Skip to content

Commit ef2a829

Browse files
Copilotpelikhan
Copilot
and
pelikhan
authored
Merge remote-tracking branch 'origin/main' into pelikhan-work-queue-logging
# Conflicts: # docs/src/content/docs/reference/work-queue.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
2 parents 99004b1 + 812d1a8 commit ef2a829

68 files changed

Lines changed: 5119 additions & 128 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.changeset/dry-run-coverage-diagnostics.md‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/aw/debug-agentic-workflow.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,12 @@ push jobs, memory/cache persistence, reusable safe-output calls, work-queue
9898
operations, reactions, status/failure comments and issues, label removal, and
9999
issue locking. Diagnostics, summaries, and run artifacts remain available;
100100
`aw_info.json` records `dry_run: true`.
101+
Compile text output reports excluded effects and scanner invocation coverage.
102+
`--json` adds a batch `workflow: "dry-run"` summary: `dry_run.gate` includes
103+
workflow and batch failures; scanner statuses distinguish `passed`, `failed`
104+
and `not_run`. Model inventory refresh/collection warnings fail the dry-run
105+
gate. Check the exit status and all results; preflight failures may emit no
106+
summary. Passing coverage is not execution approval or per-image/script proof.
101107

102108
This is not a sandbox for arbitrary code. Custom scripts/jobs, agent shell
103109
commands, external MCP servers, and custom credentials remain unverified.

‎.github/workflows/agentic_commands.yml‎

Lines changed: 6 additions & 4 deletions
Large diffs are not rendered by default.

‎.github/workflows/smoke-agy.lock.yml‎

Lines changed: 1961 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/smoke-agy.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
name: Smoke Agy (Experimental)
3+
description: On-demand smoke test for experimental Agy authentication, inference, AWF, MCP and staged safe outputs.
4+
on:
5+
workflow_dispatch:
6+
slash_command:
7+
name: smoke-agy
8+
strategy: centralized
9+
events: [issues, issue_comment, pull_request, pull_request_comment]
10+
label_command:
11+
name: smoke
12+
events: [pull_request]
13+
remove_label: false
14+
reaction: none
15+
status-comment: false
16+
permissions:
17+
contents: read
18+
concurrency:
19+
job-discriminator: ${{ github.run_id }}
20+
strict: true
21+
inlined-imports: true
22+
timeout-minutes: 10
23+
jobs:
24+
agent:
25+
timeout-minutes: 10
26+
max-ai-credits: 50
27+
features:
28+
gh-aw-detection: false
29+
engine:
30+
id: agy
31+
env:
32+
ENGINE_CONFORMANCE_SENTINEL: conformance-agy
33+
safe-outputs:
34+
staged: true
35+
threat-detection: false
36+
activation-comments: false
37+
report-failure-as-issue: false
38+
report-failed-jobs: false
39+
timeout-minutes: 2
40+
noop:
41+
report-as-issue: false
42+
missing-tool:
43+
create-issue: false
44+
imports:
45+
- shared/agy-conformance.md
46+
---
47+
48+
Execute the imported Agy conformance gate once.

‎actions/setup/js/install_frontmatter_skills.cjs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ async function writeSkillSummary(skillDir, skills, installedSkillCount, failures
166166
}
167167
}
168168
const openAttr = failures.length > 0 ? " open" : "";
169-
core.summary.addRaw(`### Frontmatter skills installed\n\n<details${openAttr}>\n<summary>Skill install details</summary>\n\n${body}\n</details>\n\n`);
169+
core.summary.addRaw(`<details${openAttr}>\n<summary>Skill install details</summary>\n\n${body}\n</details>\n\n`);
170170
await core.summary.write();
171171
}
172172

‎actions/setup/js/install_frontmatter_skills.test.cjs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,7 @@ describe("install_frontmatter_skills", () => {
151151
expect(global.exec.exec).toHaveBeenNthCalledWith(1, "gh", ["skill", "install", "githubnext/skills", "--all", "--pin", "abc123", "--agent", "claude-code", "--dir", "/tmp/gh-aw/.claude/skills", "--force"]);
152152
expect(global.exec.exec).toHaveBeenNthCalledWith(2, "gh", ["skill", "install", "githubnext/skills", "review/security", "--pin", "def456", "--agent", "claude-code", "--dir", "/tmp/gh-aw/.claude/skills", "--force"]);
153153
expect(global.exec.exec).toHaveBeenNthCalledWith(3, "gh", ["skill", "install", "${{ inputs.skill_ref }}", "--agent", "claude-code", "--dir", "/tmp/gh-aw/.claude/skills", "--force"]);
154-
expect(global.core.summary.addRaw).toHaveBeenCalledWith(expect.stringContaining("### Frontmatter skills installed"));
155-
expect(global.core.summary.addRaw).toHaveBeenCalledWith(expect.stringContaining("<details>"));
154+
expect(global.core.summary.addRaw).toHaveBeenCalledWith(expect.stringMatching(/^<details>\n<summary>Skill install details<\/summary>/));
156155
expect(global.core.summary.addRaw).toHaveBeenCalledWith(expect.stringContaining('["githubnext/skills@abc123","githubnext/skills/review/security@def456","${{ inputs.skill_ref }}"]'));
157156
});
158157

