maintain-docs.yml

name: Maintain Docs

env:
  # Advance this revision and all package digests together when package bytes change.
  DOCS_AGENT_PACKAGE_REVISION: a39d9db230eb9e0b72ed84465f4d61bd8dda1bab
  # Advance independently when the post-command completion validator changes.
  DOCS_AGENT_COMPLETION_CONTRACT_REVISION: 44f1e60e9278dd351fafea53434999de4782514b

'on':
  workflow_call:
    inputs:
      audience:
        description: Maintenance lane to prepare. Use technical for developer docs, user for product docs, or skills for live skill upkeep.
        type: string
        default: technical
      run_kind:
        description: 'Docs Agent flow kind to prepare: bootstrap or maintenance.'
        type: string
        default: maintenance
      require_pr:
        description: Require a published target-repository pull request for successful maintenance.
        type: boolean
        default: false
      base_ref:
        description: Base branch or ref for the documentation pull request.
        type: string
        default: main
      docs_branch:
        description: Stable branch reused for the canonical Docs Agent pull request.
        type: string
        default: docs-agent/docs-upkeep
      writable_paths:
        description: Comma-separated paths Docs Agent may edit.
        type: string
        default: README.md,docs/**
      context_repositories:
        description: JSON array of read-only evidence repositories with alias, repository, and optional revision.
        type: string
        default: "[]"
      bootstrap_contract:
        description: JSON object declaring required bootstrap paths, glob minimums, entry-point links, and forbidden phrases.
        type: string
        default: "{}"
      source_delta:
        description: JSON array of caller-bounded source deltas with id, source_refs, and requires_documentation_change; required and non-empty for maintenance.
        type: string
        default: "[]"
      validation_dependencies:
        description: Optional caller-owned command that installs dependencies needed before validation.
        type: string
        default: ""
      verification_commands:
        description: JSON array of canonical runner verification commands executed in the target workspace.
        type: string
        default: "[]"
      drift_checks:
        description: JSON array of canonical runner drift checks executed after verification.
        type: string
        default: "[]"
      prompt:
        description: Optional maintenance instruction appended to the default Docs Agent prompt.
        type: string
        default: ""
      run_agent:
        description: Run the prepared Docs Agent task through the generic Codebox agent-task workflow.
        type: boolean
        default: true
      dry_run:
        description: Validate the prepared Docs Agent task without starting a live agent run.
        type: boolean
        default: false
    secrets:
      OPENAI_API_KEY:
        description: Optional OpenAI credential used for live Docs Agent runs.
        required: false
      EXTERNAL_PACKAGE_SOURCE_POLICY:
        description: Version 1 JSON policy authorizing Docs Agent standalone native packages.
        required: true
    outputs:
      job_status:
        description: Docs Agent run status.
        value: ${{ jobs.run-agent.outputs.job_status }}
      recipe_json:
        description: Portable Docs Agent runner recipe JSON.
        value: ${{ jobs.prepare.outputs.recipe_json }}
      declared_artifacts_json:
        description: Docs Agent typed artifact declarations.
        value: ${{ jobs.run-agent.outputs.declared_artifacts_json }}
      transcript_summary:
        description: Compact native runner transcript summary.
        value: ${{ jobs.run-agent.outputs.transcript_summary }}
      projected_outputs_json:
        description: Bounded native runner projections, including Docs Agent publication when available.
        value: ${{ jobs.run-agent.outputs.projected_outputs_json }}
      credential_mode:
        description: Normalized native runner credential mode.
        value: ${{ jobs.run-agent.outputs.credential_mode }}
      success_requires_pr:
        description: Whether the selected lane requires a published pull request for success.
        value: ${{ jobs.prepare.outputs.success_requires_pr }}
      validation_dependencies:
        description: Caller-owned validation dependency command included in the runner recipe.
        value: ${{ jobs.prepare.outputs.validation_dependencies }}

