Use WP Codebox v0.12.4 release (#125)

Author: chubes4

.github/workflows/README.md

@@ -12,7 +12,7 @@ The reusable workflow declares the expected typed review artifacts for Docs Agen
 
 The target repository grants `contents: write`, `pull-requests: write`, and `issues: write`. Docs Agent forwards the caller-scoped `${{ github.token }}` to WP Codebox for same-repository publication, so consumers do not configure `ACCESS_TOKEN`. `OPENAI_API_KEY` is an optional workflow secret and is required only for a live OpenAI run; skipped and dry-run calls do not require it. `EXTERNAL_PACKAGE_SOURCE_POLICY` remains a separate required v1 JSON secret that authorizes only the selected public standalone Docs Agent package. Both secrets are forwarded to WP Codebox without serialization into the task descriptor.
 
-Docs Agent pins the WP Codebox producer to [#1756](https://github.com/Automattic/wp-codebox/pull/1756) (`ca1cc53ea76d09dc53dd02df89e41ad7fe143a27`). That producer pins its helper checkout independently of reusable-workflow caller context, preventing the helper-resolution regression recorded by failed Build runs `29281470179` and `29281470159`.
+Docs Agent consumes the released [WP Codebox v0.12.4](https://github.com/Automattic/wp-codebox/releases/tag/v0.12.4) workflow and passes the matching `wp_codebox_release_ref: v0.12.4` input. WP Codebox validates that the paired tags match, resolves the release tag, and verifies its package version before running the task. See [WP Codebox #1759](https://github.com/Automattic/wp-codebox/issues/1759).
 
 ## Docs Agent Runner Recipe
 

.github/workflows/maintain-docs.yml

@@ -235,8 +235,9 @@ jobs:
       contents: write
       pull-requests: write
       issues: write
-    uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@ca1cc53ea76d09dc53dd02df89e41ad7fe143a27
+    uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@v0.12.4
     with:
+      wp_codebox_release_ref: v0.12.4
       external_package_source: ${{ needs.prepare.outputs.external_package_source }}
       workload_id: docs-agent-${{ inputs.audience }}-${{ inputs.run_kind }}
       workload_label: Run Docs Agent
@@ -249,7 +250,6 @@ jobs:
       drift_checks: ${{ needs.prepare.outputs.drift_checks }}
       success_requires_pr: ${{ needs.prepare.outputs.success_requires_pr == 'true' }}
       access_token_repos: ${{ github.repository }}
-      require_access_token: true
       allowed_repos: '["${{ github.repository }}"]'
       expected_artifacts: ${{ needs.prepare.outputs.expected_artifacts }}
       artifact_declarations: ${{ needs.prepare.outputs.artifact_declarations }}

.github/workflows/validate.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: Automattic/wp-codebox
-          ref: ca1cc53ea76d09dc53dd02df89e41ad7fe143a27
+          ref: v0.12.4
           path: .wp-codebox
       - name: Validate Docs Agent
         env:

tests/validate-docs-agent-bundle.php

@@ -196,10 +196,11 @@
 
 $transitional_homeboy_extensions_workflow = 'uses: Extra-Chill/homeboy-extensions/.github/workflows/runtime-agent-full-run.yml@main';
 $forbidden_docs_agent_codebox_workflow = 'uses: Automattic/wp-codebox/.github/workflows/docs-agent-runner.yml@main';
-$generic_codebox_agent_task_workflow = 'uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@ca1cc53ea76d09dc53dd02df89e41ad7fe143a27';
+$generic_codebox_agent_task_workflow = 'uses: Automattic/wp-codebox/.github/workflows/run-agent-task.yml@v0.12.4';
 $assert( ! str_contains( $maintain_docs_workflow, $transitional_homeboy_extensions_workflow ), 'maintain-docs.yml must not call Homeboy Extensions directly.' );
 $assert( ! str_contains( $maintain_docs_workflow, $forbidden_docs_agent_codebox_workflow ), 'maintain-docs.yml must not call a Codebox-owned Docs Agent wrapper.' );
 $assert( str_contains( $maintain_docs_workflow, $generic_codebox_agent_task_workflow ), 'maintain-docs.yml must call the generic Codebox agent-task workflow.' );
+$assert( str_contains( $maintain_docs_workflow, 'wp_codebox_release_ref: v0.12.4' ), 'maintain-docs.yml must pass the matching WP Codebox release tag.' );
 
