takos-control 1.0.0

package/src/adapters/workflow-binding.ts

@@ -0,0 +1,131 @@
+/**
+ * Non-Cloudflare implementation of the Workflow binding.
+ *
+ * Stores workflow instance state in the database (D1/PostgreSQL).
+ * This provides the API surface for `env.MY_WORKFLOW.create()` and
+ * instance lifecycle methods. Actual step execution is NOT implemented
+ * in this adapter — instances are created with status 'queued' and
+ * must be processed by an external runner.
+ */
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+export interface WorkflowInstance {
+  id: string;
+  pause(): Promise<void>;
+  resume(): Promise<void>;
+  terminate(): Promise<void>;
+  restart(): Promise<void>;
+  status(): Promise<WorkflowInstanceStatus>;
+}
+
+export interface WorkflowInstanceStatus {
+  status: 'queued' | 'running' | 'paused' | 'completed' | 'errored' | 'terminated';
+  output?: unknown;
+  error?: string;
+}
+
+export interface WorkflowBinding {
+  create(options?: { id?: string; params?: unknown }): Promise<WorkflowInstance>;
+  get(id: string): Promise<WorkflowInstance>;
+}
+
+// Minimal DB interface (compatible with D1Database and PostgreSQL adapter)
+interface DbLike {
+  prepare(query: string): {
+    bind(...values: unknown[]): {
+      first<T = Record<string, unknown>>(): Promise<T | null>;
+      run(): Promise<unknown>;
+    };
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+
+export type WorkflowBindingConfig = {
+  db: DbLike;
+  serviceId: string;
+  workflowName: string;
+};
+
+export function createWorkflowBinding(config: WorkflowBindingConfig): WorkflowBinding {
+  const { db, serviceId, workflowName } = config;
+
+  function makeInstance(id: string): WorkflowInstance {
+    return {
+      id,
+      async pause() {
+        await db.prepare(
+          'UPDATE tenant_workflow_instances SET status = ?, updated_at = ? WHERE id = ? AND status = ?',
+        ).bind('paused', new Date().toISOString(), id, 'running').run();
+      },
+      async resume() {
+        await db.prepare(
+          'UPDATE tenant_workflow_instances SET status = ?, updated_at = ? WHERE id = ? AND status = ?',
+        ).bind('queued', new Date().toISOString(), id, 'paused').run();
+      },
+      async terminate() {
+        await db.prepare(
+          'UPDATE tenant_workflow_instances SET status = ?, updated_at = ? WHERE id = ?',
+        ).bind('terminated', new Date().toISOString(), id).run();
+      },
+      async restart() {
+        await db.prepare(
+          'UPDATE tenant_workflow_instances SET status = ?, output = NULL, error = NULL, updated_at = ? WHERE id = ?',
+        ).bind('queued', new Date().toISOString(), id).run();
+      },
+      async status(): Promise<WorkflowInstanceStatus> {
+        const row = await db.prepare(
+          'SELECT status, output, error FROM tenant_workflow_instances WHERE id = ?',
+        ).bind(id).first<{ status: string; output: string | null; error: string | null }>();
+
+        if (!row) {
+          throw new Error(`Workflow instance ${id} not found`);
+        }
+
+        return {
+          status: row.status as WorkflowInstanceStatus['status'],
+          ...(row.output ? { output: JSON.parse(row.output) } : {}),
+          ...(row.error ? { error: row.error } : {}),
+        };
+      },
+    };
+  }
+
+  return {
+    async create(options?: { id?: string; params?: unknown }): Promise<WorkflowInstance> {
+      const id = options?.id ?? crypto.randomUUID();
+      const now = new Date().toISOString();
+
+      await db.prepare(
+        'INSERT INTO tenant_workflow_instances (id, service_id, workflow_name, params, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)',
+      ).bind(
+        id,
+        serviceId,
+        workflowName,
+        options?.params !== undefined ? JSON.stringify(options.params) : null,
+        'queued',
+        now,
+        now,
+      ).run();
+
+      return makeInstance(id);
+    },
+
+    async get(id: string): Promise<WorkflowInstance> {
+      const row = await db.prepare(
+        'SELECT id FROM tenant_workflow_instances WHERE id = ?',
+      ).bind(id).first<{ id: string }>();
+
+      if (!row) {
+        throw new Error(`Workflow instance ${id} not found`);
+      }
+
+      return makeInstance(id);
+    },
+  };
+}

package/src/application/services/actions/actions-env.ts

@@ -0,0 +1,49 @@
+import type { Job, Workflow } from 'takos-actions-engine';
+
+export interface WorkflowDispatchEnvOptions {
+  workflow: Workflow;
+  workflowPath: string;
+  repoId: string;
+  runId: string;
+  ref: string;
+  sha: string;
+  jobKey: string;
+  jobId: string;
+  jobDefinition: Job;
+}
+
+/**
+ * Build base environment passed from control plane to runtime job.
