@plainconceptsplatform/workflows 1.10.0 → 1.10.1

package/loops/actions/report-workflow-errors/action.yml

@@ -29,6 +29,12 @@ inputs:
       occurrence is a blip; an issue that is already open is always appended to.
     required: false
     default: '2'
+  min-occurrences-unknown:
+    description: >-
+      The same, for a failure the catalogue could not classify. With no diagnosis behind it, a
+      cause has to repeat more before it is worth a person's time.
+    required: false
+    default: '3'
   max-findings:
     description: The most issues one run opens, the most frequent first. The rest stay in the job summary.
     required: false
@@ -58,6 +64,7 @@ runs:
         UPSTREAM_REPO: ${{ inputs.upstream-repo }}
         LOOKBACK_HOURS: ${{ inputs.lookback-hours }}
         MIN_OCCURRENCES: ${{ inputs.min-occurrences }}
+        MIN_UNKNOWN: ${{ inputs.min-occurrences-unknown }}
         MAX_FINDINGS: ${{ inputs.max-findings }}
         QUIET_DAYS: ${{ inputs.quiet-days }}
         POLICY_PATH: ${{ github.action_path }}/report-policy.cjs
@@ -118,7 +125,7 @@ runs:
           // line carries repository paths, branch names and issue titles.
           const CATALOGUE = [
             { id: 'runner-never-assigned', test: /waiting for a runner|no runner matching|requested labels/i, note: 'A job waited for a self-hosted runner that never arrived.' },
-            { id: 'runner-lost-mid-job', test: /lost communication with the server|runner has received a shutdown signal|The self-hosted runner:.*lost/i, note: 'The runner disappeared while a job was running.' },
+            { id: 'runner-lost-mid-job', test: /lost communication with the server|runner has received a shutdown signal|The self-hosted runner:.*lost|exit code 143/i, note: 'The runner disappeared while a job was running.' },
             { id: 'job-cancelled-by-timeout', test: /The job running on runner .* has exceeded the maximum execution time|timeout-minutes/i, note: 'A job hit its timeout instead of finishing.' },
             { id: 'out-of-disk', test: /no space left on device|You are running out of disk space/i, note: 'The runner ran out of disk.' },
             { id: 'out-of-memory', test: /JavaScript heap out of memory|Killed\s+process|OOMKilled/i, note: 'A step was killed for memory.' },
@@ -187,7 +194,7 @@ runs:
           // Things that happened and are worth a number in the job summary, but that nobody can
           // fix by editing a workflow, so they never open an issue: a cancelled job with no step
           // that failed, a log that could not be read, and the fleet's own transient causes.
-          const quiet = { cancelledNoStep: 0, unreadable: 0, infra: new Map() };
+          const quiet = { cancelledNoStep: 0, unreadable: 0, retried: 0, reviewChecks: 0, infra: new Map() };
           let queueWaitTotal = 0;
           let queueWaitCount = 0;
           let queueWaitWorst = 0;
@@ -213,6 +220,9 @@ runs:
             if (!['failure', 'cancelled', 'timed_out', 'startup_failure'].includes(run.conclusion)) continue;
             ownedFailures += 1;
 
+            // A lint check failing on a pull request has done its job on somebody's change.
+            if (policy.isReviewCheck({ workflow: file, event: run.event })) { quiet.reviewChecks += 1; continue; }
+
             let jobs = [];
             try {
               jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRunAttempt, {
@@ -220,6 +230,10 @@ runs:
               });
             } catch { continue; }
 
+            // The worker already caught this one and sent the work back through the router; the
+            // attempt that parks does not retry, so a failure no retry got past is still read.
+            if (policy.wasRetried(jobs)) { quiet.retried += 1; continue; }
+
             for (const job of jobs) {
               if (job.started_at && job.created_at) {
                 const wait = (new Date(job.started_at) - new Date(job.created_at)) / 1000;
@@ -251,20 +265,24 @@ runs:
                 annotationText = notes.map((note) => note.message ?? '').join('\n');
               } catch { /* annotations are an extra; the log can still classify */ }
 