 $workflow_blocked_runtime_fragments = array_values( array_diff( $blocked_runtime_fragments, array( 'wp-codebox', 'Automattic/wp-codebox', 'OPENAI_API_KEY' ) ) );
 $workflow_internal_fragments = array_merge( $workflow_blocked_runtime_fragments, array( 'homeboy_extensions_ref:', 'runtime_ref:', 'runtime_ref }}', 'runtime_provider:', 'runtime_provider }}', 'runtime_profile:', 'runtime_profile }}', 'runtime_profiles:', 'runtime_profiles }}', 'runtime_execution:', 'runtime_execution }}', 'runtime_config:', 'runtime_config }}', 'component_contracts:', 'component_contracts }}', 'ability_requirements:', 'ability_requirements }}', 'runtime_components:', 'runtime_components }}', 'runtime_mounts:', 'runtime_mounts }}', 'required_abilities:', 'required_abilities }}', 'extra_wp_config_defines:' ) );
@@ -235,8 +236,8 @@
 foreach ( array( 'Docs Agent Runner Recipe', 'portable recipe', 'Docs Agent owns the native package' ) as $migration_note_text ) {
 	$assert( str_contains( $workflow_readme, $migration_note_text ), "Workflow README missing agent runtime note: {$migration_note_text}" );
 }
-$assert( str_contains( $workflow_readme, 'ca1cc53ea76d09dc53dd02df89e41ad7fe143a27' ), 'Workflow README must record the #1756 WP Codebox producer revision.' );
-$assert( str_contains( $workflow_readme, '29281470179' ) && str_contains( $workflow_readme, '29281470159' ), 'Workflow README must retain the failed Build run regression references.' );
+$assert( str_contains( $workflow_readme, 'v0.12.4' ), 'Workflow README must record the WP Codebox release tag.' );
+$assert( str_contains( $workflow_readme, 'https://github.com/Automattic/wp-codebox/issues/1759' ), 'Workflow README must link the WP Codebox release contract issue.' );
 $assert( str_contains( $workflow_readme, 'blocks concrete runner workflow calls' ), 'Workflow README must document blocked concrete runner calls.' );
 $assert( str_contains( $workflow_readme, 'runtime ability names, component paths, mount directives, provider defaults, and define directives' ), 'Workflow README must document blocked runtime substrate surfaces.' );
 

tests/validate-wp-codebox-run-agent-task-contract.php

@@ -47,9 +47,15 @@
 $contract = $read_json( rtrim( $wp_codebox_dir, '/' ) . '/contracts/run-agent-task-reusable-workflow-interface.v1.json' );
 $assert( 'wp-codebox/reusable-workflow-interface/v1' === ( $contract['schema'] ?? null ), 'WP Codebox producer schema version mismatch.' );
 $assert( '.github/workflows/run-agent-task.yml' === ( $contract['workflow'] ?? null ), 'WP Codebox producer contract targets an unexpected workflow.' );
+$release = $read_json( $root . '/tests/wp-codebox-release.fixture.json' );
+$release_tag = $release['tag'] ?? null;
+$assert( is_string( $release_tag ) && preg_match( '/^v\d+\.\d+\.\d+$/', $release_tag ) === 1, 'WP Codebox release fixture must declare an exact release tag.' );
+$assert( substr( $release_tag, 1 ) === ( $release['package_version'] ?? null ), 'WP Codebox release fixture package version must match its tag.' );
+$producer_package = $read_json( rtrim( $wp_codebox_dir, '/' ) . '/package.json' );
+$assert( ( $release['package_version'] ?? null ) === ( $producer_package['version'] ?? null ), 'Checked-out WP Codebox package version must match the release fixture.' );
 
