@plainconceptsplatform/workflows 1.2.3 → 1.3.1

package/loops/actions/remove-issue-labels/action.yml

@@ -1,37 +1,37 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/remove-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Remove issue labels
-description: Remove one or more labels from an issue or pull request.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue or pull request number.
-    required: true
-  labels:
-    description: Labels to remove, one per line. A comma-separated list is accepted as well.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Remove labels
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        LABELS: ${{ inputs.labels }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          // Callers wrote `labels: a,b` while this split on newlines, so one label named "a,b"
-          // was removed: a 404, swallowed below, and neither label ever came off.
-          for (const label of process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean)) {
-            try {
-              await github.rest.issues.removeLabel({
-                ...context.repo,
-                issue_number: Number(process.env.ISSUE_NUMBER),
-                name: label,
-              });
-            } catch (error) {
-              if (error.status !== 404) throw error;
-            }
-          }
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/remove-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Remove issue labels
+description: Remove one or more labels from an issue or pull request.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue or pull request number.
+    required: true
+  labels:
+    description: Labels to remove, one per line. A comma-separated list is accepted as well.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Remove labels
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        LABELS: ${{ inputs.labels }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          // Callers wrote `labels: a,b` while this split on newlines, so one label named "a,b"
+          // was removed: a 404, swallowed below, and neither label ever came off.
+          for (const label of process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean)) {
+            try {
+              await github.rest.issues.removeLabel({
+                ...context.repo,
+                issue_number: Number(process.env.ISSUE_NUMBER),
+                name: label,
+              });
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+          }

package/loops/actions/update-agent-issues/action.yml

@@ -1,58 +1,58 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Update agent issues
-description: Apply every update_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-  fallback-issue-number:
-    description: Issue an item targets when it names none.
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Update issues
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
-
-          let updated = 0;
-
-          for (const item of items) {
-            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
-
-            if (!target) {
-              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const changes = {};
-            if (item.title) changes.title = item.title;
-            if (item.body) changes.body = item.body;
-
-            if (Object.keys(changes).length === 0) {
-              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.update({
-              ...context.repo,
-              issue_number: Number(target),
-              ...changes,
-            });
-
-            updated += 1;
-          }
-
-          core.info(`Updated ${updated} issue(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Update agent issues
+description: Apply every update_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+  fallback-issue-number:
+    description: Issue an item targets when it names none.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Update issues
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
+
+          let updated = 0;
+
+          for (const item of items) {
+            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
+
+            if (!target) {
+              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const changes = {};
+            if (item.title) changes.title = item.title;
+            if (item.body) changes.body = item.body;
+
+            if (Object.keys(changes).length === 0) {
+              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: Number(target),
+              ...changes,
+            });
+
+            updated += 1;
+          }
+
+          core.info(`Updated ${updated} issue(s).`);

package/loops/actions/validate-merge-gate-output/action.yml

@@ -27,6 +27,10 @@ inputs:
     description: Agent confidence below which the pull request goes to a human.
     required: false
     default: '0.8'
+  code-rules:
+    description: "check-diff result on the pull request: pass, fail or absent. Empty means it did not report."
+    required: false
+    default: absent
 outputs:
   valid:
     description: Whether the output produced a usable disposition.
@@ -48,12 +52,13 @@ runs:
         PROTECTED_HIT: ${{ inputs.protected-hit }}
         OWNER_HIT: ${{ inputs.owner-hit }}
         CONFIDENCE_THRESHOLD: ${{ inputs.confidence-threshold }}
+        CODE_RULES: ${{ inputs.code-rules }}
       run: |
         set -euo pipefail
 
         outcome="$(bash "${{ github.action_path }}/validate-merge-gate-output.sh" \
           "$OUTPUT_FILE" "$ISSUE_NUMBER" "$CI_CONCLUSION" \
-          "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD")"
+          "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD" "$CODE_RULES")"
         echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 

package/loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh

@@ -18,7 +18,8 @@
 #
 # Usage:
 #   validate-merge-gate-output.sh OUTPUT_FILE ISSUE CI_CONCLUSION \
-#                                 BLAST_LEVEL PROTECTED_HIT OWNER_HIT CONFIDENCE_THRESHOLD
+#                                 BLAST_LEVEL PROTECTED_HIT OWNER_HIT CONFIDENCE_THRESHOLD \
+#                                 CODE_RULES
 
 set -euo pipefail
 
@@ -33,6 +34,9 @@ blast_level="${4-low}"
 protected_hit="${5-false}"
 owner_hit="${6-false}"
 confidence_threshold="${7-0.8}"
+# pass, fail or absent (the repository has no check-diff). An empty value is a job that did not
+# report, and like every other unmeasured fact it goes to a person.
+code_rules="${8-absent}"
 
