@plainconceptsplatform/workflows 1.21.3 → 1.21.5

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1946,6 +1946,11 @@ fi
 if worker_installed implement && ! grep -qF 'cannot run as a subagent' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must stop at a planner-sub spawn error instead of retrying other agents" >&2
 fi
+# gh-aw strips HTML comments from safe-output comments, so the refine marker never reaches GitHub: the
+# router's auto-accept found no questions anywhere until it matched refine's visible prefix as well.
+if ! grep -qF 'contains($prefix)' "$ROUTER_YML" || ! grep -qF 'REFINE_PREFIX: "Refinement update"' "$ROUTER_YML"; then
+  LEAD_OK=0; echo "FAIL: the refine auto-accept must find the questions by refine's visible prefix, not only the stripped marker" >&2
+fi
 if [ "$LEAD_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # The harness plugins only load with .opencode/node_modules installed; without it every CI run
 # spawned untiered workers on the session's model. And the tier model a worker pins has to be one
@@ -3739,6 +3744,10 @@ rc 'test-timings\.mjs' "$CI_DOTNET" 'the .NET template must summarise the test t
 SYNC_YML="${HERE}/../../templates/platform-template/.github/workflows/platform-template-sync.yml"
 rc '^  UV_SHA256: [0-9a-f]{64}$' "$SYNC_YML" 'the template sync must pin uv by SHA-256'
 rc 'sha256sum --check --strict' "$SYNC_YML" 'the template sync must check the uv download'
+# A conformance run that could not read the template must not pass as a comparison.
+rc 'compare\+=\(--require-source\)' "$CI_DOTNET" 'the conformance job must require the template when it has a token'
+rc 'create-github-app-token@[0-9a-f]{40}' "$CI_DOTNET" 'the conformance job must mint a token that reads the template'
+rc "requireSource \\? \\{ failures: \\[message\\]" "${HERE}/../../templates/platform-template/scripts/check-platform-conformance.mjs" 'check-platform-conformance must fail on an unread template with --require-source'
 rc "python3 -c 'import ensurepip'" "$SYNC_YML" 'the template sync must not try a venv where ensurepip is missing'
 if [ "$RC_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -33,6 +33,12 @@ on:
     secrets:
       NPM_REGISTRY_TOKEN:
         required: false
+      # The bot App, for the platform conformance job to read the template repository when it is
+      # private. A deploy pipeline passes them; without them the owned files are not compared.
+      BOT_APP_ID:
+        required: false
+      BOT_PRIVATE_KEY:
+        required: false
 
 permissions:
   contents: read
@@ -518,17 +524,34 @@ jobs:
     name: Platform conformance
     runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
     timeout-minutes: 5
+    env:
+      HAS_BOT_APP: ${{ secrets.BOT_APP_ID != '' && secrets.BOT_PRIVATE_KEY != '' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      # The template repository is usually private, and GITHUB_TOKEN reads only this one. Without a
+      # token the comparison could not run and the job still said the owned files matched.
+      - name: Token that reads the platform template
+        id: app-token
+        if: env.HAS_BOT_APP == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+      # The token reaches git through process-scoped config only, never a file on the runner.
       - name: Owned files change only through a template sync
         env:
           EVENT: ${{ github.event_name }}
           BASE_REF: ${{ github.base_ref }}
+          GIT_CONFIG_COUNT: ${{ steps.app-token.outputs.token != '' && '1' || '0' }}
+          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/.insteadOf
+          GIT_CONFIG_VALUE_0: https://github.com/
+          HAS_TOKEN: ${{ steps.app-token.outputs.token != '' }}
         run: |
           set -euo pipefail
           if [ ! -f .platform/contract.yml ] && { [ ! -f .copier-answers.yml ] || [ ! -f .platform/manifest ]; }; then
@@ -539,11 +562,19 @@ jobs:
             echo "::error::This repository has a platform contract but no scripts/check-platform-conformance.mjs. Install it with: npx @plainconceptsplatform/workflows add --template platform-template"
             exit 1
           fi
+          # With a token the template must be read; without one (Dependabot, a caller that passes no
+          # secrets) the job still checks for changes outside a sync, and says it did not compare.
+          compare=(--compare)
+          if [ "$HAS_TOKEN" = true ]; then
+            compare+=(--require-source)
+          else
+            echo "::warning::No bot App token in this run, so the owned files were not compared with the template. Pass BOT_APP_ID and BOT_PRIVATE_KEY to this workflow."
+          fi
           if [ "$EVENT" = pull_request ]; then
             git fetch origin "$BASE_REF"
-            node scripts/check-platform-conformance.mjs --compare --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"
+            node scripts/check-platform-conformance.mjs "${compare[@]}" --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"
           else
-            node scripts/check-platform-conformance.mjs --compare | tee -a "$GITHUB_STEP_SUMMARY"
+            node scripts/check-platform-conformance.mjs "${compare[@]}" | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 
   secret-scan:

