Initial commit

Author: mrjf

.gitattributes

@@ -0,0 +1,2 @@
+.github/workflows/*.lock.yml linguist-generated=true merge=ours
+workflows/*.lock.yml linguist-generated=true merge=ours

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,46 @@
+name: Bug report
+description: Report incorrect Evergreen workflow, installer, or documentation behavior.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Workflow controller
+        - Agent or safe outputs
+        - Installation guide
+        - Shared skills or policy
+        - Documentation
+    validations:
+      required: true
+  - type: textarea
+    id: current
+    attributes:
+      label: Current behavior
+      description: Explain what happened. Remove tokens, secrets, and private repository data.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Include the smallest safe example, controller state, and relevant check conclusions.
+    validations:
+      required: true
+  - type: textarea
+    id: version
+    attributes:
+      label: Toolchain
+      description: Include the gh-aw version and the Evergreen source commit.
+      placeholder: "gh-aw v0.79.4; Evergreen commit ..."
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Summary
+
+Describe the behavior or documentation change and why it is needed.
+
+## Validation
+
+- [ ] `gh aw compile --dir workflows --validate --strict --approve --no-check-update`
+- [ ] `gh aw validate --dir workflows --strict --no-check-update`
+- [ ] `ruby tests/readiness_state_machine_test.rb`
+- [ ] `git diff --check`
+- [ ] Generated lockfiles are committed and were not edited directly
+- [ ] Install, policy, and design docs remain consistent with workflow behavior
+
+## Security
+
+- [ ] No secrets, private logs, or repository-specific credentials are included
+- [ ] New permissions, action references, network domains, and write paths are justified

.github/aw/actions-lock.json

@@ -0,0 +1,34 @@
+{
+  "entries": {
+    "actions/checkout@v6.0.3": {
+      "repo": "actions/checkout",
+      "version": "v6.0.3",
+      "sha": "df4cb1c069e1874edd31b4311f1884172cec0e10"
+    },
+    "actions/download-artifact@v8.0.1": {
+      "repo": "actions/download-artifact",
+      "version": "v8.0.1",
+      "sha": "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
+    },
+    "actions/github-script@v9.0.0": {
+      "repo": "actions/github-script",
+      "version": "v9.0.0",
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
+    },
+    "actions/setup-node@v6.4.0": {
+      "repo": "actions/setup-node",
+      "version": "v6.4.0",
+      "sha": "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"
+    },
+    "actions/upload-artifact@v7.0.1": {
+      "repo": "actions/upload-artifact",
+      "version": "v7.0.1",
+      "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
+    },
+    "github/gh-aw-actions/setup@v0.79.4": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.79.4",
+      "sha": "d059700c6a8ec3b5fd798b9ea60f5d048447b918"
+    }
+  }
+}

.github/workflows/validate.yml

@@ -0,0 +1,41 @@
+name: Validate
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: validate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  workflow:
+    name: Workflow source and readiness states
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install gh-aw
+        run: gh extension install github/gh-aw --pin v0.79.4
+
+      - name: Compile workflow
+        run: gh aw compile --dir workflows --validate --strict --approve --no-check-update
+
+      - name: Verify generated files are current
+        run: git diff --exit-code -- workflows/evergreen.lock.yml .github/aw/actions-lock.json
+
+      - name: Run workflow security validators
+        run: gh aw validate --dir workflows --strict --no-check-update
+
+      - name: Test readiness state machine
+        run: ruby tests/readiness_state_machine_test.rb

.poutine.yml

@@ -0,0 +1,7 @@
+# Configure poutine security scanner.
+# See: https://github.com/boostsecurityio/poutine
+
+rulesConfig:
+  pr_runs_on_self_hosted:
+    allowed_runners:
+      - ubuntu-slim

CONTRIBUTING.md

@@ -0,0 +1,26 @@
+# Contributing to Evergreen
+
+Evergreen is a source template for GitHub Agentic Workflows. Changes should keep
+the install contract, workflow source, generated lockfile, and shared policy
+documents in sync.
+
+## Before Opening a Pull Request
+
+1. Edit `workflows/evergreen.md`, not `workflows/evergreen.lock.yml` directly.
+2. Update the install guide and design docs when behavior or policy changes.
+3. Add or update readiness fixtures when controller state handling changes.
+4. Compile and validate with the pinned release toolchain:
+
+   ```bash
+   gh extension install github/gh-aw --pin v0.79.4
+   gh aw compile --dir workflows --validate --strict --approve --no-check-update
+   gh aw validate --dir workflows --strict --no-check-update
+   ruby tests/readiness_state_machine_test.rb
+   git diff --check
+   ```
+
+5. Commit the regenerated `workflows/evergreen.lock.yml` and any action-lock
+   updates with the source change.
+
+Keep changes focused. Do not include repository credentials, CI logs containing
+secrets, or private installation policy in issues or pull requests.