@plainconceptsplatform/workflows 1.0.2 → 1.0.5

package/loops/scripts/compile-agent-workflows.mjs

@@ -2,6 +2,28 @@
 
 const OPENCODE_VERSION = '2.0.22'
 const OPENCODE_PACKAGE = '@opencode/cli'
+
+// The install the compiled locks carry, shared so both rewrite sites emit exactly
+// the same command.
+//
+// `--allow-scripts` is the part that matters. npm now blocks a dependency's
+// install scripts unless the package is explicitly allowed, and @opencode/cli
+// downloads its platform binary from its own postinstall. Without the flag the
+// install "succeeds" (exit 0, `added N packages`) while the postinstall is
+// skipped with a warning, leaving a stub bin and the previous version in place,
+// so the job runs OpenCode 1 against OpenCode 2 config and the gateway rejects
+// every model. `NPM_CONFIG_ALLOW_SCRIPTS` is the spelling npm accepts for a
+// global install; the CLI form is refused for project-scoped installs.
+//
+// The trailing check turns a silent bad install into a loud failure: if the
+// version still is not there after installing, the step exits non-zero rather
+// than letting the agent run on the wrong binary.
+const OPENCODE_INSTALL_GUARD =
+  "opencode --version 2>/dev/null | grep -qF '" + OPENCODE_VERSION + "' || " +
+  "flock /tmp/opencode-install.lock sh -c " +
+  "'NPM_CONFIG_ALLOW_SCRIPTS=" + OPENCODE_PACKAGE + " npm install -g " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION + "' ; " +
+  "opencode --version 2>/dev/null | grep -qF '" + OPENCODE_VERSION + "' || " +
+  "{ echo \"::error::opencode " + OPENCODE_VERSION + " is not installed after the install step\"; exit 1; }"
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -122,7 +144,10 @@ for (const file of readdirSync(workflowDirectory)) {
     //     explicitly, so the remote registry is not needed here.
     //   - --print-logs + a non-silent level: stripping --print-logs and forcing
     //     ERROR hid every engine log, so a stalled bootstrap looked like silence.
-    .replace(/opencode run(?: --print-logs)? --log-level (?:DEBUG|ERROR|INFO)/g, "OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --print-logs --log-level INFO")
+    //     The level must be lower case: OpenCode 2 rejects `INFO` with
+    //     "Invalid value for flag --log-level", aborting before the agent runs.
+    //     The old upper-case spelling was valid in v1 and is not in v2.
+    .replace(/opencode run(?: --print-logs)? --log-level (?:DEBUG|ERROR|INFO|debug|error|info)/g, "OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --print-logs --log-level info")
     .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
     .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
     .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'')
@@ -291,15 +316,10 @@ for (const file of readdirSync(workflowDirectory)) {
     .replace(
       /opencode --version[^\n]*grep -qF '[0-9][0-9.]*' \|\|[^\n]*?npm install --ignore-scripts -g opencode-ai@[0-9][0-9.]*[^\n]*/g,
       () =>
-        "opencode --version 2>/dev/null | grep -qF '" + OPENCODE_VERSION + "' || " +
-        "flock /tmp/opencode-install.lock npm install -g " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION +
-        " # " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION)
+        OPENCODE_INSTALL_GUARD)
     .replace(
       /npm install --ignore-scripts -g opencode-ai@([0-9][0-9.]*)/g,
-      () =>
-        "opencode --version 2>/dev/null | grep -qF '" + OPENCODE_VERSION + "' || " +
-        "flock /tmp/opencode-install.lock npm install -g " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION +
-        " # " + OPENCODE_PACKAGE + "@" + OPENCODE_VERSION)
+      () => OPENCODE_INSTALL_GUARD)
     .replace(/opencode-ai@[0-9][0-9.]*/g, OPENCODE_PACKAGE + '@' + OPENCODE_VERSION)
     .replace(/opencode-ai\b/g, OPENCODE_PACKAGE)
     // One warm server per runner, on its own port, with its own data directory. Keyed on the

package/loops/workflows/agent-refine.md

@@ -360,9 +360,25 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-      # No apply-agent-output here. safe_outputs already creates the split children, links
-      # them as sub-issues of the parent and rewrites the parent body; running the action too
-      # filed a second unlinked, unlabelled copy of every child.
+      # Path B needs this step, exactly as triage and merge-gate have it. `staged: true` above
+      # means the framework writes nothing, so without an apply the run validates everything and
+      # publishes nothing: the agent's comment and the refined body stay in the artifact, conclude
+      # reports success, and the issue keeps `refine` forever. That is how a refine came back green
+      # and untouched.
+      #
+      # It is not redundant with safe_outputs: staged, safe_outputs never writes. The comment that
+      # used to sit here said this action filed a duplicate of every split child, which is what
+      # happens when it runs *without* staging. Staged, the children exist only in the artifact
+      # and this step is the only thing that creates them.
+      - name: Apply agent output
+        uses: ./.github/actions/apply-agent-output
+        with:
+          artifact-name: ${{ needs.activation.outputs.artifact_prefix }}agent
+          token: ${{ steps.app-token.outputs.token }}
+          apply-labels: 'false'
+          update-issues: 'true'
+          create-issues: 'true'
+          fallback-issue-number: ${{ inputs.issue-number }}
       - name: Apply complete refinement labels
         if: needs.validate_output.outputs.outcome == 'complete'
         uses: ./.github/actions/add-issue-labels

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",