jobs:
  prepare:
    name: Prepare Docs Agent Recipe
    runs-on: ubuntu-latest
    outputs:
      job_status: prepared
      recipe_json: ${{ steps.config.outputs.recipe_json }}
      artifact_declarations: ${{ steps.config.outputs.artifact_declarations }}
      external_package_source: ${{ steps.config.outputs.external_package_source }}
      runtime_sources: ${{ steps.config.outputs.runtime_sources }}
      prompt: ${{ steps.config.outputs.prompt }}
      validation_dependencies: ${{ steps.config.outputs.validation_dependencies }}
      verification_commands: ${{ steps.config.outputs.verification_commands }}
      drift_checks: ${{ steps.config.outputs.drift_checks }}
      completion_check: ${{ steps.config.outputs.completion_check }}
      runner_workspace: ${{ steps.config.outputs.runner_workspace }}
      expected_artifacts: ${{ steps.config.outputs.expected_artifacts }}
      output_projections: ${{ steps.config.outputs.output_projections }}
      success_requires_pr: ${{ steps.config.outputs.success_requires_pr }}
      allowed_repos: ${{ steps.config.outputs.allowed_repos }}
      access_token_repos: ${{ steps.config.outputs.access_token_repos }}
    steps:
      - name: Resolve Docs Agent settings
        id: config
        env:
          AUDIENCE: ${{ inputs.audience }}
          RUN_KIND: ${{ inputs.run_kind }}
          REQUIRE_PR: ${{ inputs.require_pr }}
          INPUT_VERIFICATION_COMMANDS: ${{ inputs.verification_commands }}
          INPUT_DRIFT_CHECKS: ${{ inputs.drift_checks }}
          INPUT_CONTEXT_REPOSITORIES: ${{ inputs.context_repositories }}
          INPUT_BOOTSTRAP_CONTRACT: ${{ inputs.bootstrap_contract }}
          INPUT_SOURCE_DELTA: ${{ inputs.source_delta }}
          INPUT_VALIDATION_DEPENDENCIES: ${{ inputs.validation_dependencies }}
          INPUT_PROMPT: ${{ inputs.prompt }}
          INPUT_WRITABLE_PATHS: ${{ inputs.writable_paths }}
          RUN_AGENT: ${{ inputs.run_agent }}
          DRY_RUN: ${{ inputs.dry_run }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          INPUT_DOCS_BRANCH: ${{ inputs.docs_branch }}
          INPUT_BASE_REF: ${{ inputs.base_ref }}
          GITHUB_REPOSITORY_NAME: ${{ github.repository }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_RUN_ID_VALUE: ${{ github.run_id }}
        run: |
          set -euo pipefail

          case "$AUDIENCE:$RUN_KIND" in
            technical:bootstrap)
              package_path="bundles/technical-docs-agent/native/technical-docs-bootstrap-agent.agent.json"
              agent_slug="technical-docs-bootstrap-agent"
              package_digest="sha256-bytes-v1:0230e0e3fd8a4f045a545407d3d01c22df537b05f031260e29d6b531285b7839"
              lane_requires_pr=true
              default_prompt="Bootstrap source-grounded developer documentation that helps developers understand, use, and extend the code in the repository."
              ;;
            technical:maintenance)
              package_path="bundles/technical-docs-agent/native/technical-docs-maintenance-agent.agent.json"
              agent_slug="technical-docs-maintenance-agent"
              package_digest="sha256-bytes-v1:975c7b0a0a7aff52897c52be5ac903a7fb110ea3c33e16227f8694c74c932519"
              lane_requires_pr=false
              default_prompt="Maintain source-grounded developer documentation that helps developers understand, use, and extend the code in the repository."
              ;;
            user:bootstrap)
              package_path="bundles/user-docs-agent/native/user-docs-bootstrap-agent.agent.json"
              agent_slug="user-docs-bootstrap-agent"
              package_digest="sha256-bytes-v1:a3ada797a125f638364caac43004bbb47fcc8c7bdc89021f25fcfcdc4c2d502f"
              lane_requires_pr=true
              default_prompt="Bootstrap source-grounded product documentation for onboarding, setup, common tasks, expected outcomes, permissions, compatibility, troubleshooting, and FAQs."
              ;;
            user:maintenance)
              package_path="bundles/user-docs-agent/native/user-docs-maintenance-agent.agent.json"
              agent_slug="user-docs-maintenance-agent"
              package_digest="sha256-bytes-v1:747de10fdb52d7c1543b404030e0e0a2604b6496e95d50143149f72c975a98fb"
              lane_requires_pr=false
              default_prompt="Maintain source-grounded product documentation for onboarding, setup, common tasks, expected outcomes, permissions, compatibility, troubleshooting, and FAQs."
              ;;
            skills:maintenance)
              package_path="bundles/skills-agent/native/skills-maintenance-agent.agent.json"
              agent_slug="skills-maintenance-agent"
              package_digest="sha256-bytes-v1:0f8d35fe0026aa62b9ddf2e86c4f9432b4d8aae90757dfbaf334d4a0671fb8a3"
              lane_requires_pr=false
              default_prompt="Maintain live agent skill instructions and generated packaged skill outputs."
              ;;
            *)
              printf 'Unsupported Docs Agent lane: %s/%s\n' "$AUDIENCE" "$RUN_KIND" >&2
              exit 1
              ;;
          esac

