Skip to content
Agentic Maintenance

fix: narrow super-linter scope and preserve diagnostic reports (#68733) #6375

Sign in to view logs

fix: narrow super-linter scope and preserve diagnostic reports (#68733)

fix: narrow super-linter scope and preserve diagnostic reports (#68733) #6375

Workflow file for this run

.github/workflows/agentics-maintenance.yml at a5c80a9
# This file was automatically generated by pkg/workflow/maintenance_workflow.go. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
#
# ___ _ _
# / _ \ | | (_)
# | |_| | __ _ ___ _ __ | |_ _ ___
# | _ |/ _` |/ _ \ '_ \| __| |/ __|
# | | | | (_| | __/ | | | |_| | (__
# \_| |_/\__, |\___|_| |_|\__|_|\___|
# __/ |
# _ _ |___/
# | | | | / _| |
# | | | | ___ _ __ _ __| |_| | _____ ____
# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
#
# To regenerate this workflow, run:
# gh aw compile
# Not all edits will cause changes to this file.
#
# For more information: https://github.github.com/gh-aw/introduction/overview/
#
# This file defines the generated agentic maintenance workflow for this repository.
# It runs scheduled cleanup for expiring safe outputs and supports manual maintenance operations.
#
# This workflow is generated automatically when workflows use expiring safe outputs,
# when workflows enable steering (safe-outputs.steer), declare compaction-enabled
# ledgers (tools.ledger) or work queues, or when repository maintenance features are
# enabled in .github/workflows/aw.json.
#
# To disable maintenance workflow generation, set in .github/workflows/aw.json:
# {"maintenance": false}
#
# Agentic maintenance docs:
# https://github.github.com/gh-aw/reference/ephemerals/#manual-maintenance-operations
#
name: Agentic Maintenance
on:
schedule:
- cron: "37 */2 * * *" # Every 2 hours (based on minimum expires: 1 days)
push:
branches:
- main
paths:
- '.github/workflows/*.md'
issues:
types: [labeled]
workflow_dispatch:
inputs:
operation:
description: 'Optional maintenance operation to run'
required: false
type: choice
default: 'none'
options:
- 'none'
- 'disable'
- 'enable'
- 'update'
- 'upgrade'
- 'safe_outputs'
- 'create_labels'
- 'activity_report'
- 'close_agentic_workflows_issues'
- 'clean_cache_memories'
- 'update_pull_request_branches'
- 'validate'
- 'forecast'
- 'compact_ledger'
run_url:
description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
required: false
type: string
default: ''
ledger:
description: 'Ledger name to compact when operation is compact_ledger (empty compacts every due ledger).'
required: false
type: string
default: ''
workflow_call:
inputs:
operation:
description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate, forecast, compact_ledger)'
required: false
type: string
default: ''
run_url:
description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
required: false
type: string
default: ''
ledger:
description: 'Ledger name to compact when operation is compact_ledger (empty compacts every due ledger).'
required: false
type: string
default: ''
outputs:
operation_completed:
description: 'The maintenance operation that was completed (empty when none ran or a scheduled job ran)'
value: ${{ jobs.run_operation.outputs.operation || (inputs.operation == 'safe_outputs' || inputs.operation == 'create_labels' || inputs.operation == 'activity_report' || inputs.operation == 'close_agentic_workflows_issues' || inputs.operation == 'update_pull_request_branches' || inputs.operation == 'validate' || inputs.operation == 'forecast' || inputs.operation == 'clean_cache_memories' || inputs.operation == 'compact_ledger') && inputs.operation || '' }}
applied_run_url:
description: 'The run URL that safe outputs were applied from'
value: ${{ jobs.apply_safe_outputs.outputs.run_url }}
# Jobs request only the permissions needed for their individual maintenance operations.
permissions: {}
# Serialize maintenance runs to avoid overlapping writes to repository resources.
concurrency:
group: ${{ github.workflow }}-${{ github.repository }}
cancel-in-progress: false
jobs:
close-expired-discussions:
name: Close expired discussions
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
runs-on: ubuntu-slim
# Closing expired resources requires write access to this resource type only.
permissions:
discussions: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Close expired discussions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'close_expired_discussions.cjs'));
await main();
close-expired-issues:
