agentops-accelerator 0.3.0__py3-none-any.whl

agentops/templates/workflows/agentops-deploy-prompt-agent.yml

@@ -0,0 +1,197 @@
+# AgentOps - Deploy Foundry prompt agent to __ENV_LABEL__
+#
+# agentops:deploy-mode=prompt-agent
+#
+# This workflow treats the repo prompt file as the source of truth for agent
+# instructions and uses Foundry to manage candidate agent versions:
+#   1. create/reuse a candidate Foundry prompt-agent version from prompt_file;
+#   2. run AgentOps eval against that exact candidate version;
+#   3. record the candidate as deployed only after the gate passes.
+#
+# Generated by `agentops workflow generate --deploy-mode prompt-agent`.
+
+name: AgentOps Deploy (__ENV_LABEL__)
+
+on:
+  push:
+    branches:
+__BRANCHES__
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: agentops-deploy-__ENV_KEY__-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  stage-candidate:
+    name: Stage Foundry prompt candidate (__ENV_LABEL__)
+    runs-on: ubuntu-latest
+    environment: __ENV_NAME__
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          uv pip install --system "agentops-accelerator[foundry,agent] @ git+https://github.com/Azure/agentops.git@main"
+
+      - name: Create candidate agent version from prompt_file
+        env:
+          AZURE_AI_FOUNDRY_PROJECT_ENDPOINT: ${{ vars.AZURE_AI_FOUNDRY_PROJECT_ENDPOINT }}
+          AGENTOPS_AGENT_PROMPT_FILE: ${{ vars.AGENTOPS_AGENT_PROMPT_FILE || '' }}
+        run: |
+          python -m agentops.pipeline.prompt_deploy stage \
+            --config "${{ inputs.config || 'agentops.yaml' }}" \
+            --environment "__ENV_NAME__" \
+            --out ".agentops/deployments/foundry-agent.json" \
+            --eval-config ".agentops/deployments/agentops.candidate.yaml"
+
+      - name: Upload candidate deployment record
+        uses: actions/upload-artifact@v7
+        with:
+          name: foundry-agent-__ENV_KEY__-candidate
+          path: |
+            .agentops/deployments/foundry-agent.json
+            .agentops/deployments/agentops.candidate.yaml
+          if-no-files-found: error
+
+  eval:
+    name: __EVAL_JOB_NAME__
+    needs: stage-candidate
+    runs-on: ubuntu-latest
+    environment: __ENV_NAME__
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Download candidate deployment record
+        uses: actions/download-artifact@v4
+        with:
+          name: foundry-agent-__ENV_KEY__-candidate
+          path: .agentops/deployments
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          uv pip install --system "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"
+
+__EVAL_STEPS__
+
+      - name: Generate release evidence
+        if: always()
+        env:
+          AZURE_AI_FOUNDRY_PROJECT_ENDPOINT: ${{ vars.AZURE_AI_FOUNDRY_PROJECT_ENDPOINT }}
+          AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+          AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
+          APPLICATIONINSIGHTS_CONNECTION_STRING: ${{ secrets.APPLICATIONINSIGHTS_CONNECTION_STRING || vars.APPLICATIONINSIGHTS_CONNECTION_STRING }}
+        run: |
+          agentops doctor --workspace . --out .agentops/agent/report.md \
+            --severity-fail critical --evidence-pack
+
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-__ENV_KEY__-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+            .agentops/agent/report.md
+            .agentops/release/latest/evidence.json
+            .agentops/release/latest/evidence.md
+          if-no-files-found: warn
+
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## AgentOps Eval (__ENV_LABEL__ candidate gate)"
+            echo
+            if [ -f .agentops/results/latest/report.md ]; then
+              cat .agentops/results/latest/report.md
+            fi
+            if [ -f .agentops/release/latest/evidence.md ]; then
+              echo
+              echo "---"
+              echo
+              cat .agentops/release/latest/evidence.md
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  deploy:
+    name: Record Foundry prompt deploy (__ENV_LABEL__)
+    needs: eval
+    runs-on: ubuntu-latest
+    environment: __ENV_NAME__
+    timeout-minutes: 10
+    steps:
+      - name: Download candidate deployment record
+        uses: actions/download-artifact@v4
+        with:
+          name: foundry-agent-__ENV_KEY__-candidate
+          path: .agentops/deployments
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install AgentOps Toolkit
+        run: |
+          python -m pip install "agentops-accelerator @ git+https://github.com/Azure/agentops.git@main"
+
+      - name: Mark candidate as deployed
+        run: |
+          python -m agentops.pipeline.prompt_deploy summarize \
+            --deployment ".agentops/deployments/foundry-agent.json" \
+            --environment "__ENV_NAME__"
+
+      - name: Upload Foundry deployment record
+        uses: actions/upload-artifact@v7
+        with:
+          name: foundry-agent-__ENV_KEY__-deployment
+          path: .agentops/deployments/foundry-agent.json
+          if-no-files-found: error