-              let patternId = 'unrecognised';
+              // A step whose name already says what failed is not read further: a missing secret
+              // is the repository's to set, whatever the log says around it.
+              let patternId = policy.causeFromStep(step?.name) ?? 'unrecognised';
               let logRead = true;
-              try {
-                const { data: log } = await github.rest.actions.downloadJobLogsForWorkflowRun({
-                  ...context.repo, job_id: job.id,
-                });
-                const text = typeof log === 'string' ? log : Buffer.from(log).toString('utf8');
-                // The tail is where the failure is, and reading less of the log is less to get
-                // wrong. Only the matched entry's id crosses into the report.
-                const tail = `${annotationText}\n${text.slice(-20000)}`;
-                patternId = CATALOGUE.find((entry) => entry.test.test(tail))?.id ?? 'unrecognised';
-              } catch {
-                logRead = false;
-                patternId = CATALOGUE.find((entry) => entry.test.test(annotationText))?.id ?? 'log-unavailable';
+              if (patternId === 'unrecognised') {
+                try {
+                  const { data: log } = await github.rest.actions.downloadJobLogsForWorkflowRun({
+                    ...context.repo, job_id: job.id,
+                  });
+                  const text = typeof log === 'string' ? log : Buffer.from(log).toString('utf8');
+                  // The tail is where the failure is, and reading less of the log is less to get
+                  // wrong. Only the matched entry's id crosses into the report.
+                  const tail = `${annotationText}\n${text.slice(-20000)}`;
+                  patternId = CATALOGUE.find((entry) => entry.test.test(tail))?.id ?? 'unrecognised';
+                } catch {
+                  logRead = false;
+                  patternId = CATALOGUE.find((entry) => entry.test.test(annotationText))?.id ?? 'log-unavailable';
+                }
               }
 
               // A log nobody could read says nothing, so it is counted and not filed.
@@ -303,7 +321,8 @@ runs:
           }
 
           const catalogueNote = (id) => CATALOGUE.find((entry) => entry.id === id)?.note
-            ?? (id === 'log-unavailable' ? 'The job log could not be read, so the failure could not be classified.'
+            ?? (id === 'missing-secret' ? 'A workflow stopped at a check for a secret this repository has not set.'
+              : id === 'log-unavailable' ? 'The job log could not be read, so the failure could not be classified.'
               : 'The log matched no known failure shape. Worth adding one to the catalogue.');
 
           const ranked = [...findings.values()].sort((a, b) => b.count - a.count);
@@ -313,6 +332,7 @@ runs:
           // person's time, and a bad night opens a handful of issues rather than forty.
           const selection = policy.select(ranked, {
             minOccurrences: Number(process.env.MIN_OCCURRENCES),
+            minUnknown: Number(process.env.MIN_UNKNOWN),
             maxFindings: Number(process.env.MAX_FINDINGS),
           });
 
@@ -385,6 +405,8 @@ runs:
               `Distinct failure signatures: ${ranked.length}`,
               `Filed or appended: ${selection.file.length}; held back: ${selection.held.length}`,
               `Cancelled jobs with no failing step, not reported: ${quiet.cancelledNoStep}`,
+              `Runs whose failure the worker retried through the router, not reported: ${quiet.retried}`,
+              `Checks that failed on a pull request, not reported: ${quiet.reviewChecks}`,
               `Jobs whose log could not be read, not reported: ${quiet.unreadable}`,
               `Infrastructure causes, counted and not reported: ${[...quiet.infra].map(([id, n]) => `${id} ${n}`).join(', ') || 'none'}`,
               queueWaitCount > 0
@@ -397,6 +419,12 @@ runs:
             ])
             .write();
 
+          // The repository's own configuration is said here, to the people who can change it, and
+          // nowhere else. The step name is the package's (or gh-aw's) own words.
+          for (const { finding } of selection.held.filter(({ finding }) => finding.severity === 'consumer')) {
+            core.warning(`${finding.count} job(s) of ${finding.workflow} stopped at "${finding.step}": set the secret it checks for, or the work it guards never runs.`);
+          }
+
           if (ranked.length === 0) {
             core.info('No failures in the window for any workflow this package ships.');
             core.setOutput('filed', '');
@@ -427,6 +455,18 @@ runs:
           const upstream = getOctokit(upstreamToken);
           const filed = [];
 
