Repository navigation
feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml #350
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -64,8 +64,19 @@ on: | |||||
| required: false | ||||||
| default: false | ||||||
| type: boolean | ||||||
| enhance_backlog: | ||||||
| description: 'Backlog enhancement sweep: enhance this repo''s open, human-authored, not-yet-enhanced Ideas (one comment each, idempotent). Combine with dry_run=true to preview.' | ||||||
| required: false | ||||||
| default: false | ||||||
| type: boolean | ||||||
| target_discussion: | ||||||
| description: 'Internal — set by `redispatch` when bridging a `discussion:created` event to workflow_dispatch (claude-code-action does not support discussion contexts). Not for manual use.' | ||||||
| required: false | ||||||
| default: '' | ||||||
| type: string | ||||||
| # Auto-enhance a freshly-created idea: when a new Discussion is opened in the | ||||||
| # Ideas category, the analyst researches and refines it in single-idea mode. | ||||||
| # Ideas category, the `redispatch` job bridges it to workflow_dispatch (see below) | ||||||
| # so the analyst refines it in single-idea mode under a supported event. | ||||||
| discussion: | ||||||
| types: [created] | ||||||
|
|
||||||
|
|
@@ -76,15 +87,88 @@ concurrency: | |||||
| cancel-in-progress: false | ||||||
|
|
||||||
| jobs: | ||||||
| ideate: | ||||||
| # On the `discussion` trigger, only run for new ideas in the Ideas category | ||||||
| # and skip the bot's own creations (avoids re-enhancing scheduled output; | ||||||
| # enhancement posts a comment, which does not re-fire `discussion: created`). | ||||||
| # Schedule/dispatch runs are unaffected by this guard. | ||||||
| # ── #963 discussion→dispatch redispatch bridge ─────────────────────────────── | ||||||
| # claude-code-action aborts on `discussion` event contexts ("Unsupported event | ||||||
| # type: discussion"). So on `discussion: created` we do NOT call the reusable | ||||||
| # inline; the `redispatch` job re-invokes this workflow via workflow_dispatch | ||||||
| # (under which the action runs cleanly), passing the number as target_discussion. | ||||||
| # Mirrors initiative-planner.yml's redispatch (#618). The `ideate` reusable call | ||||||
| # then runs only on workflow_dispatch/schedule. | ||||||
| redispatch: | ||||||
| if: >- | ||||||
| github.event_name != 'discussion' || | ||||||
| (github.event.discussion.category.slug == 'ideas' && | ||||||
| github.event.discussion.user.type != 'Bot') | ||||||
| github.event_name == 'discussion' && | ||||||
| github.event.discussion.category.slug == 'ideas' && | ||||||
| github.event.discussion.user.type != 'Bot' | ||||||
| runs-on: ubuntu-latest | ||||||
| timeout-minutes: 5 | ||||||
| permissions: {} | ||||||
| steps: | ||||||
| - name: Guard — PAT present | ||||||
| # A workflow_dispatch fired with GITHUB_TOKEN is accepted but never starts | ||||||
| # a run (loop prevention), so a PAT is required (same as initiative-planner). | ||||||
| env: | ||||||
| GH_TOKEN: ${{ secrets.GH_PAT_WORKFLOWS }} | ||||||
| run: | | ||||||
| if [ -z "${GH_TOKEN}" ]; then | ||||||
| echo "::error::GH_PAT_WORKFLOWS is required — a workflow_dispatch fired with GITHUB_TOKEN will not start a run." | ||||||
| exit 1 | ||||||
| fi | ||||||
| - name: Re-dispatch under workflow_dispatch | ||||||
| env: | ||||||
| GH_TOKEN: ${{ secrets.GH_PAT_WORKFLOWS }} | ||||||