+ *
+ * Runtime will still inject authoritative values (workspace path, runner paths),
+ * but we include workflow-level env and GitHub context defaults here so the
+ * queue payload is self-contained and deterministic.
+ */
+export function buildWorkflowDispatchEnv(options: WorkflowDispatchEnvOptions): Record<string, string> {
+  const {
+    workflow,
+    workflowPath,
+    repoId,
+    runId,
+    ref,
+    sha,
+    jobKey,
+    jobId,
+    jobDefinition,
+  } = options;
+
+  const workflowEnv = workflow.env || {};
+  const normalizedRef = ref.startsWith('refs/') ? ref : `refs/heads/${ref}`;
+
+  return {
+    ...workflowEnv,
+    CI: 'true',
+    GITHUB_ACTIONS: 'true',
+    GITHUB_REPOSITORY: repoId,
+    GITHUB_REF: normalizedRef,
+    GITHUB_SHA: sha,
+    GITHUB_JOB: jobDefinition.name || jobKey || jobId,
+    GITHUB_RUN_ID: runId,
+    GITHUB_WORKFLOW: workflowPath,
+  };
+}

package/src/application/services/actions/actions-execution.ts

@@ -0,0 +1,156 @@
+import type { Queue, D1Database } from '../../../shared/types/bindings.ts';
+import { createExecutionPlan, type Workflow, type Job } from 'takos-actions-engine';
+import { generateId } from '../../../shared/utils';
+import { getDb, workflowSecrets, workflowJobs, workflowSteps } from '../../../infra/db';
+import { eq } from 'drizzle-orm';
+import {
+  WORKFLOW_QUEUE_MESSAGE_VERSION,
+  type WorkflowJobDefinition,
+  type WorkflowJobQueueMessage,
+} from '../../../shared/types';
+import { buildWorkflowDispatchEnv } from './actions-env';
+import { logWarn } from '../../../shared/utils/logger';
+import { normalizeWorkflowShell, toWorkflowJobDefinition } from '../execution/workflow-engine-converters';
+
+export async function getWorkflowSecretIds(
+  db: D1Database,
+  repoId: string
+): Promise<string[]> {
+  const drizzle = getDb(db);
+  const secretRecords = await drizzle.select({ id: workflowSecrets.id }).from(workflowSecrets).where(eq(workflowSecrets.repoId, repoId)).all();
+  return secretRecords.map((s) => s.id);
+}
+
+export async function enqueueFirstPhaseJobs(options: {
+  queue?: Queue<WorkflowJobQueueMessage>;
+  workflow: Workflow;
+  workflowPath: string;
+  jobKeyToId: Map<string, string>;
+  repoId: string;
+  runId: string;
+  ref: string;
+  sha: string;
+  db: D1Database;
+}) {
+  const { queue, workflow, workflowPath, jobKeyToId, repoId, runId, ref, sha, db } = options;
+
+  if (!queue) {
+    logWarn('WORKFLOW_QUEUE not configured, workflow jobs will not be enqueued', { module: 'services/actions/actions-execution' });
+    return;
+  }
+
+  const plan = createExecutionPlan(workflow);
+  const firstPhaseJobs = plan.phases[0] || [];
+  const secretIds = await getWorkflowSecretIds(db, repoId);
+
+  for (const jobKey of firstPhaseJobs) {
+    const jobDef = workflow.jobs[jobKey] as Job | undefined;
+    if (!jobDef) continue;
+
+    const jobId = jobKeyToId.get(jobKey);
+    if (!jobId) continue;
+
+    const dispatchEnv = buildWorkflowDispatchEnv({
+      workflow,
+      workflowPath,
+      repoId,
+      runId,
+      ref,
+      sha,
+      jobKey,
+      jobId,
+      jobDefinition: jobDef,
+    });
+
+    const message: WorkflowJobQueueMessage = {
+      version: WORKFLOW_QUEUE_MESSAGE_VERSION,
+      type: 'job',
+      runId,
+      jobId,
+      repoId,
+      ref,
+      sha,
+      jobKey,
+      jobDefinition: toWorkflowJobDefinition(jobDef),
+      env: dispatchEnv,
+      secretIds,
+      timestamp: Date.now(),
+    };
+
+    await queue.send(message);
+  }
+}
+
+export async function createWorkflowJobs(options: {
+  db: D1Database;
+  runId: string;
+  workflow: Workflow;
+  timestamp: string;
+}) {
+  const { db, runId, workflow, timestamp } = options;
+  const drizzle = getDb(db);
+  const jobKeyToId = new Map<string, string>();
+
+  const jobDataList: {
+    id: string;
+    runId: string;
+    jobKey: string;
+    name: string;
+    status: string;
+    queuedAt: string;
+    createdAt: string;
+  }[] = [];
+
+  const stepDataList: {
+    id: string;
+    jobId: string;
+    number: number;
+    name: string;
+    status: string;
+    runCommand: string | null;
+    usesAction: string | null;
+    createdAt: string;
+  }[] = [];
+
+  for (const [jobKey, jobDef] of Object.entries(workflow.jobs)) {
+    const jobId = generateId();
+    const jobName = jobDef.name || jobKey;
+    jobKeyToId.set(jobKey, jobId);
+
+    jobDataList.push({
+      id: jobId,
+      runId,
+      jobKey,
+      name: jobName,
+      status: 'queued',
+      queuedAt: timestamp,
+      createdAt: timestamp,
+    });
+
+    for (let i = 0; i < jobDef.steps.length; i++) {
+      const step = jobDef.steps[i];
+      const stepId = generateId();
+      const stepName = step.name || step.uses || step.run?.slice(0, 50) || `Step ${i + 1}`;
+
+      stepDataList.push({
+        id: stepId,
+        jobId,
+        number: i + 1,
+        name: stepName,
+        status: 'pending',
+        runCommand: step.run || null,
+        usesAction: step.uses || null,
+        createdAt: timestamp,
+      });
+    }
+  }
+
+  if (jobDataList.length > 0) {
+    await drizzle.insert(workflowJobs).values(jobDataList);
+  }
+  if (stepDataList.length > 0) {
+    await drizzle.insert(workflowSteps).values(stepDataList);
+  }
+
+  return jobKeyToId;
+}

package/src/application/services/actions/actions-triggers.ts

@@ -0,0 +1,224 @@
+import type { D1Database, ExecutionContext, Queue, R2Bucket } from '../../../shared/types/bindings.ts';
+import { parseWorkflow, type BranchFilter, type PullRequestTriggerConfig, type Workflow, type WorkflowTrigger } from 'takos-actions-engine';
+import { getDb, pullRequests, repositories } from '../../../infra/db';
+import { eq, and } from 'drizzle-orm';
+import type { WorkflowJobQueueMessage } from '../../../shared/types';
+import * as gitStore from '../git-smart';
+import { createWorkflowEngine } from '../execution/workflow-engine';
+import { logError, logWarn } from '../../../shared/utils/logger';
+
+export type PullRequestWorkflowAction = 'opened' | 'edited' | 'closed' | 'synchronize';
+export interface PullRequestWorkflowEvent { action: PullRequestWorkflowAction; number: number; title: string; body?: string | null; state: 'open' | 'closed'; merged: boolean; mergedAt?: string | null; headRef: string; headSha?: string | null; baseRef: string; baseSha?: string | null; changedFiles?: string[]; authorId?: string | null; }
+export interface TriggerPullRequestWorkflowsOptions { db: D1Database; bucket?: R2Bucket; queue?: Queue<WorkflowJobQueueMessage>; encryptionKey?: string; repoId: string; repoName: string; defaultBranch: string; actorId: string; event: PullRequestWorkflowEvent; }
+export interface PullRequestWorkflowTriggerResult { triggeredRunIds: string[]; workflowPaths: string[]; }
+export interface TriggerPullRequestSynchronizeOptions { db: D1Database; bucket?: R2Bucket; queue?: Queue<WorkflowJobQueueMessage>; encryptionKey?: string; repoId: string; repoName: string; defaultBranch: string; actorId: string; headBranch: string; headSha?: string; changedFiles?: string[]; }
+export interface TriggerPushWorkflowsConfig { db: D1Database; bucket?: R2Bucket; queue?: Queue<WorkflowJobQueueMessage>; encryptionKey?: string; }
+export interface TriggerPushWorkflowsEvent { repoId: string; branch: string; before: string | null; after: string; actorId: string; actorName?: string | null; actorEmail?: string | null; }
+export interface PushWorkflowTriggerResult { triggeredRunIds: string[]; workflowPaths: string[]; }
+interface ResolvedRef { ref: string; sha: string; }
+interface WorkflowCandidate { path: string; workflow: Workflow; }