+          // The latest release, to tell a failure a release may already have fixed from one that
+          // is still live. Best effort: a token that cannot read tags files as before.
+          let latestRelease = '';
+          try {
+            const { data: tags } = await upstream.rest.repos.listTags({
+              owner: upstreamOwner, repo: upstreamName, per_page: 100,
+            });
+            latestRelease = policy.latestVersion(tags.map((tag) => tag.name));
+          } catch (error) {
+            core.info(`could not read the upstream tags: HTTP ${error.status ?? '?'}`);
+          }
+
           for (const { finding, title, body } of reports) {
             const marker = body.split('\n')[0];
             // One issue per signature, updated rather than repeated. Searching by the marker
@@ -450,6 +490,13 @@ runs:
               core.warning(`could not search upstream for an existing report: HTTP ${error.status ?? '?'}`);
             }
 
+            // An install a minor or more behind does not open a new issue: update it first. It
+            // still appends to one that is open, because then the bug is live on newer versions too.
+            if (!existing && policy.isOutdated(packageVersion, latestRelease)) {
+              core.info(`left alone, ${packageVersion} is behind ${latestRelease}; update first: ${title}`);
+              continue;
+            }
+
             if (dryRun) {
               core.info(`[dry-run] would ${existing ? `append to #${existing.number}` : 'open an issue'}: ${title}`);
               continue;

package/loops/actions/report-workflow-errors/report-policy.cjs

@@ -10,6 +10,11 @@
 // a runner shut down under a job, 47% re-filed a signature seen before, every one was closed as
 // not planned and none had a comment. What follows is the filter that would have kept about a
 // hundred of them out of that pile and left the rest as a count in the job summary.
+//
+// The 11 that still got through in the week to 2026-11-03 were the next layer: 39 jobs a day failing
+// gh-aw's check for an engine secret the repository never set, agent failures the worker had
+// already sent back through the router and recovered, a shellcheck step failing on a pull request
+// it was right to fail, and installs several minors behind reporting what a release had fixed.
 
 'use strict';
 
@@ -27,6 +32,13 @@ const INFRA = new Set([
   'out-of-memory',
 ]);
 
+// Causes that belong to the repository that installed the package: a secret it never set. They are
+// warned about in that repository's own job summary, where the person who can set it will look,
+// and never filed upstream, where nobody can.
+const CONSUMER = new Set([
+  'missing-secret',
+]);
+
 // Causes that are a defect in something this package ships.
 const PACKAGE_BUG = new Set([
   'jq-error',
@@ -39,13 +51,75 @@ const PACKAGE_BUG = new Set([
   'gh-api-409-conflict',
 ]);
 
-/** infra, package-bug, or unknown (a cause nobody classified yet, worth a look when it repeats). */
+/** infra, consumer, package-bug, or unknown (a cause nobody classified yet, worth a look when it repeats). */
 function severityOf(patternId) {
   if (INFRA.has(patternId)) return 'infra';
+  if (CONSUMER.has(patternId)) return 'consumer';
   if (PACKAGE_BUG.has(patternId)) return 'package-bug';
   return 'unknown';
 }
 
