@plainconceptsplatform/workflows 1.0.11 → 1.0.13

package/loops/scripts/compile-agent-workflows.mjs

@@ -135,6 +135,11 @@ for (const file of readdirSync(workflowDirectory)) {
   }
   const patched = content
     .replace(/^(# This file was automatically generated by gh-aw[^\n]*\n)/m, `$1${SENTINEL}\n`)
+    // Workflow affinity: every agent job carries a per-run label so the scaler can pin a
+    // whole run to one VM, and the base label moves to agents-aw so a CI-only job
+    // (agents-arc) can never land on a run's dedicated VM. Done post-compile because
+    // gh-aw's frontmatter runs-on is a plain scalar. The function form keeps ${{ }} literal.
+    .replace(/runs-on: agents-arc/g, () => 'runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]')
     // The engine command is normalized to one shape:
     //   - OPENCODE_DISABLE_MODELS_FETCH=1: opencode otherwise fetches its model
     //     registry from https://models.opencode.ai/api.json at startup and blocks

package/loops/templates/agentics/actionlint.yaml

@@ -2,12 +2,13 @@
 # Runners this repository actually has.
 #
 # actionlint knows GitHub's own labels and rejects everything else, so a workflow that
-# names one of our runner groups was reported as an error on every pull request. Both
-# of these are real: agents-arc runs the agentic workflows, RunnerLandingZone runs the
-# work router. Listing them here is how actionlint is told a label is self-hosted
-# rather than a typo, and it keeps that knowledge in a file the workflow generator
-# does not overwrite.
+# names one of our runner groups was reported as an error on every pull request. All of
+# these are real: agents-arc runs CI/Deploy, agents-aw runs the agent workflows,
+# RunnerLandingZone runs the work router. Listing them here is how actionlint is told a
+# label is self-hosted rather than a typo, and it keeps that knowledge in a file the
+# workflow generator does not overwrite.
 self-hosted-runner:
   labels:
     - agents-arc
+    - agents-aw
     - RunnerLandingZone

package/loops/workflows/authorize-bot-work.yml

@@ -34,7 +34,7 @@ jobs:
        github.event.label.name == 'refine') &&
       !contains(github.event.issue.labels.*.name, 'bot-working') &&
       !endsWith(github.actor, '[bot]')
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     concurrency:
       group: authorize-${{ github.event.issue.number }}

package/loops/workflows/shared/opencode-ci.md

@@ -198,6 +198,15 @@ pre-agent-steps:
 
       printf '%s\n' "$merged" > "$CONFIG"
 
+      # A tracked config now differs from HEAD, so the agent sees it in `git diff`, takes it for
+      # a stray change and reverts it with `git checkout`. That drops the CI agent and its
+      # permissions mid-run: the next shell call is refused and the run falls back to the
+      # default agent with no key (Pliny-Bot run 37674193415). skip-worktree hides the file
+      # from status and diff and makes `git checkout -- opencode.jsonc` refuse the path.
+      if git ls-files --error-unmatch "$CONFIG" > /dev/null 2>&1; then
+        git update-index --skip-worktree "$CONFIG"
+      fi
+
       # gh-aw's own "Write OpenCode Config" step runs next and merges its base config with
       # `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
       # nor this provider, so both survive and `awf-proxy` is added alongside.

package/loops/workflows/work-router.yml

@@ -267,7 +267,7 @@ permissions:
 jobs:
   # Public repositories must check repository permission before an event can start a model.
   authorize:
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
       contents: read
@@ -370,7 +370,7 @@ jobs:
           esac
 
   classify:
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
       contents: read
@@ -428,7 +428,7 @@ jobs:
   check-implement-pr:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 3
     permissions:
       contents: read
@@ -519,7 +519,7 @@ jobs:
   dispatch-triage:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
       actions: write
@@ -669,7 +669,7 @@ jobs:
     if: >
       needs.classify.outputs.route == 'bot-approve' &&
         (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
       actions: write
@@ -726,7 +726,7 @@ jobs:
           github.event.pull_request.head.repo.full_name == github.repository
         )
       )
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 10
     permissions:
       contents: read
@@ -918,7 +918,7 @@ jobs:
   reconcile-bot-pr-runs:
     needs: classify
     if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
       contents: read
@@ -1145,7 +1145,7 @@ jobs:
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 15
     concurrency:
       group: audit-close
@@ -1170,7 +1170,7 @@ jobs:
   cleanup-artifacts:
     needs: classify
     if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 15
     concurrency:
       group: cleanup-artifacts
@@ -1194,7 +1194,7 @@ jobs:
   housekeeping:
     needs: classify
     if: needs.classify.outputs.route == 'housekeeping' && !github.event.repository.fork
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 15
     concurrency:
       group: housekeeping
@@ -1235,7 +1235,7 @@ jobs:
   validate:
     needs: classify
     if: needs.classify.outputs.route == 'validate'
-    runs-on: agents-arc
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 10
     permissions:
       contents: read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -25,6 +25,13 @@
     "loops",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit --project tsconfig.json",
+    "release": "pnpm build && pnpm test && npm publish --access public",
+    "prepack": "node ./scripts/copy-loops.mjs"
+  },
   "engines": {
     "node": ">=20.19"
   },
@@ -35,11 +42,5 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
-  },
-  "scripts": {
-    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit --project tsconfig.json",
-    "release": "pnpm build && pnpm test && npm publish --access public"
   }
-}
+}