jules-orchestrator-kit 0.74.0 → 0.75.1

package/src/ci-templates.mjs

@@ -149,51 +149,214 @@ ${extraSteps ? extraSteps + "\n" : ""}
 }
 
 /**
- * Write the generated workflow, refusing to clobber an existing file unless
+ * Generate a workflow_run auto-merge workflow for GitHub Actions that safely
+ * merges qualifying green PRs opened by authorized automation bots.
+ *
+ * Implements a strict trust boundary:
+ * - Executes exclusively on the base branch (default `main`)
+ * - Evaluates PR commits strictly as unexecuted data (fetch + git diff)
+ * - Verifies the bot actor against authorized identities (default `google-labs-jules[bot]`)
+ * - Merges cleanly via `gh pr merge --squash --delete-branch`
+ *
+ * @param {object} opts
+ * @param {object} [opts.config]
+ * @param {string} [opts.version]
+ * @param {string[]} [opts.allowedActors]
+ * @returns {{ file: string, content: string }}
+ */
+export function buildAutoMergeWorkflow(opts = {}) {
+  const base = opts.config?.baseBranch || opts.baseBranch || "main";
+  const version = opts.version || "0";
+  const defaultActors = ["google-labs-jules[bot]", "github-actions[bot]"];
+  const allowedActors = opts.allowedActors || defaultActors;
+  const actorCases = allowedActors.map((a) => `"${a}"`).join("|");
+
+  const content = `# Generated by jules-orchestrator-kit v${version}.
+#
+# Auto-merge verified pull requests opened by authorized automation bots.
+#
+# TRUST BOUNDARY ARCHITECTURE:
+#   For pull requests from repository branches, GitHub Actions runs
+#   'on: pull_request' workflows from the PR branch head. A pull request can
+#   therefore supply its own modified workflow code.
+#
+#   This workflow runs on 'workflow_run' after 'Agent Safety Gate' completes.
+#   It executes STRICTLY from the default branch (${base}), ensuring that:
+#   1. It only runs code, scripts, and policies committed to ${base}.
+#   2. The pull request commits are fetched strictly as unexecuted data.
+#   3. Privileged write tokens are never exposed to the untrusted PR branch.
+#
+# Regenerate with: agentctl ci init --with-automerge --force
+
+name: Agent Auto-Merge
+
+on:
+  workflow_run:
+    workflows: ["Agent Safety Gate"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agent-automerge-\${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: false
+
+jobs:
+  automerge:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+      REPO: \${{ github.repository }}
+      HEAD_SHA: \${{ github.event.workflow_run.head_sha }}
+      ACTOR: \${{ github.event.workflow_run.actor.login }}
+    steps:
+      - name: Checkout base revision (${base})
+        uses: actions/checkout@v4
+        with:
+          ref: ${base}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify authorized automation actor
+        run: |
+          set -euo pipefail
+          case "$ACTOR" in
+            ${actorCases})
+              echo "Authorized automation actor: $ACTOR"
+              ;;
+            *)
+              echo "Actor '$ACTOR' is not an authorized automation bot; leaving PR for human review."
+              exit 0
+              ;;
+          esac
+
+      - id: pr
+        name: Resolve Pull Request
+        run: |
+          set -euo pipefail
+          num=$(gh pr list --repo "$REPO" --state open --base "${base}" \\
+                  --json number,headRefOid \\
+                  --jq "[.[] | select(.headRefOid == \\"$HEAD_SHA\\")] | .[0].number // empty")
+          if [ -z "$num" ]; then
+            echo "No open PR found for head SHA $HEAD_SHA; nothing to merge."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "Resolved PR #$num for $HEAD_SHA"
+          echo "number=$num" >> "$GITHUB_OUTPUT"
+          echo "found=true" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch PR commits as untrusted data
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin "+$HEAD_SHA:refs/pr-head"
+
+      - name: Set up Node.js
+        if: steps.pr.outputs.found == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Verify safety gate from base
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          npx --yes jules-orchestrator-kit check --mode committed --base "${base}"
+
+      - name: Squash and merge pull request
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          gh pr merge --squash --delete-branch "\${{ steps.pr.outputs.number }}" --repo "$REPO"
+`;
+
+  return { file: ".github/workflows/agent-automerge.yml", content };
+}
+
+/**
+ * Write the generated workflow(s), refusing to clobber existing files unless
  * asked.
  *
  * @param {string} root
- * @param {object} [opts] - see {@link buildCiWorkflow}, plus `force` and `dryRun`
- * @returns {{ ok: boolean, file?: string, written?: boolean, stack?: string, setupSummary?: string, content?: string, error?: string }}
+ * @param {object} [opts] - see {@link buildCiWorkflow}, plus `force`, `dryRun`, and `withAutomerge`
+ * @returns {{ ok: boolean, file?: string, files?: string[], written?: boolean, stack?: string, setupSummary?: string, content?: string, error?: string }}
  */
 export function writeCiWorkflow(root, opts = {}) {
+  const target = CI_TARGETS.includes(opts.target) ? opts.target : (opts.target ? opts.target : "github");
   if (opts.target && !CI_TARGETS.includes(opts.target)) {
     return { ok: false, error: `Unknown CI target '${opts.target}'. Choose one of: ${CI_TARGETS.join(", ")}` };
   }
 
