue that died before producing an answer.
+    value: ${{ steps.classify.outputs.implement-attempts }}
   refine-mode:
     description: first or rerefine.
     value: ${{ steps.classify.outputs.refine-mode }}
@@ -60,6 +66,7 @@ runs:
         INPUT_MODE: ${{ github.event.inputs.mode }}
         INPUT_CI_CONCLUSION: ${{ github.event.inputs.ci-conclusion }}
         INPUT_CI_RUN_ID: ${{ github.event.inputs.ci-run-id }}
+        INPUT_ATTEMPTS_SO_FAR: ${{ github.event.inputs.attempts_so_far }}
         INPUT_TRIGGER_KIND: ${{ github.event.inputs.trigger-kind }}
       run: |
         set -euo pipefail

package/loops/actions/classify-route/classify-route.sh

@@ -8,10 +8,15 @@
 
 set -euo pipefail
 
-readonly AUDIT_CRON="17 1 * * 1"
+# The audit slot is per repository, so it comes from the router's own env: block rather than
+# from here. The fallback is the package default and matches the cron the router ships; a run
+# fired on a cron this file does not know classifies to no route and dies silently, so the
+# route matrix asserts the two still agree.
+readonly AUDIT_CRON="${AUDIT_CRON:-17 1 * * 1}"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
 readonly RECONCILE_BOT_PR_RUNS_CRON="17 * * * *"
+readonly HOUSEKEEPING_CRON="23 */6 * * *"
 
 has_label() {
   jq -e --arg name "$1" 'index($name)' >/dev/null 2>&1 <<<"${ISSUE_LABELS:-[]}"
@@ -23,7 +28,7 @@ is_issue_number() {
 
 classify_route() {
   local route="none" error=""
-  local issue_number="" pr_number="" ci_conclusion="" ci_run_id=""
+  local issue_number="" pr_number="" ci_conclusion="" ci_run_id="" merge_gate_attempts="0" implement_attempts="0"
   local refine_mode="" triage_mode="" trigger_kind=""
 
   case "${EVENT:-}" in
@@ -100,8 +105,14 @@ classify_route() {
 
     issue_comment)
       if [ "${COMMENT_ON_PR:-false}" = "true" ]; then
-        route="apply-review"
-        pr_number="${EVENT_ISSUE_NUMBER:-}"
+        if [ "${COMMENT_SENDER_TYPE:-}" = "Bot" ]; then
+          # Every App-token comment on a pull request is an issue_comment event, and the
+          # workers comment on pull requests they own. None of that is reviewer feedback.
+          error="comment authored by a bot"
+        else
+          route="apply-review"
+          pr_number="${EVENT_ISSUE_NUMBER:-}"
+        fi
       elif [ "${ISSUE_STATE:-}" = "closed" ]; then
         # A closing comment on a refine-labelled issue used to start a full re-refine, which
         # held a runner for 35 minutes and filed split children under an already-shut parent.
@@ -144,8 +155,10 @@ classify_route() {
 
