chore: sync workflow templates by stranske · Pull Request #144 · stranske/Counter_Risk

stranske · 2026-02-17T05:19:55Z

Sync Summary

Files Updated

autofix.yml: Autofix workflow - automatically fixes lint/format issues
agents-71-codex-belt-dispatcher.yml: Codex belt dispatcher - selects issues and creates codex/issue-N branches for agent work
agents-72-codex-belt-worker.yml: Codex belt worker - executes Codex agent on issues with full prompt and context
agents-72-codex-belt-worker-dispatch.yml: Codex belt worker dispatch wrapper - allows workflow_dispatch for the worker
agents-73-codex-belt-conveyor.yml: Codex belt conveyor - orchestrates belt worker execution and handles completion
agents-autofix-loop.yml: Autofix loop - dispatches Codex when autofix can't fix Gate failures (deprecated; replaced by agents-81-gate-followups.yml, removal no earlier than 2026-02-15)
agents-verify-to-issue.yml: Verify to issue v1 (DEPRECATED) - disabled workflow, replaced by v2
agents-verify-to-issue-v2.yml: Verify to issue v2 - creates follow-up issues from verification feedback with LLM curation (Phase 4E; deprecated for agents-80-pr-event-hub.yml, removal no earlier than 2026-02-15)
agents-verify-to-new-pr.yml: Verify to new PR - creates follow-up issue and triggers auto-pilot to prepare a new PR
agents-auto-pilot.yml: Auto-pilot - end-to-end automation orchestrator (format → optimize → agent → verify)
sync_dev_dependencies.py: Syncs dev dependency versions from autofix-versions.env to pyproject.toml
requirements-llm.txt: Pinned LLM dependencies - required by agents-auto-pilot.yml
registry.yml: Agent registry - source of truth for agent keys and runner workflow mapping
agent_registry.js: Agent registry helper - loads registry and resolves agent key from labels
keepalive_loop.js: Core keepalive loop logic
issue_optimizer.py: Issue optimizer - analyzes issues and suggests improvements
pr_verifier.py: PR verifier - validates PR changes against acceptance criteria
followup_issue_generator.py: Follow-up issue generator - creates issues from verification feedback
llm_provider.py: LLM provider configuration - GitHub Models and OpenAI client setup
CLAUDE.md: Context file for Claude/AI assistants

Files Skipped

pr-00-gate.yml: File exists and sync_mode is create_only
ci.yml: File exists and sync_mode is create_only
dependabot.yml: File exists and sync_mode is create_only
llm_slots.json: None

Review Checklist

CI passes with updated workflows
No repo-specific customizations were overwritten

Source: stranske/Workflows
Manifest: .github/sync-manifest.yml

Automated sync from stranske/Workflows Template hash: a4274c4ed410 Changes synced from sync-manifest.yml

agents-workflows-bot · 2026-02-17T05:20:15Z

⚠️ Action Required: Unable to determine source issue for PR #144. The PR title, branch name, or body must contain the issue number (e.g. #123, branch: issue-123, or the hidden marker ).

agents-workflows-bot · 2026-02-17T05:20:50Z

🤖 Keepalive Loop Status

PR #144 | Agent: Codex | Iteration 0/5

Current State

Metric	Value
Iteration progress	[----------] 0/5
Action	wait (missing-agent-label)
Disposition	skipped (transient)
Gate	failure
Tasks	0/24 complete
Timeout	45 min (default)
Timeout usage	4m elapsed (9%, 41m remaining)
Keepalive	❌ disabled
Autofix	❌ disabled

🔍 Failure Classification

Copilot

Pull request overview

Syncs workflow templates/scripts from stranske/Workflows, expanding the automation stack to support agent registry–driven routing and adding LangSmith trace metadata capture for LangChain-based steps.

Changes:

Added agent registry (.github/agents/registry.yml) and JS helper (.github/scripts/agent_registry.js), and updated multiple workflows to resolve agent_key / branch prefixes from it.
Added LangSmith metadata + trace URL extraction utilities and propagated trace IDs/URLs into verifier + follow-up issue generator outputs.
Updated workflow LLM dependency pins and refreshed several workflows’ triggering/labeling behavior (e.g., autofix workflow_job trigger, verify-to-* label routing).

