diff --git a/.github/workflows/agent-ai-automation.yml b/.github/workflows/agent-ai-automation.yml new file mode 100644 index 000000000..ac6d3fd6f --- /dev/null +++ b/.github/workflows/agent-ai-automation.yml @@ -0,0 +1,59 @@ +name: Agent AI Automation & Compilation Check + +on: + schedule: + - cron: "0 0 * * *" + workflow_dispatch: + +permissions: + contents: write + issues: write + pull-requests: write + +jobs: + diagnostics-and-compilation: + name: Run Diagnostics & Compile Verification + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - name: Check out repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@f2113028b1d37eff4509472199697f3a402e478a # v5.3.0 + with: + go-version: ">=1.22" + + - name: Set up Python + uses: actions/setup-python@42375524e23c412d93fb67b49958b490673d461a # v5.3.0 + with: + python-version: "3.12" + cache: "pip" + + - name: Install Python Dependencies + run: | + python -m pip install --upgrade pip + pip install pytest pytest-cov pyyaml pytest-asyncio + + - name: Clone gh-aw and build compiler + run: | + git clone https://github.com/github/gh-aw.git /tmp/gh-aw-repo + cd /tmp/gh-aw-repo + git checkout v0.82.14 + go build -ldflags "-X main.version=v0.82.14 -X main.isRelease=true" ./cmd/gh-aw + + - name: Run verification of existing lock files + run: | + /tmp/gh-aw-repo/gh-aw compile + # Ensure there is no drift between markdown workflows and generated .lock.yml files + if ! git diff --exit-code; then + echo "::error::Workflow drift detected! One or more Markdown workflows have uncompiled changes. Please run 'gh aw compile' locally and commit the modified lock files." + exit 1 + fi + echo "All agentic workflows are perfectly compiled and in sync with their lock files." + + - name: Run Truth Gate Unit Tests + run: | + PYTHONPATH=src pytest tests/unit/test_agent_completion_gate.py -v -o addopts="" diff --git a/.github/workflows/canonical-pr-remediator.lock.yml b/.github/workflows/canonical-pr-remediator.lock.yml index f6d398408..ed5d845a4 100644 --- a/.github/workflows/canonical-pr-remediator.lock.yml +++ b/.github/workflows/canonical-pr-remediator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"34a7466d6c5cdcc62b5f750959ba94c29bd1616262c5a8eddbae9d01011d6e83","body_hash":"6514dad4af8ea5d3df54b447c3a6a6ecec2c4cd7cb16f79fb2ae1fe38b42ed2a","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7193332cd0e0073d2af55a2db1e53b63aaa991ad668c8a06f9dce85ecd761ce1","body_hash":"6514dad4af8ea5d3df54b447c3a6a6ecec2c4cd7cb16f79fb2ae1fe38b42ed2a","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -512,9 +512,9 @@ jobs: mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" mkdir -p /tmp/gh-aw/safeoutputs mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs - cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_d8f6610a884e4ed0_EOF' - {"add_comment":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} - GH_AW_SAFE_OUTPUTS_CONFIG_d8f6610a884e4ed0_EOF + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_f25854d36be18781_EOF' + {"add_comment":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"false"}} + GH_AW_SAFE_OUTPUTS_CONFIG_f25854d36be18781_EOF - name: Generate Safe Outputs Tools env: GH_AW_TOOLS_META_JSON: | @@ -1134,7 +1134,7 @@ jobs: GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/canonical-pr-remediator.md" GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} - GH_AW_NOOP_REPORT_AS_ISSUE: "true" + GH_AW_NOOP_REPORT_AS_ISSUE: "false" GH_AW_AIC: ${{ needs.agent.outputs.aic }} GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }} GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} @@ -1607,7 +1607,7 @@ jobs: GH_AW_ALLOWED_DOMAINS: "172.30.0.1,api.github.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} - GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"}}" + GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"}}" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/canonical-pr-remediator.md b/.github/workflows/canonical-pr-remediator.md index 7b6bd6995..90e43f753 100644 --- a/.github/workflows/canonical-pr-remediator.md +++ b/.github/workflows/canonical-pr-remediator.md @@ -18,6 +18,7 @@ safe-outputs: max: 1 report-incomplete: false threat-detection: true + noop: { report-as-issue: false } --- diff --git a/.github/workflows/eventrelay-ci-investigator.lock.yml b/.github/workflows/eventrelay-ci-investigator.lock.yml index 550e95a7e..35abcf6d7 100644 --- a/.github/workflows/eventrelay-ci-investigator.lock.yml +++ b/.github/workflows/eventrelay-ci-investigator.