     workflow_run)
       # Only a FAILED CI run on an attached pull request auto-dispatches the gate. A green
-      # run reaches merge through app-ci's dispatch-merge-gate and the reconcile belt, so
-      # routing success here would double-fire the gate for every passing pull request.
+      # run reaches the gate through the consumer CI's dispatch-merge-gate job and the
+      # reconcile belt, so routing success here would double-fire the gate for every passing
+      # pull request. GitHub delivers workflow_run only for CI runs whose actor is a human;
+      # a bot pull request's CI never arrives here at all, and the same two paths cover it.
       if [ "${RUN_CONCLUSION:-}" != "failure" ]; then
         error="CI concluded '${RUN_CONCLUSION:-}'; the gate auto-triggers only on failure"
       elif is_issue_number "${RUN_PR_NUMBER:-}"; then
@@ -165,6 +178,7 @@ classify_route() {
         "$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
         "$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
+        "$HOUSEKEEPING_CRON") route="housekeeping" ;;
         *) error="no route for cron '${SCHEDULE:-}'" ;;
       esac
       ;;
@@ -178,6 +192,10 @@ classify_route() {
             issue_number="${INPUT_ISSUE_NUMBER}"
             if [ "$OPERATION" = "refine" ]; then
               refine_mode="${INPUT_MODE:-first}"
+            else
+              # The implement worker re-dispatches itself when a run dies before doing any work,
+              # and carries the count so the budget is bounded.
+              implement_attempts="${INPUT_ATTEMPTS_SO_FAR:-0}"
             fi
           else
             error="operation '${OPERATION}' needs a positive issue-number, got '${INPUT_ISSUE_NUMBER:-}'"
@@ -206,6 +224,7 @@ classify_route() {
             pr_number="${INPUT_PR_NUMBER}"
             ci_conclusion="${INPUT_CI_CONCLUSION:-}"
             ci_run_id="${INPUT_CI_RUN_ID:-}"
+            merge_gate_attempts="${INPUT_ATTEMPTS_SO_FAR:-0}"
           else
             error="operation 'merge-gate' needs a positive pr-number, got '${INPUT_PR_NUMBER:-}'"
           fi
@@ -214,7 +233,7 @@ classify_route() {
           route="${OPERATION}"
           trigger_kind="${INPUT_TRIGGER_KIND:-manual}"
           ;;
-        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | validate)
+        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | housekeeping | validate)
           route="${OPERATION}"
           ;;
         release)
@@ -237,6 +256,8 @@ issue-number=${issue_number}
 pr-number=${pr_number}
 ci-conclusion=${ci_conclusion}
 ci-run-id=${ci_run_id}
+merge-gate-attempts=${merge_gate_attempts}
+implement-attempts=${implement_attempts}
 refine-mode=${refine_mode}
 triage-mode=${triage_mode}
 trigger-kind=${trigger_kind}

package/loops/actions/cleanup-artifacts/action.yml

@@ -36,17 +36,32 @@ runs:
           const failed = [];
 
           for (const artifact of expired) {
-            try {
-              await github.rest.actions.deleteArtifact({
-                ...context.repo,
-                artifact_id: artifact.id,
-              });
+            // GitHub answers a delete with a 5xx now and then. Three tries, because the
+            // alternative is a red daily run over one artifact that tomorrow's run would
+            // have removed anyway.
+            let lastError;
+            for (let attempt = 1; attempt <= 3; attempt += 1) {
+              try {
+                await github.rest.actions.deleteArtifact({
+                  ...context.repo,
+                  artifact_id: artifact.id,
+                });
 
-              core.info(`Deleted ${artifact.name} (created ${artifact.created_at})`);
-              deleted += 1;
-            } catch (error) {
-              core.warning(`Could not delete ${artifact.name} (${artifact.id}): ${error.message}`);
-              failed.push(artifact.name);
+                core.info(`Deleted ${artifact.name} (created ${artifact.created_at})`);
+                deleted += 1;
+                lastError = undefined;
+                break;
+              } catch (error) {
+                lastError = error;
+                if (attempt < 3) await new Promise((wait) => setTimeout(wait, attempt * 2000));
+              }
+            }
+
+            if (lastError) {
+              core.warning(
+                `Could not delete ${artifact.name} (${artifact.id}) after 3 tries: ${lastError.message}`,
+              );
+              failed.push({ name: artifact.name, status: lastError.status });
             }
           }
 
@@ -60,6 +75,17 @@ runs:
             ])
             .write();
 
-          if (failed.length > 0) {
-            core.setFailed(`${failed.length} artifact(s) could not be deleted: ${failed.join(', ')}`);
+          // Deleting nothing at all while expired artifacts exist is a permission or
+          // configuration problem, and has to be loud. One stubborn artifact among many is
+          // the API having a bad minute: tomorrow's run picks it up, and failing here only
+          // teaches people to ignore a red cleanup. A 4xx is never transient, so it fails
+          // whatever else succeeded.
+          const names = failed.map((entry) => entry.name).join(', ');
+          const structural = failed.some((entry) => entry.status && entry.status < 500);
+          if (failed.length > 0 && (deleted === 0 || structural)) {
+            core.setFailed(`${failed.length} artifact(s) could not be deleted: ${names}`);
+          } else if (failed.length > 0) {
+            core.warning(
+              `${failed.length} artifact(s) survived this run and will be retried tomorrow: ${names}`,
+            );
           }