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tools/requirements-llm.txt	Bumps pinned LangChain-related runtime deps for workflow LLM steps.
tools/llm_provider.py	Adds shared LangSmith config/metadata builders and trace extraction helpers.
scripts/sync_dev_dependencies.py	Simplifies output/flow for `--check` vs `--apply`.
scripts/langchain/pr_verifier.py	Captures LangSmith trace id/url from invocations and surfaces them in reports.
scripts/langchain/issue_optimizer.py	Minor formatting/whitespace sync.
scripts/langchain/followup_issue_generator.py	Captures LangSmith traces per operation and appends trace links as comments.
CLAUDE.md	Removes the CI test policy section from assistant guidance.
.github/workflows/autofix.yml	Adds `workflow_job` trigger and refactors PR context resolution/helpers.
.github/workflows/agents-verify-to-new-pr.yml	Includes registry helper in sparse checkout; routes follow-up issue labels based on resolved agent.
.github/workflows/agents-verify-to-issue.yml	Updates user-facing guidance to reference `agent:*` labels generically.
.github/workflows/agents-verify-to-issue-v2.yml	Includes registry helper in sparse checkout; routes follow-up issue labels based on resolved agent.
.github/workflows/agents-autofix-loop.yml	Adds agent type detection via registry and gates loop to Codex-only support.
.github/workflows/agents-auto-pilot.yml	Loads default agent + branch prefix from registry and dispatches belt with `agent_key`.
.github/workflows/agents-73-codex-belt-conveyor.yml	Adds `agent_key` input and uses registry-derived branch prefix + concurrency naming.
.github/workflows/agents-72-codex-belt-worker.yml	Adds `agent_key` input and updates labeling/branch-step conventions to be agent-aware.
.github/workflows/agents-72-codex-belt-worker-dispatch.yml	Adds `agent_key` input passthrough for manual dispatch wrapper.
.github/workflows/agents-71-codex-belt-dispatcher.yml	Adds `agent_key` input/output and uses registry-derived queue labels + branch prefix.
.github/scripts/keepalive_loop.js	Resolves agent routing via registry helper (safer handling of conflicting agent labels).
.github/scripts/agent_registry.js	New registry loader + minimal YAML parser + routing/config helpers.
.github/agents/registry.yml	New source-of-truth registry for agents (default agent, secrets, branch prefix, capabilities).

Comments suppressed due to low confidence (1)

.github/workflows/agents-72-codex-belt-worker.yml:236

This step interpolates ${{ inputs.agent_key }} directly into a single-quoted JavaScript string. If the input contains quotes/newlines, it can break the script and potentially allow JS injection. Use ${{ toJson(inputs.agent_key) }} (or an env var) to safely pass the input into the github-script step.

          script: |
            const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';
            const issueInput = '${{ inputs.issue }}'.trim();
            const branchInput = '${{ inputs.branch }}'.trim();
            const baseInput = '${{ inputs.base }}'.trim();
            const sourceInput = '${{ inputs.source }}'.trim();

Copilot · 2026-02-17T05:26:02Z

tools/llm_provider.py

+        # Fallback: Some LangChain providers may use id attribute directly
+        # WARNING: This may not always correspond to the LangSmith trace ID
+        if hasattr(response, "id"):
+            trace_id = str(response.id)
+            logger.debug(
+                "Using response.id as trace ID (fallback). "
+                "Verify this corresponds to LangSmith trace for your provider."
+            )
+            return trace_id
+
+        # Additional fallback for compatibility
+        if hasattr(response, "__dict__"):
+            response_dict = response.__dict__
+            if "id" in response_dict:
+                trace_id = str(response_dict["id"])
+                logger.debug(
+                    "Using response.__dict__['id'] as trace ID (fallback). "
+                    "Verify this corresponds to LangSmith trace for your provider."
+                )
+                return trace_id


extract_trace_id() falls back to using response.id / __dict__['id'] as the LangSmith trace ID without validating the format. In many LangChain providers this id is a provider message/completion id (e.g., chatcmpl-...) rather than a LangSmith run UUID, which will produce misleading trace URLs/logging. Consider only accepting the fallback when the value matches the expected LangSmith run id format (e.g., UUID), otherwise return None.

Copilot · 2026-02-17T05:26:03Z

.github/workflows/agents-71-codex-belt-dispatcher.yml

            const forced = '${{ inputs.force_issue }}';
+            const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';


This step interpolates ${{ inputs.agent_key }} directly into a single-quoted JavaScript string. If the input contains quotes/newlines (even accidentally), it can break the script (and in the worst case enable script injection). Prefer injecting workflow inputs via ${{ toJson(inputs.agent_key) }} (or pass via env) so the value is safely escaped before it reaches JS.

Suggested change

const forced = '${{ inputs.force_issue }}';

const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';

const forced = ${{ toJson(inputs.force_issue) }};

const agentKeyInput = ${{ toJson(inputs.agent_key) }};

const agentKey = String(agentKeyInput || 'codex').trim().toLowerCase() || 'codex';

Copilot · 2026-02-17T05:26:03Z

.github/workflows/agents-73-codex-belt-conveyor.yml

            const issueValue = Number(issueRaw);
            const issueNumber = Number.isFinite(issueValue) && issueValue > 0 ? issueValue : null;
            const branch = '${{ inputs.branch }}'.trim();
+            const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';
            const prNumber = Number('${{ inputs.pr_number }}');
            const targetPr = Number.isFinite(prNumber) ? `#${prNumber}` : 'Unknown';
            const modeDisplay = dryRun ? 'Preview (dry run)' : 'Live (merge ready)';
            const runId = context.runId;
            const concurrencyKey = branch || issueNumber || runId;
-            const concurrencyGroup = concurrencyKey ? `codex-belt-conveyor-${concurrencyKey}` : '';
+            const concurrencyGroup = concurrencyKey
+              ? (agentKey === 'codex'
+                ? `codex-belt-conveyor-${concurrencyKey}`


inputs.agent_key is injected into JS via a single-quoted string literal (several occurrences in this workflow). If the value contains quotes/newlines, it can break the script and may enable JS injection. Prefer ${{ toJson(inputs.agent_key) }} (or env) so the value is JSON-escaped before use.

