From e6a1c52b1ccc6d55fad802909f6304b81a971c34 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Mar 2026 01:05:38 +0000 Subject: [PATCH 1/2] Initial plan From 2b043dd189148185e8756b3b7983bb60e70062d0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 12 Mar 2026 01:19:47 +0000 Subject: [PATCH 2/2] update release.md: replace sync_actions workflow_call with environment-gated notification job - Replace workflow_call to sync-actions with a regular job using environment: gh-aw-actions-release - Add notification step that writes a job summary instructing the approver to run sync-actions in github/gh-aw-actions and merge the PR - Add environment property support to jobs schema in main_workflow_schema.json - Add environment extraction in buildCustomJobs in compiler_jobs.go - Recompile release.lock.yml Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/release.lock.yml | 28 ++++++++++++++------ .github/workflows/release.md | 27 ++++++++++++++----- pkg/parser/schemas/main_workflow_schema.json | 25 +++++++++++++++++ pkg/workflow/compiler_jobs.go | 20 ++++++++++++++ 4 files changed, 85 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml index 7cf31d0145b..cea160415b9 100644 --- a/.github/workflows/release.lock.yml +++ b/.github/workflows/release.lock.yml @@ -23,7 +23,7 @@ # # Build, test, and release gh-aw extension, then generate and prepend release highlights # -# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"2cb0f21ae34ffe6602495148ee30ff8a2a3da4803213b7d294805b71dfa02051"} +# gh-aw-metadata: {"schema_version":"v2","frontmatter_hash":"7f3dfef841acab2ac082e6d01ea563a16d639f9d37dd4de15164cc9ed61c13ce"} name: "Release" "on": @@ -1469,12 +1469,24 @@ jobs: - config - pre_activation - push_tag - permissions: - contents: write - pull-requests: write + runs-on: ubuntu-latest + environment: gh-aw-actions-release + steps: + - name: "Notify - run sync actions and merge PR" + run: | + echo "## Manual Sync Actions Required" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "The following manual steps must be completed in **github/gh-aw-actions** before this release continues:" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "1. Trigger the **sync-actions** workflow in github/gh-aw-actions:" >> "$GITHUB_STEP_SUMMARY" + echo " https://github.com/github/gh-aw-actions/actions/workflows/sync-actions.yml" >> "$GITHUB_STEP_SUMMARY" + echo "2. Merge the PR created by the sync-actions workflow in **github/gh-aw-actions**" >> "$GITHUB_STEP_SUMMARY" + echo "3. Verify that tag **\`${RELEASE_TAG}\`** exists in github/gh-aw-actions" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "Once the above steps are complete, approve the **gh-aw-actions-release** environment gate to continue the release." >> "$GITHUB_STEP_SUMMARY" - uses: github/gh-aw-actions/.github/workflows/sync-actions.yml@main - with: - ref: ${{ needs.config.outputs.release_tag }} - secrets: inherit + echo "Sync actions instructions written for release: $RELEASE_TAG" + echo "Ensure the sync-actions job has been run and the PR merged in github/gh-aw-actions before approving." + env: + RELEASE_TAG: ${{ needs.config.outputs.release_tag }} diff --git a/.github/workflows/release.md b/.github/workflows/release.md index abfec8f51ee..86091fa73fb 100644 --- a/.github/workflows/release.md +++ b/.github/workflows/release.md @@ -203,13 +203,26 @@ jobs: sync_actions: needs: ["pre_activation", "activation", "config", "push_tag"] - uses: github/gh-aw-actions/.github/workflows/sync-actions.yml@main - with: - ref: ${{ needs.config.outputs.release_tag }} - secrets: inherit - permissions: - contents: write - pull-requests: write + runs-on: ubuntu-latest + environment: gh-aw-actions-release + steps: + - name: Notify - run sync actions and merge PR + env: + RELEASE_TAG: ${{ needs.config.outputs.release_tag }} + run: | + echo "## Manual Sync Actions Required" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "The following manual steps must be completed in **github/gh-aw-actions** before this release continues:" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "1. Trigger the **sync-actions** workflow in github/gh-aw-actions:" >> "$GITHUB_STEP_SUMMARY" + echo " https://github.com/github/gh-aw-actions/actions/workflows/sync-actions.yml" >> "$GITHUB_STEP_SUMMARY" + echo "2. Merge the PR created by the sync-actions workflow in **github/gh-aw-actions**" >> "$GITHUB_STEP_SUMMARY" + echo "3. Verify that tag **\`${RELEASE_TAG}\`** exists in github/gh-aw-actions" >> "$GITHUB_STEP_SUMMARY" + echo "" >> "$GITHUB_STEP_SUMMARY" + echo "Once the above steps are complete, approve the **gh-aw-actions-release** environment gate to continue the release." >> "$GITHUB_STEP_SUMMARY" + + echo "Sync actions instructions written for release: $RELEASE_TAG" + echo "Ensure the sync-actions job has been run and the PR merged in github/gh-aw-actions before approving." release: needs: ["pre_activation", "activation", "config", "sync_actions"] diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json index e331e1e95bc..cf6913f56cf 100644 --- a/pkg/parser/schemas/main_workflow_schema.json +++ b/pkg/parser/schemas/main_workflow_schema.json @@ -1857,6 +1857,31 @@ "$ref": "#/properties/concurrency", "description": "Concurrency control configuration for this job. Prevents parallel execution of jobs with the same concurrency group." }, + "environment": { + "oneOf": [ + { + "type": "string", + "description": "The name of the GitHub Actions environment this job references. Environments can have protection rules (required reviewers, wait timers) that must be satisfied before the job runs." + }, + { + "type": "object", + "description": "Environment configuration with name and optional URL.", + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "description": "The name of the GitHub Actions environment." + }, + "url": { + "type": "string", + "description": "The URL to set as the environment URL in the deployment." + } + }, + "required": ["name"] + } + ], + "description": "The GitHub Actions environment this job references. When set, any protection rules for the environment must pass before the job runs. Use this to gate jobs on manual approval workflows." + }, "uses": { "type": "string", "description": "Path to a reusable workflow file to call (e.g., ./.github/workflows/reusable-workflow.yml)" diff --git a/pkg/workflow/compiler_jobs.go b/pkg/workflow/compiler_jobs.go index 75c1c66a852..b371d5d6fc6 100644 --- a/pkg/workflow/compiler_jobs.go +++ b/pkg/workflow/compiler_jobs.go @@ -632,6 +632,26 @@ func (c *Compiler) buildCustomJobs(data *WorkflowData, activationJobCreated bool } } + // Extract environment for custom jobs + if environment, hasEnvironment := configMap["environment"]; hasEnvironment { + switch v := environment.(type) { + case string: + job.Environment = "environment: " + v + case map[string]any: + yamlBytes, err := yaml.Marshal(v) + if err != nil { + return fmt.Errorf("failed to convert environment to YAML for job '%s': %w", jobName, err) + } + lines := strings.Split(strings.TrimSpace(string(yamlBytes)), "\n") + var formattedEnvironment strings.Builder + formattedEnvironment.WriteString("environment:\n") + for _, line := range lines { + formattedEnvironment.WriteString(" " + line + "\n") + } + job.Environment = strings.TrimSuffix(formattedEnvironment.String(), "\n") + } + } + // Extract outputs for custom jobs if outputs, hasOutputs := configMap["outputs"]; hasOutputs { if outputsMap, ok := outputs.(map[string]any); ok {