Skip to content

Commit e64eec9

Browse files
NagyViktNagyVikt
NagyVikt
and
NagyVikt
authored
Auto-finish: agent/gx/gx-setup-2026-05-14-17-10 (#9)
Co-authored-by: NagyVikt <nagy.viktordp@gmail.com>
1 parent eb54a2a commit e64eec9

72 files changed

Lines changed: 7363 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/pull.yml.example‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: "1"
2+
rules:
3+
- base: main
4+
upstream: upstream-owner:main
5+
mergeMethod: hardreset
6+
mergeUnstable: true

‎.github/workflows/README.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# `templates/github/workflows/` — budget-friendly CI defaults
2+
3+
Workflow files in this directory are copied into a gitguardex-managed
4+
project's `.github/workflows/` directory when bootstrapping. They are
5+
the **default** budget posture for projects that use `gx branch start`
6+
to drive agent iterations.
7+
8+
Agent flows land a high volume of PRs per month. Without these trims,
9+
every PR + every post-merge push fans out across CI, CodeQL, Scorecard,
10+
and Code Review — which dominates the GitHub Actions bill for any
11+
multi-agent repo. The trims below cut that cost without giving up
12+
correctness coverage.
13+
14+
## What's trimmed and why
15+
16+
1. **`concurrency: cancel-in-progress: true`** scoped per workflow + ref
17+
so rapid pushes to the same agent branch cancel the prior run
18+
instead of letting both finish on Actions minutes.
19+
20+
2. **`if: github.event.pull_request.draft == false`** on every job that
21+
shouldn't run on a draft PR, paired with
22+
`pull_request.types: [..., ready_for_review]` in the trigger list so
23+
CI fires the moment the PR is promoted out of draft.
24+
25+
3. **`if: !startsWith(head.ref, 'agent/')`** on the Code Review job
26+
(`cr.yml`) — skip AI review on automated agent-lane PRs. AI review
27+
on hundreds of agent PRs per month burns both Actions minutes and
28+
OpenAI tokens without adding signal; human-authored PRs (any non-
29+
`agent/*` head branch) still get reviewed.
30+
31+
4. **No `push: main` trigger** in `ci.yml` — branch protection on
32+
`main` forces all changes through a PR, so PR-time CI is sufficient
33+
and post-merge CI on `main` was pure duplication. Use
34+
`workflow_dispatch` for ad-hoc full runs.
35+
36+
5. **`paths-ignore`** for docs / openspec / template-only changes — skip
37+
CI on changes that don't affect runtime behavior.
38+
39+
## Customizing
40+
41+
- Replace `placeholder` steps in `ci.yml` with your build/test/lint
42+
commands.
43+
- Keep the `concurrency:`, `if:`, and `paths-ignore:` patterns. They
44+
are the load-bearing part of the budget posture; removing them undoes
45+
the win.
46+
47+
## When to skip the draft-skip pattern
48+
49+
If your CI is fast (≤ 2 min) and you want continuous validation as
50+
agents iterate, drop the `if: pull_request.draft == false` job guard.
51+
The concurrency cancel alone still prevents minute pile-up.
52+
53+
## When to re-enable AI code review on agent PRs
54+
55+
If your team relies on AI review as a true gating signal (not just
56+
advisory), remove the `!startsWith(head.ref, 'agent/')` guard in
57+
`cr.yml`. Expect the OpenAI bill to scale linearly with merge volume.
58+
59+
## Per-PR label opt-in
60+
61+
Both `cr.yml` and `ci-full.yml` honor PR labels so the occasional
62+
agent PR that actually needs the heavier check can opt in without
63+
flipping a global toggle:
64+
65+
| Label | Effect |
66+
| --- | --- |
67+
| `needs-review` | Run AI code review on this PR even though it's `agent/*`. Useful for security-sensitive changes or public-API redesigns. |
68+
| `needs-ci-full` | Run the full cross-runtime matrix from `ci-full.yml` on this PR instead of waiting for the weekly schedule. Useful before a release branch lands. |
69+
70+
To enable: open the PR, then `gh pr edit <num> --add-label needs-review`
71+
(or click the labels picker in the GitHub UI). The label-trigger fires
72+
the workflow immediately; you don't need to re-push.
73+
74+
Add label definitions to your repo with `gh label create needs-review
75+
--description "Run AI code review on this PR"` and similar for
76+
`needs-ci-full`, or define them in `.github/labels.yml` if you use a
77+
label-sync workflow.
78+
79+
## What about CodeQL / Scorecard?
80+
81+
The gitguardex repo itself runs CodeQL and Scorecard on the **weekly
82+
schedule + `workflow_dispatch`** only — not on per-PR / per-push
83+
triggers. Those workflows are long-running (5–10 min for CodeQL) and
84+
were the largest single line item on the monthly Actions bill before
85+
this change. If your project needs per-PR CodeQL gating for compliance
86+
reasons, re-add the `pull_request` trigger and accept the cost; for
87+
most repos, weekly + on-demand is the right default.