agentops/templates/workflows/agentops-deploy-qa-azd.yml

@@ -0,0 +1,156 @@
+# AgentOps - Deploy to QA with azd
+#
+# agentops:deploy-mode=azd
+#
+# Runs on push to release/**. Delegates deployment to Azure Developer CLI.
+# Infrastructure changes are opt-in for QA via workflow_dispatch input.
+#
+# Generated by `agentops workflow generate --deploy-mode azd`.
+
+name: AgentOps Deploy (QA)
+
+on:
+  push:
+    branches:
+      - "release/**"
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+      provision:
+        description: "Run azd provision before deploy"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+concurrency:
+  group: agentops-deploy-qa-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  provision:
+    name: azd environment (QA)
+    runs-on: ubuntu-latest
+    environment: qa
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up azd
+        uses: Azure/setup-azd@v2
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Prepare azd environment
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'qa' }}
+          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+        run: |
+          test -f azure.yaml || {
+            echo "::error file=azure.yaml::No azure.yaml found. Ask your coding agent to generate a zero-trust azd deployment, then re-run this workflow."
+            exit 1
+          }
+          azd env new "$AZURE_ENV_NAME" --no-prompt --subscription "${{ vars.AZURE_SUBSCRIPTION_ID }}" ${AZURE_LOCATION:+--location "$AZURE_LOCATION"} \
+            || azd env select "$AZURE_ENV_NAME"
+          azd env set AZURE_SUBSCRIPTION_ID "${{ vars.AZURE_SUBSCRIPTION_ID }}"
+          if [ -n "$AZURE_LOCATION" ]; then
+            azd env set AZURE_LOCATION "$AZURE_LOCATION"
+          fi
+
+      - name: Run azd provision when requested
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'qa' }}
+        run: |
+          SHOULD_PROVISION="false"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            SHOULD_PROVISION="${{ inputs.provision }}"
+          fi
+          if [ "$SHOULD_PROVISION" = "true" ]; then
+__AILZ_PREFLIGHT_COMMAND__
+            azd provision --no-prompt
+          else
+            echo "Skipping azd provision for QA. Use workflow_dispatch with provision=true for infra changes."
+          fi
+
+  eval:
+    name: Eval (gate)
+    needs: provision
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: uv pip install --system "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"
+__EVAL_STEPS__
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-qa-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+          if-no-files-found: warn
+
+  deploy:
+    name: azd deploy (QA)
+    needs: eval
+    runs-on: ubuntu-latest
+    environment: qa
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up azd
+        uses: Azure/setup-azd@v2
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+      - name: Run azd deploy
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'qa' }}
+          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+        run: |
+          test -f azure.yaml || {
+            echo "::error file=azure.yaml::No azure.yaml found. Ask your coding agent to generate a zero-trust azd deployment, then re-run this workflow."
+            exit 1
+          }
+          azd env new "$AZURE_ENV_NAME" --no-prompt --subscription "${{ vars.AZURE_SUBSCRIPTION_ID }}" ${AZURE_LOCATION:+--location "$AZURE_LOCATION"} \
+            || azd env select "$AZURE_ENV_NAME"
+          azd env set AZURE_SUBSCRIPTION_ID "${{ vars.AZURE_SUBSCRIPTION_ID }}"
+          if [ -n "$AZURE_LOCATION" ]; then
+            azd env set AZURE_LOCATION "$AZURE_LOCATION"
+          fi
+          azd env refresh "$AZURE_ENV_NAME" --no-prompt
+          azd deploy --no-prompt

