chore: sync workflow templates by stranske · Pull Request #317 · stranske/Counter_Risk

stranske · 2026-03-02T23:59:55Z

Sync Summary

Files Updated

agents-pr-health.yml: PR health scanner - periodic conflict resolution and failing check re-dispatch
maint-76-claude-code-review.yml: Claude Code review (opt-in) - runs only on labeled PRs or manual dispatch

Files Skipped

pr-00-gate.yml: File exists and sync_mode is create_only
ci.yml: File exists and sync_mode is create_only
dependabot.yml: File exists and sync_mode is create_only
llm_slots.json: None

Review Checklist

CI passes with updated workflows
No repo-specific customizations were overwritten

Source: stranske/Workflows
Manifest: .github/sync-manifest.yml

Automated sync from stranske/Workflows Template hash: 6adbaf966a8d Changes synced from sync-manifest.yml

agents-workflows-bot · 2026-03-03T00:01:14Z

⚠️ Action Required: Unable to determine source issue for PR #317. The PR title, branch name, or body must contain the issue number (e.g. #123, branch: issue-123, or the hidden marker ).

stranske-keepalive · 2026-03-03T00:03:08Z

🤖 Keepalive Loop Status

PR #317 | Agent: Codex | Iteration 0/5

Current State

Metric	Value
Iteration progress	[----------] 0/5
Action	wait (missing-agent-label)
Disposition	skipped (transient)
Gate	success
Tasks	0/6 complete
Timeout	45 min (default)
Timeout usage	7m elapsed (16%, 38m remaining)
Keepalive	❌ disabled
Autofix	❌ disabled

🔍 Failure Classification

stranske-keepalive · 2026-03-03T00:03:09Z

Keepalive Work Log (click to expand)

Time (UTC)	Agent	Action	Result	Files	Progress	Commit	Gate
2026-03-03 00:03:08	Codex	wait (missing-agent-label-transient)	skipped	—	0/6	—	—
2026-03-03 00:04:52	Codex	wait (missing-agent-label-transient)	skipped	—	0/6	—	cancelled
2026-03-03 00:07:46	Codex	wait (missing-agent-label-transient)	skipped	—	0/6	—	success

Copilot

Pull request overview

Syncs in updated GitHub Actions workflow templates from stranske/Workflows, adding an opt-in Claude Code review workflow and adjusting the PR health wrapper’s input passing to the reusable workflow.

Changes:

Added .github/workflows/maint-76-claude-code-review.yml to run Claude Code review only when opted-in via label or manual dispatch.
Updated .github/workflows/agents-pr-health.yml to pass reusable-workflow inputs using explicit 'true'/'false' string patterns and string defaults.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/maint-76-claude-code-review.yml	New opt-in Claude Code Review workflow with label/manual dispatch gating, secret detection, and an integrity guard.
.github/workflows/agents-pr-health.yml	Adjusts `with:` values passed into the reusable PR health workflow (notably boolean/string coercions and defaults).

Copilot · 2026-03-03T00:05:26Z

.github/workflows/maint-76-claude-code-review.yml

+            echo "workflow_unchanged=true" >>"$GITHUB_OUTPUT"
+            exit 0


In the workflow-integrity guard, github.base_ref is empty for workflow_dispatch, so the step unconditionally sets workflow_unchanged=true and allows the secrets-gated jobs to run even when this workflow file was modified on the dispatched ref. This defeats the “workflow must match default branch to safely access secrets” intent for manual dispatch; consider comparing the file against the repository default branch for workflow_dispatch too (or failing closed unless github.ref_name is the default branch).

Suggested change

echo "workflow_unchanged=true" >>"$GITHUB_OUTPUT"

exit 0

echo "github.base_ref is empty; resolving repository default branch from origin/HEAD"

# Ensure we have the remote HEAD reference so we can determine the default branch.

git fetch --no-tags origin '+HEAD:refs/remotes/origin/HEAD'

# Resolve default branch name (strip the leading "origin/").

default_remote_head="$(git symbolic-ref --short refs/remotes/origin/HEAD || true)"

default_branch="${default_remote_head#origin/}"

if [ -z "$default_branch" ]; then

echo "Could not determine default branch; failing closed."

echo "workflow_unchanged=false" >>"$GITHUB_OUTPUT"

exit 0

fi

base_ref="$default_branch"

echo "Using default branch '${base_ref}' for workflow integrity check."

