@plainconceptsplatform/workflows 0.5.1 → 0.16.0

package/loops/scripts/compile-agent-workflows.mjs

@@ -19,6 +19,50 @@ function resolveGhPath() {
   return "gh";
 }
 
+// gh-aw folds a workflow's top-level `if:` into the activation job but computes activation.needs
+// on its own, so a compiled `if:` can read `needs.<job>` for a job activation never waits for.
+// GitHub does not reject that: the reference resolves to '' at runtime and the clause is silently
+// true (agent-merge-gate's protected_changes guard, Pliny-Bot run 34042143350). actionlint would
+// flag it, but it is deliberately not run on generated files (it does not model concurrency.queue
+// or job.workflow_*). This is the one check that reads the locks, and it needs no dependency:
+// gh-aw emits jobs at two spaces, job keys at four, list items at six.
+function undeclaredNeeds(lock) {
+  const violations = [];
+  let inJobs = false;
+  let job = null;
+  let inList = false;
+  let jobs = 0;
+  let needs = new Set();
+  let refs = new Set();
+  const flush = () => {
+    if (!job) return;
+    for (const ref of refs) if (!needs.has(ref)) violations.push({ job, ref, needs: [...needs].sort() });
+  };
+  for (const line of lock.split("\n")) {
+    if (/^jobs:\s*$/.test(line)) { inJobs = true; continue; }
+    if (inJobs && /^[^\s#]/.test(line)) inJobs = false;
+    if (!inJobs) continue;
+    const start = line.match(/^  ([a-z_][a-zA-Z0-9_-]*):\s*$/);
+    if (start) { flush(); job = start[1]; jobs += 1; needs = new Set(); refs = new Set(); inList = false; continue; }
+    if (!job) continue;
+    if (/^    needs:\s*$/.test(line)) { inList = true; continue; }
+    const inline = line.match(/^    needs:\s*(.+?)\s*$/);
+    if (inline) {
+      for (const n of inline[1].replace(/[\[\]]/g, "").split(",")) if (n.trim()) needs.add(n.trim());
+      inList = false;
+      continue;
+    }
+    if (inList) {
+      const item = line.match(/^      - (\S+)\s*$/);
+      if (item) { needs.add(item[1]); continue; }
+      inList = false;
+    }
+    for (const m of line.matchAll(/needs\.([a-z_][a-zA-Z0-9_-]*)\./g)) refs.add(m[1]);
+  }
+  flush();
+  return { jobs, violations };
+}
+
 const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir", workflowDirectory], {
   stdio: "inherit",
   shell: false,
@@ -31,12 +75,43 @@ if (compile.error?.code === "ENOENT" || compile.status === null) {
 
 if (compile.status !== 0) process.exit(compile.status ?? 1);
 
+function lintLock(file, text) {
+  const lint = undeclaredNeeds(text);
+  if (lint.jobs === 0) {
+    process.stderr.write(
+      `${file}: the needs lint found no jobs; the gh-aw lock layout changed. ` +
+      `Re-anchor undeclaredNeeds() in loops/scripts/compile-agent-workflows.mjs.\n`,
+    );
+    process.exitCode = 1;
+  }
+  for (const v of lint.violations) {
+    process.stderr.write(
+      `${file}: job "${v.job}" reads needs.${v.ref} but its needs are [${v.needs.join(", ")}]; ` +
+      `the reference resolves to '' at runtime. For activation, list the job under on.needs in the ` +
+      `source frontmatter; for a custom job, add it to that job's needs.\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+// gh aw compile leaves a lock alone when its frontmatter and body hashes still match the source.
+// This script then ran over a lock it had already patched: AGENTMEMORY_URL was inserted a second
+// time, the opencode install line was wrapped in itself, and the consumer freshness check could
+// never be clean (Pliny-Bot agentics-checks run 33963600563). The sentinel marks a processed
+// lock; a lock that carries it is linted and otherwise left as it is.
+const SENTINEL = "# post-processed by scripts/compile-agent-workflows.mjs; run it again and nothing changes";
+
 for (const file of readdirSync(workflowDirectory)) {
   if (!file.endsWith(".lock.yml")) continue;
 
