@plainconceptsplatform/workflows 1.5.0 → 1.6.10

package/dist/route-processing.js

@@ -10,7 +10,12 @@ const routeCrons = {
 const routeHelperJobs = {
     implement: ["check-implement-pr"],
     triage: ["dispatch-triage"],
-    "merge-gate": ["merge-approved"],
+    "merge-gate": ["merge-approved", "merge-train"],
+};
+// Dispatch operations that exist only to serve one worker route. A router without the worker
+// would offer an operation no job answers, which the route matrix reports.
+const routeHelperOperations = {
+    "merge-gate": ["merge-train"],
 };
 export function stripRouteFromRouter(yaml, route) {
     let result = yaml;
@@ -21,7 +26,9 @@ export function stripRouteFromRouter(yaml, route) {
     for (const job of [`call-${route}`, ...(routeHelperJobs[route] ?? [])]) {
         result = removeJobBlock(result, job);
     }
-    result = result.replace(new RegExp(`^          - ${escapeRegex(route)}\\n`, "gm"), "");
+    for (const operation of [route, ...(routeHelperOperations[route] ?? [])]) {
+        result = result.replace(new RegExp(`^          - ${escapeRegex(operation)}\\n`, "gm"), "");
+    }
     return result;
 }
 export function processRoutes(files, selectedRoutes) {

package/dist/workflow-catalog.js

@@ -12,7 +12,7 @@ export const workflowRoutes = [
     { name: "implement", worker: "agent-implement.md", description: "Implements an issue and opens a pull request. Stops there: the merge decision belongs to the merge gate.", defaultEnabled: true },
     { name: "triage", worker: "agent-triage.md", description: "Triages issues opened from outside the organisation: runs 10 checks (template, security, size, danger, duplicates, clarity, reproducibility, acceptance, cross-cutting, product scope). Loops up to 3 rounds. Passes to refine, asks the author for more, parks out-of-scope work open for a maintainer, or closes what is genuinely rejected.", defaultEnabled: true },
     { name: "apply-review", worker: "agent-apply-review.md", description: "Applies reviewer feedback to an open pull request the bot authored, then pushes the fixes to the same branch.", defaultEnabled: true },
-    { name: "merge-gate", worker: "agent-merge-gate.md", description: "Decides what happens to a bot-authored pull request once CI has reported: merge, hand to a human, or fix CI.", defaultEnabled: true },
+    { name: "merge-gate", worker: "agent-merge-gate.md", description: "Decides what happens to the pull request the merge train hands it, the bot's or a person's: repair it, merge it, or hand it to a human.", defaultEnabled: true },
     { name: "audit", worker: "agent-audit.md", description: "Read-only repository audit. Finds 5-7 problems, scores each 1-10, and files a single issue that Refine then sizes and splits.", defaultEnabled: true },
     { name: "release", worker: "agent-release.md", description: "Writes release notes from the commit log, then a deterministic job opens a version-bump pull request with auto-merge; once it merges, release-tag.yml tags the commit and publishes the GitHub Release. Manual dispatch only (operation=release).", defaultEnabled: true, companions: ["release-tag.yml"] },
 ];

package/loops/actions/apply-agent-output/action.yml

@@ -19,6 +19,10 @@ inputs:
     description: Apply push_to_pull_request_branch items.
     required: false
     default: 'false'
+  expected-branch:
+    description: The only branch a push may target. A push naming any other branch is refused. Empty accepts the branch the item names.
+    required: false
+    default: ''
   close-issues:
     description: Apply close_issue items.
     required: false
@@ -73,6 +77,7 @@ runs:
         output-file: ${{ steps.output.outputs.output-file }}
         bundle-file: ${{ steps.output.outputs.bundle-file }}
         token: ${{ inputs.token }}
+        expected-branch: ${{ inputs.expected-branch }}
 