name: Close expired issues
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
runs-on: ubuntu-slim
# Closing expired resources requires write access to this resource type only.
permissions:
issues: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Close expired issues
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'close_expired_issues.cjs'));
await main();
close-expired-pull-requests:
name: Close expired pull requests
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
runs-on: ubuntu-slim
# Closing expired resources requires write access to this resource type only.
permissions:
pull-requests: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Close expired pull requests
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'close_expired_pull_requests.cjs'));
await main();
cleanup-stale-steering-issues:
name: Cleanup stale steering issues
if: ${{ (!(github.event.repository.fork)) && github.event_name == 'schedule' }}
runs-on: ubuntu-slim
# Reading workflow runs and closing issues requires these permissions.
permissions:
actions: read
issues: write
contents: read
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Close stale steering issues
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'cleanup_stale_steering_issues.cjs'));
await main();
cleanup-cache-memory:
name: Cleanup cache memory
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none' || inputs.operation == 'clean_cache_memories') }}
runs-on: ubuntu-slim
# Removing obsolete Actions caches requires actions: write.
permissions:
actions: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Cleanup outdated cache-memory entries
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'cleanup_cache_memory.cjs'));
await main();
run_operation:
name: Run maintenance operation
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'none' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && inputs.operation != 'forecast' && inputs.operation != 'compact_ledger' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
# Updates, upgrades, and workflow enable/disable operations need repository write access.
permissions:
actions: write
contents: write
pull-requests: write
outputs:
operation: ${{ steps.record.outputs.operation }}
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
- name: Build gh-aw
run: make build
- name: Run operation
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_OPERATION: ${{ inputs.operation }}
GH_AW_CMD_PREFIX: ./gh-aw
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'run_operation_update_upgrade.cjs'));
await main();
- name: Record outputs
id: record
env:
GH_AW_OPERATION: ${{ inputs.operation }}
run: echo "operation=$GH_AW_OPERATION" >> "$GITHUB_OUTPUT"
update_pull_request_branches:
name: Update pull request branches
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'update_pull_request_branches' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
# Branch updates may write commits and update pull requests.
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Update pull request branches
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'update_pull_request_branches.cjs'));
await main();
apply_safe_outputs:
name: Apply safe outputs
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
# Replay can create or update any supported safe-output resource.
permissions:
actions: read
contents: write
discussions: write
issues: write
pull-requests: write
outputs:
run_url: ${{ steps.record.outputs.run_url }}
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Apply Safe Outputs
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_AW_JOB_CHECK_RUN_ID: ${{ job.check_run_id }}
GH_AW_WORKFLOW_ID: "agentics-maintenance"
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_RUN_URL: ${{ inputs.run_url }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'apply_safe_outputs_replay.cjs'));
await main();
- name: Record outputs
id: record
env:
GH_AW_RUN_URL: ${{ inputs.run_url }}
run: echo "run_url=$GH_AW_RUN_URL" >> "$GITHUB_OUTPUT"
create_labels:
name: Create labels
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
# Creating repository labels uses the issues API.
permissions:
contents: read
issues: write
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
- name: Build gh-aw
run: make build
- name: Create missing labels
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_AW_CMD_PREFIX: ./gh-aw
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'create_labels.cjs'));
await main();
activity_report:
name: activity report
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
timeout-minutes: 120
# Read workflow logs and create the resulting report issue.
permissions:
actions: read
contents: read
issues: write
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
- name: Build gh-aw
run: make build
- name: Restore activity report logs cache
id: activity_report_logs_cache
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ./.cache/gh-aw/activity-report-logs
key: ${{ runner.os }}-activity-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
restore-keys: |
${{ runner.os }}-activity-report-logs-${{ github.repository }}-
${{ runner.os }}-activity-report-logs-
- name: Download activity report logs
timeout-minutes: 20
shell: bash
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_CMD_PREFIX: ./gh-aw
run: |
${GH_AW_CMD_PREFIX} logs \
--repo "$GITHUB_REPOSITORY" \
--start-date -1w \
--count 500 \
--output ./.cache/gh-aw/activity-report-logs \
--format markdown \
--report-file ./.cache/gh-aw/activity-report-logs/report.md
- name: Save activity report logs cache
if: ${{ always() }}
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ./.cache/gh-aw/activity-report-logs
key: ${{ steps.activity_report_logs_cache.outputs.cache-primary-key }}
- name: Generate activity report issue
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const fs = require('node:fs');
const reportPath = './.cache/gh-aw/activity-report-logs/report.md';
if (!fs.existsSync(reportPath)) {
core.warning('Activity report markdown not found at ' + reportPath + '; skipping issue creation.');
return;
}
let reportBody = '';
try {
reportBody = fs.readFileSync(reportPath, 'utf8').trim();
} catch (error) {
core.warning('Failed to read activity report markdown at ' + reportPath + ': ' + error.message);
return;
}
if (!reportBody) {
core.warning('Activity report markdown is empty at ' + reportPath + '; skipping issue creation.');
return;
}
const repoSlug = context.repo.owner + '/' + context.repo.repo;
const body = [
'### Agentic workflow activity report',
'',
'Repository: ' + repoSlug,
'Generated at: ' + new Date().toISOString(),
'',
reportBody,
].join('\n');
const createdIssue = await github.rest.issues.create({
owner: context.repo.owner,
repo: context.repo.repo,
title: '[aw] agentic status report',
body,
labels: ['agentic-workflows'],
});
core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);
forecast_report:
name: forecast report
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'forecast' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
