Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
124 changes: 107 additions & 17 deletions .github/workflows/feature-ideation.yml
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,19 @@ on:
required: false
default: false
type: boolean
enhance_backlog:
description: 'Backlog enhancement sweep: enhance this repo''s open, human-authored, not-yet-enhanced Ideas (one comment each, idempotent). Combine with dry_run=true to preview.'
required: false
default: false
type: boolean
target_discussion:
description: 'Internal — set by `redispatch` when bridging a `discussion:created` event to workflow_dispatch (claude-code-action does not support discussion contexts). Not for manual use.'
required: false
default: ''
type: string
# Auto-enhance a freshly-created idea: when a new Discussion is opened in the
# Ideas category, the analyst researches and refines it in single-idea mode.
# Ideas category, the `redispatch` job bridges it to workflow_dispatch (see below)
# so the analyst refines it in single-idea mode under a supported event.
discussion:
types: [created]

Expand All @@ -76,15 +87,88 @@ concurrency:
cancel-in-progress: false

jobs:
ideate:
# On the `discussion` trigger, only run for new ideas in the Ideas category
# and skip the bot's own creations (avoids re-enhancing scheduled output;
# enhancement posts a comment, which does not re-fire `discussion: created`).
# Schedule/dispatch runs are unaffected by this guard.
# ── #963 discussion→dispatch redispatch bridge ───────────────────────────────
# claude-code-action aborts on `discussion` event contexts ("Unsupported event
# type: discussion"). So on `discussion: created` we do NOT call the reusable
# inline; the `redispatch` job re-invokes this workflow via workflow_dispatch
# (under which the action runs cleanly), passing the number as target_discussion.
# Mirrors initiative-planner.yml's redispatch (#618). The `ideate` reusable call
# then runs only on workflow_dispatch/schedule.
redispatch:
if: >-
github.event_name != 'discussion' ||
(github.event.discussion.category.slug == 'ideas' &&
github.event.discussion.user.type != 'Bot')
github.event_name == 'discussion' &&
github.event.discussion.category.slug == 'ideas' &&
github.event.discussion.user.type != 'Bot'
runs-on: ubuntu-latest
timeout-minutes: 5
permissions: {}
steps:
- name: Guard — PAT present
# A workflow_dispatch fired with GITHUB_TOKEN is accepted but never starts
# a run (loop prevention), so a PAT is required (same as initiative-planner).
env:
GH_TOKEN: ${{ secrets.GH_PAT_WORKFLOWS }}
run: |
if [ -z "${GH_TOKEN}" ]; then
echo "::error::GH_PAT_WORKFLOWS is required — a workflow_dispatch fired with GITHUB_TOKEN will not start a run."
exit 1
fi
- name: Re-dispatch under workflow_dispatch
env:
GH_TOKEN: ${{ secrets.GH_PAT_WORKFLOWS }}
REPO: ${{ github.repository }}
DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
run: |
gh workflow run feature-ideation.yml --repo "${REPO}" \
-f target_discussion="${DISCUSSION_NUMBER}"