+
+function getTriggerConfig<K extends keyof WorkflowTrigger>(workflow: Workflow, eventName: K): WorkflowTrigger[K] | null | undefined {
+  const on = workflow.on;
+  if (typeof on === 'string') return on === eventName ? null : undefined;
+  if (Array.isArray(on)) return on.includes(eventName) ? null : undefined;
+  if (!on || typeof on !== 'object') return undefined;
+  if (!(eventName in on)) return undefined;
+  const trigger = on[eventName];
+  if (!trigger || typeof trigger !== 'object') return null;
+  return trigger;
+}
+
+async function parseWorkflowFiles(bucket: R2Bucket, commitSha: string): Promise<WorkflowCandidate[]> {
+  const commit = await gitStore.getCommitData(bucket, commitSha);
+  if (!commit) return [];
+  const entries = await gitStore.listDirectory(bucket, commit.tree, '.takos/workflows');
+  if (!entries) return [];
+  const candidates: WorkflowCandidate[] = [];
+  for (const entry of entries) {
+    if (entry.mode === gitStore.FILE_MODES.DIRECTORY) continue;
+    const lowerName = entry.name.toLowerCase();
+    if (!lowerName.endsWith('.yml') && !lowerName.endsWith('.yaml')) continue;
+    const path = `.takos/workflows/${entry.name}`;
+    const blob = await gitStore.getBlobAtPath(bucket, commit.tree, path);
+    if (!blob) continue;
+    const content = new TextDecoder().decode(blob);
+    const { workflow, diagnostics } = parseWorkflow(content);
+    if (diagnostics.some((d) => d.severity === 'error')) continue;
+    candidates.push({ path, workflow });
+  }
+  return candidates;
+}
+
+function matchesBranchAndPathFilters(config: BranchFilter, branch: string, changedFiles?: string[]): boolean {
+  if (!matchesBranchFilters(branch, config.branches, config['branches-ignore'])) return false;
+  if (!matchesPathFilters(changedFiles, config.paths, config['paths-ignore'])) return false;
+  return true;
+}
+
+export async function triggerPullRequestWorkflows(options: TriggerPullRequestWorkflowsOptions): Promise<PullRequestWorkflowTriggerResult> {
+  const result: PullRequestWorkflowTriggerResult = { triggeredRunIds: [], workflowPaths: [] };
+  if (!options.bucket) { logWarn('GIT_OBJECTS not configured, skipping pull_request workflow triggers', { module: 'services/actions/actions-triggers' }); return result; }
+  if (!options.queue) { logWarn('WORKFLOW_QUEUE not configured, skipping pull_request workflow triggers', { module: 'services/actions/actions-triggers' }); return result; }
+  const resolvedRef = await resolveRefForPullRequestEvent(options.db, options.repoId, options.defaultBranch, options.event);
+  if (!resolvedRef) { logWarn('No ref could be resolved for pull_request workflow trigger', { module: 'services/actions/actions-triggers', ...{ repoId: options.repoId, action: options.event.action, number: options.event.number } }); return result; }
+  const allWorkflows = await parseWorkflowFiles(options.bucket, resolvedRef.sha);
+  const candidates = allWorkflows.filter((c) => matchesPullRequestTrigger(c.workflow, options.event));
+  if (candidates.length === 0) return result;
+  const engine = createWorkflowEngine({ db: options.db, bucket: options.bucket, queue: options.queue });
+  const inputs = buildPullRequestRunInputs(options.repoId, options.repoName, options.defaultBranch, options.event);
+  for (const candidate of candidates) {
+    try {
+      const run = await engine.startRun({ repoId: options.repoId, workflowPath: candidate.path, event: 'pull_request', ref: resolvedRef.ref, sha: resolvedRef.sha, actorId: options.actorId, inputs });
+      result.triggeredRunIds.push(run.id); result.workflowPaths.push(candidate.path);
+    } catch (err) { logError(`Failed to start pull_request workflow ${candidate.path}`, err, { module: 'services/actions/actions-triggers' }); }
+  }
+  return result;
+}
+