          success_requires_pr="$lane_requires_pr"
          if [ "$REQUIRE_PR" = true ]; then
            success_requires_pr=true
          fi

          if [ "$RUN_AGENT" = true ] && [ "$DRY_RUN" != true ] && [ -z "$OPENAI_API_KEY" ]; then
            printf 'OPENAI_API_KEY is required when run_agent=true for the openai provider. Set run_agent=false or dry_run=true for an explicit non-live path.\n' >&2
            exit 1
          fi

          verification_commands="$(printf '%s' "$INPUT_VERIFICATION_COMMANDS" | jq -c 'if type == "array" then . else error("verification_commands must be an array") end')"
          drift_checks="$(printf '%s' "$INPUT_DRIFT_CHECKS" | jq -c 'if type == "array" then . else error("drift_checks must be an array") end')"
          context_repositories="$(printf '%s' "$INPUT_CONTEXT_REPOSITORIES" | jq -c '
            if type != "array" or any(.[]; type != "object" or (.alias | type != "string" or length == 0) or (.repository | type != "string" or test("^[^/]+/[^/]+$") | not) or ((.revision // "main") | type != "string" or length == 0))
            then error("context_repositories must be a list of alias/repository/revision objects")
            else map({alias,repository,revision:(.revision // "main")}) end
          ')"
          bootstrap_contract="$(printf '%s' "$INPUT_BOOTSTRAP_CONTRACT" | jq -c '
            if type != "object" then error("bootstrap_contract must be an object") else . + {
              required_paths:(.required_paths // []), required_globs:(.required_globs // []),
              entry_points:(.entry_points // []), forbidden_phrases:(.forbidden_phrases // [])
            } end
          ')"
          printf '%s' "$bootstrap_contract" | jq -e '
            (.required_paths | type == "array" and all(.[]; type == "string" and length > 0)) and
            (.required_globs | type == "array" and all(.[]; type == "object" and (.pattern | type == "string" and length > 0) and ((.min // .min_count) | type == "number" and . >= 0))) and
            (.entry_points | type == "array" and all(.[]; type == "object" and (.path | type == "string" and length > 0) and (.must_link_to | type == "array" and length > 0 and all(.[]; type == "string" and length > 0)))) and
            (.forbidden_phrases | type == "array" and all(.[]; type == "string" and length > 0))
          ' >/dev/null
          if [ "$RUN_KIND" = bootstrap ] && [ "$(printf '%s' "$bootstrap_contract" | jq '[.required_paths,.required_globs,.entry_points]|map(length)|add')" -eq 0 ]; then
            printf 'bootstrap_contract must declare positive completion criteria for bootstrap.\n' >&2
            exit 1
          fi
          source_delta="$(printf '%s' "$INPUT_SOURCE_DELTA" | jq -c '
            if type != "array" or any(.[]; type != "object" or (.id | type != "string" or test("\\S") | not) or (.source_refs | type != "array" or length == 0 or any(.[]; type != "string" or test("\\S") | not) or (length != (unique | length))) or (.requires_documentation_change | type != "boolean")) or ([.[].id] | length != (unique | length))
            then error("source_delta must be a list of unique id/non-empty source_refs/requires_documentation_change objects") else . end
          ')"
          if [ "$RUN_KIND" = maintenance ] && [ "$(printf '%s' "$source_delta" | jq 'length')" -eq 0 ]; then
            printf 'source_delta must contain at least one caller-bounded item for maintenance.\n' >&2
            exit 1
          fi
          if ! printf '%s' "$DOCS_AGENT_PACKAGE_REVISION" | grep -Eq '^[0-9a-fA-F]{40}$'; then
            printf 'DOCS_AGENT_PACKAGE_REVISION must be a full immutable Docs Agent commit SHA.\n' >&2
            exit 1
          fi

