Skip to content

Commit 64023f3

Browse files
committed
New job steps for handling secrets & custom actions
1 parent 963334b commit 64023f3

File tree

8 files changed

+714
-136
lines changed

8 files changed

+714
-136
lines changed

.github/agents/agentic-workflows.agent.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Workflows may optionally include:
3030
- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
3131
- Workflow lock files: `.github/workflows/*.lock.yml`
3232
- Shared components: `.github/workflows/shared/*.md`
33-
- Configuration: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/github-agentic-workflows.md
33+
- Configuration: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/github-agentic-workflows.md
3434

3535
## Problems This Solves
3636

@@ -52,7 +52,7 @@ When you interact with this agent, it will:
5252
### Create New Workflow
5353
**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
5454

55-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/create-agentic-workflow.md
55+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/create-agentic-workflow.md
5656

5757
**Use cases**:
5858
- "Create a workflow that triages issues"
@@ -62,7 +62,7 @@ When you interact with this agent, it will:
6262
### Update Existing Workflow
6363
**Load when**: User wants to modify, improve, or refactor an existing workflow
6464

65-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/update-agentic-workflow.md
65+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/update-agentic-workflow.md
6666

6767
**Use cases**:
6868
- "Add web-fetch tool to the issue-classifier workflow"
@@ -72,7 +72,7 @@ When you interact with this agent, it will:
7272
### Debug Workflow
7373
**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
7474

75-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/debug-agentic-workflow.md
75+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/debug-agentic-workflow.md
7676

7777
**Use cases**:
7878
- "Why is this workflow failing?"
@@ -82,7 +82,7 @@ When you interact with this agent, it will:
8282
### Upgrade Agentic Workflows
8383
**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
8484

85-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/upgrade-agentic-workflows.md
85+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/upgrade-agentic-workflows.md
8686

8787
**Use cases**:
8888
- "Upgrade all workflows to the latest version"
@@ -92,7 +92,7 @@ When you interact with this agent, it will:
9292
### Create a Report-Generating Workflow
9393
**Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
9494

95-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/report.md
95+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/report.md
9696

9797
**Use cases**:
9898
- "Create a weekly CI health report"
@@ -102,7 +102,7 @@ When you interact with this agent, it will:
102102
### Create Shared Agentic Workflow
103103
**Load when**: User wants to create a reusable workflow component or wrap an MCP server
104104

105-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/create-shared-agentic-workflow.md
105+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/create-shared-agentic-workflow.md
106106

107107
**Use cases**:
108108
- "Create a shared component for Notion integration"
@@ -112,7 +112,7 @@ When you interact with this agent, it will:
112112
### Fix Dependabot PRs
113113
**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
114114

115-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/dependabot.md
115+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/dependabot.md
116116

117117
**Use cases**:
118118
- "Fix the open Dependabot PRs for npm dependencies"
@@ -122,7 +122,7 @@ When you interact with this agent, it will:
122122
### Analyze Test Coverage
123123
**Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
124124

125-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/test-coverage.md
125+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/test-coverage.md
126126

127127
**Use cases**:
128128
- "Create a workflow that comments coverage on PRs"
@@ -169,10 +169,10 @@ gh aw compile --validate
169169

170170
## Important Notes
171171

172-
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/github-agentic-workflows.md for complete documentation
172+
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/github-agentic-workflows.md for complete documentation
173173
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
174174
- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
175175
- **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
176176
- Follow security best practices: minimal permissions, explicit network access, no template injection
177-
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See https://github.com/github/gh-aw/blob/v0.65.6/.github/aw/network.md for the full list of valid ecosystem identifiers and domain patterns.
177+
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See https://github.com/github/gh-aw/blob/v0.67.1/.github/aw/network.md for the full list of valid ecosystem identifiers and domain patterns.
178178
- **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.