+/**
+ * Some steps say what failed by their name alone, and their log says it in words the catalogue
+ * cannot safely match: gh-aw's secret check names the variable, and a pattern for that name would
+ * put an engine name in a file that asserts it never reaches for a model. Step names are the
+ * package's own (or gh-aw's, compiled into the package's lock files), so they are safe to read.
+ */
+function causeFromStep(step) {
+  if (/^Validate .* secrets?$/i.test(step ?? '')) return 'missing-secret';
+  if (/^Check workflow lock file$/i.test(step ?? '')) return 'lock-out-of-date';
+  return null;
+}
+
+/**
+ * A worker that hits a short run, a runner shutdown or a cut-off sends the work back through the
+ * router (decide-agent-retry) and the next attempt usually lands. The failed agent job stays red in
+ * the run that retried it, and used to be filed as if nothing had caught it. A run whose retry step
+ * succeeded has had its failure answered; the attempt that finally parks does not retry, so a
+ * failure the retries never got past is still counted.
+ */
+function wasRetried(jobs) {
+  return (jobs ?? []).some((job) => (job.steps ?? []).some((step) =>
+    /^Send the (work|issue) back through the router$/.test(step.name ?? '') && step.conclusion === 'success'));
+}
+
+/**
+ * agentics-checks lints the repository's workflows and actions. On a pull request a red check is
+ * the check doing its job on somebody's change; only on the default branch, where the package's
+ * own files are what is there, can its failure be the package's.
+ */
+function isReviewCheck({ workflow, event }) {
+  return workflow === 'agentics-checks.yml' && (event === 'pull_request' || event === 'pull_request_target');
+}
+
+/**
+ * Whether the reporting install is a minor or more behind the latest release. Its failure may be
+ * one the release already fixed, so it does not open an issue; it still appends to one that is
+ * open. Patch versions are left alone: the fleet is rolled out the same day and a patch behind is
+ * the normal state for hours after every release.
+ */
+function isOutdated(reporting, latest) {
+  const parse = (v) => /^v?(\d+)\.(\d+)\./.exec(v ?? '')?.slice(1, 3).map(Number);
+  const a = parse(reporting);
+  const b = parse(latest);
+  if (!a || !b) return false;
+  return a[0] < b[0] || (a[0] === b[0] && a[1] < b[1]);
+}
+
+/**
+ * The newest release among the upstream tags. Tags, not GitHub releases or the npm dist-tag: the
+ * fleet is rolled out from tags, and both of the others have lagged them by several minors.
+ */
+function latestVersion(tags) {
+  let best = '';
+  for (const tag of tags ?? []) {
+    if (!/^v?\d+\.\d+\.\d+$/.test(tag)) continue;
+    const [a, b] = [tag, best].map((v) => v.replace(/^v/, '').split('.').map(Number));
+    if (!best || a[0] > b[0] || (a[0] === b[0] && (a[1] > b[1] || (a[1] === b[1] && a[2] > b[2])))) best = tag;
+  }
+  return best;
+}
+
 /**
  * One cause is one issue. A specific cause is the same defect whichever job of the router tripped
  * on it, so the job and the step are not part of its identity: conclude, safe_outputs and reserve
@@ -65,19 +139,26 @@ function markerKey({ workflow, step, conclusion, patternId }) {
 /**
  * Which findings become issues, and why the others do not.
  *  - infra causes are held: they are a rate, not a bug.
+ *  - consumer causes are held: the repository that has them is the one that can fix them.
  *  - a finding seen fewer than `minOccurrences` times in the window is held: once is a blip.
+ *  - an unrecognised cause needs `minUnknown`: with no diagnosis, twice in a day was mostly a
+ *    provider hiccup nobody could act on.
  *  - at most `maxFindings` are filed per run, the most frequent first, so a bad night opens a
  *    handful of issues and not forty.
  */
-function select(findings, { minOccurrences = 2, maxFindings = 5 } = {}) {
+function select(findings, { minOccurrences = 2, minUnknown = 3, maxFindings = 5 } = {}) {
   const ranked = [...findings].sort((a, b) => b.count - a.count);
   const file = [];
   const held = [];
+  const neededFor = (finding) => (finding.severity === 'unknown' ? Math.max(minOccurrences, minUnknown) : minOccurrences);
   for (const finding of ranked) {
     if (finding.severity === 'infra') {
       held.push({ finding, reason: 'infrastructure cause, counted not filed' });
-    } else if (finding.count < minOccurrences) {
-      held.push({ finding, reason: `seen ${finding.count} time(s), under the ${minOccurrences} needed to file` });
+    } else if (finding.severity === 'consumer') {
+      held.push({ finding, reason: "this repository's own configuration, warned here not filed" });
+    } else if (finding.count < neededFor(finding)) {
+      const needed = neededFor(finding);
+      held.push({ finding, reason: `seen ${finding.count} time(s), under the ${needed} needed to file` });
     } else if (file.length >= maxFindings) {
       held.push({ finding, reason: `over the ${maxFindings} filed per run` });
     } else {
@@ -107,4 +188,7 @@ function parseVersion(header) {
   return match ? match[1] : 'unknown';
 }
 