+export async function triggerPullRequestSynchronizeForHeadUpdate(options: TriggerPullRequestSynchronizeOptions): Promise<PullRequestWorkflowTriggerResult[]> {
+  const db = getDb(options.db);
+  const prs = await db.select({ number: pullRequests.number, title: pullRequests.title, description: pullRequests.description, headBranch: pullRequests.headBranch, baseBranch: pullRequests.baseBranch, authorId: pullRequests.authorId })
+    .from(pullRequests).where(and(eq(pullRequests.repoId, options.repoId), eq(pullRequests.headBranch, options.headBranch), eq(pullRequests.status, 'open'))).all();
+  const results: PullRequestWorkflowTriggerResult[] = [];
+  for (const pr of prs) {
+    let baseSha: string | null = null;
+    try { baseSha = await gitStore.resolveRef(options.db, options.repoId, pr.baseBranch); } catch (err) { logError(`Failed to resolve base ref for PR #${pr.number}`, err, { module: 'services/actions/actions-triggers' }); }
+    const triggerResult = await triggerPullRequestWorkflows({
+      db: options.db, bucket: options.bucket, queue: options.queue, encryptionKey: options.encryptionKey,
+      repoId: options.repoId, repoName: options.repoName, defaultBranch: options.defaultBranch, actorId: options.actorId,
+      event: { action: 'synchronize', number: pr.number, title: pr.title, body: pr.description, state: 'open', merged: false, headRef: pr.headBranch, headSha: options.headSha, baseRef: pr.baseBranch, baseSha: baseSha ?? undefined, changedFiles: options.changedFiles, authorId: pr.authorId },
+    });
+    results.push(triggerResult);
+  }
+  return results;
+}
+
+async function resolveRefForPullRequestEvent(d1: D1Database, repoId: string, defaultBranch: string, event: PullRequestWorkflowEvent): Promise<ResolvedRef | null> {
+  const candidateRefs = uniqueRefs([event.baseRef, defaultBranch]);
+  for (const ref of candidateRefs) {
+    const resolvedSha = await gitStore.resolveRef(d1, repoId, ref);
+    if (!resolvedSha) continue;
+    if (ref === event.baseRef && event.baseSha) return { ref, sha: event.baseSha };
+    return { ref, sha: resolvedSha };
+  }
+  return null;
+}
+
+function matchesPullRequestTrigger(workflow: Workflow, event: PullRequestWorkflowEvent): boolean {
+  const triggerConfig = getTriggerConfig(workflow, 'pull_request');
+  if (triggerConfig === undefined) return false;
+  if (triggerConfig === null) return true;
+  const config = triggerConfig as PullRequestTriggerConfig;
+  if (Array.isArray(config.types) && config.types.length > 0 && !config.types.includes(event.action)) return false;
+  return matchesBranchAndPathFilters(config, event.baseRef, event.changedFiles);
+}
+
+function buildPullRequestRunInputs(repoId: string, repoName: string, defaultBranch: string, event: PullRequestWorkflowEvent): Record<string, unknown> {
+  return {
+    action: event.action, number: event.number, title: event.title, body: event.body || '', state: event.state, merged: event.merged, merged_at: event.mergedAt || null,
+    head_ref: event.headRef, head_sha: event.headSha || null, base_ref: event.baseRef, base_sha: event.baseSha || null, changed_files: event.changedFiles || [],
+    pull_request: { number: event.number, title: event.title, body: event.body || '', state: event.state, merged: event.merged, merged_at: event.mergedAt || null, head: { ref: event.headRef, sha: event.headSha || null }, base: { ref: event.baseRef, sha: event.baseSha || null }, user: { id: event.authorId || null } },
+    repository: { id: repoId, name: repoName, full_name: `${repoId}/${repoName}`, default_branch: defaultBranch },
+  };
+}
+
+function normalizePushBranchRef(ref: string): string { return ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref; }
+
+async function computePushChangedFiles(bucket: R2Bucket, afterSha: string, beforeSha: string | null): Promise<string[]> {
