Skip to content

Commit f3b20e0

Browse files
Copilotpelikhan
Copilot
and
pelikhan
authored
Add awf-release-integrator skill for AWF release bumps (#31759)
* Plan awf release integrator skill Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add awf release integrator skill Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Clarify awf release integrator skill Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
1 parent c8cb24f commit f3b20e0

2 files changed

Lines changed: 102 additions & 4 deletions

File tree

‎.github/skills/awf-release-integrator/SKILL.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
name: awf-release-integrator
3+
description: Integrate the latest gh-aw-firewall release into gh-aw and surface follow-up spec work
4+
---
5+
6+
# AWF Release Integrator
7+
8+
Use this skill when updating `github/gh-aw` to a newer `github/gh-aw-firewall` release.
9+
10+
## Goal
11+
12+
Land the version bump cleanly, rebuild the generated artifacts, and review upstream release/spec changes for any follow-up work that should accompany the bump.
13+
14+
## Required sources
15+
16+
Consult these sources before editing anything:
17+
18+
1. The latest `github/gh-aw-firewall` release metadata and body.
19+
2. The current gh-aw version pins in `pkg/constants/version_constants.go`.
20+
3. The canonical AWF config sources spec in `specs/awf-config-sources-spec.md`.
21+
4. The embedded AWF schema in `pkg/workflow/schemas/awf-config.schema.json`.
22+
5. AWF config integration code in:
23+
- `pkg/workflow/awf_config.go`
24+
- `pkg/workflow/awf_helpers.go`
25+
- related AWF tests under `pkg/workflow/`
26+
27+
For upstream spec review, compare these files from the target `github/gh-aw-firewall` release or tag:
28+
29+
- `docs/awf-config-spec.md`
30+
- `docs/awf-config.schema.json`
31+
- `src/awf-config-schema.json`
32+
- any release assets such as `awf-config.schema.json`
33+
34+
## Update procedure
35+
36+
1. Read `pkg/constants/version_constants.go` and record:
37+
- `DefaultFirewallVersion`
38+
- every `AWF*MinVersion` constant
39+
2. Look up the latest `github/gh-aw-firewall` release.
40+
3. If the latest release tag matches `DefaultFirewallVersion`, report that no version bump is needed and only continue with spec/release-note review if explicitly requested.
41+
4. If a newer release exists, update the gh-aw pins:
42+
- bump `DefaultFirewallVersion`
43+
- update any `AWF*MinVersion` constants that must move because the new release introduces or changes gated flags/features
44+
5. Review release notes for:
45+
- new flags
46+
- removed or deprecated flags
47+
- schema/config additions
48+
- security fixes
49+
- behavioral changes that could require new tests, docs, or ADR/spec updates
50+
6. Review the upstream AWF specification and schema changes against:
51+
- `pkg/workflow/schemas/awf-config.schema.json`
52+
- `specs/awf-config-sources-spec.md`
53+
- local AWF config generation and validation code
54+
7. Update any directly related gh-aw files needed for a complete integration, such as:
55+
- embedded schema copies
56+
- version-gated helpers/tests
57+
- specs or ADRs documenting newly surfaced AWF behavior
58+
8. Add or update a patch changeset when the bump changes shipped behavior.
59+
60+
## Required validation
61+
62+
After editing, run the full AWF rebuild flow exactly in this order. The second
63+
`make recompile` is required to refresh image SHA pins resolved during the first pass.
64+
65+
```bash
66+
make build
67+
make recompile
68+
make recompile
69+
```
70+
71+
Then run focused validation for any touched Go code or schema logic, especially AWF-related tests.
72+
73+
## Expected output
74+
75+
Summarize:
76+
77+
- current gh-aw AWF version → target release
78+
- updated constants
79+
- release-note highlights
80+
- specification/schema differences reviewed
81+
- additional recommended follow-up updates that are not yet implemented
82+
83+
## Review heuristics
84+
85+
When deciding whether more than a version bump is needed, specifically check for:
86+
87+
- new AWF schema properties not represented in gh-aw
88+
- new CLI flags that need `AWF*MinVersion` gates
89+
- config fields present in schema but absent from gh-aw generation/validation
90+
- drift that should update `specs/awf-config-sources-spec.md`
91+
- tests whose expected pinned AWF version or schema URLs need refresh

‎pkg/workflow/schemas/github-workflow.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"properties": {
1919
"group": {
2020
"$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run-1",
21-
"description": "When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled.",
21+
"description": "When a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`.",
2222
"type": "string"
2323
},
2424
"cancel-in-progress": {
@@ -32,6 +32,13 @@
3232
"$ref": "#/definitions/expressionSyntax"
3333
}
3434
]
35+
},
36+
"queue": {
37+
"$comment": "https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-queueing-multiple-pending-runs",
38+
"description": "Controls how pending jobs or workflow runs are queued within a concurrency group. With the default `single`, at most one run can be pending — additional pending runs cancel the previous one. With `max`, up to 100 runs can be pending and are processed in FIFO order. The combination of `queue: max` and `cancel-in-progress: true` is not allowed.",
39+
"type": "string",
40+
"enum": ["single", "max"],
41+
"default": "single"
3542
}
3643
},
3744
"required": ["group"],
@@ -718,7 +725,7 @@
718725
},
719726
"concurrency": {
720727
"$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency",
721-
"description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.",
728+
"description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.",
722729
"oneOf": [
723730
{
724731
"type": "string"
@@ -921,7 +928,7 @@
921928
},
922929
"concurrency": {
923930
"$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idconcurrency",
924-
"description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.",
931+
"description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.",
925932
"oneOf": [
926933
{
927934
"type": "string"
@@ -1780,7 +1787,7 @@
17801787
},
17811788
"concurrency": {
17821789
"$comment": "https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency",
1783-
"description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. Any previously pending job or workflow in the concurrency group will be canceled. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.",
1790+
"description": "Concurrency ensures that only a single job or workflow using the same concurrency group will run at a time. A concurrency group can be any string or expression. The expression can use any context except for the secrets context. \nYou can also specify concurrency at the workflow level. \nWhen a concurrent job or workflow is queued, if another job or workflow using the same concurrency group in the repository is in progress, the queued job or workflow will be pending. By default any previously pending job or workflow in the concurrency group will be canceled; this behavior can be changed with `queue`. To also cancel any currently running job or workflow in the same concurrency group, specify cancel-in-progress: true.",
17841791
"oneOf": [
17851792
{
17861793
"type": "string"

0 commit comments

Comments
 (0)