Remove hardcoded bot usernames, use vars.BOT_USERNAME

[james-in-a-box]

Remove hardcoded bot usernames, use vars.BOT_USERNAME

The codebase contained hardcoded james-in-a-box bot usernames in workflow
inputs, shell script defaults, Python module defaults, and a job-level if:
condition. This prevented external adopters from using the SDLC workflows
with their own GitHub Apps. This was flagged as issue #9 in PR #457's review.

Entry-point workflows now use ${{ vars.BOT_USERNAME || 'egg' }} instead of
hardcoded values, allowing configuration via repository variables. The
self-trigger prevention check in sdlc-hitl.yml was moved from the job-level
if: condition (which can't access needs outputs) to an early step that
reads the configured bot_username. Script and module defaults were changed
from james-in-a-box to the generic egg. Documentation and test fixtures
were updated to use generic bot names.

After merging, set the BOT_USERNAME repository variable to james-in-a-box
to preserve current behavior for this repository.

Fixes #458

Test plan:

• Verified all 73 gateway policy tests pass with updated fixtures
• Confirm entry-point workflows resolve vars.BOT_USERNAME correctly
• Verify self-trigger prevention in sdlc-hitl.yml process-feedback job
• Check action/build-mention-prompt.sh defaults to egg when BOT_USERNAME unset

Authored-by: egg

[james-in-a-box]

No agent-mode design concerns.

This PR is infrastructure/configuration work — making bot identity configurable rather than hardcoded. The changes don't involve agent workflow design patterns:

• No pre-fetching of context that would constrain agent exploration
• No structured output requirements imposed on agents
• No post-processing pipelines parsing agent output
• No rigid procedures micromanaging agent behavior
• Security constraints remain sandbox-enforced

The self-trigger prevention moving from job-level if: to step-level is a reasonable GitHub Actions workaround that doesn't affect agent design.

— Authored by egg

[james-in-a-box]

Review: Remove hardcoded bot usernames, use vars.BOT_USERNAME

This PR addresses issue #458 by replacing hardcoded james-in-a-box bot usernames with configurable vars.BOT_USERNAME repository variables, and moving self-trigger prevention from job-level to step-level in sdlc-hitl.yml.

Issues Found

1. Incomplete Scope: Other workflows still have hardcoded defaults in resolve-inputs

The PR correctly updates entry-point workflows (on-check-failure.yml, on-pull-request.yml, etc.) to use vars.BOT_USERNAME, but several reusable workflows still have hardcoded james-in-a-box in their resolve-inputs fallbacks:

• .github/workflows/on-review-feedback.yml:83: echo "bot_username=${{ inputs.bot_username || 'james-in-a-box' }}"
• .github/workflows/on-mention.yml:81: echo "bot_username=${{ inputs.bot_username || 'james-in-a-box' }}"
• .github/workflows/sdlc-pipeline.yml:98: echo "bot_username=${{ inputs.bot_username || 'james-in-a-box' }}"
• .github/workflows/sdlc-work-loop.yml:194: echo "bot_username=${{ inputs.bot_username || 'james-in-a-box' }}"

These resolve-inputs fallbacks should also be updated to use 'egg' for consistency with sdlc-hitl.yml:66 which now uses 'egg'. While callers can override via inputs, the internal fallbacks should match the documented default.

Recommendation: Update these resolve-inputs fallbacks to 'egg' for consistency, or document why they're intentionally left as james-in-a-box.

2. Input default inconsistency between workflows

The PR updates sdlc-hitl.yml input default from james-in-a-box to egg (line 23), but other reusable workflows still define default: "james-in-a-box" in their inputs:

• on-review-feedback.yml:31
• on-mention.yml:27
• sdlc-pipeline.yml:37
• sdlc-work-loop.yml:84
• reusable-review.yml:18
• reusable-autofix.yml:24
• reusable-conflict-resolve.yml:19

This creates an inconsistency: some workflows default to egg, others to james-in-a-box. If the goal is to allow external adopters to use generic defaults, all should be updated.

Recommendation: Either update all workflow input defaults to egg, or explicitly document that these are intentionally left for backward compatibility.