timeout-minutes: 60
# Read workflow logs and create the resulting report issue.
permissions:
actions: read
contents: read
issues: write
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
- name: Build gh-aw
run: make build
- name: Restore forecast report logs cache
id: forecast_report_logs_cache
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ./.github/aw/logs
key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
restore-keys: |
${{ runner.os }}-forecast-report-logs-${{ github.repository }}-
${{ runner.os }}-forecast-report-logs-
- name: Generate forecast report
id: generate_forecast_report
timeout-minutes: 30
shell: bash
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_CMD_PREFIX: ./gh-aw
run: |
mkdir -p ./.cache/gh-aw/forecast
set +e
${GH_AW_CMD_PREFIX} forecast --repo "$GITHUB_REPOSITORY" --timeout 30 --verbose --json > ./.cache/gh-aw/forecast/report.json
forecast_exit_code=$?
set -e
if [ "${forecast_exit_code}" -eq 124 ]; then
echo '{"outcome":"timeout","message":"Forecast computation timed out after 30 minutes."}' > ./.cache/gh-aw/forecast/error.json
echo "::error::Forecast computation timed out after 30 minutes."
exit 1
fi
if [ "${forecast_exit_code}" -ne 0 ]; then
echo '{"outcome":"error","message":"Forecast computation failed before producing a report."}' > ./.cache/gh-aw/forecast/error.json
echo "::error::Forecast computation failed with exit code ${forecast_exit_code}."
exit 1
fi
- name: Debug forecast logs folder
if: ${{ always() }}
shell: bash
run: |
if [ ! -d ./.github/aw/logs ]; then
echo "Logs directory not found: ./.github/aw/logs"
exit 0
fi
echo "Files under ./.github/aw/logs:"
find ./.github/aw/logs -type f | sort
- name: Save forecast report logs cache
if: ${{ always() }}
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ./.github/aw/logs
key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
- name: Generate forecast issue
if: ${{ always() }}
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
FORECAST_STEP_OUTCOME: ${{ steps.generate_forecast_report.outcome }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'create_forecast_issue.cjs'));
await main();
close_agentic_workflows_issues:
name: Close agentic workflows issues
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'close_agentic_workflows_issues' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-slim
# Closing no-repro issues requires issues: write.
permissions:
issues: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Close no-repro agentic-workflows issues
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'close_agentic_workflows_issues.cjs'));
await main();
validate_workflows:
name: Validate workflows
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
runs-on: ubuntu-latest
# Read workflow sources and file issues for validation findings.
permissions:
contents: read
issues: write
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
- name: Build gh-aw
run: make build
- name: Validate workflows and file issue on findings
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_AW_CMD_PREFIX: ./gh-aw
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'run_validate_workflows.cjs'));
await main();
label_disable_agentic_workflow:
name: Disable agentic workflow by label
if: ${{ (!(github.event.repository.fork)) && github.event_name == 'issues' && github.event.label.name == 'agentic-workflows:disable' }}
runs-on: ubuntu-slim
# Label requests disable workflow runs and update the requesting issue.
permissions:
actions: write
contents: read
issues: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
id: check_permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Disable agentic workflow
if: ${{ steps.check_permissions.outcome == 'success' }}
uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'disable_agentic_workflow.cjs'));
await main();
label_apply_safe_outputs:
name: Apply safe outputs by label
if: ${{ (!(github.event.repository.fork)) && github.event_name == 'issues' && github.event.label.name == 'agentic-workflows:apply-safe-outputs' }}