+  const afterCommit = await gitStore.getCommitData(bucket, afterSha);
+  if (!afterCommit) return [];
+  const afterFiles = await gitStore.flattenTree(bucket, afterCommit.tree);
+  if (!beforeSha) return afterFiles.map((file) => file.path).sort((a, b) => a.localeCompare(b));
+  const beforeCommit = await gitStore.getCommitData(bucket, beforeSha);
+  if (!beforeCommit) return afterFiles.map((file) => file.path).sort((a, b) => a.localeCompare(b));
+  const beforeFiles = await gitStore.flattenTree(bucket, beforeCommit.tree);
+  const beforeMap = new Map(beforeFiles.map((file) => [file.path, file.sha]));
+  const afterMap = new Map(afterFiles.map((file) => [file.path, file.sha]));
+  const changed = new Set<string>();
+  for (const [path, oid] of afterMap) { if (!beforeMap.has(path) || beforeMap.get(path) !== oid) changed.add(path); }
+  for (const path of beforeMap.keys()) { if (!afterMap.has(path)) changed.add(path); }
+  return Array.from(changed).sort((a, b) => a.localeCompare(b));
+}
+
+function matchesPushTrigger(workflow: Workflow, branch: string, changedFiles: string[]): boolean {
+  const triggerConfig = getTriggerConfig(workflow, 'push');
+  if (triggerConfig === undefined) return false;
+  if (triggerConfig === null) return true;
+  const config = triggerConfig as BranchFilter;
+  if ((!Array.isArray(config.branches) || config.branches.length === 0) && Array.isArray(config.tags) && config.tags.length > 0) return false;
+  return matchesBranchAndPathFilters(config, branch, changedFiles);
+}
+
+export async function triggerPushWorkflows(config: TriggerPushWorkflowsConfig, event: TriggerPushWorkflowsEvent): Promise<PushWorkflowTriggerResult> {
+  const result: PushWorkflowTriggerResult = { triggeredRunIds: [], workflowPaths: [] };
+  if (!config.bucket || !config.queue) return result;
+  const branch = normalizePushBranchRef(event.branch);
+  const resolvedAfterSha = await gitStore.resolveRef(config.db, event.repoId, branch) || event.after;
+  const changedFiles = await computePushChangedFiles(config.bucket, resolvedAfterSha, event.before);
+  const allWorkflows = await parseWorkflowFiles(config.bucket, resolvedAfterSha);
+  const candidates = allWorkflows.filter((c) => matchesPushTrigger(c.workflow, branch, changedFiles));
+  if (candidates.length === 0) { await triggerPullRequestSynchronizeFromPush({ config, event, branch, afterSha: resolvedAfterSha, changedFiles }); return result; }
+  const engine = createWorkflowEngine({ db: config.db, bucket: config.bucket, queue: config.queue });
+  const pushInputs: Record<string, unknown> = {
+    event_name: 'push', ref: `refs/heads/${branch}`, branch, before: event.before, after: resolvedAfterSha, created: event.before === null, deleted: false, forced: false,
+    repository: { id: event.repoId }, pusher: { id: event.actorId, name: event.actorName || null, email: event.actorEmail || null }, sender: { id: event.actorId, name: event.actorName || null, email: event.actorEmail || null },
+  };
+  for (const candidate of candidates) {
+    try {
+      const run = await engine.startRun({ repoId: event.repoId, workflowPath: candidate.path, event: 'push', ref: branch, sha: resolvedAfterSha, actorId: event.actorId, inputs: pushInputs });
+      result.triggeredRunIds.push(run.id); result.workflowPaths.push(candidate.path);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes('Workflow does not support event: push')) continue;
+      logError(`Failed to start push workflow ${candidate.path}`, err, { module: 'services/actions/actions-triggers' });
+    }
+  }
+  await triggerPullRequestSynchronizeFromPush({ config, event, branch, afterSha: resolvedAfterSha, changedFiles });
+  return result;
+}
+