3. Minor: Documentation mentions only entry-point workflows

The new documentation in docs/guides/reusable-workflows.md (lines 149-175) explains vars.BOT_USERNAME usage but the example shows calling a reusable workflow (reusable-review.yml), not an entry-point workflow. Since the reusable workflows receive bot_username via the with: input block, this is correct—but it would be clearer to note that:

• Entry-point workflows use vars.BOT_USERNAME directly
• When calling reusable workflows, you pass it via the bot_username input

What Looks Good

1. Self-trigger prevention move is correct: Moving from job-level if: to step-level check in handle-feedback job allows the check to use the configured bot_username from needs.resolve-inputs.outputs. The implementation pattern matches other similar checks in the file (e.g., check-trigger job at line 108, handle-phase-approval at line 586).

2. Step guards are properly chained: Subsequent steps correctly check steps.auth.outputs.authorized == 'true' before proceeding.

3. Test fixture updates are appropriate: Using test-bot instead of james-in-a-box in test fixtures is cleaner and avoids coupling tests to production values.

4. Documentation and error messages updated: The gateway/policy.py error message now shows a generic example.

Summary

The core changes to entry-point workflows and sdlc-hitl.yml are correct. However, the PR leaves several reusable workflows with hardcoded james-in-a-box defaults and resolve-inputs fallbacks, creating an inconsistency between sdlc-hitl.yml (which now defaults to egg) and other workflows.

If this is intentional (leaving reusable workflow defaults unchanged for backward compatibility while only updating entry-points), please document that decision. Otherwise, the scope should be expanded to cover all workflows for consistency.

— Authored by egg

[james-in-a-box]

egg is addressing review feedback...

[james-in-a-box]

Addressed all review feedback issues.

Issue 1: Incomplete Scope - resolve-inputs fallbacks

Updated all four reusable workflows to use 'egg' as the fallback in resolve-inputs:

• on-review-feedback.yml:83
• on-mention.yml:81
• sdlc-pipeline.yml:98
• sdlc-work-loop.yml:194

Issue 2: Input default inconsistency

Updated all seven workflows with bot_username input defaults to use "egg":

• on-review-feedback.yml:31
• on-mention.yml:27
• sdlc-pipeline.yml:37
• sdlc-work-loop.yml:84
• reusable-review.yml:18
• reusable-autofix.yml:24
• reusable-conflict-resolve.yml:19

Issue 3: Documentation clarity

Updated docs/guides/reusable-workflows.md to clarify:

• Entry-point workflows use vars.BOT_USERNAME directly
• Reusable workflows receive bot_username via the with: input block

All workflows now consistently default to egg, matching the documented default in the Common Parameters table.

— Authored by egg

[james-in-a-box]

egg feedback addressed. View run logs

2 previous review(s) hidden.

[james-in-a-box]

Agent-mode design re-review: No concerns.

Changes since 86b58ad address all three issues from the previous review:

1. ✓ Resolve-inputs fallbacks now use 'egg' in all 4 workflows
2. ✓ Input defaults now use "egg" in all 7 workflows
3. ✓ Documentation now clarifies entry-point vs reusable workflow usage

This remains infrastructure/configuration work with no agent-mode design implications. Ready for human approval.

— Authored by egg

[james-in-a-box]

egg agent-mode-design completed. View run logs

[james-in-a-box]

Re-Review: Feedback Addressed

All three issues from my previous review have been addressed correctly.

Verification Summary

Issue 1: resolve-inputs fallbacks ✅
All four resolve-inputs fallbacks now use 'egg':

• on-review-feedback.yml:83
• on-mention.yml:81
• sdlc-pipeline.yml:98
• sdlc-work-loop.yml:194

Issue 2: input default inconsistency ✅
All seven workflow input defaults now use "egg":

• on-review-feedback.yml:31
• on-mention.yml:27
• sdlc-pipeline.yml:37
• sdlc-work-loop.yml:84
• reusable-review.yml:18
• reusable-autofix.yml:24
• reusable-conflict-resolve.yml:19

Issue 3: documentation clarity ✅
Documentation in reusable-workflows.md (lines 162-196) now clearly explains:

• Entry-point workflows use vars.BOT_USERNAME directly
• Reusable workflows receive bot_username via the with: input block
• Includes examples for both scenarios

Observation (Non-blocking)

The mention_patterns default in on-mention.yml:42 and its resolve-inputs fallback at line 83 still contain @james-in-a-box:

default: "@james-in-a-box,@egg"

This is a separate parameter from bot_username and falls outside the scope of this PR (which targets bot username configuration), but may warrant a follow-up to ensure mention_patterns is consistent with the configured bot username. The documentation in docs/guides/github-automation.md:218 also references both mentions.

No blocking issues found.

— Authored by egg

[james-in-a-box]

egg review completed. View run logs