runs-on: ubuntu-slim
# Applying safe outputs can update each supported repository resource.
permissions:
actions: read
contents: write
discussions: write
issues: write
pull-requests: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check admin/maintainer permissions
id: check_permissions
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
await main();
- name: Apply safe outputs from referenced run
if: ${{ steps.check_permissions.outcome == 'success' }}
uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' # v9.0.0
env:
GH_AW_JOB_CHECK_RUN_ID: ${{ job.check_run_id }}
GH_AW_WORKFLOW_ID: "agentics-maintenance"
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'label_apply_safe_outputs.cjs'));
await main();
compile-workflows:
name: Compile workflows
if: ${{ (!(github.event.repository.fork)) && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
runs-on: ubuntu-slim
concurrency:
group: ${{ github.workflow }}-compile-workflows-${{ github.repository }}
cancel-in-progress: true
# Detect drift by reading sources and open a tracking issue when necessary.
permissions:
contents: read
issues: write
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
- name: Build gh-aw
run: make build
- name: Pre-compile validation
run: |
./gh-aw compile --validate --no-emit --verbose
echo "✓ Pre-compile validation passed"
- name: Compile workflows
run: |
./gh-aw compile --validate --verbose
echo "✓ All workflows compiled successfully"
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Check for out-of-sync workflows and create issue or pull request if needed
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'check_workflow_recompile_needed.cjs'));
await main();
secret-validation:
name: Validate secrets
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
runs-on: ubuntu-slim
# Read repository scripts to check configured integration secrets without write access.
permissions:
contents: read
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Node.js
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
with:
node-version: '22'
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Validate Secrets
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
# GitHub tokens
GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
GH_AW_PROJECT_GITHUB_TOKEN: ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}
GH_AW_COPILOT_TOKEN: ${{ secrets.GH_AW_COPILOT_TOKEN }}
# AI Engine API keys
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
BRAVE_API_KEY: ${{ secrets.BRAVE_API_KEY }}
# Integration tokens
NOTION_API_TOKEN: ${{ secrets.NOTION_API_TOKEN }}
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'validate_secrets.cjs'));
await main();
- name: Upload secret validation report
if: always()
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: secret-validation-report
path: secret-validation-report.md
retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '30' }}
if-no-files-found: warn
ledger_compaction_plan:
name: Plan ledger compaction
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none' || inputs.operation == 'compact_ledger') }}
runs-on: ubuntu-slim
# Planning treats ledger content as untrusted and must remain read-only.
permissions:
contents: read
outputs:
plan_created: ${{ steps.plan_0.outputs.plan_created == 'true' || steps.plan_1.outputs.plan_created == 'true' || steps.plan_2.outputs.plan_created == 'true' || steps.plan_3.outputs.plan_created == 'true' || steps.plan_4.outputs.plan_created == 'true' || steps.plan_5.outputs.plan_created == 'true' }}
plans_uploaded: ${{ steps.upload_plans.outcome == 'success' }}
plan_0_created: ${{ steps.plan_0.outputs.plan_created }}
plan_1_created: ${{ steps.plan_1.outputs.plan_created }}
plan_2_created: ${{ steps.plan_2.outputs.plan_created }}
plan_3_created: ${{ steps.plan_3.outputs.plan_created }}
plan_4_created: ${{ steps.plan_4.outputs.plan_created }}
plan_5_created: ${{ steps.plan_5.outputs.plan_created }}
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Plan ledger compaction (audit-history, untrusted, read-only)
if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'audit-history' }}
continue-on-error: true
timeout-minutes: 15
id: plan_0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ github.token }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/audit-history",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "run_id",
"max_patch_kb": 10,
"max_record_kb": 16,
"max_segment_kb": 100,
"name": "audit-history",
"schema": {
"additionalProperties": false,
"properties": {
"aggregate_metrics": {
"type": "object"
},
"anomaly_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"audit_window": {
"additionalProperties": false,
"properties": {
"end": {
"type": "string"
},
"start": {
"type": "string"
}
},
"type": "object"
},
"audited_at": {
"type": "string"
},
"finding_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"outcome": {
"enum": [
"findings_reported",
"noop"
]
},
"recommendation_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"record_type": {