+  const withAutomerge = Boolean(opts.withAutomerge || opts["with-automerge"]);
+  if (withAutomerge && target !== "github") {
+    return { ok: false, error: "Auto-merge workflow is currently only supported for GitHub Actions." };
+  }
+
   const built = buildCiWorkflow(opts);
   const stackId = opts.stack?.stack || "unknown";
-  const abs = join(root, built.file);
+  const itemsToWrite = [built];
 
-  if (opts.dryRun) {
-    return { ok: true, file: built.file, written: false, stack: stackId, setupSummary: built.setupSummary, content: built.content };
+  if (withAutomerge) {
+    itemsToWrite.push(buildAutoMergeWorkflow(opts));
   }
 
-  if (existsSync(abs) && !opts.force) {
-    let identical = false;
-    try {
-      identical = readFileSync(abs, "utf-8") === built.content;
-    } catch (_) {
-      // Unreadable target: treat as different so the caller is told to --force
-      // rather than being told nothing changed.
-    }
+  const files = itemsToWrite.map((item) => item.file);
+
+  if (opts.dryRun) {
     return {
       ok: true,
       file: built.file,
+      files,
       written: false,
-      identical,
       stack: stackId,
       setupSummary: built.setupSummary,
       content: built.content,
+      workflows: itemsToWrite,
     };
   }
 
-  try {
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, built.content, "utf-8");
-  } catch (err) {
-    return { ok: false, error: `Could not write ${built.file}: ${err.message}` };
+  let allWritten = true;
+  let allIdentical = true;
+  for (const item of itemsToWrite) {
+    const abs = join(root, item.file);
+    if (existsSync(abs) && !opts.force) {
+      let identical = false;
+      try {
+        identical = readFileSync(abs, "utf-8") === item.content;
+      } catch (_) {
+        // Unreadable target: treat as different so the caller is told to --force
+        // rather than being told nothing changed.
+      }
+      if (!identical) {
+        allIdentical = false;
+      }
+      allWritten = false;
+      continue;
+    }
+
+    try {
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, item.content, "utf-8");
+    } catch (err) {
+      return { ok: false, error: `Could not write ${item.file}: ${err.message}` };
+    }
   }
 
-  return { ok: true, file: built.file, written: true, stack: stackId, setupSummary: built.setupSummary, content: built.content };
+  return {
+    ok: true,
+    file: built.file,
+    files,
+    written: allWritten,
+    identical: allWritten ? false : allIdentical,
+    stack: stackId,
+    setupSummary: built.setupSummary,
+    content: built.content,
+  };
 }

package/src/config.mjs

@@ -34,7 +34,7 @@ const DEFAULTS = {
 // use: an identical exfiltration job placed in `.gitlab-ci.yml` was approved
 // where `.github/workflows/x.yml` was rejected. A safety gate that is only
 // safe on GitHub is not a safety gate.
-const CI_DEFINITIONS = [
+export const CI_DEFINITIONS = [
   ".github/**",
   ".gitlab-ci.yml",
   "**/.gitlab-ci.yml",
@@ -1019,9 +1019,11 @@ export function resolveTrustedPolicy(root = process.cwd(), baseRef = null, mode
 