Copilot · 2026-03-03T00:05:27Z

.github/workflows/maint-76-claude-code-review.yml

+              const labels = (pr.labels || []).map((label) => label.name);
+              if (labels.includes("claude-review")) {
+                shouldRun = "true";
+                reason = "label_opt_in";


resolve-target skips draft PRs for manual dispatch, but the pull_request path doesn’t check pr.draft. As written, adding the claude-review label to a draft PR will run the review (and spend tokens) on labeled/synchronize/reopened events; if drafts should be excluded, add the same pr.draft guard in the PR-event branch.

Suggested change

const labels = (pr.labels || []).map((label) => label.name);

if (labels.includes("claude-review")) {

shouldRun = "true";

reason = "label_opt_in";

if (pr.draft) {

reason = "pr_is_draft";

} else {

const labels = (pr.labels || []).map((label) => label.name);

if (labels.includes("claude-review")) {

shouldRun = "true";

reason = "label_opt_in";

}

Copilot · 2026-03-03T00:05:27Z

.github/workflows/agents-pr-health.yml

+      max_prs: ${{ inputs.max_prs || '10' }}
+      cron_interval_hours: ${{ vars.PR_HEALTH_INTERVAL_HOURS || '1' }}


max_prs is declared as a number input, but the expression ${{ inputs.max_prs || '10' }} returns a number when provided and a string when defaulting. If the called reusable workflow expects a consistent type (common when passing inputs across workflows), cast inputs.max_prs to string as well (or keep the value numeric by using a numeric default).

chore: sync workflow templates from Workflows repo

a264d8d

Automated sync from stranske/Workflows Template hash: 6adbaf966a8d Changes synced from sync-manifest.yml

Copilot AI review requested due to automatic review settings March 2, 2026 23:59

stranske added sync Automated sync from Workflows automated Automated sync from Workflows labels Mar 2, 2026

stranske temporarily deployed to agent-standard March 2, 2026 23:59 — with GitHub Actions Inactive

stranske temporarily deployed to agent-standard March 3, 2026 00:00 — with GitHub Actions Inactive

stranske temporarily deployed to agent-standard March 3, 2026 00:01 — with GitHub Actions Inactive

Copilot started reviewing on behalf of stranske March 3, 2026 00:02 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

stranske merged commit 062696e into main Mar 3, 2026
109 of 117 checks passed

stranske deleted the sync/workflows-6adbaf966a8d branch March 3, 2026 00:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync workflow templates#317

chore: sync workflow templates#317
stranske merged 1 commit intomainfrom
sync/workflows-6adbaf966a8d

stranske commented Mar 2, 2026

Uh oh!

agents-workflows-bot bot commented Mar 3, 2026

Uh oh!

stranske-keepalive bot commented Mar 3, 2026 •

edited by agents-workflows-bot bot

Loading

Uh oh!

stranske-keepalive bot commented Mar 3, 2026 •

edited by agents-workflows-bot bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-            echo "workflow_unchanged=true" >>"$GITHUB_OUTPUT"
-            exit 0
+            echo "github.base_ref is empty; resolving repository default branch from origin/HEAD"
+            # Ensure we have the remote HEAD reference so we can determine the default branch.
+            git fetch --no-tags origin '+HEAD:refs/remotes/origin/HEAD'
+            # Resolve default branch name (strip the leading "origin/").
+            default_remote_head="$(git symbolic-ref --short refs/remotes/origin/HEAD || true)"
+            default_branch="${default_remote_head#origin/}"
+            if [ -z "$default_branch" ]; then
+              echo "Could not determine default branch; failing closed."
+              echo "workflow_unchanged=false" >>"$GITHUB_OUTPUT"
+              exit 0
+            fi
+            base_ref="$default_branch"
+            echo "Using default branch '${base_ref}' for workflow integrity check."

		max_prs: ${{ inputs.max_prs \|\| '10' }}
		cron_interval_hours: ${{ vars.PR_HEALTH_INTERVAL_HOURS \|\| '1' }}

Conversation

stranske commented Mar 2, 2026

Sync Summary

Files Updated

Files Skipped

Review Checklist

Uh oh!

agents-workflows-bot bot commented Mar 3, 2026

Uh oh!

stranske-keepalive bot commented Mar 3, 2026 • edited by agents-workflows-bot bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Keepalive Loop Status

Current State

🔍 Failure Classification

Uh oh!

stranske-keepalive bot commented Mar 3, 2026 • edited by agents-workflows-bot bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stranske-keepalive bot commented Mar 3, 2026 •

edited by agents-workflows-bot bot

Loading

stranske-keepalive bot commented Mar 3, 2026 •

edited by agents-workflows-bot bot

Loading