 $workflow = (string) file_get_contents( $root . '/.github/workflows/maintain-docs.yml' );
-$assert( preg_match( '/^\s*uses: Automattic\/wp-codebox\/\.github\/workflows\/run-agent-task\.yml@ca1cc53ea76d09dc53dd02df89e41ad7fe143a27$/m', $workflow ) === 1, 'Docs Agent must call the #1756 producer workflow revision.' );
+$assert( preg_match( '/^\s*uses: Automattic\/wp-codebox\/\.github\/workflows\/run-agent-task\.yml@' . preg_quote( $release_tag, '/' ) . '$/m', $workflow ) === 1, 'Docs Agent must call the released WP Codebox workflow tag.' );
 
 preg_match( '/uses: Automattic\/wp-codebox\/\.github\/workflows\/run-agent-task\.yml@[^\n]+\n    with:\n(?<inputs>.*?)\n    secrets:\n(?<secrets>(?:      [^\n]*\n?)*)/s', $workflow, $caller );
 $assert( isset( $caller['inputs'], $caller['secrets'] ), 'Docs Agent must declare producer inputs and secrets.' );
@@ -74,6 +80,18 @@
 	}
 }
 
+$assert( $release_tag === ( $caller_inputs['wp_codebox_release_ref'] ?? null ), 'Docs Agent must pass the WP Codebox release tag required by the producer contract.' );
+$is_coherent_release_pair = static function ( string $consumer_workflow ): bool {
+	preg_match( '/uses: Automattic\/wp-codebox\/\.github\/workflows\/run-agent-task\.yml@(?<workflow_tag>[^\s]+)/', $consumer_workflow, $workflow_match );
+	preg_match( '/^\s+wp_codebox_release_ref: (?<helper_tag>[^\s]+)$/m', $consumer_workflow, $helper_match );
+
+	return isset( $workflow_match['workflow_tag'], $helper_match['helper_tag'] )
+		&& preg_match( '/^v\d+\.\d+\.\d+$/', $workflow_match['workflow_tag'] ) === 1
+		&& $workflow_match['workflow_tag'] === $helper_match['helper_tag'];
+};
+$assert( $is_coherent_release_pair( $workflow ), 'Docs Agent must use matching exact WP Codebox release tags.' );
+$assert( ! $is_coherent_release_pair( str_replace( 'wp_codebox_release_ref: ' . $release_tag, 'wp_codebox_release_ref: v0.12.3', $workflow ) ), 'A mismatched WP Codebox workflow and helper release tag must fail.' );
+
 $caller_secrets = array();
 preg_match_all( '/^      (?<name>[A-Z0-9_]+): (?<value>[^\n]+)$/m', $caller['secrets'], $matches, PREG_SET_ORDER );
 foreach ( $matches as $match ) {
@@ -87,7 +105,6 @@
 	}
 }
 
-$assert( 'true' === ( $caller_inputs['require_access_token'] ?? null ), 'Docs Agent must require the caller-scoped publication token.' );
 $assert( '${{ github.token }}' === ( $caller_secrets['ACCESS_TOKEN'] ?? null ), 'Docs Agent must explicitly forward the caller-scoped GitHub token as ACCESS_TOKEN.' );
 $assert( '${{ secrets.OPENAI_API_KEY }}' === ( $caller_secrets['OPENAI_API_KEY'] ?? null ), 'Docs Agent must explicitly forward OPENAI_API_KEY.' );
 $assert( '${{ secrets.EXTERNAL_PACKAGE_SOURCE_POLICY }}' === ( $caller_secrets['EXTERNAL_PACKAGE_SOURCE_POLICY'] ?? null ), 'Docs Agent must explicitly forward the external package policy secret.' );

tests/wp-codebox-release.fixture.json

@@ -0,0 +1,4 @@
+{
+  "tag": "v0.12.4",
+  "package_version": "0.12.4"
+}