     - name: Close issues
       if: inputs.close-issues == 'true' && steps.output.outputs.item-count != '0'

package/loops/actions/classify-route/classify-route.sh

@@ -156,9 +156,9 @@ classify_route() {
         ci_run_id=""
       elif [ "${ACTION:-}" = "closed" ] && [ "${PR_MERGED:-false}" = "true" ]; then
         # A merge is when the change's verification plan describes what the default branch now
-        # does, so the evidence run replays it then. detect-pr-conflicts reacts to this same
-        # event as its own event-gated job, not as a route, so taking the route here costs it
-        # nothing.
+        # does, so the evidence run replays it then. The merge train and land-stack-child react
+        # to this same event as event-gated jobs, not as routes, so taking the route here costs
+        # them nothing.
         if [ "${EVIDENCE_ENABLED:-true}" = "true" ]; then
           route="evidence"
           pr_number="${EVENT_PR_NUMBER:-}"
@@ -171,17 +171,17 @@ classify_route() {
       ;;
 
     workflow_run)
-      # Only a FAILED CI run on an attached pull request auto-dispatches the gate. A green
-      # run reaches the gate through the consumer CI's dispatch-merge-gate job and the
-      # reconcile belt, so routing success here would double-fire the gate for every passing
-      # pull request. GitHub delivers workflow_run only for CI runs whose actor is a human;
-      # a bot pull request's CI never arrives here at all, and the same two paths cover it.
-      if [ "${RUN_CONCLUSION:-}" != "failure" ]; then
-        error="CI concluded '${RUN_CONCLUSION:-}'; the gate auto-triggers only on failure"
+      # A CI verdict on a pull request moves the merge train, green or red. The train, not this
+      # event, decides which pull request the gate takes next: dispatching the gate for this one
+      # directly is what let a night of pull requests race each other for the default branch.
+      # GitHub delivers workflow_run only for CI runs whose actor is a human; a bot-updated pull
+      # request's CI reaches the train through the consumer CI's dispatch job and the schedule.
+      if [ "${RUN_CONCLUSION:-}" != "failure" ] && [ "${RUN_CONCLUSION:-}" != "success" ]; then
+        error="CI concluded '${RUN_CONCLUSION:-}'; only a success or a failure moves the merge train"
       elif is_issue_number "${RUN_PR_NUMBER:-}"; then
-        route="merge-gate"
+        route="merge-train"
         pr_number="${RUN_PR_NUMBER}"
-        ci_conclusion="failure"
+        ci_conclusion="${RUN_CONCLUSION}"
         ci_run_id="${RUN_ID:-}"
       else
         error="CI run has no attached pull request"
@@ -237,7 +237,17 @@ classify_route() {
           fi
           ;;
         merge-gate)
-          if is_issue_number "${INPUT_PR_NUMBER:-}"; then
+          # A consumer CI hands its verdict over with GITHUB_TOKEN, whose dispatches carry
+          # github-actions[bot] as the actor; the train and a person dispatch with other
+          # identities. That handover is a CI completion, so it moves the train rather than
+          # jumping the queue. The CI templates now dispatch merge-train; this keeps a consumer
+          # CI that still dispatches merge-gate in line until it is updated.
+          if is_issue_number "${INPUT_PR_NUMBER:-}" && [ "${ACTOR:-}" = "github-actions[bot]" ]; then
+            route="merge-train"
+            pr_number="${INPUT_PR_NUMBER}"
+            ci_conclusion="${INPUT_CI_CONCLUSION:-}"
+            ci_run_id="${INPUT_CI_RUN_ID:-}"
+          elif is_issue_number "${INPUT_PR_NUMBER:-}"; then
             route="merge-gate"
             pr_number="${INPUT_PR_NUMBER}"
             ci_conclusion="${INPUT_CI_CONCLUSION:-}"
@@ -260,6 +270,17 @@ classify_route() {
           route="${OPERATION}"
           trigger_kind="${INPUT_TRIGGER_KIND:-manual}"
           ;;
+        merge-train)
+          # The train always takes the oldest pull request that can move. A CI handover names its
+          # pull request and verdict because it runs inside that CI run, which still reads as in
+          # progress when the train looks; the verdict stands in for the run's own conclusion.
+          route="merge-train"
+          if is_issue_number "${INPUT_PR_NUMBER:-}"; then
+            pr_number="${INPUT_PR_NUMBER}"
+            ci_conclusion="${INPUT_CI_CONCLUSION:-}"
+            ci_run_id="${INPUT_CI_RUN_ID:-}"
+          fi
+          ;;
         audit-close | cleanup-artifacts | reconcile-bot-pr-runs | housekeeping | validate)
           route="${OPERATION}"
           ;;

