update to use safe outputs

Author: dsyme

workflows/daily-dependency-updates.md

@@ -13,19 +13,10 @@ permissions: read-all
 safe-outputs:
   create-pull-request:
     draft: true
+  create-issue:
+    title-prefix: "${{ github.workflow }}"
 
 tools:
-  github:
-    allowed:
-      [
-        create_or_update_file,
-        create_branch,
-        delete_file,
-        create_issue,
-        update_issue,
-        add_issue_comment,
-        update_pull_request,
-      ]
   claude:
     allowed:
       Edit:
@@ -34,8 +25,8 @@ tools:
       WebFetch:
       WebSearch:
       # Configure bash build commands here, or in .github/workflows/agentics/daily-dependency-updates.config.md or .github/workflows/agentics/build-tools.md
-      Bash:
       # For YOLO mode, uncomment the following line
+      #Bash:
       #- ":*
 ---
 
@@ -48,11 +39,9 @@ Your name is "${{ github.workflow }}". Your job is to act as an agentic coder fo
    - Use the `list_dependabot_alerts` tool to retrieve the list of Dependabot alerts.
    - Use the `get_dependabot_alert` tool to retrieve details of each alert.
 
-2. Check for an existing PR starting with title "Daily Dependency Updates". Add your additional updates to that PR if it exists, otherwise create a new PR.  Try to bundle as many dependency updates as possible into one PR. Test the changes to ensure they work correctly, if the tests don't pass then divide and conquer and create separate PRs for each dependency update. 
-
-> NOTE: If you didn't make progress on a particular dependency update, add a comment saying what you've tried, ask for clarification if necessary, and add a link to a new branch containing any investigations you tried.
+2. Create a new PR with title "${{ github.workflow }}". Try to bundle as many dependency updates as possible into one PR. Test the changes to ensure they work correctly, if the tests don't pass then work with a smaller number of updates until things are OK. 
 
-> NOTE: You can use the tools to list, get and add issue comments to add comments to pull reqests too.
+> NOTE: If you didn't make progress on particular dependency updates, create one overall issue saying what you've tried, ask for clarification if necessary, and add a link to a new branch containing any investigations you tried.
 
 @include agentics/shared/no-push-to-main.md
 

workflows/daily-perf-improver.md

@@ -137,7 +137,7 @@ Your name is ${{ github.workflow }}. Your job is to act as an agentic coder for
 
 4. Work towards your selected goal.. For the performance improvement goal you selected, do the following:
 
-   4a. Create a new branch.
+   4a. Create a new branch starting with "perf/".
 
    4b. Work towards the performance improvement goal you selected. This may involve:
      - Refactoring code

workflows/issue-triage.md

@@ -9,9 +9,8 @@ permissions: read-all
 
 safe-outputs:
   add-issue-label:
-    max: 3
+    max: 5
   add-issue-comment:
-    max: 1
 
 tools:
   claude:

workflows/pr-fix.md

@@ -5,30 +5,15 @@ on:
   reaction: "eyes"
   stop-after: +48h
 
-permissions:
-  contents: write # needed to push changes
-  actions: read # needed to access workflow runs and job logs
-  checks: read # needed to read check runs and status
-  statuses: read # needed to read commit statuses
-  issues: read # needed to create investigation issues
-  pull-requests: write # needed to comment on PRs if failure is related
+permissions: read-all
+
+safe-outputs:
+  push-to-branch:
+  create-issue:
+    title-prefix: "${{ github.workflow }}"
+  add-issue-comment:
 
 tools:
-  github:
-    allowed: [
-      get_workflow_run,
-      list_workflow_jobs,
-      get_job_logs,
-      get_workflow_run_logs,
-      get_commit,
-      get_pull_request,
-      get_pull_request_files,
-      create_issue,
-      add_issue_comment,
-      search_issues,
-      list_issues
-    ]
-  
   claude:
     allowed:
       Edit: