@plainconceptsplatform/workflows 1.21.1 → 1.21.3

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1934,9 +1934,12 @@ fi
 if worker_installed implement && ! grep -qF 'subagent_type: planner-sub' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner-sub agent" >&2
 fi
-# agent-harness before 3.11.3 writes `resource: *`, a YAML alias that does not parse: opencode drops the agent's
+# agent-harness before 3.12.1 writes `resource: *`, a YAML alias that does not parse: opencode drops the agent's
 # mode and refuses to spawn planner and planner-sub ("cannot run as a subagent"). The CI setup repairs the
 # generated files before opencode reads them, and the implement prompt stops at the first spawn error.
+if ! grep -qF 'resource: ${JSON.stringify(p.resource)}' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  LEAD_OK=0; echo "FAIL: the CI setup must quote the permission resource in the harness generator, which rewrites the agents at startup" >&2
+fi
 if ! grep -qF 'resource: "*"' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   LEAD_OK=0; echo "FAIL: the CI setup must quote the generated agents' permission resource (a bare * is a YAML alias)" >&2
 fi
@@ -3731,6 +3734,12 @@ rc 'side-checks\.sh' "${HERE}/../merge-agent-pr/action.yml" 'merge-agent-pr must
 rc 'land-pull-request/side-checks\.sh' "${HERE}/../merge-train/merge-train.sh" 'the merge train must hold a pull request whose side workflow is red'
 rc 'test-timings\.mjs' "$CI_DOTNET" 'the .NET template must summarise the test timings'
 [ "$(grep -c -- '--logger trx' "$CI_DOTNET")" -ge 5 ] || { RC_OK=0; echo "FAIL: required checks: every .NET test step must write a trx report" >&2; }
+# The template sync installs copier on a runner whose Python cannot make a venv: the pinned uv it
+# falls back to must stay checked against its SHA-256, or the sync never runs (it never had).
+SYNC_YML="${HERE}/../../templates/platform-template/.github/workflows/platform-template-sync.yml"
+rc '^  UV_SHA256: [0-9a-f]{64}$' "$SYNC_YML" 'the template sync must pin uv by SHA-256'
+rc 'sha256sum --check --strict' "$SYNC_YML" 'the template sync must check the uv download'
+rc "python3 -c 'import ensurepip'" "$SYNC_YML" 'the template sync must not try a venv where ensurepip is missing'
 if [ "$RC_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
 echo "── App error privacy ─────────────────────────────────────────────────────"

package/loops/templates/platform-template/.github/workflows/platform-template-sync.yml

@@ -25,6 +25,10 @@ concurrency:
 env:
   # copier 9.19.1 needs Python 3.10 or newer on the runner.
   COPIER_VERSION: "9.19.1"
+  # The pinned uv the copier step downloads when the runner has no uvx, no pipx and no ensurepip
+  # (the self-hosted runner image ships Python without python3-venv, so a venv cannot be made).
+  UV_VERSION: "0.13.5"
+  UV_SHA256: f68d291c75783122dad58ab77def0e13f3233f358731db5d6d7e8715603b928f
   NODE_VERSION: "22"
   SYNC_BRANCH: platform/template-sync
 
@@ -79,7 +83,8 @@ jobs:
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
-      # uvx where uv is installed, then pipx, then a virtual environment from the runner's Python.
+      # uvx where uv is installed, then pipx, then a virtual environment from the runner's Python, and
+      # where that Python cannot make one, a pinned uv checked against its SHA-256.
       - name: Install copier
         if: steps.decide.outputs.run == 'true' && startsWith(steps.contract.outputs.update, 'copier ')
         run: |
@@ -90,10 +95,16 @@ jobs:
             run="uvx --from copier==$COPIER_VERSION copier"
           elif command -v pipx >/dev/null 2>&1; then
             run="pipx run --spec copier==$COPIER_VERSION copier"
-          else
+          elif python3 -c 'import ensurepip' >/dev/null 2>&1; then
             python3 -m venv "$RUNNER_TEMP/copier-venv"
             "$RUNNER_TEMP/copier-venv/bin/pip" install --quiet "copier==$COPIER_VERSION"
             run="$RUNNER_TEMP/copier-venv/bin/copier"
+          else
+            tarball="$RUNNER_TEMP/uv.tar.gz"
+            curl -fsSL -o "$tarball" "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz"
+            echo "${UV_SHA256}  $tarball" | sha256sum --check --strict
+            tar -xzf "$tarball" -C "$RUNNER_TEMP"
+            run="$RUNNER_TEMP/uv-x86_64-unknown-linux-gnu/uvx --from copier==$COPIER_VERSION copier"
           fi
           cat > "$bin/copier" <<EOF
           #!/usr/bin/env bash

package/loops/workflows/shared/opencode-ci.md

@@ -251,10 +251,21 @@ pre-agent-steps:
     # variants visible from the first turn; the doctor is the audit line.
     run: |
       set -euo pipefail
-      if [ -f .opencode/scripts/sync-agents.mjs ] && [ -f .opencode/plugins/pc-subagent-tiers-core.js ]; then
+      # agent-harness before 3.12.1 generates `resource: *` (see below). Quoting the generated files alone is not
+      # enough: the plugin rewrites them when opencode starts, so the generator itself is patched first. A no-op
+      # once the harness quotes the value.
+      tiers_core=.opencode/plugins/pc-subagent-tiers-core.js
+      if [ -f "$tiers_core" ]; then
+        sed -i 's/resource: ${p\.resource}`/resource: ${JSON.stringify(p.resource)}`/' "$tiers_core"
+        if grep -qF 'resource: ${p.resource}`' "$tiers_core"; then
+          echo "::error::Could not quote the permission resource in $tiers_core; opencode would refuse to spawn planner-sub." >&2
+          exit 1
+        fi
+      fi
+      if [ -f .opencode/scripts/sync-agents.mjs ] && [ -f "$tiers_core" ]; then
         node .opencode/scripts/sync-agents.mjs --strict
       fi
-      # agent-harness before 3.11.3 writes `resource: *` into plan.md, planner.md and planner-sub.md. A bare `*` is
+      # agent-harness before 3.12.1 writes `resource: *` into plan.md, planner.md and planner-sub.md. A bare `*` is
       # a YAML alias, so the frontmatter does not parse, opencode drops the agents' `mode`, treats them as primary
       # and refuses to spawn them ("Agent planner-sub cannot run as a subagent"). These files are generated here on
       # every run and never committed, so quote the value before opencode reads them; a no-op once the harness does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.21.1",
+  "version": "1.21.3",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",