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ae74088a4ad234760e5514280445197a19fdc82bef5b48dd8ccd0b30ba0aea43","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"502354827a4d13779b4272e2df469f032549775f0723a8df5fbb1d6e6cc55fa9","body_hash":"db86ab41ca32e4ef5905d00ea66edbc4f150a3776b3a87011795bbf5997ed92b","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -547,9 +547,9 @@ jobs: mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" mkdir -p /tmp/gh-aw/safeoutputs mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs - cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_5d812d3d4cea2b40_EOF' - {"add_comment":{"max":1},"create_check_run":{"max":1},"create_issue":{"max":1},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{},"update_issue":{"allow_body":true,"max":1}} - GH_AW_SAFE_OUTPUTS_CONFIG_5d812d3d4cea2b40_EOF + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_b07d05184293908f_EOF' + {"add_comment":{"max":1},"create_check_run":{"max":1},"create_issue":{"max":1},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"false"},"report_incomplete":{},"update_issue":{"allow_body":true,"max":1}} + GH_AW_SAFE_OUTPUTS_CONFIG_b07d05184293908f_EOF - name: Generate Safe Outputs Tools env: GH_AW_TOOLS_META_JSON: | @@ -1278,7 +1278,7 @@ jobs: GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/eventrelay-ci-investigator.md" GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} - GH_AW_NOOP_REPORT_AS_ISSUE: "true" + GH_AW_NOOP_REPORT_AS_ISSUE: "false" GH_AW_AIC: ${{ needs.agent.outputs.aic }} GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }} GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} @@ -1815,7 +1815,7 @@ jobs: GH_AW_ALLOWED_DOMAINS: "172.30.0.1,api.github.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} - GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_check_run\":{\"max\":1},\"create_issue\":{\"max\":1},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{},\"update_issue\":{\"allow_body\":true,\"max\":1}}" + GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_check_run\":{\"max\":1},\"create_issue\":{\"max\":1},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"},\"report_incomplete\":{},\"update_issue\":{\"allow_body\":true,\"max\":1}}" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/eventrelay-ci-investigator.md b/.github/workflows/eventrelay-ci-investigator.md index 58c9f9d64..df360e0ef 100644 --- a/.github/workflows/eventrelay-ci-investigator.md +++ b/.github/workflows/eventrelay-ci-investigator.md @@ -44,6 +44,7 @@ safe-outputs: update-issue: max: 1 threat-detection: true + noop: { report-as-issue: false } --- diff --git a/.github/workflows/focused-coverage-controller.lock.yml b/.github/workflows/focused-coverage-controller.lock.yml index 349b8d445..d69b5f422 100644 --- a/.github/workflows/focused-coverage-controller.lock.yml +++ b/.github/workflows/focused-coverage-controller.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"df33ebc8485a32f06deee2d6380ca71cfce81ba2cb8ec1c48d6a2e621c364c53","body_hash":"423fb9a3df19a84b185977bd53f9f7a46bd4f70633766742d313a0949f476693","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"4101f8a2dcb9e4da4d21ad55277c3986c8fcdc4918a529541c726df456169082","body_hash":"423fb9a3df19a84b185977bd53f9f7a46bd4f70633766742d313a0949f476693","compiler_version":"v0.82.14","strict":true,"agent_id":"codex","agent_model":"gpt-5.4","engine_versions":{"codex":"0.144.5"}} # gh-aw-manifest: {"version":1,"secrets":["CODEX_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN","OPENAI_API_KEY"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]} # This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # @@ -521,9 +521,9 @@ jobs: mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs" mkdir -p /tmp/gh-aw/safeoutputs mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs - cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_d8f6610a884e4ed0_EOF' - {"add_comment":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} - GH_AW_SAFE_OUTPUTS_CONFIG_d8f6610a884e4ed0_EOF + cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_f25854d36be18781_EOF' + {"add_comment":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"false"}} + GH_AW_SAFE_OUTPUTS_CONFIG_f25854d36be18781_EOF - name: Generate Safe Outputs Tools env: GH_AW_TOOLS_META_JSON: | @@ -1143,7 +1143,7 @@ jobs: GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}/.github/workflows/focused-coverage-controller.md" GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }} - GH_AW_NOOP_REPORT_AS_ISSUE: "true" + GH_AW_NOOP_REPORT_AS_ISSUE: "false" GH_AW_AIC: ${{ needs.agent.outputs.aic }} GH_AW_THREAT_DETECTION_AIC: ${{ needs.detection.outputs.aic }} GH_AW_AMBIENT_CONTEXT: ${{ needs.agent.outputs.ambient_context }} @@ -1616,7 +1616,7 @@ jobs: GH_AW_ALLOWED_DOMAINS: "172.30.0.1,api.github.com,api.openai.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,chatgpt.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,openai.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,s.symcb.com,s.symcd.com,security.ubuntu.