# ── #571 input resolution — keep `inputs` out of the reusable `with:` ────────
# A reusable-workflow call graph (its `uses:` + `with:`) is validated at
# WORKFLOW SETUP, before — and regardless of — the calling job's `if:`. The
# `inputs` context is only populated for workflow_dispatch/workflow_call, so a
# `with:` that references `${{ inputs.* }}` trips a zero-job startup failure on
# the `discussion` event even though `ideate` is gated off it. We therefore
# resolve the dispatch inputs in this ordinary job (whose step expressions are
# evaluated at RUN time and are skipped on `discussion`) and hand them to
# `ideate` via `needs.prep.outputs.*` — an always-valid context that defers the
# `with:` evaluation to run time. Do not reference `inputs` in `ideate.with`.
prep:
if: github.event_name != 'discussion'
runs-on: ubuntu-latest
timeout-minutes: 5
permissions: {}
outputs:
target_discussion: ${{ steps.resolve.outputs.target_discussion }}
focus_area: ${{ steps.resolve.outputs.focus_area }}
research_depth: ${{ steps.resolve.outputs.research_depth }}
dry_run: ${{ steps.resolve.outputs.dry_run }}
enhance_backlog: ${{ steps.resolve.outputs.enhance_backlog }}
steps:
- name: Resolve dispatch inputs
id: resolve
# `github.event.inputs.*` (not the `inputs` context) so this reads
# cleanly on schedule too, where it is simply null → the defaults below.
env:
TARGET_DISCUSSION: ${{ github.event.inputs.target_discussion }}
FOCUS_AREA: ${{ github.event.inputs.focus_area }}
RESEARCH_DEPTH: ${{ github.event.inputs.research_depth }}
DRY_RUN: ${{ github.event.inputs.dry_run }}
ENHANCE_BACKLOG: ${{ github.event.inputs.enhance_backlog }}
run: |
{
echo "target_discussion=${TARGET_DISCUSSION:-}"
echo "focus_area<<FOCUS_AREA_EOF"
echo "${FOCUS_AREA:-}"
echo "FOCUS_AREA_EOF"
echo "research_depth=${RESEARCH_DEPTH:-standard}"
echo "dry_run=${DRY_RUN:-false}"
echo "enhance_backlog=${ENHANCE_BACKLOG:-false}"
} >> "$GITHUB_OUTPUT"
Comment thread
coderabbitai[bot] marked this conversation as resolved.

ideate:
# Runs on workflow_dispatch (including the redispatch bridge above) and schedule.
needs: [prep]
if: github.event_name != 'discussion'
# Permissions cascade from the calling job to the reusable workflow.
# The reusable workflow's two jobs (gather-signals + analyze) need:
# - contents: read (checkout, file reads)
Expand All @@ -100,12 +184,14 @@ jobs:
discussions: write
id-token: write
actions: read
uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@49ecdfb72d1378864fd6263b0fb94c23626f554a # v1
uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref
Comment thread
don-petry marked this conversation as resolved.

@coderabbitai coderabbitai Bot Jul 21, 2026 •

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Reusable ref not pinned to @v1 — contradicts this PR's stated compliance objective.

The PR objectives explicitly require the reusable workflow reference to be pinned to petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1, and to copy the canonical template verbatim. This line instead points at a mutable branch (@feature-ideation/stable) and adds a NOSONAR suppression for the pinning lint rule. A floating branch ref for a workflow that runs with discussions: write and id-token: write permissions can change underneath this repo without review, undermining exactly the supply-chain guarantee compliance issue #301 is meant to enforce.

🔒 Proposed fix
-    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref
uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/feature-ideation.yml at line 185, Update the reusable
workflow reference in the feature ideation workflow to use the required
immutable channel ref `@v1` instead of the mutable `@feature-ideation/stable`,
and remove the NOSONAR suppression attached to that line. Keep the canonical
reusable workflow reference otherwise unchanged.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipping this change: @feature-ideation/stable is a first-party channel tag — an intentional mutable ref per AGENTS.md "Release channel tags & the mutable-ref exception". The pattern petry-projects/.github/.github/workflows/*.yml@<agent>/<channel> is the org's release/rollback mechanism and must not be pinned to @v1 or a commit SHA. The # NOSONAR suppression is correct and remains. If the compliance audit still expects @v1, the issue/standard should be updated to reflect that channel refs are the authorised pattern.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== AGENTS files =='
fd -HI '^AGENTS\.md$' . -x sh -c 'echo "--- $1"; rg -n -C 4 -i "release channel|mutable.ref|feature-ideation/stable|NOSONAR|workflow.*ref" "$1" || true' sh {} \;

printf '%s\n' '== Related policy references =='
rg -n -i -C 4 'Release channel tags|mutable-ref exception|feature-ideation/stable|first-party channel' \
  -g 'AGENTS.md' -g '*.md' -g '*.yml' -g '*.yaml' .

Length of output: 808


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== Root AGENTS.md =='
cat -n AGENTS.md

printf '%s\n' '== Additional scoped AGENTS.md files, if any =='
fd -HI '^AGENTS\.md$' . -x sh -c '
  [ "$1" = "./AGENTS.md" ] && exit 0
  echo "--- $1"
  cat -n "$1"
' sh {}

Length of output: 1294


🤖 web_search executed:

Fetch and quote the section of https://github.com/petry-projects/.github/blob/main/AGENTS.md covering “Release channel tags & the mutable-ref exception”, including the allowed reusable GitHub Actions workflow reference pattern and any Sonar/NOSONAR guidance.

