Skip to content

Commit 0e46a13

Browse files
lpcoxCopilot
lpcox
and
Copilot
authored
chore: recompile all workflow lock files (#3345)
Recompiled with gh aw compile and ran post-processing script. Includes local build steps, session-state-dir injection, cache-memory security hardening, and xpia policy sanitization for Codex workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent f028e72 commit 0e46a13

38 files changed

Lines changed: 3135 additions & 2073 deletions

‎.github/aw/actions-lock.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75,15 +75,15 @@
7575
"version": "v4.0.0",
7676
"sha": "4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd"
7777
},
78-
"github/gh-aw-actions/setup-cli@v0.72.1": {
78+
"github/gh-aw-actions/setup-cli@v0.74.4": {
7979
"repo": "github/gh-aw-actions/setup-cli",
80-
"version": "v0.72.1",
81-
"sha": "bc56a0cad2f450c562810785ef38649c04db812a"
80+
"version": "v0.74.4",
81+
"sha": "d3abfe96a194bce3a523ed2093ddedd5704cdf62"
8282
},
83-
"github/gh-aw-actions/setup@v0.72.1": {
83+
"github/gh-aw-actions/setup@v0.74.4": {
8484
"repo": "github/gh-aw-actions/setup",
85-
"version": "v0.72.1",
86-
"sha": "bc56a0cad2f450c562810785ef38649c04db812a"
85+
"version": "v0.74.4",
86+
"sha": "d3abfe96a194bce3a523ed2093ddedd5704cdf62"
8787
},
8888
"github/gh-aw/actions/setup@v0.72.1": {
8989
"repo": "github/gh-aw/actions/setup",

‎.github/dependabot.yml‎

Lines changed: 53 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,54 @@
1-
# Dependabot configuration for automated dependency updates
2-
# See: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
3-
#
4-
# PR budget: ~5 total across all ecosystems (2 + 1 + 1 + 1 = 5)
5-
# Each ecosystem groups ALL deps into a single PR to minimize noise.
6-
7-
version: 2
81
updates:
9-
# npm ecosystem - root package.json
10-
- package-ecosystem: "npm"
11-
directory: "/"
12-
schedule:
13-
interval: "weekly"
14-
day: "monday"
15-
open-pull-requests-limit: 2
16-
groups:
17-
all-npm-dependencies:
18-
patterns:
19-
- "*"
20-
21-
# npm ecosystem - docs-site
22-
- package-ecosystem: "npm"
23-
directory: "/docs-site"
24-
schedule:
25-
interval: "weekly"
26-
day: "monday"
27-
open-pull-requests-limit: 1
28-
groups:
29-
all-docs-site-dependencies:
30-
patterns:
31-
- "*"
32-
33-
# Docker ecosystem - agent container
34-
- package-ecosystem: "docker"
35-
directory: "/containers/agent"
36-
schedule:
37-
interval: "weekly"
38-
day: "monday"
39-
open-pull-requests-limit: 1
40-
groups:
41-
all-docker-agent:
42-
patterns:
43-
- "*"
44-
45-
# Docker ecosystem - squid container
46-
- package-ecosystem: "docker"
47-
directory: "/containers/squid"
48-
schedule:
49-
interval: "weekly"
50-
day: "monday"
51-
open-pull-requests-limit: 1
52-
groups:
53-
all-docker-squid:
54-
patterns:
55-
- "*"
56-
57-
# GitHub Actions ecosystem
58-
- package-ecosystem: "github-actions"
59-
directory: "/"
60-
schedule:
61-
interval: "weekly"
62-
day: "monday"
63-
open-pull-requests-limit: 1
64-
groups:
65-
all-github-actions:
66-
patterns:
67-
- "*"
2+
- directory: /
3+
groups:
4+
all-npm-dependencies:
5+
patterns:
6+
- "*"
7+
open-pull-requests-limit: 2
8+
package-ecosystem: npm
9+
schedule:
10+
day: monday
11+
interval: weekly
12+
- directory: /docs-site
13+
groups:
14+
all-docs-site-dependencies:
15+
patterns:
16+
- "*"
17+
open-pull-requests-limit: 1
18+
package-ecosystem: npm
19+
schedule:
20+
day: monday
21+
interval: weekly
22+
- directory: /containers/agent
23+
groups:
24+
all-docker-agent:
25+
patterns:
26+
- "*"
27+
open-pull-requests-limit: 1
28+
package-ecosystem: docker
29+
schedule:
30+
day: monday
31+
interval: weekly
32+
- directory: /containers/squid
33+
groups:
34+
all-docker-squid:
35+
patterns:
36+
- "*"
37+
open-pull-requests-limit: 1
38+
package-ecosystem: docker
39+
schedule:
40+
day: monday
41+
interval: weekly
42+
- directory: /
43+
groups:
44+
all-github-actions:
45+
patterns:
46+
- "*"
47+
ignore:
48+
- dependency-name: "github/gh-aw-actions/**" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
49+
open-pull-requests-limit: 1
50+
package-ecosystem: github-actions
51+
schedule:
52+
day: monday
53+
interval: weekly
54+
version: 2