| REPO: ${{ github.repository }} | ||||||
| DISCUSSION_NUMBER: ${{ github.event.discussion.number }} | ||||||
| run: | | ||||||
| gh workflow run feature-ideation.yml --repo "${REPO}" \ | ||||||
| -f target_discussion="${DISCUSSION_NUMBER}" | ||||||
|
|
||||||
| # ── #571 input resolution — keep `inputs` out of the reusable `with:` ──────── | ||||||
| # A reusable-workflow call graph (its `uses:` + `with:`) is validated at | ||||||
| # WORKFLOW SETUP, before — and regardless of — the calling job's `if:`. The | ||||||
| # `inputs` context is only populated for workflow_dispatch/workflow_call, so a | ||||||
| # `with:` that references `${{ inputs.* }}` trips a zero-job startup failure on | ||||||
| # the `discussion` event even though `ideate` is gated off it. We therefore | ||||||
| # resolve the dispatch inputs in this ordinary job (whose step expressions are | ||||||
| # evaluated at RUN time and are skipped on `discussion`) and hand them to | ||||||
| # `ideate` via `needs.prep.outputs.*` — an always-valid context that defers the | ||||||
| # `with:` evaluation to run time. Do not reference `inputs` in `ideate.with`. | ||||||
| prep: | ||||||
| if: github.event_name != 'discussion' | ||||||
| runs-on: ubuntu-latest | ||||||
| timeout-minutes: 5 | ||||||
| permissions: {} | ||||||
| outputs: | ||||||
| target_discussion: ${{ steps.resolve.outputs.target_discussion }} | ||||||
| focus_area: ${{ steps.resolve.outputs.focus_area }} | ||||||
| research_depth: ${{ steps.resolve.outputs.research_depth }} | ||||||
| dry_run: ${{ steps.resolve.outputs.dry_run }} | ||||||
| enhance_backlog: ${{ steps.resolve.outputs.enhance_backlog }} | ||||||
| steps: | ||||||
| - name: Resolve dispatch inputs | ||||||
| id: resolve | ||||||
| # `github.event.inputs.*` (not the `inputs` context) so this reads | ||||||
| # cleanly on schedule too, where it is simply null → the defaults below. | ||||||
| env: | ||||||
| TARGET_DISCUSSION: ${{ github.event.inputs.target_discussion }} | ||||||
| FOCUS_AREA: ${{ github.event.inputs.focus_area }} | ||||||
| RESEARCH_DEPTH: ${{ github.event.inputs.research_depth }} | ||||||
| DRY_RUN: ${{ github.event.inputs.dry_run }} | ||||||
| ENHANCE_BACKLOG: ${{ github.event.inputs.enhance_backlog }} | ||||||
| run: | | ||||||
| { | ||||||
| echo "target_discussion=${TARGET_DISCUSSION:-}" | ||||||
| echo "focus_area<<FOCUS_AREA_EOF" | ||||||
| echo "${FOCUS_AREA:-}" | ||||||
| echo "FOCUS_AREA_EOF" | ||||||
| echo "research_depth=${RESEARCH_DEPTH:-standard}" | ||||||
| echo "dry_run=${DRY_RUN:-false}" | ||||||
| echo "enhance_backlog=${ENHANCE_BACKLOG:-false}" | ||||||
| } >> "$GITHUB_OUTPUT" | ||||||
|
|
||||||
| ideate: | ||||||
| # Runs on workflow_dispatch (including the redispatch bridge above) and schedule. | ||||||
| needs: [prep] | ||||||
| if: github.event_name != 'discussion' | ||||||
| # Permissions cascade from the calling job to the reusable workflow. | ||||||
| # The reusable workflow's two jobs (gather-signals + analyze) need: | ||||||
| # - contents: read (checkout, file reads) | ||||||
|
|
@@ -100,12 +184,14 @@ jobs: | |||||
| discussions: write | ||||||
| id-token: write | ||||||
| actions: read | ||||||
| uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@49ecdfb72d1378864fd6263b0fb94c23626f554a # v1 | ||||||
| uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref | ||||||
|
don-petry marked this conversation as resolved.