agentops/templates/workflows/agentops-deploy-qa.yml

@@ -0,0 +1,145 @@
+# AgentOps — Deploy to QA
+#
+# Triggers on every push to a `release/**` branch. Runs the AgentOps
+# eval as a quality gate, then builds and deploys to the `qa` GitHub
+# Environment.
+#
+# To finish wiring this for your project:
+#   1. Configure the `qa` GitHub Environment (Settings -> Environments).
+#      Add any environment-specific variables/secrets there.
+#   2. Fill in the `Build` and `Deploy` steps below to match your stack
+#      (see commented examples).
+#   3. Recommended: tighten thresholds in your bundle for QA-grade gating.
+#
+# Generated by `agentops workflow generate`.
+
+name: AgentOps Deploy (QA)
+
+on:
+  push:
+    branches:
+      - "release/**"
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+concurrency:
+  group: agentops-deploy-qa-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  eval:
+    name: Eval (gate)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      # uv is ~5-10x faster than pip on cold installs; the AgentOps stack
+      # (azure-* + opentelemetry-instrumentation-*) pulls dozens of small
+      # wheels so the speed-up is very visible in CI.
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          # NOTE: pinned to GitHub main until the next package release includes this flow.
+          # Switch to `uv pip install --system "agentops-accelerator[foundry]"` after release.
+          uv pip install --system "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"
+
+__EVAL_STEPS__
+
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-qa-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+          if-no-files-found: warn
+
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## AgentOps Eval (QA gate)"
+            echo
+            if [ -f .agentops/results/latest/report.md ]; then
+              cat .agentops/results/latest/report.md
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  build:
+    name: Build
+    needs: eval
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      # ---------------------------------------------------------------
+      # TODO: replace this placeholder with your build step.
+      # See agentops-deploy-dev.yml for example snippets (wheel,
+      # docker, az acr build, azd package).
+      # ---------------------------------------------------------------
+      - name: Build (placeholder)
+        run: |
+          echo "TODO: replace this step with your build."
+
+  deploy:
+    name: Deploy to QA
+    needs: build
+    runs-on: ubuntu-latest
+    environment: qa
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      # ---------------------------------------------------------------
+      # TODO: replace this placeholder with your deploy step.
+      # See agentops-deploy-dev.yml for example snippets (ACA, App
+      # Service, Foundry hosted agent, azd deploy).
+      # ---------------------------------------------------------------
+      - name: Deploy (placeholder)
+        run: |
+          echo "TODO: replace this step with your deploy."
+          echo "Target environment: qa"