‎.github/workflows/agentics-maintenance.yml‎

Lines changed: 96 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
1313
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
1414
#
15-
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.72.1). DO NOT EDIT.
15+
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.74.4). DO NOT EDIT.
1616
#
1717
# To regenerate this workflow, run:
1818
# gh aw compile
@@ -55,6 +55,7 @@ on:
5555
- 'clean_cache_memories'
5656
- 'update_pull_request_branches'
5757
- 'validate'
58+
- 'forecast'
5859
run_url:
5960
description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
6061
required: false
@@ -63,7 +64,7 @@ on:
6364
workflow_call:
6465
inputs:
6566
operation:
66-
description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate)'
67+
description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate, forecast)'
6768
required: false
6869
type: string
6970
default: ''
@@ -92,7 +93,7 @@ jobs:
9293
pull-requests: write
9394
steps:
9495
- name: Setup Scripts
95-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
96+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
9697
with:
9798
destination: ${{ runner.temp }}/gh-aw/actions
9899

@@ -130,7 +131,7 @@ jobs:
130131
actions: write
131132
steps:
132133
- name: Setup Scripts
133-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
134+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
134135
with:
135136
destination: ${{ runner.temp }}/gh-aw/actions
136137

@@ -144,7 +145,7 @@ jobs:
144145
await main();
145146
146147
run_operation:
147-
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && (!(github.event.repository.fork)) }}
148+
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && inputs.operation != 'forecast' && (!(github.event.repository.fork)) }}
148149
runs-on: ubuntu-slim
149150
permissions:
150151
actions: write
@@ -159,7 +160,7 @@ jobs:
159160
persist-credentials: false
160161

161162
- name: Setup Scripts
162-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
163+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
163164
with:
164165
destination: ${{ runner.temp }}/gh-aw/actions
165166

@@ -174,9 +175,9 @@ jobs:
174175
await main();
175176
176177
- name: Install gh-aw
177-
uses: github/gh-aw-actions/setup-cli@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
178+
uses: github/gh-aw-actions/setup-cli@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
178179
with:
179-
version: v0.72.1
180+
version: v0.74.4
180181

181182
- name: Run operation
182183
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -204,7 +205,7 @@ jobs:
204205
pull-requests: write
205206
steps:
206207
- name: Setup Scripts
207-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
208+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
208209
with:
209210
destination: ${{ runner.temp }}/gh-aw/actions
210211

@@ -250,7 +251,7 @@ jobs:
250251
persist-credentials: false
251252

252253
- name: Setup Scripts
253-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
254+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
254255
with:
255256
destination: ${{ runner.temp }}/gh-aw/actions
256257

@@ -294,7 +295,7 @@ jobs:
294295
persist-credentials: false
295296

296297
- name: Setup Scripts
297-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
298+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
298299
with:
299300
destination: ${{ runner.temp }}/gh-aw/actions
300301

@@ -309,9 +310,9 @@ jobs:
309310
await main();
310311
311312
- name: Install gh-aw
312-
uses: github/gh-aw-actions/setup-cli@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
313+
uses: github/gh-aw-actions/setup-cli@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
313314
with:
314-
version: v0.72.1
315+
version: v0.74.4
315316

316317
- name: Create missing labels
317318
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -340,7 +341,7 @@ jobs:
340341
persist-credentials: false
341342

342343
- name: Setup Scripts
343-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
344+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
344345
with:
345346
destination: ${{ runner.temp }}/gh-aw/actions
346347

