ci: schedule bounded hourly product development by seonghobae · Pull Request #504 · ContextualWisdomLab/newsdom-api

seonghobae · 2026-08-03T05:28:33Z

Summary

Add a fail-closed hourly product-development loop that creates at most one bounded Copilot cloud-agent task when the repository has no open pull requests and no active or unknown Agent Task.

TDD evidence

Added the workflow contract tests first.
Verified the RED state: all three tests failed because .github/workflows/hourly-product-development.yml did not exist.
Added the minimal workflow and operating documentation.
Re-ran the contract: 3 passed.
Parsed the workflow with a safe YAML base loader and verified the hourly schedule, 15-minute runtime bound, and job structure.

Behavior

Runs at minute 41 of every hour and through manual workflow_dispatch.
Defers whenever any open PR exists, leaving review, repair, exact-head validation, and merge to the central organization maintenance loop.
Inventories Agent Tasks before creation and fails closed on a missing token, unavailable inventory, active work, or an unknown task state.
Uses read-only GITHUB_TOKEN only for PR inventory and a fine-grained COPILOT_GITHUB_TOKEN for the Agent Tasks API.
Limits each maintenance run to 15 minutes so a stalled preview API call cannot accumulate indefinitely behind the hourly single-flight concurrency group.
Creates exactly one test-first, buyer-visible, reviewable PR task against develop.
Requires 100% production statement/branch coverage, complete production docstrings, security checks, packaging, strict docs, CHANGELOG, and affected documentation.
Preserves NewsDOM API as both a standalone service and a modular CWL/naruon sidecar.
Directs Figma/Product Design use only when a selected increment has a genuine UI or interaction surface.
Forbids autonomous merge, publication, release, or review-gate bypass.

Primary-source verification

GitHub's current Agent Tasks REST documentation identifies the endpoints as public preview, requires Agent tasks repository permission (read for inventory and read/write for task creation), supports fine-grained personal access tokens or GitHub App user access tokens, and explicitly excludes GitHub App installation access tokens. The workflow therefore does not use GITHUB_TOKEN for Agent Tasks calls and pins the supported REST API version 2022-11-28.

Files

.github/workflows/hourly-product-development.yml
tests/test_hourly_product_development.py
docs/workflow/hourly-product-development.md
CHANGELOG.md

Operational prerequisite

Configure COPILOT_GITHUB_TOKEN as a repository or organization secret with Agent tasks read/write permission for this repository. The authenticating user also needs an eligible Copilot Business or Enterprise subscription and organization policy access. Without the credential, or when task inventory cannot be proven complete, the workflow records the reason and creates no work.

Scheduled workflows execute from the default branch, so this loop becomes active only after it is merged into develop.

Stacked dependency

This draft is stacked on security PR #467. After #467 lands, the comparison against develop must contract to this workflow change and be revalidated on the resulting current head before this PR is marked ready.

Git Flow target

ci/* → develop.

pip-audit against the runtime lock (uv export --no-dev) flagged real advisories in the exact PDF/image parsing path this service depends on. Re-locked with targeted upgrades (all within the existing pyproject.toml version ranges): - pillow 12.2.0 -> 12.3.0 (PYSEC-2026-3451/3452/3453/3454/3493/3494/3495/3496: eight image-decoder advisories). - pypdf 6.13.3 -> 6.14.2 (CVE-2026-59935/59936/59937/59938: PDF parsing). - click 8.3.2 -> 8.4.2 (PYSEC-2026-2132). - setuptools 81.0.0 -> 83.0.0 (CVE-2026-59890, build tool). Verification: `uv export --frozen --no-emit-project --no-dev | pip-audit` -> No known vulnerabilities found. Lock diff is confined to these four packages and their hashes. Residual (documented, not fixable in place): pymdown-extensions 10.21.3 CVE-2026-61632 requires a major bump to 11.0.0, but mkdocs-material 9.6.x caps pymdown-extensions to <11. It is a docs-build-only dependency (mkdocs), not on the runtime/API surface, so it does not affect the shipped image or the `/parse` path; clearing it needs a coordinated docs-toolchain upgrade. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8