+async function triggerPullRequestSynchronizeFromPush(options: { config: TriggerPushWorkflowsConfig; event: TriggerPushWorkflowsEvent; branch: string; afterSha: string; changedFiles: string[]; }): Promise<void> {
+  const { config, event, branch, afterSha, changedFiles } = options;
+  const db = getDb(config.db);
+  const repo = await db.select({ name: repositories.name, defaultBranch: repositories.defaultBranch }).from(repositories).where(eq(repositories.id, event.repoId)).get();
+  if (!repo) return;
+  try {
+    await triggerPullRequestSynchronizeForHeadUpdate({ db: config.db, bucket: config.bucket, queue: config.queue, encryptionKey: config.encryptionKey, repoId: event.repoId, repoName: repo.name, defaultBranch: repo.defaultBranch || 'main', actorId: event.actorId, headBranch: branch, headSha: afterSha, changedFiles });
+  } catch (err) { logError(`Failed to trigger pull_request synchronize workflows for ${event.repoId}/${branch}`, err, { module: 'services/actions/actions-triggers' }); }
+}
+
+function matchesBranchFilters(branch: string, branches?: string[], branchesIgnore?: string[]): boolean {
+  if (Array.isArray(branches) && branches.length > 0 && !matchesAnyPattern(branch, branches)) return false;
+  if (Array.isArray(branchesIgnore) && branchesIgnore.length > 0 && matchesAnyPattern(branch, branchesIgnore)) return false;
+  return true;
+}
+
+function matchesPathFilters(changedFiles: string[] | undefined, paths?: string[], pathsIgnore?: string[]): boolean {
+  if (!changedFiles || changedFiles.length === 0) { return !(Array.isArray(paths) && paths.length > 0) && !(Array.isArray(pathsIgnore) && pathsIgnore.length > 0); }
+  if (Array.isArray(paths) && paths.length > 0 && !changedFiles.some((file) => matchesAnyPattern(file, paths))) return false;
+  if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0 && changedFiles.every((file) => matchesAnyPattern(file, pathsIgnore))) return false;
+  return true;
+}
+
+function matchesAnyPattern(value: string, patterns: string[]): boolean { return patterns.some((pattern) => globToRegExp(pattern).test(value)); }
+
+const globCache = new Map<string, RegExp>();
+function globToRegExp(glob: string): RegExp {
+  const cached = globCache.get(glob);
+  if (cached) return cached;
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '___DOUBLE_STAR___').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/___DOUBLE_STAR___/g, '.*');
+  const regex = new RegExp(`^${escaped}$`);
+  globCache.set(glob, regex);
+  return regex;
+}
+
+function uniqueRefs(values: Array<string | null | undefined>): string[] {
+  return Array.from(new Set(values.map((value) => value?.trim()).filter((value): value is string => Boolean(value))));
+}
+
+export function scheduleActionsAutoTrigger(executionCtx: Pick<ExecutionContext, 'waitUntil'> | undefined, taskFactory: () => Promise<unknown>, source: string): void {
+  const wrapped = taskFactory().catch((error) => { logError(`${source}: unexpected workflow trigger failure`, error, { module: 'actions-triggers' }); });
+  if (executionCtx && typeof executionCtx.waitUntil === 'function') { executionCtx.waitUntil(wrapped); return; }
+  void wrapped;
+}

package/src/application/services/actions/index.ts

@@ -0,0 +1,18 @@
+export { type WorkflowDispatchEnvOptions, buildWorkflowDispatchEnv } from './actions-env';
+export { getWorkflowSecretIds, enqueueFirstPhaseJobs, createWorkflowJobs } from './actions-execution';
+export type {
+  PullRequestWorkflowAction,
+  PullRequestWorkflowEvent,
+  TriggerPullRequestWorkflowsOptions,
+  PullRequestWorkflowTriggerResult,
+  TriggerPullRequestSynchronizeOptions,
+  TriggerPushWorkflowsConfig,
+  TriggerPushWorkflowsEvent,
+  PushWorkflowTriggerResult,
+} from './actions-triggers';
+export {
+  triggerPullRequestWorkflows,
+  triggerPullRequestSynchronizeForHeadUpdate,
+  triggerPushWorkflows,
+  scheduleActionsAutoTrigger,
+} from './actions-triggers';