‎.github/workflows/ci-full.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Optional companion to `ci.yml`. Drop in alongside it when your
2+
# project supports multiple runtimes / OS combinations and you want
3+
# coverage across all of them without paying per-PR.
4+
#
5+
# Strategy: PR-time `ci.yml` runs the primary runtime only (cheap).
6+
# This workflow runs the full matrix on the weekly schedule, and
7+
# on-demand via `workflow_dispatch` before a release. Per-PR opt-in
8+
# is available by applying the `needs-ci-full` label to a PR.
9+
#
10+
# Customize the matrix rows below to match your supported runtimes.
11+
12+
name: CI (full matrix)
13+
14+
on:
15+
schedule:
16+
- cron: '15 4 * * 1'
17+
workflow_dispatch:
18+
pull_request:
19+
types: [labeled, synchronize]
20+
21+
permissions:
22+
contents: read
23+
24+
concurrency:
25+
group: ci-full-${{ github.workflow }}-${{ github.ref }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
test:
30+
name: test (node ${{ matrix.node }})
31+
# PR runs only fire when the `needs-ci-full` label is present.
32+
# Schedule and workflow_dispatch always run.
33+
if: >-
34+
github.event_name != 'pull_request' ||
35+
contains(github.event.pull_request.labels.*.name, 'needs-ci-full') ||
36+
(github.event.action == 'labeled' && github.event.label.name == 'needs-ci-full')
37+
runs-on: ubuntu-latest
38+
strategy:
39+
fail-fast: false
40+
matrix:
41+
node: [18, 22]
42+
43+
steps:
44+
- name: Checkout
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
47+
- name: Setup Node
48+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
49+
with:
50+
node-version: ${{ matrix.node }}
51+
52+
# Replace below with your build/test/lint steps. Keep them parallel
53+
# to `ci.yml` so the weekly matrix matches what runs per-PR.
54+
- name: Project verification placeholder
55+
run: echo "Replace this step with your build/test/lint commands."

‎.github/workflows/ci.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Budget-friendly CI default for gitguardex-managed projects.
2+
#
3+
# Four trims keep Actions minutes low while agent branches iterate:
4+
# 1. `concurrency: cancel-in-progress` — rapid pushes to the same ref
5+
# kill the prior run instead of letting both finish.
6+
# 2. Job-level `if: pull_request.draft == false` plus the
7+
# `ready_for_review` PR trigger — draft PRs skip CI, and CI fires
8+
# automatically the moment the PR is promoted out of draft.
9+
# 3. `paths-ignore` for docs / openspec / template-only changes —
10+
# skip CI on changes that don't affect runtime behavior.
11+
# 4. No `push: main` trigger — branch-protection-required PR runs
12+
# already cover correctness, and post-merge CI on main is pure
13+
# duplication. Use `workflow_dispatch` for ad-hoc full runs.
14+
#
15+
# Copy this file to `.github/workflows/ci.yml` in your project and
16+
# replace the placeholder `steps:` block with your build/test/lint
17+
# commands.
18+
19+
name: CI
20+
21+
on:
22+
pull_request:
23+
branches:
24+
- main
25+
types: [opened, reopened, synchronize, ready_for_review]
26+
paths-ignore:
27+
- '**/*.md'
28+
- 'docs/**'
29+
- 'openspec/**'
30+
- '.github/ISSUE_TEMPLATE/**'
31+
- '.github/PULL_REQUEST_TEMPLATE.md'
32+
- '.changeset/**'
33+
workflow_dispatch:
34+
35+
permissions:
36+
contents: read
37+
38+
concurrency:
39+
group: ci-${{ github.workflow }}-${{ github.ref }}
40+
cancel-in-progress: true
41+
42+
jobs:
43+
build:
44+
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Checkout
48+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
49+
50+
# Replace below with your build/test/lint steps. Examples:
51+
# - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
52+
# with: { node-version: '20' }
53+
# - run: npm ci
54+
# - run: npm test
55+
- name: Project verification placeholder
56+
run: echo "Replace this step with your build/test/lint commands."