-module.exports = { INFRA, PACKAGE_BUG, severityOf, signatureOf, markerKey, select, isQuiet, parseVersion };
+module.exports = {
+  INFRA, CONSUMER, PACKAGE_BUG, severityOf, causeFromStep, wasRetried, isReviewCheck, isOutdated, latestVersion,
+  signatureOf, markerKey, select, isQuiet, parseVersion,
+};

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2414,6 +2414,21 @@ if [ -f "$ERROR_REPORT_YML" ]; then
       ok(p.isQuiet(null, now, 30) === false, "no closing date is not quiet");
       ok(p.parseVersion("# Managed by @plainconceptsplatform/workflows@1.2.3. Source: x") === "1.2.3", "the version has no trailing full stop");
       ok(p.parseVersion("nothing here") === "unknown", "no version reads as unknown");
+      // The layer that still got through: a secret the consumer never set, an agent failure the
+      // worker had already retried, a lint check failing on a pull request, an outdated install.
+      ok(p.severityOf("missing-secret") === "consumer", "a missing secret belongs to the consumer");
+      ok(p.causeFromStep("Validate CODEX_API_KEY or OPENAI_API_KEY secret") === "missing-secret", "the secret check is read from its step name");
+      ok(p.causeFromStep("Execute OpenCode CLI") === null, "any other step is left to the catalogue");
+      const held = p.select([f("s", 39, "consumer"), f("u", 2, "unknown"), f("k", 2, "package-bug")], { minOccurrences: 2, minUnknown: 3, maxFindings: 5 });
+      ok(held.file.map((x) => x.patternId).join() === "k", "a consumer cause and an undiagnosed pair are held, a diagnosed pair is filed");
+      const retry = (conclusion) => [{ steps: [{ name: "Execute OpenCode CLI", conclusion: "failure" }] }, { steps: [{ name: "Send the work back through the router", conclusion }] }];
+      ok(p.wasRetried(retry("success")) === true, "a run whose retry was sent is answered");
+      ok(p.wasRetried(retry("skipped")) === false, "a run that parked is not");
+      ok(p.isReviewCheck({ workflow: "agentics-checks.yml", event: "pull_request" }) === true, "a check failing on a pull request did its job");
+      ok(p.isReviewCheck({ workflow: "agentics-checks.yml", event: "push" }) === false, "a check failing on the default branch is read");
+      ok(p.isOutdated("1.6.41", "v1.10.0") === true && p.isOutdated("1.10.0", "v1.10.1") === false, "only a minor or more behind is outdated");
+      ok(p.isOutdated("unknown", "v1.10.0") === false && p.isOutdated("1.9.0", "") === false, "an unknown version files as before");
+      ok(p.latestVersion(["v1.9.4", "v1.10.0", "v0.28.11-alpha.1", "v1.8.3"]) === "v1.10.0", "the newest tag is read numerically, prereleases left out");
       if (bad.length) { console.error(bad.join("\n")); process.exit(1); }
     '
     if node -e "$policy_js" "$POLICY_CJS" 2>/tmp/policy-err; then
@@ -2432,6 +2447,9 @@ if [ -f "$ERROR_REPORT_YML" ]; then
   er "patternId === 'log-unavailable'\) \{ quiet\.unreadable \+= 1; continue; \}" 'files jobs whose log could not be read'
   er 'policy\.isQuiet\(' 'does not keep a recently closed signature quiet'
   er 'listAnnotations' 'does not read the job annotations, where the runner shutdown is written'
+  er 'if \(policy\.wasRetried\(jobs\)\) \{ quiet\.retried \+= 1; continue; \}' 'files agent failures the worker already retried'
+  er 'if \(policy\.isReviewCheck\(.*\{ quiet\.reviewChecks \+= 1; continue; \}' 'files lint checks that failed on a pull request'
+  er 'if \(!existing && policy\.isOutdated\(' 'opens issues from installs a minor or more behind'
 
   # 4. No model. A model asked to summarise a failure paraphrases whatever the log held, which
   # is the one thing that must not cross the boundary. This job stays deterministic.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",