 # An empty measured level is not a low-risk pull request, it is a job that did not report. The
 # defaults above exist for a caller that genuinely has nothing to say; an empty string arriving
@@ -56,7 +60,8 @@ jq -r \
   --arg blast "$blast_level" \
   --arg protected "$protected_hit" \
   --arg owner "$owner_hit" \
-  --arg threshold "$confidence_threshold" '
+  --arg threshold "$confidence_threshold" \
+  --arg code "$code_rules" '
 
   def level_rank: {"low": 0, "medium": 1, "high": 2}[.];
   def is_bool: type == "boolean";
@@ -143,11 +148,13 @@ jq -r \
 
                 | if $conclusion != "success" then "blocked"
                   elif $blockers > 0 then "blocked"
+                  elif $code == "fail" then "blocked"
                   elif $protected == "true" or $owner == "true" or $level == 2 then "owner-review"
                   # A fact the workflow could not measure is not a fact. Anything other than a
                   # clean true or false here means protected_changes did not report, and the
                   # pull request goes to a person rather than through on a default.
                   elif $protected != "false" or $owner != "false" then "human-review"
+                  elif $code != "pass" and $code != "absent" then "human-review"
                   elif $level == 1 and $recoverability == "low" then "human-review"
                   elif ($report | has("acceptanceCriteriaMet")) and $report.acceptanceCriteriaMet == false then "human-review"
                   elif $confidence < ($threshold | tonumber) then "human-review"

package/loops/actions/validate-review-output/action.yml

@@ -1,35 +1,35 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate review output
-description: Verify an apply-review outcome accounts for every unresolved review thread.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  pr-number:
-    description: Pull request receiving the review feedback.
-    required: true
-  review-threads-file:
-    description: JSON file containing unresolved review threads.
-    required: true
-outputs:
-  valid:
-    description: Whether the agent output is a valid review outcome.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate review outcome
-      id: validate
-      shell: bash
-      env:
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
-      run: |
-        set -euo pipefail
-        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate review output
+description: Verify an apply-review outcome accounts for every unresolved review thread.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  pr-number:
+    description: Pull request receiving the review feedback.
+    required: true
+  review-threads-file:
+    description: JSON file containing unresolved review threads.
+    required: true
+outputs:
+  valid:
+    description: Whether the agent output is a valid review outcome.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate review outcome
+      id: validate
+      shell: bash
+      env:
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
+      run: |
+        set -euo pipefail
+        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

package/loops/actions/validate-triage-output/action.yml

@@ -1,36 +1,36 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate triage output
-description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  issue-number:
-    description: Issue number that every triage outcome must target.
-    required: true
-outputs:
-  valid:
-    description: Whether the output contains a usable triage comment with a verdict.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic triage outcome: pass, needs-info, needs-maintainer, block, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate triage outcome
-      id: validate
-      shell: bash
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      run: |
-        set -euo pipefail
-
-        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-
-        if [ "$outcome" = 'invalid' ]; then
-          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
-        fi
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate triage output
+description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that every triage outcome must target.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable triage comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic triage outcome: pass, needs-info, needs-maintainer, block, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate triage outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
+        fi

package/loops/actions/verify-composite-actions/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-composite-actions/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify composite actions
-description: Check every local composite action manifest parses and uses only contexts a composite action actually has.
-runs:
-  using: composite
-  steps:
-    - name: Validate composite action manifests
-      shell: bash
-      run: bash "${GITHUB_ACTION_PATH}/verify-composite-actions.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-composite-actions/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify composite actions
+description: Check every local composite action manifest parses and uses only contexts a composite action actually has.
+runs:
+  using: composite
+  steps:
+    - name: Validate composite action manifests
+      shell: bash
+      run: bash "${GITHUB_ACTION_PATH}/verify-composite-actions.sh"

package/loops/actions/verify-refine-output/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-refine-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify refine output validation
-description: Exercise deterministic Refine output validation regressions.
-runs:
-  using: composite
-  steps:
-    - name: Verify refinement outcomes
-      shell: bash
-      run: bash "${{ github.action_path }}/verify-refine-output.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-refine-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify refine output validation
+description: Exercise deterministic Refine output validation regressions.
+runs:
+  using: composite
+  steps:
+    - name: Verify refinement outcomes
+      shell: bash
+      run: bash "${{ github.action_path }}/verify-refine-output.sh"

package/loops/actions/verify-route-matrix/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify route matrix
-description: Exercise the router's classifier against every supported event, and check that each route and dispatch operation has a job in work-router.yml.
-runs:
-  using: composite
-  steps:
-    - name: Run route matrix verification
-      shell: bash
-      run: bash "${GITHUB_ACTION_PATH}/verify-route-matrix.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify route matrix
+description: Exercise the router's classifier against every supported event, and check that each route and dispatch operation has a job in work-router.yml.
+runs:
+  using: composite
+  steps:
+    - name: Run route matrix verification
+      shell: bash
+      run: bash "${GITHUB_ACTION_PATH}/verify-route-matrix.sh"