.github/aw/actions-lock.json

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,25 @@
55
"version": "v8",
66
"sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
77
},
8-
"github/gh-aw-actions/setup-cli@v0.65.6": {
8+
"github/gh-aw-actions/setup-cli@v0.67.1": {
99
"repo": "github/gh-aw-actions/setup-cli",
10-
"version": "v0.65.6",
11-
"sha": "31130b20a8fd3ef263acbe2091267c0aace07e09"
10+
"version": "v0.67.1",
11+
"sha": "80471a493be8c528dd27daf73cd644242a7965e0"
1212
},
13-
"github/gh-aw-actions/setup@v0.65.6": {
13+
"github/gh-aw-actions/setup-cli@v0.67.2": {
14+
"repo": "github/gh-aw-actions/setup-cli",
15+
"version": "v0.67.2",
16+
"sha": "03e31e064a68e8d5ad890c92f303cfb5a3536006"
17+
},
18+
"github/gh-aw-actions/setup@v0.67.1": {
19+
"repo": "github/gh-aw-actions/setup",
20+
"version": "v0.67.1",
21+
"sha": "80471a493be8c528dd27daf73cd644242a7965e0"
22+
},
23+
"github/gh-aw-actions/setup@v0.67.2": {
1424
"repo": "github/gh-aw-actions/setup",
15-
"version": "v0.65.6",
16-
"sha": "31130b20a8fd3ef263acbe2091267c0aace07e09"
25+
"version": "v0.67.2",
26+
"sha": "03e31e064a68e8d5ad890c92f303cfb5a3536006"
1727
}
1828
}
1929
}
Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
# ___ _ _
2+
# / _ \ | | (_)
3+
# | |_| | __ _ ___ _ __ | |_ _ ___
4+
# | _ |/ _` |/ _ \ '_ \| __| |/ __|
5+
# | | | | (_| | __/ | | | |_| | (__
6+
# \_| |_/\__, |\___|_| |_|\__|_|\___|
7+
# __/ |
8+
# _ _ |___/
9+
# | | | | / _| |
10+
# | | | | ___ _ __ _ __| |_| | _____ ____
11+
# | |/\| |/ _ \ '__| |/ /| _| |/ _ \ \ /\ / / ___|
12+
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
13+
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
14+
#
15+
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.67.1). DO NOT EDIT.
16+
#
17+
# To regenerate this workflow, run:
18+
# gh aw compile
19+
# Not all edits will cause changes to this file.
20+
#
21+
# For more information: https://github.github.com/gh-aw/introduction/overview/
22+
#
23+
# Alternative regeneration methods:
24+
# make recompile
25+
#
26+
# Or use the gh-aw CLI directly:
27+
# ./gh-aw compile --validate --verbose
28+
#
29+
# The workflow is generated when any workflow uses the 'expires' field
30+
# in create-discussions, create-issues, or create-pull-request safe-outputs configuration.
31+
# Schedule frequency is automatically determined by the shortest expiration time.
32+
#
33+
name: Agentic Maintenance
34+
35+
on:
36+
schedule:
37+
- cron: "37 0 * * *" # Daily (based on minimum expires: 7 days)
38+
workflow_dispatch:
39+
inputs:
40+
operation:
41+
description: 'Optional maintenance operation to run'
42+
required: false
43+
type: choice
44+
default: ''
45+
options:
46+
- ''
47+
- 'disable'
48+
- 'enable'
49+
- 'update'
50+
- 'upgrade'
51+
- 'safe_outputs'
52+
- 'create_labels'
53+
run_url:
54+
description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
55+
required: false
56+
type: string
57+
default: ''
58+
59+
permissions: {}
60+
61+
jobs:
62+
close-expired-entities:
63+
if: ${{ !github.event.repository.fork && (github.event_name != 'workflow_dispatch' || github.event.inputs.operation == '') }}
64+
runs-on: ubuntu-slim
65+
permissions:
66+
discussions: write
67+
issues: write
68+
pull-requests: write
69+
steps:
70+
- name: Setup Scripts
71+
uses: github/gh-aw-actions/setup@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
72+
with:
73+
destination: ${{ runner.temp }}/gh-aw/actions
74+
75+
- name: Close expired discussions
76+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
77+
with:
78+
script: |
79+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
80+
setupGlobals(core, github, context, exec, io);
81+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
82+
await main();
83+
84+
- name: Close expired issues
85+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
86+
with:
87+
script: |
88+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
89+
setupGlobals(core, github, context, exec, io);
90+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
91+
await main();
92+
93+
- name: Close expired pull requests
94+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
95+
with:
96+
script: |
97+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
98+
setupGlobals(core, github, context, exec, io);
99+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
100+
await main();
101+
102+
run_operation:
103+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation != '' && github.event.inputs.operation != 'safe_outputs' && github.event.inputs.operation != 'create_labels' && !github.event.repository.fork }}
104+
runs-on: ubuntu-slim
105+
permissions:
106+
actions: write
107+
contents: write
108+
pull-requests: write
109+
steps:
110+
- name: Checkout repository
111+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
112+
with:
113+
persist-credentials: false
114+
115+
- name: Setup Scripts
116+
uses: github/gh-aw-actions/setup@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
117+
with:
118+
destination: ${{ runner.temp }}/gh-aw/actions
119+
120+
- name: Check admin/maintainer permissions
121+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
122+
with:
123+
github-token: ${{ secrets.GITHUB_TOKEN }}
124+
script: |
125+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
126+
setupGlobals(core, github, context, exec, io);
127+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
128+
await main();
129+
130+
- name: Install gh-aw
131+
uses: github/gh-aw-actions/setup-cli@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
132+
with:
133+
version: v0.67.1
134+
135+
- name: Run operation
136+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
137+
env:
138+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
139+
GH_AW_OPERATION: ${{ github.event.inputs.operation }}
140+
GH_AW_CMD_PREFIX: gh aw
141+
with:
142+
github-token: ${{ secrets.GITHUB_TOKEN }}
143+
script: |
144+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
145+
setupGlobals(core, github, context, exec, io);
146+
const { main } = require('${{ runner.temp }}/gh-aw/actions/run_operation_update_upgrade.cjs');
147+
await main();
148+
149+
apply_safe_outputs:
150+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation == 'safe_outputs' && !github.event.repository.fork }}
151+
runs-on: ubuntu-slim
152+
permissions:
153+
actions: read
154+
contents: write
155+
discussions: write
156+
issues: write
157+
pull-requests: write
158+
steps:
159+
- name: Checkout actions folder
160+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
161+
with:
162+
sparse-checkout: |
163+
actions
164+
persist-credentials: false
165+
166+
- name: Setup Scripts
167+
uses: github/gh-aw-actions/setup@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
168+
with:
169+
destination: ${{ runner.temp }}/gh-aw/actions
170+
171+
- name: Check admin/maintainer permissions
172+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
173+
with:
174+
github-token: ${{ secrets.GITHUB_TOKEN }}
175+
script: |
176+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
177+
setupGlobals(core, github, context, exec, io);
178+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
179+
await main();
180+
181+
- name: Apply Safe Outputs
182+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
183+
env:
184+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
185+
GH_AW_RUN_URL: ${{ github.event.inputs.run_url }}
186+
with:
187+
github-token: ${{ secrets.GITHUB_TOKEN }}
188+
script: |
189+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
190+
setupGlobals(core, github, context, exec, io);
191+
const { main } = require('${{ runner.temp }}/gh-aw/actions/apply_safe_outputs_replay.cjs');
192+
await main();
193+
194+
create_labels:
195+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation == 'create_labels' && !github.event.repository.fork }}
196+
runs-on: ubuntu-slim
197+
permissions:
198+
contents: read
199+
issues: write
200+
steps:
201+
- name: Checkout repository
202+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
203+
with:
204+
persist-credentials: false
205+
206+
- name: Setup Scripts
207+
uses: github/gh-aw-actions/setup@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
208+
with:
209+
destination: ${{ runner.temp }}/gh-aw/actions
210+
211+
- name: Check admin/maintainer permissions
212+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
213+
with:
214+
github-token: ${{ secrets.GITHUB_TOKEN }}
215+
script: |
216+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
217+
setupGlobals(core, github, context, exec, io);
218+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
219+
await main();
220+
221+
- name: Install gh-aw
222+
uses: github/gh-aw-actions/setup-cli@80471a493be8c528dd27daf73cd644242a7965e0 # v0.67.1
223+
with:
224+
version: v0.67.1
225+
226+
- name: Create missing labels
227+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
228+
env:
229+
GH_AW_CMD_PREFIX: gh aw
230+
with:
231+
github-token: ${{ secrets.GITHUB_TOKEN }}
232+
script: |
233+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
234+
setupGlobals(core, github, context, exec, io);
235+
const { main } = require('${{ runner.temp }}/gh-aw/actions/create_labels.cjs');
236+
await main();

0 commit comments

Comments
 (0)