"enum": [
"workflow_run_audit"
]
},
"recurring_finding_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"run_id": {
"type": "string"
},
"runs_reviewed": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"record_type",
"run_id",
"audited_at",
"audit_window",
"runs_reviewed",
"aggregate_metrics",
"finding_ids",
"recommendation_ids",
"anomaly_ids",
"recurring_finding_ids",
"outcome"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-0.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
await main();
- name: Plan ledger compaction (awf-feature-reviews, untrusted, read-only)
if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'awf-feature-reviews' }}
continue-on-error: true
timeout-minutes: 15
id: plan_1
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ github.token }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/awf-feature-reviews",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"max_patch_kb": 10,
"max_record_kb": 8,
"max_segment_kb": 100,
"name": "awf-feature-reviews"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-1.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
await main();
- name: Plan ledger compaction (caveman-run-history, untrusted, read-only)
if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'caveman-run-history' }}
continue-on-error: true
timeout-minutes: 15
id: plan_2
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ github.token }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/caveman-run-history",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "run_id",
"max_patch_kb": 10,
"max_record_kb": 4,
"max_segment_kb": 100,
"name": "caveman-run-history",
"schema": {
"additionalProperties": false,
"properties": {
"date": {
"type": "string"
},
"files_optimized": {
"minimum": 0,
"type": "integer"
},
"files_processed": {
"minimum": 0,
"type": "integer"
},
"planned_outcome": {
"enum": [
"pull_request_requested",
"noop"
]
},
"record_type": {
"enum": [
"caveman_run"
]
},
"run_id": {
"type": "string"
}
},
"required": [
"record_type",
"run_id",
"date",
"files_processed",
"files_optimized",
"planned_outcome"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-2.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
await main();
- name: Plan ledger compaction (centralization, untrusted, read-only)
if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'centralization' }}
continue-on-error: true
timeout-minutes: 15
id: plan_3
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ github.token }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/centralization",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "run_id",
"max_patch_kb": 10,
"max_record_kb": 8,
"max_segment_kb": 100,
"name": "centralization",
"schema": {
"additionalProperties": false,
"properties": {
"generated_at": {
"type": "string"
},
"intent_buckets": {
"items": {
"additionalProperties": false,
"properties": {
"avg_sessions": {
"minimum": 0,
"type": "number"
},
"distinct_users": {
"minimum": 0,
"type": "integer"
},
"fallback_rate": {
"minimum": 0,
"type": "number"
},
"intent_bucket": {
"type": "string"
},
"task_count": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"intent_bucket",
"task_count",
"distinct_users",
"avg_sessions",
"fallback_rate"
],
"type": "object"
},
"maxItems": 10,
"type": "array"
},
"overall_stats": {
"type": "object"
},
"record_type": {
"enum": [
"centralization_snapshot"
]
},
"repository": {
"type": "string"
},
"run_id": {
"type": "string"
},
"workflow_opportunities": {
"items": {
"additionalProperties": false,
"properties": {
"artifact_types": {
"items": {
"type": "string"
},
"type": "array"
},
"centralization_score": {
"minimum": 0,
"type": "number"
},
"distinct_users": {
"minimum": 0,
"type": "integer"
},
"intent_bucket": {
"type": "string"
},
"recommendation_kind": {
"type": "string"
},
"start_context_guess": {
"type": "string"
},
"task_count": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"intent_bucket",
"artifact_types",
"start_context_guess",
"task_count",
"distinct_users",
"centralization_score",
"recommendation_kind"
],
"type": "object"
},
"maxItems": 10,
"type": "array"
}
},
"required": [
"record_type",
"run_id",
"generated_at",
"repository",
"overall_stats",
"intent_buckets",
"workflow_opportunities"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-3.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
await main();
- name: Plan ledger compaction (concurrency-audits, untrusted, read-only)
if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'concurrency-audits' }}
continue-on-error: true
timeout-minutes: 15
id: plan_4
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ github.token }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/concurrency-audits",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"max_patch_kb": 10,
"max_record_kb": 4,
"max_segment_kb": 100,
"name": "concurrency-audits"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-4.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
await main();