package/loops/actions/decide-agent-retry/action.yml

@@ -25,6 +25,9 @@ outputs:
   minutes:
     description: How long the agent job ran, or -1 when that could not be read.
     value: ${{ steps.decide.outputs.minutes }}
+  cause:
+    description: 'Why a retry was chosen: short-run, runner-shutdown or cut-off. "none" when there is none.'
+    value: ${{ steps.decide.outputs.cause }}
 runs:
   using: composite
   steps:
@@ -33,6 +36,13 @@ runs:
     # repeating it buys the same wrong answer half an hour later. Duration is what separates them,
     # and it needs no model and no log parsing to read.
     #
+    # Except when the long run was killed rather than wrong. The VM was deleted under a forty
+    # minute implement (Pliny-Bot #699), and an AI gateway that answered nothing ended another
+    # run one turn after it began (#693's first attempt): neither is a verdict on the work, and
+    # both waited six hours for the janitor. classify-failure.sh reads those two from the job's
+    # annotations and from the line above the sandbox teardown, and they are repeated whatever
+    # the run lasted, within the same attempt budget.
+    #
     # Written once here because the rule was in the implement worker alone, and refine, triage and
     # apply-review parked instead -- an Odyssey refine died in three minutes on
     # `Model 'glm-5-2' not found`, a gateway fault that clears in seconds, and waited on the
@@ -44,15 +54,16 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
         REPO: ${{ github.repository }}
         RUN_ID: ${{ github.run_id }}
+        ACTION_PATH: ${{ github.action_path }}
         ATTEMPTS: ${{ inputs.attempts-so-far }}
         PARK_AT: ${{ inputs.park-at }}
         UNDER_MINUTES: ${{ inputs.under-minutes }}
       run: |
         set -euo pipefail
         # The agent job belongs to this same run: a called workflow shares the caller's run id.
-        read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+        read -r job_id started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
           --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                | "\(.started_at // "") \(.completed_at // "")"')"
+                | "\(.id // "") \(.started_at // "") \(.completed_at // "")"')"
         minutes=-1
         if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
           minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
@@ -60,13 +71,30 @@ runs:
         attempts="${ATTEMPTS:-0}"
         [ -n "$attempts" ] || attempts=0
         retry=false
+        cause=none
         # An unknown duration is treated as a long run: never retry on a guess.
         if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$attempts" -lt "$PARK_AT" ]; then
           retry=true
+          cause=short-run
+        fi
+        # A long run is repeated only when it was killed, not when it was wrong. The reads are best
+        # effort: a log or an annotation list that cannot be fetched leaves the run parked, exactly
+        # as before this check existed.
+        if [ "$retry" != true ] && [ "$attempts" -lt "$PARK_AT" ] && [ -n "${job_id:-}" ]; then
+          work="$(mktemp -d)"
+          gh api "repos/$REPO/check-runs/$job_id/annotations" --paginate --jq '.[].message' >"$work/annotations" 2>/dev/null || true
+          gh api "repos/$REPO/actions/jobs/$job_id/logs" >"$work/log" 2>/dev/null || true
+          kind="$(bash "$ACTION_PATH/classify-failure.sh" "$work/log" "$work/annotations" || echo none)"
+          if [ "$kind" != none ]; then
+            retry=true
+            cause="$kind"
+          fi
+          rm -rf "$work"
         fi
         {
           echo "retry=$retry"
           echo "next=$((attempts + 1))"
           echo "minutes=$minutes"
+          echo "cause=$cause"
         } >> "$GITHUB_OUTPUT"
-        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}"
+        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}; cause=${cause}"