agentops/templates/workflows/agentops-pr-prompt-agent.yml

@@ -0,0 +1,210 @@
+# AgentOps - PR evaluation gate (Foundry prompt agent)
+#
+# agentops:deploy-mode=prompt-agent
+#
+# For Foundry prompt-agent flows, the PR gate must evaluate the prompt
+# the PR is proposing, not the seed agent version pinned in
+# `agentops.yaml`. So this PR workflow stages an ephemeral candidate
+# Foundry prompt-agent version in the dev project from the
+# source-controlled `prompt_file`, evaluates that exact candidate, and
+# runs Doctor against it. The merge gate is the eval + Doctor result.
+#
+# Notes:
+#   - Each PR run creates or reuses a candidate version in the dev
+#     Foundry project. AgentOps deduplicates only when the prompt is
+#     byte-identical to the current seed version's instructions; PR
+#     candidates can therefore accumulate over time and may need to be
+#     cleaned up out-of-band.
+#   - Merge is what promotes the candidate via the deploy workflow.
+#     This PR workflow does not record the candidate as deployed.
+#
+# Generated by `agentops workflow generate --deploy-mode prompt-agent`.
+
+name: AgentOps PR
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - "release/**"
+      - main
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+
+permissions:
+  contents: read
+  pull-requests: write
+  id-token: write
+
+concurrency:
+  group: agentops-pr-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  stage-candidate:
+    name: Stage Foundry prompt candidate (PR)
+    runs-on: ubuntu-latest
+    # Stage candidates in the dev Foundry project. Sandbox is the
+    # author's playground; dev is where CI proves a change is safe to
+    # merge.
+    environment: __ENV_NAME__
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          uv pip install --system "agentops-accelerator[foundry,agent] @ git+https://github.com/Azure/agentops.git@main"
+
+      - name: Create candidate agent version from prompt_file
+        env:
+          AZURE_AI_FOUNDRY_PROJECT_ENDPOINT: ${{ vars.AZURE_AI_FOUNDRY_PROJECT_ENDPOINT }}
+          AGENTOPS_AGENT_PROMPT_FILE: ${{ vars.AGENTOPS_AGENT_PROMPT_FILE || '' }}
+        run: |
+          python -m agentops.pipeline.prompt_deploy stage \
+            --config "${{ inputs.config || 'agentops.yaml' }}" \
+            --environment "__ENV_NAME__" \
+            --out ".agentops/deployments/foundry-agent.json" \
+            --eval-config ".agentops/deployments/agentops.candidate.yaml"
+
+      - name: Upload candidate deployment record
+        uses: actions/upload-artifact@v7
+        with:
+          name: foundry-agent-__ENV_KEY__-candidate
+          path: |
+            .agentops/deployments/foundry-agent.json
+            .agentops/deployments/agentops.candidate.yaml
+          if-no-files-found: error
+
+  eval:
+    name: __EVAL_JOB_NAME__
+    needs: stage-candidate
+    runs-on: ubuntu-latest
+    environment: __ENV_NAME__
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Download candidate deployment record
+        uses: actions/download-artifact@v4
+        with:
+          name: foundry-agent-__ENV_KEY__-candidate
+          path: .agentops/deployments
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          uv pip install --system "agentops-accelerator[foundry,agent] @ git+https://github.com/Azure/agentops.git@main"
+
+__EVAL_STEPS__
+
+      - name: Generate release evidence
+        if: always()
+        env:
+          AZURE_AI_FOUNDRY_PROJECT_ENDPOINT: ${{ vars.AZURE_AI_FOUNDRY_PROJECT_ENDPOINT }}
+          AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+          AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
+          APPLICATIONINSIGHTS_CONNECTION_STRING: ${{ secrets.APPLICATIONINSIGHTS_CONNECTION_STRING || vars.APPLICATIONINSIGHTS_CONNECTION_STRING }}
+        run: |
+          # Doctor gate severity is configured at workflow generation time via
+          # `agentops workflow generate --doctor-gate critical|warning|none`.
+          agentops doctor --workspace . --out .agentops/agent/report.md \
+            --severity-fail __DOCTOR_GATE__ --evidence-pack
+
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-pr-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+            .agentops/agent/report.md
+            .agentops/release/latest/evidence.json
+            .agentops/release/latest/evidence.md
+          if-no-files-found: warn
+
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## AgentOps PR Eval (Foundry prompt candidate)"
+            echo
+            echo "Result: \`${{ steps.eval.outputs.result }}\` (exit code \`${{ steps.eval.outputs.exit_code }}\`)"
+            echo
+            if [ -f .agentops/results/latest/report.md ]; then
+              cat .agentops/results/latest/report.md
+            fi
+            if [ -f .agentops/release/latest/evidence.md ]; then
+              echo
+              echo "---"
+              echo
+              cat .agentops/release/latest/evidence.md
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Comment AgentOps report on PR
+        if: always() && github.event_name == 'pull_request'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const path = '.agentops/results/latest/report.md';
+            const marker = '<!-- agentops-pr-report -->';
+            let body = `${marker}\n## AgentOps PR Eval (Foundry prompt candidate)\n\nNo report produced.`;
+            if (fs.existsSync(path)) {
+              const md = fs.readFileSync(path, 'utf8');
+              body = `${marker}\n${md}`;
+            }
+            const evidencePath = '.agentops/release/latest/evidence.md';
+            if (fs.existsSync(evidencePath)) {
+              const evidence = fs.readFileSync(evidencePath, 'utf8');
+              body = `${body}\n\n---\n\n${evidence}`;
+            }
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+            const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number });
+            const existing = comments.find(c => c.body && c.body.startsWith(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            }