          artifact_declarations='[
            {"schema":"docs-agent/artifact-declaration/v1","name":"docs_agent_transcript","type":"DocsAgentTranscript","artifact_schema":"docs-agent/transcript/v1","description":"Machine-readable transcript for the Docs Agent run.","required":false},
            {"schema":"docs-agent/artifact-declaration/v1","name":"docs_agent_change_summary","type":"DocsAgentChangeSummary","artifact_schema":"docs-agent/change-summary/v1","description":"Reviewable summary of documentation or skill changes made by the run.","required":false},
            {"schema":"docs-agent/artifact-declaration/v1","name":"docs_agent_verification_report","type":"DocsAgentVerificationReport","artifact_schema":"docs-agent/verification-report/v1","description":"Runner verification command results for the target workspace.","required":false},
            {"schema":"docs-agent/artifact-declaration/v1","name":"docs_agent_drift_report","type":"DocsAgentDriftReport","artifact_schema":"docs-agent/drift-report/v1","description":"Drift-check results for generated documentation, skills, or packaged outputs.","required":false},
            {"schema":"docs-agent/artifact-declaration/v1","name":"docs_agent_completion_report","type":"DocsAgentCompletionReport","artifact_schema":"docs-agent/completion-report/v1","description":"Versioned host-observed completion and drift report staged by WP Codebox.","required":false},
            {"schema":"docs-agent/artifact-declaration/v1","name":"docs_agent_workspace_publication","type":"DocsAgentWorkspacePublication","artifact_schema":"docs-agent/workspace-publication/v1","description":"Canonical branch and pull request links published by the runner workspace.","required":false}
          ]'

          context_prompt="$(printf '%s' "$context_repositories" | jq -r 'if length == 0 then "No additional context repositories are declared." else "Read-only context repositories (cite aliases in evidence):\n" + (map("- " + .alias + ": " + .repository + "@" + .revision) | join("\n")) end')"
          completion_prompt="$(jq -nr --argjson bootstrap "$bootstrap_contract" --argjson delta "$source_delta" '
            "Completion contract:\n" +
            "- Interpret the caller-known source delta and edit only within writable paths when source evidence requires documentation updates.\n" +
            "- Leave the workspace clean when the documentation is current.\n" +
            "- Every source delta marked requires_documentation_change needs an actual Markdown or MDX workspace diff.\n" +
            "- Bootstrap must satisfy every caller criterion and create a substantive navigable initial documentation system on a fresh surface.\n" +
            "- The host generates and stages the completion report from caller inputs, Git, and filesystem checks; finish with normal concise prose.\n" +
            "Bootstrap contract JSON: " + ($bootstrap|tojson) + "\n" +
            "Caller-known source delta JSON: " + ($delta|tojson)
          ')"
          prompt="$(printf '%s\n\n%s\n\n%s\n\n%s\n\nTarget repository: %s\nWorkflow run: %s/%s/actions/runs/%s\nDocs Agent lane: %s\nDocs Agent run kind: %s\nBase ref: %s\nCanonical branch: %s\nWritable paths: %s\n' \
            "$default_prompt" \
            "$INPUT_PROMPT" \
            "$context_prompt" \
            "$completion_prompt" \
            "$GITHUB_REPOSITORY_NAME" \
            "$GITHUB_SERVER_URL" \
            "$GITHUB_REPOSITORY_NAME" \
            "$GITHUB_RUN_ID_VALUE" \
            "$AUDIENCE" \
            "$RUN_KIND" \
            "$INPUT_BASE_REF" \
            "$INPUT_DOCS_BRANCH" \
            "$INPUT_WRITABLE_PATHS")"