Length of output: 19050


🏁 Script executed:

#!/bin/bash
set -euo pipefail

policy_file="$(mktemp)"
trap 'rm -f "$policy_file"' EXIT

curl --fail --silent --show-error --location \
  'https://raw.githubusercontent.com/petry-projects/.github/main/AGENTS.md' \
  -o "$policy_file"

printf '%s\n' '== Relevant organization policy sections =='
rg -n -i -C 12 \
  'release channel|mutable.ref|internal reusable workflow references|first-party|channel ref|NOSONAR|workflow pinning' \
  "$policy_file" || true

Length of output: 640


🏁 Script executed:

#!/bin/bash
set -euo pipefail

template_file="$(mktemp)"
trap 'rm -f "$template_file"' EXIT

curl --fail --silent --show-error --location \
  'https://raw.githubusercontent.com/petry-projects/.github/main/standards/workflows/feature-ideation.yml' \
  -o "$template_file"

printf '%s\n' '== Canonical template identity and reusable reference =='
rg -n -C 4 \
  'SOURCE OF TRUTH|^name:|^\s*uses:\s*petry-projects/\.github/\.github/workflows/feature-ideation-reusable\.yml@|NOSONAR' \
  "$template_file"

Length of output: 2115


@don-petry, confirmed. The current canonical standards/workflows/feature-ideation.yml uses the exact same reference on Line 185:

uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable  # NOSONAR(githubactions:S7637) first-party channel ref

This PR therefore copies the canonical template correctly. My finding was invalid and should be withdrawn. The stated @v1 objective is stale or inconsistent with the current standard and should be updated separately.

🐇


✏️ Learnings added
Learnt from: don-petry
Repo: petry-projects/markets PR: 350
File: .github/workflows/feature-ideation.yml:185-185
Timestamp: 2026-07-21T05:35:01.322Z
Learning: For `.github/workflows/feature-ideation.yml`, the canonical template in `petry-projects/.github/standards/workflows/feature-ideation.yml` intentionally delegates through `petry-projects/.github/.github/workflows/feature-ideation-reusable.ymlfeature-ideation/stable` with `# NOSONAR(githubactions:S7637) first-party channel ref`. This first-party release-channel reference is canonical and must not be changed to `v1` or a commit SHA during template adoption.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

with:
# On the `discussion: created` trigger this carries the new Discussion's
# number → the reusable runs single-idea enhancement mode. Empty on
# schedule/dispatch → normal scan. Do not edit this line.
target_discussion: ${{ github.event.discussion.number }}
# All values below come from `needs.prep.outputs.*` (resolved in the `prep`
# job) — NOT the `inputs` context — so this reusable `with:` compiles on the
# `discussion` event without a zero-job startup failure (#571).
# `target_discussion` is forwarded by the `redispatch` bridge above on
# `discussion: created`; empty on schedule/dispatch → normal scan.
target_discussion: ${{ needs.prep.outputs.target_discussion }}
# === CUSTOMISE THIS PER REPO — the only required edit ===
# Replace this paragraph with a 3-5 sentence description of your project,
# its target users, and the competitive landscape. The more specific you
Expand All @@ -120,8 +206,12 @@ jobs:
# workflow defaults to that path, so you only need to uncomment and change
# sources_file below if you store the list somewhere else.
# sources_file: 'docs/feature-ideation-sources.md'
focus_area: ${{ inputs.focus_area || '' }}
research_depth: ${{ inputs.research_depth || 'standard' }}
dry_run: ${{ inputs.dry_run || false }}
focus_area: ${{ needs.prep.outputs.focus_area }}
research_depth: ${{ needs.prep.outputs.research_depth }}
# prep emits the string 'true'/'false'; fromJSON casts it to the boolean
# the reusable's typed inputs require.
dry_run: ${{ fromJSON(needs.prep.outputs.dry_run) }}
# Backlog enhancement sweep of existing un-enhanced Ideas (workflow_dispatch).
enhance_backlog: ${{ fromJSON(needs.prep.outputs.enhance_backlog) }}
secrets:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Loading