   let trustedConfigRaw = null;
   let trustedJulesRaw = null;
+  let trustedProtectedRaw = null;
   try {
     trustedConfigRaw = showFromOrigin(root, base, ".agent/config.yml");
     trustedJulesRaw = showFromOrigin(root, base, ".agent/jules.yml");
+    trustedProtectedRaw = showFromOrigin(root, base, ".agent/protected-paths.json");
   } catch (_) {
     // If base branch cannot be resolved or show fails, let changedFiles report code 1
   }
@@ -1035,7 +1037,21 @@ export function resolveTrustedPolicy(root = process.cwd(), baseRef = null, mode
       if (raw) parsed = parseYaml(raw) || {};
     } catch (_) {}
 
+    let trustedProtectedPaths = [];
+    if (trustedProtectedRaw) {
+      try {
+        const parsedProtected = JSON.parse(trustedProtectedRaw);
+        if (Array.isArray(parsedProtected.protected)) {
+          trustedProtectedPaths = parsedProtected.protected.filter((p) => typeof p === "string" && p);
+        }
+      } catch (_) {}
+    }
+
     const trustedScope = normalizeScope(parsed);
+    if (trustedProtectedPaths.length > 0) {
+      trustedScope.protect = dedupe([...trustedScope.protect, ...trustedProtectedPaths]);
+      trustedScope.protectedPatterns = trustedProtectedPaths;
+    }
     const trustedDiffKb = Number(parsed.limits?.diff_kb || parsed.limits?.diffKb) || 75;
 
     const rawSetup = parsed.setup_cmd ?? parsed.verify?.setup;
@@ -1100,6 +1116,7 @@ export function resolveTrustedPolicy(root = process.cwd(), baseRef = null, mode
   // Inspect any proposed scaffold in this change (F06)
   let proposedConfig = null;
   let proposedJules = null;
+  let proposedProtectedPaths = [];
 
   try {
     if (mode === "committed") {
@@ -1107,11 +1124,29 @@ export function resolveTrustedPolicy(root = process.cwd(), baseRef = null, mode
       if (c) proposedConfig = parseYaml(c);
       const j = showFromOrigin(root, "HEAD", ".agent/jules.yml");
       if (j) proposedJules = parseYaml(j);
+      const p = showFromOrigin(root, "HEAD", ".agent/protected-paths.json");
+      if (p) {
+        try {
+          const parsedP = JSON.parse(p);
+          if (Array.isArray(parsedP.protected)) {
+            proposedProtectedPaths = parsedP.protected.filter((x) => typeof x === "string" && x);
+          }
+        } catch (_) {}
+      }
     } else {
       const configPath = join(root, ".agent/config.yml");
       if (existsSync(configPath)) proposedConfig = parseYaml(readFileSync(configPath, "utf-8"));
       const julesPath = join(root, ".agent/jules.yml");
       if (existsSync(julesPath)) proposedJules = parseYaml(readFileSync(julesPath, "utf-8"));
+      const protectedPath = join(root, ".agent/protected-paths.json");
+      if (existsSync(protectedPath)) {
+        try {
+          const parsedP = JSON.parse(readFileSync(protectedPath, "utf-8"));
+          if (Array.isArray(parsedP.protected)) {
+            proposedProtectedPaths = parsedP.protected.filter((x) => typeof x === "string" && x);
+          }
+        } catch (_) {}
+      }
     }
   } catch (_) {}
 
@@ -1182,6 +1217,10 @@ export function resolveTrustedPolicy(root = process.cwd(), baseRef = null, mode
 
   const stages = explicitStages ?? profilePlan?.stages ?? null;
   const trustedScope = normalizeScope(pConfig);
+  if (proposedProtectedPaths.length > 0) {
+    trustedScope.protect = dedupe([...trustedScope.protect, ...proposedProtectedPaths]);
+    trustedScope.protectedPatterns = proposedProtectedPaths;
+  }
   const trustedLimits = {
     diffKb: Number(pConfig.limits?.diff_kb || pConfig.limits?.diffKb) || 75,
   };