          recipe_json="$(jq -cn \
            --arg targetRepository "$GITHUB_REPOSITORY_NAME" \
            --arg prompt "$prompt" \
            --arg repository "Automattic/docs-agent" \
            --arg revision "$DOCS_AGENT_PACKAGE_REVISION" \
            --arg packagePath "$package_path" \
            --arg packageDigest "$package_digest" \
            --arg agentSlug "$agent_slug" \
            --arg writablePaths "$INPUT_WRITABLE_PATHS" \
            --arg baseRef "$INPUT_BASE_REF" \
            --arg docsBranch "$INPUT_DOCS_BRANCH" \
            --arg validationDependencies "$INPUT_VALIDATION_DEPENDENCIES" \
            --argjson contextRepositories "$context_repositories" \
            --argjson bootstrapContract "$bootstrap_contract" \
            --argjson sourceDelta "$source_delta" \
            --argjson successRequiresPr "$success_requires_pr" \
            --argjson verificationCommands "$verification_commands" \
            --argjson driftChecks "$drift_checks" \
            --argjson artifactDeclarations "$artifact_declarations" \
            '{schema:"docs-agent/runner-recipe/v1",targetRepository:$targetRepository,prompt:$prompt,docsAgent:{externalPackageSource:{repository:$repository,revision:$revision,path:$packagePath,digest:$packageDigest},agentSlug:$agentSlug},runner:{contextRepositories:$contextRepositories,bootstrapContract:$bootstrapContract,sourceDelta:$sourceDelta,validationDependencies:$validationDependencies,verificationCommands:$verificationCommands,driftChecks:$driftChecks,writablePaths:$writablePaths,baseRef:$baseRef,docsBranch:$docsBranch,successRequiresPr:$successRequiresPr},artifacts:{expected:($artifactDeclarations|map(.name)),declarations:$artifactDeclarations}}')"
          external_package_source="$(jq -cn --arg repository "Automattic/docs-agent" --arg revision "$DOCS_AGENT_PACKAGE_REVISION" --arg path "$package_path" --arg digest "$package_digest" '{repository:$repository,revision:$revision,path:$path,digest:$digest}')"
          runtime_sources='[{"version":1,"role":"component","repository":"Automattic/agents-api","revision":"78e2dd409010f98fa4d26cdd72572117384ab18d","path":".","metadata":{"slug":"agents-api","loadAs":"mu-plugin","pluginFile":"agents-api.php"}},{"version":1,"role":"provider_plugin","source":{"type":"https_zip","url":"https://downloads.wordpress.org/plugin/ai-provider-for-openai.1.0.3.zip","sha256":"48f3c0c714b3164cda79d320829830d5a0ea1116e0b19653da8af898a22d3bb6","archive_root":"ai-provider-for-openai"},"metadata":{"slug":"ai-provider-for-openai","pluginFile":"plugin.php","activate":true,"providers":["openai"]}},{"version":1,"role":"bundled_library","repository":"WordPress/php-ai-client","revision":"631704201d15ffeff7091ad3bc7156db74054956","path":".","metadata":{"library":"php-ai-client","strategy":"wordpress-scoped-bundle"}}]'

          runner_workspace="$(jq -cn \
            --arg repo "$GITHUB_REPOSITORY_NAME" \
            --arg branch "$INPUT_DOCS_BRANCH" \
            --arg baseRef "$INPUT_BASE_REF" \
            '{enabled:true,repo:$repo,clone_url:("https://github.com/" + $repo + ".git"),branch:$branch,branch_prefix:$branch,base:$baseRef,from:("origin/" + $baseRef)}')"
          expected_artifacts="$(printf '%s' "$artifact_declarations" | jq -c 'map(.name)')"
          output_projections="$(jq -cn --arg path 'metadata.runner_workspace_publication.pull_request.url' --argjson required "$success_requires_pr" '{docs_agent_publication:{path:$path,required:$required}}')"
          if ! printf '%s' "$DOCS_AGENT_COMPLETION_CONTRACT_REVISION" | grep -Eq '^[0-9a-fA-F]{40}$'; then
            printf 'DOCS_AGENT_COMPLETION_CONTRACT_REVISION must be a full immutable Docs Agent commit SHA.\n' >&2
            exit 1
          fi
          contract_url="https://raw.githubusercontent.com/Automattic/docs-agent/$DOCS_AGENT_COMPLETION_CONTRACT_REVISION/scripts/validate-docs-agent-completion.php"
          bootstrap_contract_b64="$(printf '%s' "$bootstrap_contract" | base64 -w0)"
          source_delta_b64="$(printf '%s' "$source_delta" | base64 -w0)"
          completion_artifact_path="docs-agent-completion-report.json"
          completion_command="curl --fail --silent --show-error '$contract_url' --output .codebox/validate-docs-agent-completion.php && php .codebox/validate-docs-agent-completion.php --workspace . --lane '$AUDIENCE' --run-kind '$RUN_KIND' --writable-paths '$INPUT_WRITABLE_PATHS' --bootstrap-contract-b64 '$bootstrap_contract_b64' --source-delta-b64 '$source_delta_b64' --artifact-path '$completion_artifact_path'"
          completion_check="$(jq -cn --arg command "$completion_command" --arg path "$completion_artifact_path" '{command:$command,description:"Validate Docs Agent completion report against the actual workspace diff",artifact:{name:"docs_agent_completion_report",type:"DocsAgentCompletionReport",path:$path}}')"
          effective_drift_checks="$(jq -cn --argjson caller "$drift_checks" --argjson completion "$completion_check" '$caller + [$completion]')"
          allowed_repos="$(printf '%s' "$context_repositories" | jq -c --arg target "$GITHUB_REPOSITORY_NAME" '([$target] + map(.repository)) | unique')"
          access_token_repos="$(printf '%s' "$allowed_repos" | jq -r 'join(",")')"