Copilot · 2026-02-17T05:26:03Z

.github/workflows/agents-73-codex-belt-conveyor.yml

+            const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';
+            let branchPrefix = 'codex/issue-';
+            try {
+              const { getAgentConfig } = require('./.github/scripts/agent_registry.js');
+              const cfg = getAgentConfig(agentKey);
+              branchPrefix = String(cfg.branch_prefix || branchPrefix);


Another instance of directly interpolating ${{ inputs.agent_key }} into a single-quoted JS string literal. To avoid broken scripts / injection risk, pass the value via ${{ toJson(inputs.agent_key) }} (or env) before calling getAgentConfig() / building regex patterns.

Copilot · 2026-02-17T05:26:03Z

.github/workflows/agents-73-codex-belt-conveyor.yml

            const { withRetry } = retryHelpers;
            const { owner, repo } = context.repo;
+            const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';
            try {
              await withRetry(() => github.rest.actions.createWorkflowDispatch({
                owner,
                repo,
                workflow_id: 'agents-71-codex-belt-dispatcher.yml',
-                ref: 'refs/heads/' + (process.env.GITHUB_REF_NAME || context.ref.replace('refs/heads/', ''))
+                ref: 'refs/heads/' + (process.env.GITHUB_REF_NAME || context.ref.replace('refs/heads/', '')),
+                inputs: {
+                  agent_key: agentKey,
+                },


This workflow dispatch step also injects ${{ inputs.agent_key }} into JS via a single-quoted literal before using it in API inputs. Use ${{ toJson(inputs.agent_key) }} (or env) so the string is safely escaped and cannot break the github-script step.

github-actions · 2026-02-17T05:29:27Z

Autofix updated these files:

scripts/langchain/issue_optimizer.py
scripts/langchain/pr_verifier.py
tests/test_historical_update.py

stranske · 2026-02-17T05:38:29Z

Superseded by newer sync PR #145

chore: sync workflow templates from Workflows repo

2ae89ff

Automated sync from stranske/Workflows Template hash: a4274c4ed410 Changes synced from sync-manifest.yml

Copilot AI review requested due to automatic review settings February 17, 2026 05:19

stranske added sync Automated sync from Workflows automated Automated sync from Workflows labels Feb 17, 2026

stranske temporarily deployed to agent-standard February 17, 2026 05:19 — with GitHub Actions Inactive

stranske temporarily deployed to agent-standard February 17, 2026 05:20 — with GitHub Actions Inactive

Copilot started reviewing on behalf of stranske February 17, 2026 05:21 View session

stranske added the autofix:escalated label Feb 17, 2026

stranske temporarily deployed to agent-standard February 17, 2026 05:25 — with GitHub Actions Inactive

Copilot AI reviewed Feb 17, 2026

View reviewed changes

stranske temporarily deployed to agent-standard February 17, 2026 05:26 — with GitHub Actions Inactive

github-actions bot added the autofix Triggers autofix on PR label Feb 17, 2026

chore(autofix): formatting/lint

61f1bc6

github-actions bot added the autofix:patch label Feb 17, 2026

stranske closed this Feb 17, 2026

stranske deleted the sync/workflows-a4274c4ed410 branch February 17, 2026 05:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync workflow templates#144

chore: sync workflow templates#144
stranske wants to merge 2 commits intomainfrom
sync/workflows-a4274c4ed410

stranske commented Feb 17, 2026

Uh oh!

agents-workflows-bot bot commented Feb 17, 2026

Uh oh!

agents-workflows-bot bot commented Feb 17, 2026 •

edited by stranske-keepalive bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

stranske commented Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		const forced = '${{ inputs.force_issue }}';
		const agentKey = String('${{ inputs.agent_key }}' \|\| 'codex').trim().toLowerCase() \|\| 'codex';

-            const forced = '${{ inputs.force_issue }}';
-            const agentKey = String('${{ inputs.agent_key }}' || 'codex').trim().toLowerCase() || 'codex';
+            const forced = ${{ toJson(inputs.force_issue) }};
+            const agentKeyInput = ${{ toJson(inputs.agent_key) }};
+            const agentKey = String(agentKeyInput || 'codex').trim().toLowerCase() || 'codex';

Conversation

stranske commented Feb 17, 2026

Sync Summary

Files Updated

Files Skipped

Review Checklist

Uh oh!

agents-workflows-bot bot commented Feb 17, 2026

Uh oh!

agents-workflows-bot bot commented Feb 17, 2026 • edited by stranske-keepalive bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Keepalive Loop Status

Current State

🔍 Failure Classification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

stranske commented Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

agents-workflows-bot bot commented Feb 17, 2026 •

edited by stranske-keepalive bot

Loading