From eb8988306e10e30fc5fa77a96aef768a6e773c64 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 31 Jul 2026 20:28:19 +0000 Subject: [PATCH] chore: sync workflow templates from Workflows repo Automated sync from stranske/Workflows Template hash: 745dc9c0bdbd Changes synced from sync-manifest.yml --- .gitattributes | 3 -- .github/scripts/source_context.js | 35 ++++++++++++++++++- .github/workflows/agents-80-pr-event-hub.yml | 2 +- .github/workflows/agents-auto-label.yml | 27 ++++++++++++-- .github/workflows/agents-auto-pilot.yml | 2 +- .github/workflows/agents-capability-check.yml | 2 +- .github/workflows/agents-decompose.yml | 2 +- .github/workflows/agents-dedup.yml | 2 +- .github/workflows/agents-issue-optimizer.yml | 2 +- .github/workflows/agents-verify-to-new-pr.yml | 3 +- .github/workflows/agents-weekly-metrics.yml | 2 +- .github/workflows/backplane-conformance.yml | 2 +- .../pr-46-dependency-repair-contract.yml | 25 +++++++++++++ 13 files changed, 94 insertions(+), 15 deletions(-) create mode 100644 .github/workflows/pr-46-dependency-repair-contract.yml diff --git a/.gitattributes b/.gitattributes index 566e67b41..79574d771 100644 --- a/.gitattributes +++ b/.gitattributes @@ -12,6 +12,3 @@ ci/autofix/history.json merge=ours linguist-generated # Agent ledger files are metadata, not reviewable code # Mark as generated to exclude from Copilot/Codex code reviews .agents/*.yml linguist-generated - -# Windows command launchers must retain CRLF on every checkout. -*.cmd text eol=crlf diff --git a/.github/scripts/source_context.js b/.github/scripts/source_context.js index 549b2a923..6d8095e25 100644 --- a/.github/scripts/source_context.js +++ b/.github/scripts/source_context.js @@ -50,6 +50,8 @@ const CHECKBOX_SOURCE_PATTERNS = Object.freeze([ ]); const NO_AUTOMATION_CHECKBOX_PATTERN = /\bdo\s+not\s+automate\b|\bhuman[- ]only\b/i; +const DEPENDENCY_REPAIR_PROMOTION_PATTERN = + //; function cleanString(value) { return String(value || '').trim(); @@ -281,6 +283,29 @@ function parseWorkflowSourceBlock(body) { return result; } +function parseDependencyRepairPromotionSource(body) { + const match = String(body || '').match(DEPENDENCY_REPAIR_PROMOTION_PATTERN); + if (!match) { + return null; + } + + try { + const metadata = JSON.parse(match[1]); + const sourcePr = Number(metadata?.source_pr); + const validShas = [ + metadata?.source_base_sha, + metadata?.source_head_sha, + metadata?.promotion_base_sha, + ].every((value) => /^[0-9a-f]{40}$/i.test(String(value || ''))); + if (!Number.isInteger(sourcePr) || sourcePr <= 0 || !validShas) { + return null; + } + return { ...metadata, source_pr: sourcePr }; + } catch { + return null; + } +} + function sourceTypeFromCheckedTemplate(body) { const sectionLines = workflowSourceSectionLines(body); if (!sectionLines.length) { @@ -355,6 +380,7 @@ function inferredSourceType(pull = {}) { function resolvePrSourceContext(pull = {}) { const body = String(pull?.body || ''); const block = parseWorkflowSourceBlock(body); + const dependencyRepairPromotion = parseDependencyRepairPromotionSource(body); const issueNumber = extractIssueNumberFromPull(pull); const noAutomation = hasNoAutomationWorkflowContext(pull); @@ -363,7 +389,9 @@ function resolvePrSourceContext(pull = {}) { const checkboxType = sourceTypeFromCheckedTemplate(body); const labelType = sourceTypeFromLabels(pull); const inferredType = inferredSourceType(pull); - const detectedSourceType = issueNumber + const detectedSourceType = dependencyRepairPromotion + ? SOURCE_TYPES.DEPENDABOT + : issueNumber ? SOURCE_TYPES.GITHUB_ISSUE : [markerType, blockType, checkboxType, labelType, inferredType].find((type) => type !