          {
            printf 'recipe_json<<EOF\n%s\nEOF\n' "$recipe_json"
            printf 'artifact_declarations<<EOF\n%s\nEOF\n' "$artifact_declarations"
            printf 'external_package_source=%s\n' "$external_package_source"
            printf 'runtime_sources<<EOF\n%s\nEOF\n' "$runtime_sources"
            printf 'prompt<<EOF\n%s\nEOF\n' "$prompt"
            printf 'validation_dependencies<<EOF\n%s\nEOF\n' "$INPUT_VALIDATION_DEPENDENCIES"
            printf 'verification_commands<<EOF\n%s\nEOF\n' "$verification_commands"
            printf 'drift_checks<<EOF\n%s\nEOF\n' "$effective_drift_checks"
            printf 'completion_check<<EOF\n%s\nEOF\n' "$completion_check"
            printf 'allowed_repos=%s\n' "$allowed_repos"
            printf 'access_token_repos=%s\n' "$access_token_repos"
            printf 'runner_workspace<<EOF\n%s\nEOF\n' "$runner_workspace"
            printf 'expected_artifacts<<EOF\n%s\nEOF\n' "$expected_artifacts"
            printf 'output_projections<<EOF\n%s\nEOF\n' "$output_projections"
            printf 'success_requires_pr=%s\n' "$success_requires_pr"
          } >> "$GITHUB_OUTPUT"

  run-agent:
    name: Run Docs Agent
    needs: prepare
    permissions:
      contents: write
      pull-requests: write
      issues: write
    uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@a6fe2d208e990a8d04104aa74aacbb8d1539fbc1
    with:
      wp_codebox_release_ref: v0.12.29
      wp_codebox_workflow_ref: a6fe2d208e990a8d04104aa74aacbb8d1539fbc1
      external_package_source: ${{ needs.prepare.outputs.external_package_source }}
      runtime_sources: ${{ needs.prepare.outputs.runtime_sources }}
      workload_id: docs-agent-${{ inputs.audience }}-${{ inputs.run_kind }}
      workload_label: Run Docs Agent
      component_id: docs-agent
      target_repo: ${{ github.repository }}
      prompt: ${{ needs.prepare.outputs.prompt }}
      writable_paths: ${{ inputs.writable_paths }}
      runner_workspace: ${{ needs.prepare.outputs.runner_workspace }}
      validation_dependencies: ${{ needs.prepare.outputs.validation_dependencies }}
      verification_commands: ${{ needs.prepare.outputs.verification_commands }}
      drift_checks: ${{ needs.prepare.outputs.drift_checks }}
      success_requires_pr: ${{ needs.prepare.outputs.success_requires_pr == 'true' }}
      access_token_repos: ${{ needs.prepare.outputs.access_token_repos }}
      allowed_repos: ${{ needs.prepare.outputs.allowed_repos }}
      expected_artifacts: ${{ needs.prepare.outputs.expected_artifacts }}
      artifact_declarations: ${{ needs.prepare.outputs.artifact_declarations }}
      output_projections: ${{ needs.prepare.outputs.output_projections }}
      callback_data: ${{ needs.prepare.outputs.recipe_json }}
      run_agent: ${{ inputs.run_agent }}
      dry_run: ${{ inputs.dry_run }}
    secrets:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      ACCESS_TOKEN: ${{ github.token }}
      EXTERNAL_PACKAGE_SOURCE_POLICY: ${{ secrets.EXTERNAL_PACKAGE_SOURCE_POLICY }}