package/loops/actions/decide-agent-retry/classify-failure.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/decide-agent-retry/classify-failure.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Say why an agent job died, when the reason is one that repeating the run fixes.
+#
+# Duration alone could not tell the difference. A run that dies in three minutes produced nothing;
+# a run that works for forty minutes and is then killed by its machine produced nothing either, and
+# was parked for the janitor's six-hourly sweep as if the agent had been wrong. Two causes are
+# infrastructure, not judgement:
+#
+#   runner-shutdown  the VM was taken away mid-job: the process is killed with SIGTERM and GitHub
+#                    annotates the job "Process completed with exit code 143" (the log has the
+#                    longer "The runner has received a shutdown signal"), whatever the model was
+#                    doing. 137, a SIGKILL, is left out: an out-of-memory kill repeats itself
+#   cut-off          the engine was stopped one turn after it started: the last thing the log shows
+#                    before the sandbox stops is the header opencode prints when it sends a request
+#                    to the model, with no reply under it. The AI gateway answered nothing, or an
+#                    error opencode did not surface, and the run ended with the work unsaid
+#
+# A tool's output in the log can quote either phrase, so neither is searched for in the body: the
+# shutdown is read from the annotations, which only GitHub writes, and the cut-off from the one line
+# immediately above the sandbox teardown.
+#
+# Usage: classify-failure.sh LOG_FILE ANNOTATIONS_FILE
+# Prints one word: runner-shutdown, cut-off or none.
+
+set -euo pipefail
+
+log="${1:-}"
+annotations="${2:-}"
+
+if [ -n "$annotations" ] && [ -f "$annotations" ] && grep -qiE 'exit code 143|runner has received a shutdown signal|lost communication with the server|runner.*(was|has been) (deleted|terminated)' "$annotations"; then
+  echo runner-shutdown
+  exit 0
+fi
+
+if [ -n "$log" ] && [ -f "$log" ]; then
+  # The line the sandbox teardown starts on. grep exits 1 for none, which is an answer here.
+  stop=$(grep -n '\[INFO\] Stopping containers' "$log" | head -1 | cut -d: -f1 || true)
+  if [ -n "$stop" ] && [ "$stop" -gt 1 ]; then
+    # The last line with any text above it, ignoring the ANSI colour codes opencode wraps its
+    # output in and the timestamp every runner line carries.
+    last=$(sed -n "1,$((stop - 1))p" "$log" | sed -E 's/\x1b\[[0-9;]*m//g' | grep -vE '^(\S+Z )?[[:space:]]*$' | tail -1 || true)
+    if printf '%s' "$last" | grep -qE '^(\S+Z )?> [A-Za-z0-9_.-]+ · [A-Za-z0-9_./:-]+[[:space:]]*$'; then
+      echo cut-off
+      exit 0
+    fi
+  fi
+fi
+
+echo none

package/loops/actions/housekeeping/action.yml

@@ -71,13 +71,33 @@ runs:
           // timeout. A stuck pending implement or refine run holds a fleet slot that the retry
           // logic below can never free because the run never reaches a terminal state. This
           // cancel runs on a GitHub-hosted runner, so it works even when the fleet is full.
+          //
+          // Only a run with nothing live ahead of it. The router queues implement runs FIFO
+          // (`queue: max`) so that labelling six issues at once implements all six, one after the
+          // other, and each of those takes an hour: the sixth waits five hours legitimately. A
+          // flat one-hour cutoff cancelled every run behind the first, which left its issue
+          // carrying bot-working with no run until the sweep cleared it (Pliny-Bot #706 and #644,
+          // both cancelled while #693 ran). A pending run is stuck when no run of its own kind
+          // ("Agent: Implement", "Agent: Merge Gate") is running or queued to hold the group.
           const stuckCutoff = Date.now() - 3600 * 1000; // 1 hour ago
+          const runKind = (run) => String(run.display_title || '').split(' - ')[0];
+          const liveKinds = new Set();
+          for (const status of ['in_progress', 'queued']) {
+            for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
+              owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
+              status, per_page: 50,
+            })) liveKinds.add(runKind(run));
+          }
           let cancelledRuns = 0;
           for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
             owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
             status: 'pending', per_page: 50,
           })) {
             if (new Date(run.created_at).getTime() > stuckCutoff) continue;
+            if (liveKinds.has(runKind(run))) {
+              core.info(`run #${run.id} (${run.display_title}) waits behind a live ${runKind(run)} run; not stuck`);
+              continue;
+            }
             await act(`cancelling stuck pending run #${run.id} (queued ${new Date(run.created_at).toISOString()})`, async () => {
               await github.rest.actions.cancelWorkflowRun({
                 owner: context.repo.owner, repo: context.repo.repo, run_id: run.id,