== SOURCE_TYPES.UNKNOWN) || SOURCE_TYPES.UNKNOWN; @@ -372,6 +400,9 @@ function resolvePrSourceContext(pull = {}) { : detectedSourceType; const sourceRef = + (dependencyRepairPromotion + ? `dependency-pr:#${dependencyRepairPromotion.source_pr}` + : '') || cleanString(parseHtmlMarker(body, 'workflow-source-ref')) || cleanString(block.source_ref || block.ref || block.reference) || (issueNumber ? `#${issueNumber}` : ''); @@ -392,6 +423,7 @@ function resolvePrSourceContext(pull = {}) { isValid: VALID_SOURCE_TYPES.has(sourceType), isExplicit: Boolean( issueNumber || + dependencyRepairPromotion || markerType !== SOURCE_TYPES.UNKNOWN || blockType !== SOURCE_TYPES.UNKNOWN || checkboxType !== SOURCE_TYPES.UNKNOWN || @@ -433,6 +465,7 @@ module.exports = { extractIssueNumbersFromText, extractIssueNumberFromPull, parseWorkflowSourceBlock, + parseDependencyRepairPromotionSource, sourceTypeFromCheckedTemplate, sourceTypeFromLabels, hasNoAutomationWorkflowContext, diff --git a/.github/workflows/agents-80-pr-event-hub.yml b/.github/workflows/agents-80-pr-event-hub.yml index d9dd605f7..085c381eb 100644 --- a/.github/workflows/agents-80-pr-event-hub.yml +++ b/.github/workflows/agents-80-pr-event-hub.yml @@ -326,7 +326,7 @@ jobs: - name: Set up Python if: steps.check-merged.outputs.merged == 'true' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/agents-auto-label.yml b/.github/workflows/agents-auto-label.yml index 729defcc9..d2f45207c 100644 --- a/.github/workflows/agents-auto-label.yml +++ b/.github/workflows/agents-auto-label.yml @@ -17,11 +17,18 @@ env: AUTO_APPLY_THRESHOLD: "0.90" # Threshold for suggesting labels (lower, for comments) SUGGEST_THRESHOLD: "0.75" + # Keep embedding queries bounded for large issue bodies. + AUTO_LABEL_QUERY_MAX_CHARS: "6000" + +concurrency: + group: >- + agents-auto-label-${{ github.repository }}-${{ github.event.issue.number || github.run_id }} + cancel-in-progress: false jobs: auto-label: runs-on: ubuntu-latest - # Skip if issue already has agent-related labels + # Skip issues already routed by agents or machine-managed campaign issues. if: | !contains(github.event.issue.labels.*.name, 'agents:auto-pilot') && !contains(github.event.issue.labels.*.name, 'agents:formatted') && @@ -29,6 +36,7 @@ jobs: !contains(github.event.issue.labels.*.name, 'agent:codex') && !contains(github.event.issue.labels.*.name, 'agent:claude') && !contains(github.event.issue.labels.*.name, 'agent:auto') && + !contains(join(github.event.issue.labels.*.name, ','), 'campaign:') && !contains(github.event.issue.labels.*.name, 'automated') steps: @@ -65,7 +73,7 @@ jobs: - name: Set up Python if: steps.eligibility.outputs.should-run == 'true' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.14" @@ -136,7 +144,22 @@ jobs: # Get issue content issue_title = os.environ.get('ISSUE_TITLE', '') issue_body = os.environ.get('ISSUE_BODY', '') + query_max_chars_raw = os.environ.get('AUTO_LABEL_QUERY_MAX_CHARS', '6000') + try: + query_max_chars = int(query_max_chars_raw) + except ValueError: + query_max_chars = 6000 + print( + "Invalid AUTO_LABEL_QUERY_MAX_CHARS value " + f"{query_max_chars_raw!r}; using 6000" + ) + if query_max_chars <= 0: + query_max_chars = 6000 + print("AUTO_LABEL_QUERY_MAX_CHARS must be positive; using 6000") query = f"{issue_title}\n\n{issue_body}" + if len(query) > query_max_chars: + query = query[:query_max_chars] + print(f"Truncated issue query to {query_max_chars} characters") # Get thresholds auto_threshold = float(os.environ.get('AUTO_APPLY_THRESHOLD', '0.90')) diff --git a/.github/workflows/agents-auto-pilot.yml b/.github/workflows/agents-auto-pilot.yml index 409d17526..e2441272b 100644 --- a/.github/workflows/agents-auto-pilot.yml +++ b/.github/workflows/agents-auto-pilot.yml @@ -216,7 +216,7 @@ jobs: - name: Set up Python id: setup-python if: steps.check_enabled.outputs.enabled == 'true' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: '3.14' diff --git a/.github/workflows/agents-capability-check.yml b/.github/workflows/agents-capability-check.yml index 353e1cf7d..2e5a3fd59 100644 --- a/.github/workflows/agents-capability-check.yml +++ b/.github/workflows/agents-capability-check.yml @@ -34,7 +34,7 @@ jobs: github_token: ${{ github.token }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.14" diff --git a/.github/workflows/agents-decompose.yml b/.github/workflows/agents-decompose.yml index 15f892685..0d5eccc75 100644 --- a/.github/workflows/agents-decompose.yml +++ b/.github/workflows/agents-decompose.yml @@ -29,7 +29,7 @@ jobs: github_token: ${{ github.token }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.14" diff --git a/.github/workflows/agents-dedup.yml b/.github/workflows/agents-dedup.yml index 7c5889b69..652f82200 100644 --- a/.github/workflows/agents-dedup.yml +++ b/.github/workflows/agents-dedup.yml @@ -38,7 +38,7 @@ jobs: github_token: ${{ github.token }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.14" diff --git a/.github/workflows/agents-issue-optimizer.yml b/.github/workflows/agents-issue-optimizer.yml index bcd91e5c9..95650693d 100644 --- a/.github/workflows/agents-issue-optimizer.yml +++ b/.github/workflows/agents-issue-optimizer.yml @@ -139,7 +139,7 @@ jobs: - name: Set up Python if: steps.check.outputs.should_run == 'true' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: '3.14' diff --git a/.github/workflows/agents-verify-to-new-pr.yml b/.github/workflows/agents-verify-to-new-pr.yml index 3428d1c11..d0682a3f4 100644 --- a/.github/workflows/agents-verify-to-new-pr.yml +++ b/.github/workflows/agents-verify-to-new-pr.yml @@ -78,6 +78,7 @@ jobs: .github/scripts/github-api-with-retry.js .github/scripts/terminal_disposition.js .github/scripts/token_load_balancer.js + config scripts/langchain tools sparse-checkout-cone-mode: false @@ -92,7 +93,7 @@ jobs: - name: Set up Python if: steps.check-merged.outputs.merged == 'true' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/agents-weekly-metrics.yml b/.github/workflows/agents-weekly-metrics.yml index ed8b1c500..a069074bd 100644 --- a/.github/workflows/agents-weekly-metrics.yml +++ b/.github/workflows/agents-weekly-metrics.yml @@ -58,7 +58,7 @@ jobs: - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: "3.14" diff --git a/.github/workflows/backplane-conformance.yml b/.github/workflows/backplane-conformance.yml index 587b57eef..3898ec1e0 100644 --- a/.github/workflows/backplane-conformance.yml +++ b/.github/workflows/backplane-conformance.yml @@ -29,7 +29,7 @@ jobs: manifest: artifacts/reference/manifest.json steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: '3.14' - run: pip install -e . diff --git a/.github/workflows/pr-46-dependency-repair-contract.yml b/.github/workflows/pr-46-dependency-repair-contract.yml new file mode 100644 index 000000000..18705455b --- /dev/null +++ b/.github/workflows/pr-46-dependency-repair-contract.yml @@ -0,0 +1,25 @@ +name: PR 46 Dependency Repair Contract + +on: + # zizmor: ignore[dangerous-triggers] trusted reusable workflow reads only + # PR metadata and git objects + pull_request_target: + types: [opened, reopened, synchronize, edited] + +permissions: + contents: read + pull-requests: read + +concurrency: + group: dependency-repair-contract-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + contract: + if: >- + github.event.pull_request.user.login == 'renovate[bot]' || + github.event.pull_request.user.login == 'dependabot[bot]' || + startsWith(github.event.pull_request.head.ref, 'renovate/') || + startsWith(github.event.pull_request.head.ref, 'dependabot/') || + contains(github.event.pull_request.body || '', 'dependency-repair-promotion:v1') + uses: stranske/Workflows/.github/workflows/reusable-19-dependency-repair-contract.yml@main