diff --git a/.github/workflows/check-requirements.lock.yml b/.github/workflows/check-requirements.lock.yml index a80997fa24225..b932dc189912f 100644 --- a/.github/workflows/check-requirements.lock.yml +++ b/.github/workflows/check-requirements.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"75b8b624ba0c144fb4b28cba143d16a47c30de8afae568fa3256c6febe01a68a","compiler_version":"v0.74.4","strict":true,"agent_id":"copilot"} +# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"e4fcdd04986da27ef3059faa0cea3d64bb879fe12085ebfdec0041bbc31ec181","compiler_version":"v0.74.4","strict":true,"agent_id":"copilot"} # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"d3abfe96a194bce3a523ed2093ddedd5704cdf62","version":"v0.74.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.46"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.46"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.46"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.9","digest":"sha256:64828b42a4482f58fab16509d7f8f495a6d97c972a98a68aff20543531ac0388","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.9@sha256:64828b42a4482f58fab16509d7f8f495a6d97c972a98a68aff20543531ac0388"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]} # ___ _ _ # / _ \ | | (_) @@ -59,15 +59,13 @@ permissions: {} concurrency: cancel-in-progress: true - group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha }} + group: ${{ github.workflow }}-${{ github.event.workflow_run.id }} run-name: "Check requirements (AW)" jobs: activation: - needs: - - extract_pr_number - - pre_activation + needs: pre_activation # zizmor: ignore[dangerous-triggers] - workflow_run trigger is secured with role and fork validation if: > (needs.pre_activation.outputs.activated == 'true') && (github.event_name != 'workflow_run' || github.event.workflow_run.repository.id == github.repository_id && @@ -191,20 +189,20 @@ jobs: run: | bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh" { - cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF' + cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF' - GH_AW_PROMPT_198418d99edc7d5b_EOF + GH_AW_PROMPT_2fc32253e89940f3_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md" cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md" cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md" cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md" - cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF' + cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF' Tools: add_comment, missing_tool, missing_data, noop - GH_AW_PROMPT_198418d99edc7d5b_EOF + GH_AW_PROMPT_2fc32253e89940f3_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md" - cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF' + cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF' The following GitHub context information is available for this workflow: {{#if github.actor}} @@ -233,12 +231,12 @@ jobs: {{/if}} - GH_AW_PROMPT_198418d99edc7d5b_EOF + GH_AW_PROMPT_2fc32253e89940f3_EOF cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md" - cat << 'GH_AW_PROMPT_198418d99edc7d5b_EOF' + cat << 'GH_AW_PROMPT_2fc32253e89940f3_EOF' {{#runtime-import .github/workflows/check-requirements.md}} - GH_AW_PROMPT_198418d99edc7d5b_EOF + GH_AW_PROMPT_2fc32253e89940f3_EOF } > "$GH_AW_PROMPT" - name: Interpolate variables and render templates uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -323,7 +321,6 @@ jobs: permissions: actions: read contents: read - issues: read pull-requests: read concurrency: group: "gh-aw-copilot-${{ github.workflow }}" @@ -453,9 +450,9 @@ jobs: mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" mkdir -p /tmp/gh-aw/safeoutputs mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs - cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_627e06df80c4e5ad_EOF' + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_eaae5443153d0b45_EOF' {"add_comment":{"max":1,"target":"${{ needs.extract_pr_number.outputs.pr_number }}"},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}} - GH_AW_SAFE_OUTPUTS_CONFIG_627e06df80c4e5ad_EOF + GH_AW_SAFE_OUTPUTS_CONFIG_eaae5443153d0b45_EOF - name: Generate Safe Outputs Tools env: GH_AW_TOOLS_META_JSON: | @@ -647,7 +644,7 @@ jobs: mkdir -p /home/runner/.copilot GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node) - cat << GH_AW_MCP_CONFIG_175174907e5a28b4_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs" + cat << GH_AW_MCP_CONFIG_d99df59573a98681_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs" { "mcpServers": { "github": { @@ -657,7 +654,7 @@ jobs: "GITHUB_HOST": "\${GITHUB_SERVER_URL}", "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}", "GITHUB_READ_ONLY": "1", - "GITHUB_TOOLSETS": "context,repos,issues,pull_requests,actions" + "GITHUB_TOOLSETS": "repos,pull_requests" }, "guard-policies": { "allow-only": { @@ -691,7 +688,7 @@ jobs: "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}" } } - GH_AW_MCP_CONFIG_175174907e5a28b4_EOF + GH_AW_MCP_CONFIG_d99df59573a98681_EOF - name: Mount MCP servers as CLIs id: mount-mcp-clis continue-on-error: true @@ -1284,6 +1281,7 @@ jobs: } extract_pr_number: + needs: activation if: github.event.workflow_run.conclusion == 'success' runs-on: ubuntu-latest permissions: diff --git a/.github/workflows/check-requirements.md b/.github/workflows/check-requirements.md index 3174d7ecf6da0..1e96cdede0aa1 100644 --- a/.github/workflows/check-requirements.md +++ b/.github/workflows/check-requirements.md @@ -6,7 +6,6 @@ on: permissions: contents: read actions: read - issues: read pull-requests: read network: allowed: @@ -14,7 +13,7 @@ network: tools: web-fetch: {} github: - toolsets: [default, actions] + toolsets: [repos, pull_requests] min-integrity: unapproved safe-outputs: add-comment: @@ -44,7 +43,7 @@ jobs: PR=$(jq -r '.pr_number' /tmp/deterministic/results.json) echo "pr_number=${PR}" >> "${GITHUB_OUTPUT}" concurrency: - group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha }} + group: ${{ github.workflow }}-${{ github.event.workflow_run.id }} cancel-in-progress: true steps: - name: Download deterministic-results artifact @@ -83,296 +82,181 @@ description: > # Check requirements (AW) -You are a code review assistant for the Home Assistant project. The -deterministic stage has already evaluated every check it can on its own -and produced an artifact containing the PR number, per-package check -results, and a pre-rendered comment with placeholders. **Your only job is -to read that artifact, resolve any `needs_agent` checks, and post the -final comment.** - -## Step 1 — Read the deterministic-stage artifact - -The deterministic stage uploaded its results to the runner at -`/tmp/gh-aw/deterministic/results.json`. - -The JSON has this shape: - -- `pr_number` — the PR being checked. The `add_comment` safe-output is - already targeted at this PR (a pre-job extracts `pr_number` from the - artifact and the workflow wires it into the safe-output config via - `needs.extract_pr_number.outputs.pr_number`), so **you do not need to - set `item_number` yourself** — just emit `add_comment` with the - rendered body. -- `needs_agent` — `true` iff any package's check needs resolution. -- `packages[]` — one entry per changed package. Each entry has: - - `name`, `old_version` (`null` for a newly added package; otherwise the - previous pin), `new_version`, `repo_url`, `publisher_kind`. - - `checks` — a dict keyed by **check kind** (string). Each value has a - `status` (`pass`, `warn`, `fail`, or `needs_agent`) and `details`. -- `rendered_comment` — the final PR comment body, already rendered. For - every check whose status is `needs_agent` it contains two placeholders - you must replace: - - `{{CHECK_CELL::}}` — one cell of the summary - table. Replace with exactly one of `✅`, `⚠️`, `❌`. - - `{{CHECK_DETAIL::}}` — the body of one bullet - in the package's `
` block. Replace with - ` ` (the bullet's leading - `- **