- name: Plan ledger compaction (smoke, untrusted, read-only)
if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'smoke' }}
continue-on-error: true
timeout-minutes: 15
id: plan_5
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ github.token }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/smoke",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "workflow_run_id",
"max_patch_kb": 10,
"max_record_kb": 4,
"max_segment_kb": 100,
"name": "smoke",
"schema": {
"additionalProperties": false,
"properties": {
"record_type": {
"enum": [
"repo_memory_ledger_smoke"
]
},
"result": {
"enum": [
"passed"
]
},
"workflow_run_id": {
"type": "string"
}
},
"required": [
"record_type",
"workflow_run_id",
"result"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-5.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
await main();
- name: Upload ledger compaction plans
if: ${{ steps.plan_0.outputs.plan_created == 'true' || steps.plan_1.outputs.plan_created == 'true' || steps.plan_2.outputs.plan_created == 'true' || steps.plan_3.outputs.plan_created == 'true' || steps.plan_4.outputs.plan_created == 'true' || steps.plan_5.outputs.plan_created == 'true' }}
id: upload_plans
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: ledger-compaction-plans
path: ${{ runner.temp }}/gh-aw/ledger-compaction
retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '1' }}
if-no-files-found: error
- name: Report ledger compaction planning failures
if: ${{ steps.plan_0.outcome == 'failure' || steps.plan_1.outcome == 'failure' || steps.plan_2.outcome == 'failure' || steps.plan_3.outcome == 'failure' || steps.plan_4.outcome == 'failure' || steps.plan_5.outcome == 'failure' }}
run: exit 1
ledger_compaction_apply:
name: Apply ledger compaction
needs: ledger_compaction_plan
if: ${{ !cancelled() && needs.ledger_compaction_plan.outputs.plans_uploaded == 'true' && needs.ledger_compaction_plan.outputs.plan_created == 'true' }}
runs-on: ubuntu-slim
# Applying a validated plan commits updated ledger content.
permissions:
contents: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Download ledger compaction plans
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
name: ledger-compaction-plans
path: ${{ runner.temp }}/gh-aw/ledger-compaction
- name: Validate and apply ledger compaction (audit-history, trusted)
if: ${{ needs.ledger_compaction_plan.outputs.plan_0_created == 'true' }}
id: apply_0
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/audit-history",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "run_id",
"max_patch_kb": 10,
"max_record_kb": 16,
"max_segment_kb": 100,
"name": "audit-history",
"schema": {
"additionalProperties": false,
"properties": {
"aggregate_metrics": {
"type": "object"
},
"anomaly_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"audit_window": {
"additionalProperties": false,
"properties": {
"end": {
"type": "string"
},
"start": {
"type": "string"
}
},
"type": "object"
},
"audited_at": {
"type": "string"
},
"finding_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"outcome": {
"enum": [
"findings_reported",
"noop"
]
},
"recommendation_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"record_type": {
"enum": [
"workflow_run_audit"
]
},
"recurring_finding_ids": {
"items": {
"type": "string"
},
"type": "array"
},
"run_id": {
"type": "string"
},
"runs_reviewed": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"record_type",
"run_id",
"audited_at",
"audit_window",
"runs_reviewed",
"aggregate_metrics",
"finding_ids",
"recommendation_ids",
"anomaly_ids",
"recurring_finding_ids",
"outcome"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-0.json
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
await main();
- name: Validate and apply ledger compaction (awf-feature-reviews, trusted)
if: ${{ needs.ledger_compaction_plan.outputs.plan_1_created == 'true' }}
id: apply_1
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/awf-feature-reviews",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"max_patch_kb": 10,
"max_record_kb": 8,
"max_segment_kb": 100,
"name": "awf-feature-reviews"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-1.json
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
await main();
- name: Validate and apply ledger compaction (caveman-run-history, trusted)
if: ${{ needs.ledger_compaction_plan.outputs.plan_2_created == 'true' }}
id: apply_2
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/caveman-run-history",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "run_id",
"max_patch_kb": 10,
"max_record_kb": 4,
"max_segment_kb": 100,
"name": "caveman-run-history",
"schema": {
"additionalProperties": false,
"properties": {
"date": {
"type": "string"
},
"files_optimized": {
"minimum": 0,
"type": "integer"
},
"files_processed": {
"minimum": 0,
"type": "integer"
},
"planned_outcome": {
"enum": [
"pull_request_requested",
"noop"
]
},
"record_type": {
"enum": [
"caveman_run"
]
},
"run_id": {
"type": "string"
}
},
"required": [
"record_type",