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} - GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"}}" + GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"false\"}}" with: github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/focused-coverage-controller.md b/.github/workflows/focused-coverage-controller.md index 0c86f2d6f..cf98bf098 100644 --- a/.github/workflows/focused-coverage-controller.md +++ b/.github/workflows/focused-coverage-controller.md @@ -32,6 +32,7 @@ safe-outputs: max: 1 report-incomplete: false threat-detection: true + noop: { report-as-issue: false } --- diff --git a/Key Benefits of the Dogfooding Loop for AI Agent Development.md b/Key Benefits of the Dogfooding Loop for AI Agent Development.md new file mode 100644 index 000000000..5ba92380e --- /dev/null +++ b/Key Benefits of the Dogfooding Loop for AI Agent Development.md @@ -0,0 +1,126 @@ +# Key Benefits of the Dogfooding Loop for AI Agent Development + +The development of high-integrity, autonomous AI agents requires robust engineering structures that transcend traditional software development paradigms. "Dogfooding"—the practice of an organization or development team using its own product—gains a transformative dimension in the field of AI-agent engineering. In this context, the dogfooding loop represents an architecture where **autonomous AI agents are utilized to design, build, test, and fortify the very agentic systems that orchestrate them**. + +By running agents on their own repositories and workflows, engineering teams establish a self-reinforcing, virtuous feedback loop of continuous improvement and ironclad reliability. This document analyzes the six key architectural and operational benefits of this paradigm within the EventRelay platform. + +--- + +## 1. Parallel Workstreams and Multi-Agent Orchestration + +Traditional software engineering relies on serial branch management or manual multitasking, both of which introduce cognitive overhead and bottleneck developer productivity. By integrating the GitHub Copilot App’s parallel worktree capabilities, the dogfooding loop enables agents to run multiple isolated sessions concurrently. + +### Isolated Git Worktrees +Each agent session runs on its own dedicated git branch backed by a physical or cloud-hosted git worktree. This prevents state contamination and cross-talk during execution. + +### Graduated Autonomy (Session Modes) +Developers can direct agent behavior based on the complexity and clarity of the task: +* **Plan Mode:** The agent analyzes the codebase, details a step-by-step approach, and waits for explicit approval before proceeding. +* **Interactive Mode:** Tighter, collaborative steering where the developer guides the agent through complex logic boundaries. +* **Autopilot Mode:** Fully autonomous execution of well-defined tasks (such as nightly audits, remediation, and routine bug fixes), maximizing throughput. + +This multi-modal steering ensures that the right LLM and cognitive effort are matched to the task complexity, saving credits and optimizing speed. + +--- + +## 2. Standardized Agent Capabilities and Tooling via MCP + +To interact with the outside world, AI agents need standard, secure interfaces to access data and execute tools. The **Model Context Protocol (MCP)** provides this exact framework, defining a standardized way to connect AI models to external systems. + +### Unified Developer Interfaces +By implementing MCP servers (like the GitHub MCP server, YouTube metadata extractor, and Video Analysis pipelines), agents operate with identical tool-calling schemas whether they are running in local IDEs, the Copilot CLI, or remote CI environments. + +### Agentic Resource Discovery (ARD) and Agent Finder +Rather than hardcoding every capability in advance, the platform implements **Agent Finder**. Guided by the ARD specification, Agent Finder searches a catalog of capabilities at runtime and dynamically returns ranked matches (MCP servers, skills, prompts) that the agent can invoke on demand. This decoupling dramatically reduces context-window bloat and eliminates tool-selection errors. + +--- + +## 3. Contract-Based Intent Freezing (Pre-Dispatch Confirmation) + +One of the greatest challenges in autonomous engineering is "scope drift"—where an agent unintentionally modifies unrelated files or strays from the primary objective. The dogfooding loop resolves this through **Pre-dispatch Confirmation Contracts**. + +Before an agent is spawned or delegated a task, the human developer must author a structured issue template specifying: +1. **Agent Login & Run ID:** Unique identifiers that bind the subsequent run to this specific task contract. +2. **Objective & Acceptance Criteria:** Observable, independently verifiable outcomes. +3. **Declared File Scope:** Explicit repository-relative paths the agent is permitted