package/loops/templates/platform-template/scripts/check-platform-conformance.mjs

@@ -3,10 +3,11 @@
 // Keeps the paths a platform contract (.platform/contract.yml) marks as `owned` equal to the template
 // they come from. A pull request may change them only in a template sync (it changes `sync.marker` or
 // moves `sync.version`) or under an unexpired exception; conflict markers and expired exceptions fail.
-// With --compare, owned files are also compared with `source.url` at the recorded version.
+// With --compare, owned files are also compared with `source.url` at the recorded version; with
+// --require-source as well, a template it cannot read is a failure rather than a note.
 // Without a contract it passes silently. .copier-answers.yml + .platform/manifest is read as one.
 //
-// Usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare]
+// Usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare [--require-source]]
 //        node scripts/check-platform-conformance.mjs --contract   (key=value lines for $GITHUB_OUTPUT)
 
 import { execFileSync } from 'node:child_process';
@@ -321,7 +322,7 @@ function sourceBlobs(url, version) {
   }
 }
 
-function compareWithSource(root, contract, patterns, live, version) {
+function compareWithSource(root, contract, patterns, live, version, requireSource = false) {
   const failures = [];
   const notes = [];
   const { name, url, changes } = contract.source;
@@ -331,7 +332,8 @@ function compareWithSource(root, contract, patterns, live, version) {
     source = sourceBlobs(url, version);
   } catch (error) {
     const reason = String(error.stderr ?? error.message).trim().split('\n').at(-1);
-    return { failures, notes: [`cannot read ${url} at ${version} (${reason}); owned files were not compared with the source`] };
+    const message = `cannot read ${url} at ${version} (${reason}); owned files were not compared with the source`;
+    return requireSource ? { failures: [message], notes, compared: false } : { failures, notes: [message], compared: false };
   }
   const local = blobIds(git(root, ['ls-files', '-s', '-z']), 1);
   for (const [path, id] of source) {
@@ -343,10 +345,10 @@ function compareWithSource(root, contract, patterns, live, version) {
   }
   const onlyHere = [...local.keys()].filter((path) => isOwned(patterns, path) && !source.has(path));
   if (onlyHere.length > 0) notes.push(`${onlyHere.length} owned file(s) are not in ${name} at ${version} under the same path; not compared`);
-  return { failures, notes };
+  return { failures, notes, compared: true };
 }
 
-export function checkConformance(root, { base, compare = false, today = new Date().toISOString().slice(0, 10) } = {}) {
+export function checkConformance(root, { base, compare = false, requireSource = false, today = new Date().toISOString().slice(0, 10) } = {}) {
   const read = (path) => (existsSync(join(root, path)) ? readFileSync(join(root, path), 'utf8') : undefined);
   let contract;
   try {
@@ -395,12 +397,14 @@ export function checkConformance(root, { base, compare = false, today = new Date
       }
     }
   }
+  let compared;
   if (compare) {
-    const result = compareWithSource(root, contract, patterns, live, version);
+    const result = compareWithSource(root, contract, patterns, live, version, requireSource);
     failures.push(...result.failures);
     notes.push(...result.notes);
+    compared = result.compared;
   }
-  return { adopted: true, failures, notes };
+  return { adopted: true, failures, notes, compared };
 }
 