   const path = join(workflowDirectory, file);
   const content = readFileSync(path, "utf8");
+  if (content.includes(SENTINEL)) {
+    lintLock(file, content);
+    continue;
+  }
   const patched = content
+    .replace(/^(# This file was automatically generated by gh-aw[^\n]*\n)/m, `$1${SENTINEL}\n`)
     .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
     .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
     .replaceAll("opencode run --log-level ERROR", "opencode run --log-level ERROR")
@@ -138,6 +213,16 @@ for (const file of readdirSync(workflowDirectory)) {
       '            /tmp/gh-aw/aw-*.patch\n' +
       '            /tmp/gh-aw/aw-*.bundle\n' +
       '            /tmp/gh-aw/agent_output.json\n')
+    // "A failed run is already a red run": report-failure-as-issue: false and
+    // GH_AW_REPORT_FAILED_JOBS: "false" were supposed to silence issue creation, but
+    // 0.87.5's engine-failure reporter files an "[aw] ... failed" issue anyway (seen as
+    // Pliny-Bot #57: an OOM-killed gate produced a fresh issue nobody needs, while the
+    // retry belt is the actual remediation). `if: false` keeps the step compiled but
+    // never runs it, so the failure stays visible in the run and in the belt's attempt
+    // comment, and out of the issue tracker.
+    .replace(
+      /^([ \t]+)- name: Report failed jobs\n([ \t]*)id: report_failed_jobs\n[ \t]*if: always\(\)\n/m,
+      '$1- name: Report failed jobs\n$2id: report_failed_jobs\n$2if: false # never: failures surface in the run and the retry belt\n')
 
     // v0.87.5's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
     // Copilot engine: command -v copilot is empty under engine: opencode and cp "" fails the
@@ -222,6 +307,7 @@ for (const file of readdirSync(workflowDirectory)) {
   for (const check of [
     { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
     { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
+    { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
   ]) {
     if (!check.ok.test(rewritten)) {
       process.stderr.write(
@@ -230,7 +316,16 @@ for (const file of readdirSync(workflowDirectory)) {
       );
       process.exitCode = 1;
     }
-  }
+  }
+
+  if (!rewritten.includes(SENTINEL)) {
+    process.stderr.write(
+      `${file}: the generated-file header changed and the post-processing sentinel was not placed; ` +
+      `re-anchor the SENTINEL insert in loops/scripts/compile-agent-workflows.mjs.\n`,
+    );
+    process.exitCode = 1;
+  }
+  lintLock(file, rewritten);
 