…fting mkdocs-material to 9.7.x The org Security Scan `trivy-fs` job fails on this repo (base branch and every open PR) with: [MEDIUM (security-severity=5.3)] CVE-2026-61632 uv.lock - pymdown-extensions pymdown-extensions 10.21.3 is vulnerable; the fix is 11.0.0+. It could not be upgraded because mkdocs-material 9.6.x pins `pymdown-extensions~=10.2` (i.e. <11). The docs toolchain deliberately held `mkdocs-material<9.7` to avoid the 9.7 "MkDocs 2.0" warning banner (encoded in pyproject, two tests, and CONTRIBUTING.md). That caution-hold now blocks a real security fix and fails required CI, so it is lifted to the minimum extent needed: bump only the theme to `mkdocs-material>=9.7,<9.8` (which relaxes its pymdown-extensions cap to `>=10.2`). The MkDocs *core* stays on the 1.x line (`mkdocs>=1.6,<2.0` unchanged) — the 9.7 theme still builds on MkDocs 1.x. Resulting lock: pymdown-extensions 10.21.3 -> 11.0.1, mkdocs-material 9.6.23 -> 9.7.7 (plus the runtime pillow/pypdf/click and setuptools bumps from the previous commit). Governance re-documented coherently: - CONTRIBUTING.md: explains the theme now tracks 9.7.x for the CVE fix while the MkDocs core stays 1.x; the 9.7 banner is informational and non-fatal under --strict. - tests/test_project_metadata.py: assertions updated to the new pin and the CONTRIBUTING rationale (CVE-2026-61632). Verification: - `uv run --frozen --extra docs mkdocs build --strict` -> builds cleanly (informational MkDocs 2.0 banner only, exit 0). - `uv export --frozen --no-emit-project --all-extras | pip-audit --no-deps` -> No known vulnerabilities found (runtime and full sets). - `PYTHONWARNINGS=error uv run --frozen --all-extras pytest` -> 430 passed. - No src/ change, so the 100% branch-coverage gate is unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Msz8Dni5zRaqPatNCmZJZ8

coderabbitai · 2026-08-03T05:28:43Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 17e4a795-ebef-4c7d-be42-2cf6d7fbac72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-03T06:00:29Z

Parking this hourly product-development workflow until security baseline PR #467 is merged. The branch and full TDD/documentation work are preserved. Reopen after develop contains #467, reconstruct a clean workflow-only diff, rerun the exact-head quality/security checks, then activate the schedule through normal review and merge. Closing the stacked draft now prevents redundant Actions and review traffic while the repository is externally blocked.

claude and others added 3 commits July 30, 2026 10:15

test(ci): define hourly product-development contract

efc320c

seonghobae added 10 commits August 3, 2026 14:30

ci: add fail-closed hourly product-development loop

77b53c1

docs(ci): document hourly product-development loop

75650b8

test(ci): make buyer-value contract formatting-agnostic

a5e7fc2

test(ci): make protected-action contract line-wrap safe

e9305ae

docs(changelog): record hourly product-development loop

336fc91

fix(ci): use supported GitHub API version for Agent Tasks

434e880

test(ci): pin supported Agent Tasks API version

54c85c3

docs(ci): record supported Agent Tasks API contract

78ce0ea

ci: bound hourly product-development runtime

41a447e

test(ci): enforce bounded hourly workflow runtime

6f3993e

seonghobae closed this Aug 3, 2026

Navigation Menu

Uh oh!

ci: schedule bounded hourly product development - #504

ci: schedule bounded hourly product development#504
seonghobae wants to merge 13 commits into
developfrom
ci/hourly-commercial-maintenance

seonghobae commented Aug 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading

Review skipped

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

seonghobae commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

TDD evidence

Behavior

Primary-source verification

Files

Operational prerequisite

Stacked dependency

Git Flow target

Uh oh!

coderabbitai Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

seonghobae commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

seonghobae commented Aug 3, 2026 •

edited

Loading

coderabbitai Bot commented Aug 3, 2026 •

edited

Loading