@@ -175,7 +174,7 @@ describe("install_frontmatter_skills", () => {
175174
const failures = JSON.parse(fs.readFileSync("/tmp/gh-aw/skill_install_failures.json", "utf8"));
176175
expect(failures).toEqual([{ skill: "bad/repo@abc123", error: "exit code 1 HTTP 404" }]);
177176
expect(global.core.warning).toHaveBeenCalledWith(expect.stringContaining("Failed to install skill 'bad/repo@abc123'"));
178-
expect(global.core.summary.addRaw).toHaveBeenCalledWith(expect.stringContaining("<details open>"));
177+
expect(global.core.summary.addRaw).toHaveBeenCalledWith(expect.stringMatching(/^<details open>\n<summary>Skill install details<\/summary>/));
179178
});
180179

181180
it("installs local path references using --from-local at runtime", async () => {

‎actions/setup/js/models.json‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,15 @@
303303
},
304304
"provider_type": "anthropic"
305305
},
306+
"claude-haiku-5.5": {
307+
"cost": {
308+
"input": "1e-07",
309+
"output": "5e-07",
310+
"cache_read": "1e-08",
311+
"cache_write": "1.25e-07"
312+
},
313+
"provider_type": "anthropic"
314+
},
306315
"claude-opus-4.5": {
307316
"cost": {
308317
"input": "5e-06",
@@ -397,7 +406,7 @@
397406
"cost": {
398407
"input": "2e-06",
399408
"output": "1e-05",
400-
"cache_read": "2e-07",
409+
"cache_read": "1e-07",
401410
"cache_write": "2.5e-06"
402411
},
403412
"provider_type": "anthropic"
@@ -480,7 +489,7 @@
480489
"cost": {
481490
"input": "2.5e-07",
482491
"output": "2e-06",
483-
"cache_read": "2e-08"
492+
"cache_read": "2.5e-08"
484493
},
485494
"provider_type": "openai",
486495
"wire_api": "responses"
@@ -507,7 +516,7 @@
507516
"cost": {
508517
"input": "1.75e-06",
509518
"output": "1.4e-05",
510-
"cache_read": "1.7e-07"
519+
"cache_read": "1.75e-07"
511520
},
512521
"provider_type": "openai",
513522
"wire_api": "responses"
@@ -525,7 +534,7 @@
525534
"cost": {
526535
"input": "7.5e-07",
527536
"output": "4.5e-06",
528-
"cache_read": "7e-08"
537+
"cache_read": "7.5e-08"
529538
},
530539
"provider_type": "openai",
531540
"wire_api": "responses"

‎actions/setup/js/work_queue_control_adapter_checks.cjs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -707,8 +707,12 @@ async function verifyCompiledDispatchIdentity(input) {
707707
let identityReads = 0;
708708
let posts = 0;
709709
let result;
710+
const controlFailures = [];
710711
const core = {
711712
setOutput() {},
713+
setFailed(message) {
714+
controlFailures.push(message);
715+
},
712716
info() {},
713717
warning() {},
714718
error() {},
@@ -827,6 +831,10 @@ async function verifyCompiledDispatchIdentity(input) {
827831
await new AsyncFunction("require", "core", "github", "context", "exec", "io", "getOctokit", input.script)(localRequire, core, fixture.githubClient, fixture.dispatcherContext, {}, {}, getOctokit);
828832
assert.equal(canonical(fixture.state.policy), canonical(input.policy));
829833
assert.ok(result, "compiled runtime must return its dispatch receipt");
834+
assert.equal(controlFailures.length, mode === "verified" ? 0 : 1, JSON.stringify(result));
835+
assert.equal(result.status, mode === "verified" ? "ok" : "recovery_required");
836+
assert.equal(result.success, mode === "verified");
837+
if (mode !== "verified") assert.match(controlFailures[0], /Work queue controls require recovery/);
830838
if (mode === "wrong-publisher") {
831839
assert.equal(identityReads, 0);
832840
assert.equal(posts, 0);

‎cmd/gh-aw/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -809,7 +809,7 @@ func configureCompileBuildFlags() {
809809
compileCmd.Flags().Bool("no-emit", false, "Validate workflow without generating lock files")
810810
compileCmd.Flags().Bool("purge", false, "Delete .lock.yml files that were not regenerated during compilation (only when no specific files are provided)")
811811
compileCmd.Flags().Bool("strict", false, "Override frontmatter to enforce strict mode validation for all workflows (enforces action pinning, network config, safe-outputs, disallows write permissions and deprecated fields). Note: Workflows default to strict mode unless frontmatter sets strict: false")
812-
compileCmd.Flags().Bool("dry-run", false, "Compile with strict validation, shellcheck, and model checks; Docker-based scanners are opt-in; disable compiler-managed GitHub mutations, stage safe outputs, and record dry_run in aw_info.json; custom scripts and external MCP effects remain unverified; does not upload or dispatch workflows")
812+
compileCmd.Flags().Bool("dry-run", false, "Compile with strict validation, shellcheck, and model checks; Docker-based scanners are opt-in; report gate/scanner coverage; disable compiler-managed GitHub mutations, stage safe outputs, and record dry_run in aw_info.json; custom scripts and external MCP effects remain unverified; does not authorize execution, upload, or dispatch workflows")
813813
compileCmd.Flags().String("environment", "", "Override the environment on every generated job; fails for reusable-workflow caller jobs, which cannot declare an environment")
814814
compileCmd.Flags().Bool("require-self-hosted-runners", false, "Fail compilation unless every generated workflow job selects a self-hosted runner")
815815
compileCmd.Flags().Bool("trial", false, "Enable trial mode compilation (modifies workflows for trial execution)")

0 commit comments

Comments
 (0)