package/loops/actions/identify-gate-subject/action.yml

@@ -1,10 +1,14 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
 name: Identify gate subject
-description: Confirm the pull request is one we authored, resolve the issue it closes, and check that issue carries the required label.
+description: Confirm the pull request is one the gate may act on (same repository, opened by a trusted bot or someone with write access) and resolve the open issue it closes, if any.
 inputs:
   token:
     description: GitHub token with issues and pull-requests read access.
     required: true
+  trusted-bots:
+    description: Space-separated bot logins whose pull requests the gate gates. Anyone else needs write access.
+    required: false
+    default: ''
   pr-number:
     description: Pull request number to gate.
     required: true
@@ -20,10 +24,6 @@ inputs:
     description: Issue the pull request closes, when the router already resolved it.
     required: false
     default: ''
-  require-label:
-    description: Label the closing issue must carry. Empty disables the check.
-    required: false
-    default: ''
 outputs:
   found:
     description: Whether a valid gate subject was found.
@@ -32,8 +32,17 @@ outputs:
     description: Pull request number.
     value: ${{ steps.identify.outputs.pr }}
   issue:
-    description: Issue number the pull request closes.
+    description: Issue number the pull request closes. Empty for a person's pull request that closes none.
     value: ${{ steps.identify.outputs.issue }}
+  record:
+    description: Where the gate writes its verdict and labels. The issue when there is one, otherwise the pull request.
+    value: ${{ steps.identify.outputs.record }}
+  head-ref:
+    description: The pull request's head branch, the only branch the gate may push to.
+    value: ${{ steps.identify.outputs.head-ref }}
+  closes:
+    description: "What the pull request closes, as the prompt says it: `closes issue #N` or `closes no issue`. gh-aw allows no expression logic in a prompt."
+    value: ${{ steps.identify.outputs.closes }}
   conclusion:
     description: CI conclusion, passed through unchanged or fetched from latest CI run.
     value: ${{ steps.identify.outputs.conclusion }}
@@ -53,7 +62,7 @@ runs:
         CONCLUSION: ${{ inputs.ci-conclusion }}
         CI_RUN_ID: ${{ inputs.ci-run-id }}
         LINKED_ISSUE: ${{ inputs.linked-issue }}
-        REQUIRE_LABEL: ${{ inputs.require-label }}
+        TRUSTED_BOTS: ${{ inputs.trusted-bots }}
       run: |
         set -euo pipefail
 
@@ -64,10 +73,31 @@ runs:
         }
 
         pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
-          --json state,author,closingIssuesReferences,body)"
+          --json state,author,closingIssuesReferences,body,isCrossRepository,headRefName)"
 
         [ "$(jq -r '.state' <<<"$pr")" = "OPEN" ] || none "PR #$PR_NUMBER is not open"
 
+        # The gate checks out the branch, runs the repository's commands on it and pushes to it,
+        # with secrets. A fork's branch is someone else's code: never.
+        [ "$(jq -r '.isCrossRepository' <<<"$pr")" = "false" ] || none "PR #$PR_NUMBER comes from a fork"
+
+        # A bot this repository trusts, or a person with write access, who could push the same
+        # branch themselves. GraphQL spells a GitHub App `app/<name>`, REST `<name>[bot]`.
+        author="$(jq -r '.author.login' <<<"$pr")"
+        bot=false
+        if [ "$(jq -r '.author.is_bot // false' <<<"$pr")" = "true" ]; then
+          for candidate in "$author" "${author#app/}[bot]"; do
+            case " $TRUSTED_BOTS " in *" $candidate "*) bot=true ;; esac
+          done
+          [ "$bot" = true ] || none "PR #$PR_NUMBER was opened by $author, a bot this repository does not trust"
+        else
+          permission="$(gh api "repos/$REPO/collaborators/$author/permission" --jq '.permission' 2>/dev/null || echo none)"
+          case "$permission" in
+            admin | maintain | write) ;;
+            *) none "PR #$PR_NUMBER was opened by $author, who has $permission access" ;;
+          esac
+        fi
+
         issue="$LINKED_ISSUE"
 
         if [ -z "$issue" ]; then
@@ -80,14 +110,16 @@ runs:
             grep -oE '[0-9]+' | head -n 1 || true)"
         fi
 