   if (rewritten !== content) writeFileSync(path, rewritten);
 }

package/loops/scripts/merge-changelog.mjs

@@ -0,0 +1,76 @@
+// Managed by @plainconceptsplatform/workflows. Source: loops/scripts/merge-changelog.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
+//
+// A git merge driver for a newest-first changelog array.
+//
+// Every merge into the default branch invalidates every other open pull request that added a
+// changelog entry, because they all insert at the top of the same list. The conflict is real
+// but it is never interesting: both entries belong, newest first. Left to the default driver
+// it costs a full model run per sibling pull request, or a person, and it recurs on every
+// merge for as long as there is more than one pull request in flight.
+//
+// Registered from .gitattributes as `merge=changelog`, so git calls this instead of producing
+// conflict markers. Falls back to exit 1 (a normal conflict) whenever it cannot be sure, so a
+// genuine edit to the same entry is still escalated rather than silently mangled.
+//
+// Usage (git's merge driver contract): merge-changelog.mjs %O %A %B
+//   %O ancestor, %A ours (written back with the result), %B theirs.
+import { readFileSync, writeFileSync } from "node:fs";
+
+const [ancestorPath, oursPath, theirsPath] = process.argv.slice(2);
+
+/** Parse, or return undefined so the caller can bail out to a normal conflict. */
+function read(path) {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    return Array.isArray(value?.changes) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const ours = read(oursPath);
+const theirs = read(theirsPath);
+const ancestor = read(ancestorPath) ?? { changes: [] };
+
+if (!ours || !theirs) {
+  process.stderr.write("merge-changelog: not a changelog document on both sides; leaving the conflict\n");
+  process.exit(1);
+}
+
+// An entry is identified by its commit when it has one, and by the whole record otherwise.
+const identify = (entry) => entry?.commit ?? JSON.stringify(entry);
+
+// Anything either side changed relative to the ancestor, plus everything the ancestor had.
+// Union by identity: an append on both sides is the case this exists for.
+const merged = new Map();
+for (const entry of [...ancestor.changes, ...theirs.changes, ...ours.changes]) {
+  merged.set(identify(entry), entry);
+}
+
+// An entry the ancestor had and both sides removed should stay removed.
+const kept = [...merged.values()].filter((entry) => {
+  const id = identify(entry);
+  const inAncestor = ancestor.changes.some((candidate) => identify(candidate) === id);
+  if (!inAncestor) return true;
+  return ours.changes.some((candidate) => identify(candidate) === id) ||
+    theirs.changes.some((candidate) => identify(candidate) === id);
+});
+
+// If the same identity carries different content on the two sides, somebody edited an entry
+// rather than adding one. That is a real conflict and a person should look at it.
+for (const entry of kept) {
+  const id = identify(entry);
+  const mine = ours.changes.find((candidate) => identify(candidate) === id);
+  const yours = theirs.changes.find((candidate) => identify(candidate) === id);
+  if (mine && yours && JSON.stringify(mine) !== JSON.stringify(yours)) {
+    process.stderr.write(`merge-changelog: entry ${id} differs on both sides; leaving the conflict\n`);
+    process.exit(1);
+  }
+}
+
+// Newest first, which is the order the file is read in and the order the page renders.
+kept.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
+
+const result = { ...theirs, ...ours, changes: kept };
+writeFileSync(oursPath, `${JSON.stringify(result, null, 2)}\n`);
+process.stderr.write(`merge-changelog: combined ${ours.changes.length} + ${theirs.changes.length} entries into ${kept.length}\n`);

package/loops/templates/agentics/actionlint.yaml

@@ -0,0 +1,13 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/actionlint.yaml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Runners this repository actually has.
+#
+# actionlint knows GitHub's own labels and rejects everything else, so a workflow that
+# names one of our runner groups was reported as an error on every pull request. Both
+# of these are real: agents-arc runs the agentic workflows, RunnerLandingZone runs the
+# work router. Listing them here is how actionlint is told a label is self-hosted
+# rather than a typo, and it keeps that knowledge in a file the workflow generator
+# does not overwrite.
+self-hosted-runner:
+  labels:
+    - agents-arc
+    - RunnerLandingZone