 // One key=value line per field, for $GITHUB_OUTPUT; contract=absent when there is none.
@@ -428,9 +432,9 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
   const args = process.argv.slice(2);
   const baseIndex = args.indexOf('--base');
   const base = baseIndex === -1 ? undefined : args[baseIndex + 1];
-  const unknown = args.filter((arg, i) => i !== baseIndex + 1 || baseIndex === -1).filter((arg) => !['--base', '--compare', '--contract'].includes(arg));
+  const unknown = args.filter((arg, i) => i !== baseIndex + 1 || baseIndex === -1).filter((arg) => !['--base', '--compare', '--require-source', '--contract'].includes(arg));
   if ((baseIndex !== -1 && !base) || unknown.length > 0) {
-    console.error('usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare] | --contract');
+    console.error('usage: node scripts/check-platform-conformance.mjs [--base <git ref>] [--compare [--require-source]] | --contract');
     process.exit(2);
   }
   const root = fileURLToPath(new URL('..', import.meta.url));
@@ -444,10 +448,11 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       process.exit(1);
     }
   }
-  const { adopted, failures, notes } = checkConformance(root, { base, compare: args.includes('--compare') });
+  const { adopted, failures, notes, compared } = checkConformance(root, { base, compare: args.includes('--compare'), requireSource: args.includes('--require-source') });
   if (!adopted) process.exit(0);
   for (const note of notes) console.log(`· ${note}`);
   for (const failure of failures) console.error(`✗ ${failure}`);
-  if (failures.length === 0) console.log('✓ owned files match the template');
+  // Only a comparison that ran may say the files match: an unread template proves nothing.
+  if (failures.length === 0) console.log(compared === false ? '✓ no owned file changed outside a template sync (not compared with the template)' : '✓ owned files match the template');
   process.exit(failures.length === 0 ? 0 : 1);
 }

package/loops/workflows/work-router.yml

@@ -1718,6 +1718,10 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           REFINE_MARKER: "<!-- agent-refine -->"
+          # gh-aw strips HTML comments from safe-output comments, so the marker above never reaches
+          # GitHub and this step found no questions in any repository. The visible prefix refine
+          # puts first (agent-refine's SAFE_OUTPUT_COMMENT_PREFIX) identifies them instead.
+          REFINE_PREFIX: "Refinement update"
           QUESTIONS_LINE: "I have some questions about this issue"
           PROPOSED_TAG: "**Proposed:**"
           DECISION_TAG: "**Your decision needed:**"
@@ -1744,8 +1748,10 @@ jobs:
             while IFS=$'\t' read -r issue people; do
               [ -n "$issue" ] || continue
               comments=$(gh api --paginate "repos/$REPO/issues/$issue/comments?per_page=100" | jq -s 'add // []')
-              asked=$(jq -c --arg marker "$REFINE_MARKER" --arg line "$QUESTIONS_LINE" '
-                [.[] | select(.user.type == "Bot" and (.body | contains($marker)) and (.body | contains($line)))]
+              asked=$(jq -c --arg marker "$REFINE_MARKER" --arg prefix "$REFINE_PREFIX" --arg line "$QUESTIONS_LINE" '
+                [.[] | select(.user.type == "Bot"
+                  and ((.body | contains($marker)) or (.body | contains($prefix)))
+                  and (.body | contains($line)))]
                 | last // empty | {id, created_at, body}' <<<"$comments")
               [ -n "$asked" ] || continue
               asked_at=$(jq -r '.created_at' <<<"$asked")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.21.3",
+  "version": "1.21.5",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",