-        [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
-
-        if [ -n "$REQUIRE_LABEL" ]; then
-          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
-            --jq '[.labels[].name]')"
-
-          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
-            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
+        # An issue that is already closed is not the work this pull request is for: the feature
+        # landed some other way, and the label on a closed issue says nothing. Comments, labels
+        # and the acceptance criteria then come from the pull request itself. A pull request is
+        # never refused for lacking an issue: the merge train hands the gate every pull request
+        # that can move, and a gate that declines one without a trace is handed it again.
+        if [ -n "$issue" ]; then
+          issue_state="$(gh issue view "$issue" --repo "$REPO" --json state --jq '.state' 2>/dev/null || echo UNKNOWN)"
+          if [ "$issue_state" != OPEN ]; then
+            echo "Issue #$issue is $issue_state; gating the pull request on its own description."
+            issue=""
           fi
         fi
 
@@ -122,8 +154,11 @@ runs:
           echo "found=true"
           echo "pr=$PR_NUMBER"
           echo "issue=$issue"
+          echo "record=${issue:-$PR_NUMBER}"
+          echo "head-ref=$(jq -r '.headRefName' <<<"$pr")"
+          if [ -n "$issue" ]; then echo "closes=closes issue #$issue"; else echo "closes=closes no issue"; fi
           echo "conclusion=$ci_conclusion"
           echo "run-id=$ci_run_id"
         } >> "$GITHUB_OUTPUT"
 
-        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"
+        echo "PR #$PR_NUMBER by $author closes #${issue:-nothing}; CI concluded $ci_conclusion"

package/loops/actions/merge-train/action.yml

@@ -0,0 +1,71 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-train/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Merge train
+description: >-
+  Move the oldest open pull request that can move one step towards merging (update it from its
+  base, hand it to the merge gate, or approve its CI), and leave every other one alone.
+  Deterministic: no model runs here.
+
+inputs:
+  token:
+    description: App token. Its dispatches and branch updates must start workflows, which GITHUB_TOKEN's do not.
+    required: true
+  ci-workflow-name:
+    description: The CI workflow whose verdict the train reads.
+    required: true
+  trusted-bots:
+    description: Space-separated bot logins whose pull requests ride the train and whose CI runs it approves.
+    required: false
+    default: ''
+  hold-label:
+    description: A pull request carrying this label stays off the train.
+    required: false
+    default: hold
+  max-gate-attempts:
+    description: Failed gate attempts on one head before the train stops dispatching it.
+    required: false
+    default: '6'
+  max-retries:
+    description: How many times a blocked verdict, or a merge that did not happen, is retried after the base branch moves.
+    required: false
+    default: '3'
+  max-repairs:
+    description: How many pull requests may be in repair at once. Merges stay one at a time.
+    required: false
+    default: '1'
+  stuck-hours:
+    description: How long the train waits behind a CI run that never finishes before it passes that pull request by.
+    required: false
+    default: '3'
+  dry-run:
+    description: Decide and report the move without making it.
+    required: false
+    default: 'false'
+  ci-run-id:
+    description: A CI run that handed its verdict over from inside itself, and so still reads as in progress.
+    required: false
+    default: ''
+  ci-conclusion:
+    description: That run's verdict, success or failure, which stands in for its conclusion.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Move the train
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        CI_WORKFLOW_NAME: ${{ inputs.ci-workflow-name }}
+        TRUSTED_BOTS: ${{ inputs.trusted-bots }}
+        HOLD_LABEL: ${{ inputs.hold-label }}
+        MAX_ATTEMPTS: ${{ inputs.max-gate-attempts }}
+        MAX_RETRIES: ${{ inputs.max-retries }}
+        STUCK_HOURS: ${{ inputs.stuck-hours }}
+        MAX_REPAIRS: ${{ inputs.max-repairs }}
+        DRY_RUN: ${{ inputs.dry-run }}
+        HINT_RUN_ID: ${{ inputs.ci-run-id }}
+        HINT_CONCLUSION: ${{ inputs.ci-conclusion }}
+      run: bash "${GITHUB_ACTION_PATH}/merge-train.sh"