to touch. + +### Intent Freezing +When an issue is labeled as an `agent-task`, a GitHub Actions workflow immediately freezes the issue's contents, generating a cryptographic hash (`body_sha256`). Any attempt by the agent (or an unauthorized actor) to modify the issue or bypass the declared scope after execution begins will invalidate the contract and trigger a fail-closed block. + +--- + +## 4. Deterministic, Evidence-Based Truth Gates + +While LLM-based verification is quick to implement, it is inherently non-deterministic and prone to false-positive completions or hallmarked approvals. The EventRelay platform establishes absolute safety through a **deterministic, evidence-based Agent Completion Truth Gate** (`scripts/ci/agent_completion_gate.py`). + +The Truth Gate validates agent pull requests against the frozen issue intent using concrete, immutable evidence: +* **No Scope Drift:** It compares the PR's `changed_files` against the issue's `declared_files` and `allowed_extra_files`. Any unauthorized file modification blocks the PR. +* **Committed Focused Tests:** The agent must commit focused unit-test files (e.g., matching `tests/unit/test_*.py`) that correspond to any behavioral code modifications. +* **Authoritative Test Logs:** The Truth Gate parses raw CI logs to verify that the committed focused tests actually ran and passed with a 100% success rate on the exact head commit. +* **Unresolved Thread Blocking:** The PR is blocked if there are any open, unresolved review comments or threads authored by reviewers or code-quality bots. + +By relying on deterministic logic rather than another LLM, the Truth Gate acts as an unbreakable guardrail ensuring production-grade code quality. + +--- + +## 5. Self-Evolving Agent Feedback Loops (Prescient Twin) + +At the pinnacle of the dogfooding loop sits the **Prescient Twin** subsystem. This self-improvement workflow allows agents to continuously audit and evolve their own codebase by processing new learning assets. + +``` +┌────────────────────────────────────────────────────────┐ +│ The Prescient Twin Loop │ +└───────────────────────────┬────────────────────────────┘ + │ + ▼ +┌────────────────────────────────────────────────────────┐ +│ 1. Video/Audio Intake (YouTube / Enterprise Feeds) │ +│ - Extract captions, transcripts, and metadata │ +└───────────────────────────┬────────────────────────────┘ + │ + ▼ +┌────────────────────────────────────────────────────────┐ +│ 2. Context Grounding (RAG Knowledge Ingestion) │ +│ - Embed transcripts into vector search index │ +└───────────────────────────┬────────────────────────────┘ + │ + ▼ +┌────────────────────────────────────────────────────────┐ +│ 3. Automated Gap Analysis & Self-Improvement │ +│ - Identify system deficiencies or missing skills │ +└───────────────────────────┬────────────────────────────┘ + │ + ▼ +┌────────────────────────────────────────────────────────┐ +│ 4. Autonomous Remediation (Jules Execution) │ +│ - Author focused tests and apply secure fixes │ +└───────────────────────────┬────────────────────────────┘ + │ + ▼ +┌────────────────────────────────────────────────────────┐ +│ 5. Verification Gate (Truth Gate Gating) │ +│ - Enforce zero scope drift, passing tests, and CI │ +└───────────────────────────┬────────────────────────────┘ + │ + ▼ +┌────────────────────────────────────────────────────────┐ +│ 6. Continuous Deployment & Production Fortification │ +└────────────────────────────────────────────────────────┘ +``` + +This self-evolving cycle ensures that as the EventRelay platform processes more tutorial videos and architectural best practices, the agents running on the platform immediately inherit that knowledge, automatically applying fortifications to the system itself. + +--- + +## 6. Real-World Measurement and Immutable Artifacts + +Under the dogfooding framework, **no work is considered complete until it is proven real**. +* **No Mock data:** All tests must run against real file systems and actual temporary directories to ensure perfect operational validity. +* **No False Claims:** Every change must compile cleanly, pass type-checks, and be validated by rigorous testing before submission. +* **Immutable Ledger of Evidence:** Execution events, run summaries, and test results are published as immutable check runs and PR comments, establishing clear, untampered provenance of the agent's work. + +--- + +## Conclusion + +The dogfooding loop represents the future of software development. By holding AI agents to the highest standards of software engineering—standardized interfaces (MCP), strict scope validation (Pre-dispatch contracts), deterministic gating (Truth Gate), and self-evolution (Prescient Twin)—we transform autonomous agents from experimental tools into trusted, elite development partners.