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Reusable ref not pinned to The PR objectives explicitly require the reusable workflow reference to be pinned to 🔒 Proposed fix- uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref
+ uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Skipping this change: There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== AGENTS files =='
fd -HI '^AGENTS\.md$' . -x sh -c 'echo "--- $1"; rg -n -C 4 -i "release channel|mutable.ref|feature-ideation/stable|NOSONAR|workflow.*ref" "$1" || true' sh {} \;
printf '%s\n' '== Related policy references =='
rg -n -i -C 4 'Release channel tags|mutable-ref exception|feature-ideation/stable|first-party channel' \
-g 'AGENTS.md' -g '*.md' -g '*.yml' -g '*.yaml' .Length of output: 808 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Root AGENTS.md =='
cat -n AGENTS.md
printf '%s\n' '== Additional scoped AGENTS.md files, if any =='
fd -HI '^AGENTS\.md$' . -x sh -c '
[ "$1" = "./AGENTS.md" ] && exit 0
echo "--- $1"
cat -n "$1"
' sh {}Length of output: 1294 🤖 web_search executed:
Length of output: 19050 🏁 Script executed: #!/bin/bash
set -euo pipefail
policy_file="$(mktemp)"
trap 'rm -f "$policy_file"' EXIT
curl --fail --silent --show-error --location \
'https://raw.githubusercontent.com/petry-projects/.github/main/AGENTS.md' \
-o "$policy_file"
printf '%s\n' '== Relevant organization policy sections =='
rg -n -i -C 12 \
'release channel|mutable.ref|internal reusable workflow references|first-party|channel ref|NOSONAR|workflow pinning' \
"$policy_file" || trueLength of output: 640 🏁 Script executed: #!/bin/bash
set -euo pipefail
template_file="$(mktemp)"
trap 'rm -f "$template_file"' EXIT
curl --fail --silent --show-error --location \
'https://raw.githubusercontent.com/petry-projects/.github/main/standards/workflows/feature-ideation.yml' \
-o "$template_file"
printf '%s\n' '== Canonical template identity and reusable reference =='
rg -n -C 4 \
'SOURCE OF TRUTH|^name:|^\s*uses:\s*petry-projects/\.github/\.github/workflows/feature-ideation-reusable\.yml@|NOSONAR' \
"$template_file"Length of output: 2115
uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel refThis PR therefore copies the canonical template correctly. My finding was invalid and should be withdrawn. The stated 🐇 ✏️ Learnings added
|
||||||
| with: | ||||||
| # On the `discussion: created` trigger this carries the new Discussion's | ||||||
| # number → the reusable runs single-idea enhancement mode. Empty on | ||||||
| # schedule/dispatch → normal scan. Do not edit this line. | ||||||
| target_discussion: ${{ github.event.discussion.number }} | ||||||
| # All values below come from `needs.prep.outputs.*` (resolved in the `prep` | ||||||
| # job) — NOT the `inputs` context — so this reusable `with:` compiles on the | ||||||
| # `discussion` event without a zero-job startup failure (#571). | ||||||
| # `target_discussion` is forwarded by the `redispatch` bridge above on | ||||||
| # `discussion: created`; empty on schedule/dispatch → normal scan. | ||||||
| target_discussion: ${{ needs.prep.outputs.target_discussion }} | ||||||
| # === CUSTOMISE THIS PER REPO — the only required edit === | ||||||
| # Replace this paragraph with a 3-5 sentence description of your project, | ||||||
| # its target users, and the competitive landscape. The more specific you | ||||||
|
|
@@ -120,8 +206,12 @@ jobs: | |||||
| # workflow defaults to that path, so you only need to uncomment and change | ||||||
| # sources_file below if you store the list somewhere else. | ||||||
| # sources_file: 'docs/feature-ideation-sources.md' | ||||||
| focus_area: ${{ inputs.focus_area || '' }} | ||||||
| research_depth: ${{ inputs.research_depth || 'standard' }} | ||||||
| dry_run: ${{ inputs.dry_run || false }} | ||||||
| focus_area: ${{ needs.prep.outputs.focus_area }} | ||||||
| research_depth: ${{ needs.prep.outputs.research_depth }} | ||||||
| # prep emits the string 'true'/'false'; fromJSON casts it to the boolean | ||||||
| # the reusable's typed inputs require. | ||||||
| dry_run: ${{ fromJSON(needs.prep.outputs.dry_run) }} | ||||||
| # Backlog enhancement sweep of existing un-enhanced Ideas (workflow_dispatch). | ||||||
| enhance_backlog: ${{ fromJSON(needs.prep.outputs.enhance_backlog) }} | ||||||
| secrets: | ||||||
| CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||||||
Uh oh!
There was an error while loading. Please reload this page.