@sweny-ai/core 0.1.167 → 0.1.168

package/dist/cli/main.js

@@ -93,6 +93,7 @@ program
     .description("Create a new workflow. With no id, opens the interactive picker. With an id, uses that built-in template.")
     .option("--template <id>", "Use a built-in template without the picker")
     .option("-y, --yes", "Skip every prompt (never overwrites existing files)")
+    .option("--no-ci", "Do not write a pack's GitHub Actions trigger to .github/workflows/")
     .action(async (id, options) => {
     // Prompts need a terminal. Without one (CI, pipes), a prompt never
     // settles, so print usage and exit 2 instead of hanging.
@@ -100,7 +101,7 @@ program
         console.error(nonInteractiveUsage());
         process.exit(2);
     }
-    await runNew({ marketplaceId: id, template: options.template, yes: options.yes });
+    await runNew({ marketplaceId: id, template: options.template, yes: options.yes, ci: options.ci });
 });
 // ── sweny try ─────────────────────────────────────────────────────────
 registerTryCommand(program);

package/dist/cli/new.d.ts

@@ -7,6 +7,7 @@
  * Pure functions for file generation + thin @clack/prompts interactive layer.
  * Tests cover the pure functions; the interactive wizard is thin glue.
  */
+import { type WorkflowTemplate } from "./templates.js";
 import { type Skill } from "../types.js";
 export interface Credential {
     key: string;
@@ -113,6 +114,18 @@ export declare function writeSwenyYmlIfMissing(cwd: string, sourceControl: strin
 /** Append credential keys to .env that aren't already present. Returns count appended. */
 export declare function appendMissingEnvKeys(cwd: string, credentials: Credential[]): number;
 /** Write workflow YAML into .sweny/workflows/<id>.yml. Returns info about what happened. */
+/** Where a pack's GitHub Actions trigger is written: `.github/workflows/sweny-<pack>.yml`. */
+export declare function packTriggerPath(id: string): string;
+/**
+ * Write a pack's Actions trigger (#474). Never overwrites: an existing file is
+ * left exactly as it is. Returns `skipped` for a template that is not a pack.
+ */
+export declare function writePackTrigger(cwd: string, template: WorkflowTemplate): {
+    written: boolean;
+    exists?: boolean;
+    skipped?: boolean;
+    path: string;
+};
 export declare function writeWorkflowFile(cwd: string, id: string, yaml: string, options?: {
     overwrite?: boolean;
 }): {
@@ -153,6 +166,8 @@ export declare function runNew(options?: {
     template?: string;
     /** Skip every confirmation prompt (never overwrites existing files). */
     yes?: boolean;
+    /** `false` (`--no-ci`) skips writing a pack's GitHub Actions trigger file. */
+    ci?: boolean;
     /** Internal: the id came from the marketplace picker, skip the built-in shortcut. */
     forceMarketplace?: boolean;
 }): Promise<void>;

package/dist/cli/new.js

@@ -431,6 +431,24 @@ export function appendMissingEnvKeys(cwd, credentials) {
     return newKeys.length;
 }
 /** Write workflow YAML into .sweny/workflows/<id>.yml. Returns info about what happened. */
+/** Where a pack's GitHub Actions trigger is written: `.github/workflows/sweny-<pack>.yml`. */
+export function packTriggerPath(id) {
+    return path.join(".github", "workflows", `sweny-${id}.yml`);
+}
+/**
+ * Write a pack's Actions trigger (#474). Never overwrites: an existing file is
+ * left exactly as it is. Returns `skipped` for a template that is not a pack.
+ */
+export function writePackTrigger(cwd, template) {
+    const target = path.join(cwd, packTriggerPath(template.id));
+    if (!template.pack)
+        return { written: false, skipped: true, path: target };
+    if (fs.existsSync(target))
+        return { written: false, exists: true, path: target };
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, template.pack.trigger, "utf-8");
+    return { written: true, path: target };
+}
 export function writeWorkflowFile(cwd, id, yaml, options) {
     const dir = path.join(cwd, ".sweny", "workflows");
     fs.mkdirSync(dir, { recursive: true });
@@ -522,7 +540,12 @@ export async function runNew(options) {
     // so it works with no network. Only other ids go to the marketplace.
     if (options?.marketplaceId && options.marketplaceId !== "e2e" && !options.forceMarketplace) {
         if (WORKFLOW_TEMPLATES.some((t) => t.id === options.marketplaceId)) {
-            return runNew({ template: options.marketplaceId, skipIntro: options.skipIntro, yes: options.yes });
+            return runNew({
+                template: options.marketplaceId,
+                skipIntro: options.skipIntro,
+                yes: options.yes,
+                ci: options.ci,
+            });
         }
     }
     if (options?.template && !WORKFLOW_TEMPLATES.some((t) => t.id === options.template)) {
@@ -700,6 +723,9 @@ export async function runNew(options) {
         files.push(".sweny.yml", ".env");
     if (template)
         files.push(`.sweny/workflows/${template.id}.yml`);
+    const writeTrigger = !!template?.pack && options?.ci !== false;
+    if (template && writeTrigger)
+        files.push(packTriggerPath(template.id));
     const inferred = [
         `  Source control:  ${sourceControl}${gitInfo ? " (detected)" : ""}`,
         `  Issue tracker:   ${issueTracker}`,
@@ -759,11 +785,22 @@ export async function runNew(options) {
     else {
         p.log.info(".env already contains all required keys — skipped");
     }
+    // The pack's Actions trigger (#474): never overwritten, skipped with --no-ci.
+    const installTrigger = () => {
+        if (!template || !writeTrigger)
+            return;
+        const r = writePackTrigger(cwd, template);
+        if (r.written)
+            p.log.success(`Created ${packTriggerPath(template.id)}`);
+        else if (r.exists)
+            p.log.info(`${packTriggerPath(template.id)} already exists, not overwritten`);
+    };
     // 3. Workflow template
     if (template) {
         const firstAttempt = writeWorkflowFile(cwd, template.id, template.yaml, { overwrite: false });
         if (firstAttempt.exists && options?.yes) {
             p.log.info(`.sweny/workflows/${template.id}.yml already exists, not overwritten`);
+            installTrigger();
             p.outro("Done.");
             return;
         }
@@ -782,6 +819,7 @@ export async function runNew(options) {
             writeWorkflowFile(cwd, template.id, template.yaml, { overwrite: true });
         }
         p.log.success(`Created .sweny/workflows/${template.id}.yml`);
+        installTrigger();
     }
     // 4. Keep .env out of version control
     const ignoreResult = ensureGitignoreEnv(cwd);
@@ -801,7 +839,10 @@ export async function runNew(options) {
     }
     if (template) {
         steps.push(`${stepNum++}. Run your workflow:`, `   ${cli} workflow run .sweny/workflows/${template.id}.yml`);
-        if (template.pack) {
+        if (template.pack && writeTrigger) {
+            steps.push("", `${stepNum++}. Run it automatically: add the CLAUDE_CODE_OAUTH_TOKEN repo secret, then commit`, `   .sweny/workflows/${template.id}.yml and ${packTriggerPath(template.id)}`, `   https://docs.sweny.ai/workflows/packs/#${template.id}`);
+        }
+        else if (template.pack) {
             steps.push("", `${stepNum++}. Run it automatically (GitHub Actions trigger and permissions):`, `   https://docs.sweny.ai/workflows/packs/#${template.id}`);
         }
     }