@@ -355,9 +356,9 @@ jobs:
355356
await main();
356357
357358
- name: Install gh-aw
358-
uses: github/gh-aw-actions/setup-cli@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
359+
uses: github/gh-aw-actions/setup-cli@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
359360
with:
360-
version: v0.72.1
361+
version: v0.74.4
361362

362363
- name: Restore activity report logs cache
363364
id: activity_report_logs_cache
@@ -430,14 +431,89 @@ jobs:
430431
});
431432
core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);
432433
434+
forecast_report:
435+
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'forecast' && (!(github.event.repository.fork)) }}
436+
runs-on: ubuntu-slim
437+
timeout-minutes: 60
438+
permissions:
439+
actions: read
440+
contents: read
441+
issues: write
442+
steps:
443+
- name: Checkout repository
444+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
445+
with:
446+
persist-credentials: false
447+
448+
- name: Setup Scripts
449+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
450+
with:
451+
destination: ${{ runner.temp }}/gh-aw/actions
452+
453+
- name: Check admin/maintainer permissions
454+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
455+
with:
456+
github-token: ${{ secrets.GITHUB_TOKEN }}
457+
script: |
458+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
459+
setupGlobals(core, github, context, exec, io, getOctokit);
460+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
461+
await main();
462+
463+
- name: Install gh-aw
464+
uses: github/gh-aw-actions/setup-cli@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
465+
with:
466+
version: v0.74.4
467+
468+
- name: Restore forecast report logs cache
469+
id: forecast_report_logs_cache
470+
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
471+
with:
472+
path: .github/aw/logs
473+
key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
474+
restore-keys: |
475+
${{ runner.os }}-forecast-report-logs-${{ github.repository }}-
476+
${{ runner.os }}-forecast-report-logs-
477+
478+
- name: Generate forecast report
479+
shell: bash
480+
env:
481+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
482+
GH_AW_CMD_PREFIX: gh aw
483+
run: |
484+
mkdir -p ./.cache/gh-aw/forecast
485+
${GH_AW_CMD_PREFIX} logs --repo "${{ github.repository }}" --start-date -30d --count 1500 > /dev/null
486+
if ! compgen -G ".github/aw/logs/run-*/run_summary.json" > /dev/null; then
487+
echo "::error::Missing run summary cache in .github/aw/logs after gh aw logs warm-up; cannot run forecast."
488+
exit 1
489+
fi
490+
${GH_AW_CMD_PREFIX} forecast --repo "${{ github.repository }}" --json 2> >(grep -Fv "forecast is an experimental command and may change without notice" >&2) > ./.cache/gh-aw/forecast/report.json
491+
492+
- name: Save forecast report logs cache
493+
if: ${{ always() }}
494+
uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
495+
with:
496+
path: .github/aw/logs
497+
key: ${{ steps.forecast_report_logs_cache.outputs.cache-primary-key }}
498+
499+
- name: Generate forecast issue
500+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
501+
with:
502+
github-token: ${{ secrets.GITHUB_TOKEN }}
503+
script: |
504+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
505+
setupGlobals(core, github, context, exec, io, getOctokit);
506+
const { main } = require('${{ runner.temp }}/gh-aw/actions/create_forecast_issue.cjs');
507+
await main();
508+
433509
close_agentic_workflows_issues:
434510
if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'close_agentic_workflows_issues' && (!(github.event.repository.fork)) }}
435511
runs-on: ubuntu-slim
436512
permissions:
437513
issues: write
438514
steps:
439515
- name: Setup Scripts
440-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
516+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
441517
with:
442518
destination: ${{ runner.temp }}/gh-aw/actions
443519

@@ -474,7 +550,7 @@ jobs:
474550
persist-credentials: false
475551

476552
- name: Setup Scripts
477-
uses: github/gh-aw-actions/setup@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
553+
uses: github/gh-aw-actions/setup@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
478554
with:
479555
destination: ${{ runner.temp }}/gh-aw/actions
480556

@@ -489,9 +565,9 @@ jobs:
489565
await main();
490566
491567
- name: Install gh-aw
492-
uses: github/gh-aw-actions/setup-cli@bc56a0cad2f450c562810785ef38649c04db812a # v0.72.1
568+
uses: github/gh-aw-actions/setup-cli@d3abfe96a194bce3a523ed2093ddedd5704cdf62 # v0.74.4
493569
with:
494-
version: v0.72.1
570+
version: v0.74.4
495571

496572
- name: Validate workflows and file issue on findings
497573
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

0 commit comments

Comments
 (0)