update workflows

Author: dsyme

docs/pr-fix.md

@@ -4,16 +4,16 @@
 
 The ["@pr-fix" workflow](../workflows/pr-fix.md?plain=1) is an alias workflow "@pr-fix" that will help you fix and complete pull requests. By default it will analyze failing CI checks in pull requests, identify root causes, and implement fixes to resolve issues and get PRs back to a passing state. 
 
-You can trigger the workflow in default mode by adding a comment to a pull request with the alias:
+You can trigger the workflow in default mode by adding a comment to a pull request with the command:
 
 ```
-@pr-fix
+/pr-fix
 ```
 
 or by writing a comment:
 
 ```
-@pr-fix Please add more tests.
+/pr-fix Please add more tests.
 ```
 
 ## Installation
@@ -24,10 +24,10 @@ gh aw add pr-fix -r githubnext/agentics --pr
 
 This creates a pull request to add the workflow to your repository. You can't start a run of this workflow directly as it is triggered in the context of a pull request with failing checks.
 
-To trigger the workflow on a specific pull request, add a comment with the alias:
+To trigger the workflow on a specific pull request, add a comment with the command:
 
 ```
-@pr-fix
+/pr-fix
 ```
 
 IMPORTANT: GitHub Actions runs will **not** trigger on commits pushed by this workflow and will **not** tell you that CI has not been run unless you have enabled a specific custom check for this condition. **You must open/close the PR or hit "Update branch" if offered to trigger CI.Yes it's painful and yes it's just something you need to be aware of.

workflows/ci-doctor.md

@@ -8,28 +8,16 @@ on:
     # The condition is handled in the workflow body
   stop-after: +48h
 
+# Only trigger for failures - check in the workflow body
 if: ${{ github.event.workflow_run.conclusion == 'failure' }}
 
-permissions:
-  contents: read # needed to read repository content and workflow files
-  actions: read # needed to access workflow runs and job logs
-  checks: read # needed to read check runs and status
-  statuses: read # needed to read commit statuses
-  issues: write # needed to create investigation issues
-  pull-requests: write # needed to comment on PRs if failure is related
+permissions: read-all
 
-tools:
-  github:
-    allowed: [
-      create_issue,
-      add_issue_comment,
-      update_issue
-    ]
-  
-  # Simple file-based storage for investigation results (no external dependencies)
-  # Using Claude's built-in file operations and a structured approach to storing patterns
-  # The cache system will handle persistence between runs
+safe-outputs:
+  create-issue:
+  add-issue-comment:
 
+tools:
   claude:
     allowed:
       WebFetch:
@@ -47,7 +35,6 @@ cache:
 
 timeout_minutes: 10
 
-# Only trigger for failures - check in the workflow body
 ---
 
 # CI Failure Doctor
@@ -150,6 +137,7 @@ You are the CI Failure Doctor, an expert investigative agent that analyzes faile
 ## Output Requirements
 
 ### Investigation Issue Template
+
 When creating an investigation issue, use this structure:
 
 ```markdown

workflows/daily-accessibility-review.md

@@ -8,10 +8,13 @@ on:
 
 timeout_minutes: 15
 
+permissions: read-all
 
-permissions:
-  contents: read  # Required so the agent can review the code in the repository
-  issues: write   # Required so the agent can create issues for accessibility problems
+safe-outputs:
+  create-issue:
+    max: 5
+  add-issue-comment:
+    max: 5
 
 tools:
   playwright:
@@ -20,11 +23,8 @@ tools:
       command: npx
       args: ["@playwright/mcp@0.0.33", "--headless"]
     allowed: ["browser_click", "browser_evaluate", "browser_handle_dialog", "browser_hover", "browser_navigate", "browser_navigate_back", "browser_navigate_forward", "browser_press_key", "browser_resize", "browser_select_option", "browser_snapshot", "browser_take_screenshot", "browser_type", "browser_wait_for"]
-  github: 
-    allowed: ["create_issue"]
   claude:
     allowed:
-      TodoWrite:
       WebFetch:
       WebSearch:
 

workflows/daily-perf-improver.md

@@ -8,13 +8,12 @@ on:
 
 timeout_minutes: 30
 
-permissions:
-  contents: write # needed to create branches, files, and pull requests in this repo without a fork
-  issues: write # needed to create report issue
-  pull-requests: write # needed to create results pull request
-  actions: read
-  checks: read
-  statuses: read
+safe-outputs:
+  create-issue:
+    max: 5
+  add-issue-comment:
+    max: 5
+  create-pull-request:
 
 tools:
   github:

workflows/daily-qa.md

@@ -9,23 +9,12 @@ on:
 
 timeout_minutes: 15
 
-permissions:
-  issues: write  # needed to create issues for problems found
-  contents: read
-  pull-requests: read
-  discussions: read
-  actions: read
-  checks: read
-  statuses: read
+safe-outputs:
+  create-issue:
+  add-issue-comment:
+    max: 5
 
 tools:
-  github:
-    allowed:
-      [
-        create_issue,
-        update_issue,
-        add_issue_comment,
-      ]
   claude:
     allowed:
       Edit:

workflows/issue-triage.md

@@ -5,30 +5,20 @@ on:
   stop-after: +30d # workflow will no longer trigger after 30 days. Remove this and recompile to run indefinitely
   reaction: eyes
 
-permissions:
-  contents: read
-  issues: write  # needed to write comments to the issue
-  actions: read
-  checks: read
-  statuses: read
-  pull-requests: read
+safe-outputs:
+  add-issue-label:
+    max: 3
+  add-issue-comment:
+    max: 1
+
+permissions: read-all
 
 tools:
-  github:
-    allowed: [update_issue, add_issue_comment]
   claude:
     allowed:
       WebFetch:
       WebSearch:
 
-# By default agentic workflows use a concurrency setting that
-# allows one run at a time, regardless of branch or issue. This is
-# not appropriate for triage workflows, so here we allow one run
-# per issue at a time.
-concurrency:
-   group: "triage-${{ github.event.issue.number }}"
-   cancel-in-progress: true
-
 timeout_minutes: 10
 ---
 

workflows/pr-fix.md

@@ -1,6 +1,6 @@
 ---
 on:
-  alias:
+  command:
     name: pr-fix
   reaction: "eyes"
   stop-after: +48h