package/dist/cli/packs.js

@@ -336,11 +336,45 @@ nodes:
             - github_add_comment
             - github_create_issue
 
+
+  quiet:
+    name: Nothing to Report
+    instruction: |
+      The week had no commits, merged PRs, or issues opened or closed, so there is nothing worth a digest. Do not call any tool and deliver nothing. Return
+      delivered false and one short sentence saying why.
+    permissions: read
+    max_turns: 2
+    output:
+      type: object
+      properties:
+        delivered:
+          type: boolean
+        reason:
+          type: string
+      required: [delivered, reason]
+    eval:
+      - name: quiet_delivers_nothing
+        kind: function
+        rule:
+          no_tool_called:
+            - github_create_issue
+            - github_add_comment
+            - github_create_pr
+            - slack_send_message
+            - notify_webhook
+
+# Quiet weeks (#474): sweny decides on the counts, with no model call. A week
+# with any activity is delivered; an empty one routes to quiet and nothing is
+# sent, so the digest is never noise.
 edges:
   - from: collect
     to: analyze
   - from: analyze
     to: publish
+    when:
+      expr: "analyze.stats.commits > 0 || analyze.stats.prs_merged > 0 || analyze.stats.issues_opened > 0 || analyze.stats.issues_closed > 0"
+  - from: analyze
+    to: quiet
 `;
 const DIGEST_TRIGGER = `name: SWEny weekly digest
 on:
@@ -350,19 +384,21 @@ on:
 
 permissions:
   contents: read
-  issues: write # only needed for deliver: issue
+  issues: write # deliver: issue, and the failure alert
 
 jobs:
   digest:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: swenyai/sweny@v5
         with:
           workflow: .sweny/workflows/weekly-digest.yml
+          notify-on-failure: issue # one sticky issue, only when a run fails
           claude-oauth-token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           input: '{"repo": "\${{ github.repository }}"}'
           # input: '{"repo": "\${{ github.repository }}", "days": 7, "deliver": "slack"}'
@@ -680,6 +716,35 @@ nodes:
             - path: result
               in: [created, updated, unchanged, none]
 
+
+  quiet:
+    name: Nothing to Report
+    instruction: |
+      Nothing actionable: no advisory at or above the severity floor and no lockfile drift. Do not call any tool and deliver nothing. Return
+      delivered false and one short sentence saying why.
+    permissions: read
+    max_turns: 2
+    output:
+      type: object
+      properties:
+        delivered:
+          type: boolean
+        reason:
+          type: string
+      required: [delivered, reason]
+    eval:
+      - name: quiet_delivers_nothing
+        kind: function
+        rule:
+          no_tool_called:
+            - github_create_issue
+            - github_add_comment
+            - github_create_pr
+            - slack_send_message
+            - notify_webhook
+
+# Quiet weeks (#474): sweny routes on the action, with no model call. Nothing
+# actionable skips the issue step, so a clean week files and posts nothing.
 edges:
   - from: inventory
     to: advisories
@@ -687,6 +752,10 @@ edges:
     to: assess
   - from: assess
     to: file-issue
+    when:
+      expr: "assess.action == 'file'"
+  - from: assess
+    to: quiet
 `;
 const DRIFT_TRIGGER = `name: SWEny dependency drift
 on:
@@ -703,10 +772,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: swenyai/sweny@v5
         with:
           workflow: .sweny/workflows/dependency-drift.yml
+          notify-on-failure: issue # one sticky issue, only when a run fails
           claude-oauth-token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           input: '{"repo": "\${{ github.repository }}"}'
         env:
@@ -994,7 +1066,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: swenyai/sweny@v5
         with:
           workflow: .sweny/workflows/pr-risk-review.yml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.167",
+  "version": "0.1.168",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"