package/loops/templates/agentics/agentics-checks.yml

@@ -1,86 +1,203 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-checks.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: Agentics checks
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/*.md
-      - .github/workflows/shared/*.md
-      - .github/workflows/*.yml
-      - .github/workflows/aw.json
-      - .github/actions/**
-
-env:
-  GH_AW_VERSION: v0.83.4
-  ACTIONLINT_VERSION: 1.7.7
-  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
-  AGENTICS_COMPILE_COMMAND: gh aw compile --strict
-
-permissions:
-  contents: read
-
-concurrency:
-  group: agentics-checks-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  verify-lockfiles:
-    name: Verify generated agent lockfiles
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
-        with:
-          version: ${{ env.GH_AW_VERSION }}
-      - name: Compile agent workflows strictly
-        run: ${{ env.AGENTICS_COMPILE_COMMAND }}
-      - name: Verify generated lockfiles are current
-        shell: bash
-        run: |
-          set -euo pipefail
-          if git diff --exit-code -- .github/workflows/*.lock.yml; then
-            exit 0
-          fi
-          if git diff --exit-code -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' -- .github/workflows/*.lock.yml; then
-            echo "::warning::Only volatile GH_AW_INFO_MODEL_COSTS metadata changed."
-            exit 0
-          fi
-          echo "::error::Generated agent lockfiles are stale. Run '${AGENTICS_COMPILE_COMMAND}' and commit the resulting .lock.yml files."
-          git diff -- .github/workflows/*.lock.yml
-          exit 1
-
-  lint-workflows:
-    name: Lint authored workflows and shell
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install actionlint
-        shell: bash
-        run: |
-          set -euo pipefail
-          tarball="$RUNNER_TEMP/actionlint.tar.gz"
-          curl -fsSL -o "$tarball" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
-          echo "${ACTIONLINT_SHA256}  $tarball" | sha256sum --check --strict
-          mkdir -p "$RUNNER_TEMP/bin"
-          tar -xzf "$tarball" -C "$RUNNER_TEMP/bin" actionlint
-          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
-      - name: Lint authored workflows
-        shell: bash
-        run: |
-          set -euo pipefail
-          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' | grep -vE '\.lock\.yml$|agentics-maintenance\.yml$')
-          if [ "${#authored[@]}" -gt 0 ]; then
-            actionlint "${authored[@]}"
-          fi
-      - name: Lint composite action shell
-        shell: bash
-        run: find .github/actions -name '*.sh' -print0 | xargs -0 -r shellcheck -x
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-checks.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Agentics checks
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/*.md
+      - .github/workflows/shared/*.md
+      - .github/workflows/*.yml
+      - .github/workflows/aw.json
+      - .github/actions/**
+  # A push to the default branch that bypassed review is exactly the case that needs the check:
+  # seven broken locks reached Pliny-Bot's main in twenty minutes with no pull request and no
+  # run of this workflow. A red run here is the detection.
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/*.md
+      - .github/workflows/shared/*.md
+      - .github/workflows/*.yml
+      - .github/workflows/aw.json
+      - .github/actions/**
+
+env:
+  # Must match the version the locks were compiled with (first line of every .lock.yml) and the
+  # `github/gh-aw/...@vX` import pin in every worker. A different compiler regenerates every lock
+  # and the freshness diff measures the version, not the change under review.
+  GH_AW_VERSION: v0.87.5
+  ACTIONLINT_VERSION: 1.7.7
+  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
+  SHELLCHECK_VERSION: 0.10.0
+  SHELLCHECK_SHA256: 6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87
+  # The same script a developer runs. It wraps `gh aw compile --strict` and applies the
+  # repository's post-processing; a bare `gh aw compile` on this side would regenerate every lock
+  # without the transform, and the diff below could never be clean.
+  AGENTICS_COMPILE_COMMAND: node scripts/compile-agent-workflows.mjs
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agentics-checks-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify-lockfiles:
+    name: Verify generated agent lockfiles
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      # gh-aw resolves the `github/gh-aw/...` imports through the GitHub API on every compile,
+      # and an unauthenticated gh on a hosted runner refuses API calls.
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install gh-aw
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh extension install github/gh-aw --pin "$GH_AW_VERSION"
+          gh aw --version
+      # The compile command is a node script. Hosted images have node; a setup step pins the
+      # major version so the script sees the same runtime everywhere.
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+      - name: Verify the locks and the workers agree on the gh-aw version
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `gh aw --version` writes to stderr; without 2>&1 the grep saw nothing and set -e
+          # ended the step with no message at all.
+          want="$(gh aw --version 2>&1 | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -n 1 || true)"
+          [ "$want" = "$GH_AW_VERSION" ] || { echo "::error::gh aw reports '${want:-nothing}', this workflow pins $GH_AW_VERSION"; exit 1; }
+          status=0
+          for lock in .github/workflows/*.lock.yml; do
+            have="$(sed -n '1s/.*"compiler_version":"\([^"]*\)".*/\1/p' "$lock")"
+            if [ "$have" != "$want" ]; then
+              echo "::error::$lock was compiled by ${have:-an unknown version}; this job runs $want. Recompile with the pinned version, or bump GH_AW_VERSION and the worker import pins together."
+              status=1
+            fi
+          done
+          while read -r file pin; do
+            if [ "$pin" != "$want" ]; then
+              echo "::error::$file imports gh-aw shared files at $pin; this job runs $want."
+              status=1
+            fi
+          done < <(grep -HoE 'github/gh-aw/[^@]*@v[0-9]+\.[0-9]+\.[0-9]+' .github/workflows/*.md | sed -E 's/^([^:]*):.*@(v[0-9.]+)$/\1 \2/' | sort -u)
+          exit "$status"
+      - name: Compile agent workflows strictly
+        run: ${{ env.AGENTICS_COMPILE_COMMAND }}
+      - name: Verify generated lockfiles are current
+        shell: bash
+        run: |
+          set -euo pipefail
+          if git diff --exit-code -- .github/workflows/*.lock.yml; then
+            exit 0
+          fi
+          if git diff --exit-code -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' -- .github/workflows/*.lock.yml; then
+            echo "::warning::Only volatile GH_AW_INFO_MODEL_COSTS metadata changed."
+            exit 0
+          fi
+          echo "::error::Generated agent lockfiles are stale. Run '${AGENTICS_COMPILE_COMMAND}' and commit the resulting .lock.yml files."
+          git diff -- .github/workflows/*.lock.yml
+          exit 1
+      # gh aw compile leaves a lock alone when its hashes still match the source, so the script
+      # must recognise a lock it already processed. If a second run changes anything, the
+      # post-processing is not idempotent and every consumer's freshness check is measuring the
+      # transform instead of the drift.
+      - name: Verify a second compile changes nothing
+        shell: bash
+        run: |
+          set -euo pipefail
+          cp -R .github/workflows "$RUNNER_TEMP/first-pass"
+          ${AGENTICS_COMPILE_COMMAND}
+          if ! diff -r -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' "$RUNNER_TEMP/first-pass" .github/workflows; then
+            echo "::error::Running '${AGENTICS_COMPILE_COMMAND}' twice produced different locks; the post-processing is not idempotent."
+            exit 1
+          fi
+
+  lint-workflows:
+    name: Lint authored workflows and shell
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install actionlint
+        shell: bash
+        run: |
+          set -euo pipefail
+          tarball="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL -o "$tarball" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  $tarball" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/bin"
+          tar -xzf "$tarball" -C "$RUNNER_TEMP/bin" actionlint
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      # Pinned rather than taken from the image: a copy of this job that ran on a self-hosted
+      # runner died with "shellcheck: No such file or directory".
+      - name: Install shellcheck
+        shell: bash
+        run: |
+          set -euo pipefail
+          tarball="$RUNNER_TEMP/shellcheck.tar.xz"
+          curl -fsSL -o "$tarball" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          echo "${SHELLCHECK_SHA256}  $tarball" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/bin"
+          tar -xJf "$tarball" -C "$RUNNER_TEMP/bin" --strip-components=1 "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      # actionlint 1.7.7 predates `concurrency.queue`, which GitHub accepts and the router uses;
+      # that one message is a known false positive and is ignored by its exact text so anything
+      # else under `concurrency` still fails. shellcheck style notes (SC2129 and friends) are
+      # opinions about consumer scripts, not defects; warnings and errors still fail the job.
+      - name: Lint authored workflows
+        shell: bash
+        env:
+          SHELLCHECK_OPTS: -S warning
+        run: |
+          set -euo pipefail
+          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' | grep -vE '\.lock\.yml$|agentics-maintenance\.yml$')
+          if [ "${#authored[@]}" -gt 0 ]; then
+            actionlint -ignore 'unexpected key "queue" for "concurrency" section' "${authored[@]}"
+          fi
+      - name: Lint composite action shell
+        shell: bash
+        run: find .github/actions -name '*.sh' -print0 | xargs -0 -r shellcheck -x
+      # A password written into a workflow is a finding whatever it protects, and one sat in
+      # these files for weeks: a throwaway SQL container credential, repeated inline in six
+      # to nine places per repository, found by a policy scan rather than by us. Anything a
+      # job needs at container-start time belongs in an expression or a secret, and this is
+      # the check that says so before a reviewer has to.
+      - name: No written-down passwords in workflows
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' '.github/actions/**' 2>/dev/null || true)
+          [ "${#authored[@]}" -gt 0 ] || exit 0
+          # Two passes, because "is this a literal" is the hard half. The first finds every
+          # assignment to a password-ish name whose value is quoted; the second keeps only
+          # the lines with no dollar sign, so a value built from an expression or read from a
+          # shell variable passes and a written-down word does not. A literal that happens to
+          # contain a dollar sign slips through; erring that way beats a check people learn to
+          # route around.
+          # Two shapes: a password-ish name assigned a quoted value, and a command-line
+          # flag given one. The literal these repositories carried appeared as both.
+          hits=$(grep -nEi \
+            -e "(password|passwd|pwd)[\"']?[[:space:]]*[:=][[:space:]]*[\"'][^\"']" \
+            -e "(^|[[:space:]])(-P|--password)[[:space:]=]*[\"'][^\"']" \
+            "${authored[@]}" | grep -v '[$]' || true)
+          if [ -n "$hits" ]; then
+            printf '%s\n' "$hits"
+            echo "::error::A password is written into a workflow. Use a secret, or derive it per run from an expression."
+            exit 1
+          fi
+          echo "No written-down passwords."