"run_id",
"date",
"files_processed",
"files_optimized",
"planned_outcome"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-2.json
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
await main();
- name: Validate and apply ledger compaction (centralization, trusted)
if: ${{ needs.ledger_compaction_plan.outputs.plan_3_created == 'true' }}
id: apply_3
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/centralization",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "run_id",
"max_patch_kb": 10,
"max_record_kb": 8,
"max_segment_kb": 100,
"name": "centralization",
"schema": {
"additionalProperties": false,
"properties": {
"generated_at": {
"type": "string"
},
"intent_buckets": {
"items": {
"additionalProperties": false,
"properties": {
"avg_sessions": {
"minimum": 0,
"type": "number"
},
"distinct_users": {
"minimum": 0,
"type": "integer"
},
"fallback_rate": {
"minimum": 0,
"type": "number"
},
"intent_bucket": {
"type": "string"
},
"task_count": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"intent_bucket",
"task_count",
"distinct_users",
"avg_sessions",
"fallback_rate"
],
"type": "object"
},
"maxItems": 10,
"type": "array"
},
"overall_stats": {
"type": "object"
},
"record_type": {
"enum": [
"centralization_snapshot"
]
},
"repository": {
"type": "string"
},
"run_id": {
"type": "string"
},
"workflow_opportunities": {
"items": {
"additionalProperties": false,
"properties": {
"artifact_types": {
"items": {
"type": "string"
},
"type": "array"
},
"centralization_score": {
"minimum": 0,
"type": "number"
},
"distinct_users": {
"minimum": 0,
"type": "integer"
},
"intent_bucket": {
"type": "string"
},
"recommendation_kind": {
"type": "string"
},
"start_context_guess": {
"type": "string"
},
"task_count": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"intent_bucket",
"artifact_types",
"start_context_guess",
"task_count",
"distinct_users",
"centralization_score",
"recommendation_kind"
],
"type": "object"
},
"maxItems": 10,
"type": "array"
}
},
"required": [
"record_type",
"run_id",
"generated_at",
"repository",
"overall_stats",
"intent_buckets",
"workflow_opportunities"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-3.json
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
await main();
- name: Validate and apply ledger compaction (concurrency-audits, trusted)
if: ${{ needs.ledger_compaction_plan.outputs.plan_4_created == 'true' }}
id: apply_4
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/concurrency-audits",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"max_patch_kb": 10,
"max_record_kb": 4,
"max_segment_kb": 100,
"name": "concurrency-audits"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-4.json
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
await main();
- name: Validate and apply ledger compaction (smoke, trusted)
if: ${{ needs.ledger_compaction_plan.outputs.plan_5_created == 'true' }}
id: apply_5
continue-on-error: true
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_AW_LEDGER_COMPACTION_CONFIG: |-
{
"branch_name": "ledgers/smoke",
"compaction": {
"schedule": "daily",
"min_segments": 32,
"max_segments": 128
},
"key": "workflow_run_id",
"max_patch_kb": 10,
"max_record_kb": 4,
"max_segment_kb": 100,
"name": "smoke",
"schema": {
"additionalProperties": false,
"properties": {
"record_type": {
"enum": [
"repo_memory_ledger_smoke"
]
},
"result": {
"enum": [
"passed"
]
},
"workflow_run_id": {
"type": "string"
}
},
"required": [
"record_type",
"workflow_run_id",
"result"
],
"type": "object"
},
"type": "table"
}
GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-5.json
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
await main();
- name: Report ledger compaction application failures
if: ${{ steps.apply_0.outcome == 'failure' || steps.apply_1.outcome == 'failure' || steps.apply_2.outcome == 'failure' || steps.apply_3.outcome == 'failure' || steps.apply_4.outcome == 'failure' || steps.apply_5.outcome == 'failure' }}
run: exit 1
work_queue_compaction:
name: Compact work queue
if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
runs-on: ubuntu-slim
permissions:
contents: write
steps:
- name: Checkout actions folder
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
sparse-checkout: |
actions
clean: false
persist-credentials: false
- name: Setup Scripts
uses: ./actions/setup
with:
destination: ${{ runner.temp }}/gh-aw/actions
- name: Plan and apply work queue compaction
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
GH_AW_WORK_QUEUE_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/work-queue-compaction/plan.json
with:
script: |
const path = require('path');
const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
setupGlobals(core, github, context, exec, io, getOctokit);
const { main: plan } = require(path.join(actionsDir, 'work_queue_compaction_plan.cjs'));
const result = await plan();
if (result.status === 'planned') {
const { main: apply } = require(path.join(actionsDir, 'work_queue_compaction_apply.cjs'));
await apply();
}