‎.github/workflows/cr.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Code Review
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, synchronize, ready_for_review, labeled]
6+
7+
permissions:
8+
contents: read
9+
pull-requests: write
10+
11+
# Budget-friendly default for gitguardex-managed projects: cancel
12+
# superseded runs on the same PR so rapid agent pushes don't fan-out
13+
# the OpenAI bill.
14+
concurrency:
15+
group: cr-${{ github.workflow }}-${{ github.event.pull_request.number }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
review:
20+
# Skip on draft PRs and on `agent/*` head branches by default.
21+
# Agent PRs can opt-in by applying the `needs-review` label —
22+
# useful for the occasional agent PR that genuinely needs AI
23+
# eyes (security-sensitive change, public-API redesign, etc.).
24+
# Human-authored PRs (any non-`agent/*` head branch) always run.
25+
if: >-
26+
github.event.pull_request.draft == false &&
27+
(
28+
!startsWith(github.event.pull_request.head.ref, 'agent/') ||
29+
contains(github.event.pull_request.labels.*.name, 'needs-review') ||
30+
(github.event.action == 'labeled' && github.event.label.name == 'needs-review')
31+
)
32+
runs-on: ubuntu-latest
33+
env:
34+
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
35+
steps:
36+
- name: Skip when OPENAI_API_KEY is missing
37+
if: ${{ env.OPENAI_API_KEY == '' }}
38+
run: echo "OPENAI_API_KEY is not configured; skipping Code Review workflow."
39+
40+
- uses: anc95/ChatGPT-CodeReview@1e3df152c1b85c12da580b206c91ad343460c584 # v1.0.23
41+
if: ${{ env.OPENAI_API_KEY != '' }}
42+
env:
43+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
44+
OPENAI_API_KEY: ${{ env.OPENAI_API_KEY }}
45+
OPENAI_API_ENDPOINT: https://api.openai.com/v1
46+
MODEL: gpt-4o-mini

‎.gitignore‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,19 @@ __pycache__/
1818
.claude/settings.local.json
1919
.omc/state/
2020
.omx/state/
21+
22+
# multiagent-safety:START
23+
.omx/
24+
.omc/
25+
.codex/
26+
!.vscode/
27+
.vscode/*
28+
!.vscode/settings.json
29+
scripts/agent-session-state.js
30+
scripts/guardex-docker-loader.sh
31+
scripts/guardex-env.sh
32+
scripts/install-vscode-active-agents-extension.js
33+
.githooks
34+
oh-my-codex/
35+
.omx/state/agent-file-locks.json
36+
# multiagent-safety:END

‎.vscode/settings.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"git.repositoryScanIgnoredFolders": [
3+
".omx/agent-worktrees",
4+
"**/.omx/agent-worktrees",
5+
".omx/.tmp-worktrees",
6+
"**/.omx/.tmp-worktrees",
7+
".omc/agent-worktrees",
8+
"**/.omc/agent-worktrees",
9+
".omc/.tmp-worktrees",
10+
"**/.omc/.tmp-worktrees"
11+
]
12+
}

0 commit comments

Comments
 (0)