package/loops/templates/agentics/agentics-error-report.yml

@@ -0,0 +1,97 @@
+# Managed by @plainconceptsplatform/workflows. Source: templates/agentics/agentics-error-report.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "Agentics: Error Report"
+
+# Once a day, look at how the workflows this package ships behaved in this repository and file
+# what broke upstream, so the package gets fixed instead of every repository working around the
+# same bug on its own.
+#
+# THIS REPOSITORY IS PRIVATE AND THE REPORT LEAVES IT. That is the whole design constraint. The
+# job is deterministic — no model runs, because a model summarising a log would paraphrase
+# whatever the log happened to contain — and it sends only:
+#
+#   * the names this package gives its own workflows, jobs and steps
+#   * a conclusion, a runner label and a count
+#   * the id of a matched entry from a fixed catalogue of failure shapes
+#
+# It never sends a log line, a branch name, an issue title, a file path, a commit, a URL or a
+# number that could be looked up. Before anything is filed, the finished text is run through a
+# leak scanner; if the scanner matches, the report is withheld and the run goes red rather than
+# filing it. See loops/actions/report-workflow-errors/action.yml.
+#
+# To turn it off: delete this file, or clear UPSTREAM_NAME below to compute the report into the
+# job summary and file nothing.
+
+run-name: "Error report: last ${{ github.event.inputs.lookback-hours || '24' }}h"
+
+on:
+  schedule:
+    # Slot this per repository the same way as the audit cron: the report is cheap, but four
+    # repositories waking at the same minute still queue against one another.
+    - cron: "11 7 * * *"
+  workflow_dispatch:
+    inputs:
+      lookback-hours:
+        description: "How far back to look"
+        required: false
+        type: string
+        default: '24'
+      dry-run:
+        description: "Compute the report and file nothing"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+env:
+  # Where the report goes. Owner and name are separate because the App token has to be scoped
+  # to the one repository, and GitHub expressions have no split(): there is no way to take the
+  # halves of "owner/name" apart inside a workflow. Clear UPSTREAM_NAME to keep the report
+  # local to the job summary.
+  UPSTREAM_OWNER: "PlainConceptsPlatform"
+  UPSTREAM_NAME: "Agentic-Workflows"
+  # How far back a scheduled run looks. Matches the cron so nothing is counted twice.
+  LOOKBACK_HOURS: "24"
+
+jobs:
+  report:
+    # Fork of a consumer: the fleet is not theirs and neither is the report.
+    if: "!github.event.repository.fork"
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    concurrency:
+      group: agentics-error-report
+      cancel-in-progress: false
+    permissions:
+      # Reading this repository's own runs, jobs and logs. Read-only throughout: the job files
+      # upstream with a separate token and writes nothing here.
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # A token for the upstream repository only. The App has to be installed there; where it is
+      # not, this step fails, the next one is skipped, and the report still lands in the job
+      # summary with a warning rather than a red run.
+      - name: Generate an upstream token
+        id: upstream-token
+        if: env.UPSTREAM_NAME != ''
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          owner: ${{ env.UPSTREAM_OWNER }}
+          repositories: ${{ env.UPSTREAM_NAME }}
+
+      - uses: ./.github/actions/report-workflow-errors
+        with:
+          token: ${{ github.token }}
+          upstream-token: ${{ steps.upstream-token.outputs.token }}
+          upstream-repo: ${{ env.UPSTREAM_OWNER }}/${{ env.UPSTREAM_NAME }}
+          lookback-hours: ${{ github.event.inputs.lookback-hours || env.LOOKBACK_HOURS }}
+          dry-run: ${{ github.event.inputs.dry-run || 'false' }}