diff --git a/.github/workflows/avenger.lock.yml b/.github/workflows/avenger.lock.yml index efd50ed491f..4235ce2a529 100644 --- a/.github/workflows/avenger.lock.yml +++ b/.github/workflows/avenger.lock.yml @@ -119,7 +119,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -277,6 +277,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -506,7 +522,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -2287,7 +2303,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml index 2b7db916679..c99f6cc43f7 100644 --- a/.github/workflows/ci-coach.lock.yml +++ b/.github/workflows/ci-coach.lock.yml @@ -114,7 +114,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -266,6 +266,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -541,7 +557,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -2388,7 +2404,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml index 4918f998cbd..934683e8cff 100644 --- a/.github/workflows/cloclo.lock.yml +++ b/.github/workflows/cloclo.lock.yml @@ -126,7 +126,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -305,6 +305,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -614,7 +630,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Go for CLI build uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -2639,7 +2655,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml index 5de16979334..5c8c7857ff8 100644 --- a/.github/workflows/code-scanning-fixer.lock.yml +++ b/.github/workflows/code-scanning-fixer.lock.yml @@ -116,7 +116,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -270,6 +270,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -499,7 +515,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2377,7 +2393,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml index 41ad4fa625b..e6626552155 100644 --- a/.github/workflows/code-simplifier.lock.yml +++ b/.github/workflows/code-simplifier.lock.yml @@ -117,7 +117,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -276,6 +276,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -494,7 +510,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Java uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: @@ -2254,7 +2270,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml index 5df93254f97..85877c45182 100644 --- a/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml +++ b/.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml @@ -120,7 +120,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -287,6 +287,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -520,7 +536,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Go for CLI build uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -2537,7 +2553,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml index 89b593b4d6e..aa583fea949 100644 --- a/.github/workflows/daily-architecture-diagram.lock.yml +++ b/.github/workflows/daily-architecture-diagram.lock.yml @@ -112,7 +112,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -264,6 +264,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -530,7 +546,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2506,7 +2522,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml index 06bdbdc9453..bc584400b65 100644 --- a/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml +++ b/.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml @@ -110,7 +110,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -269,6 +269,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -526,7 +542,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2340,7 +2356,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-caveman-optimizer.lock.yml b/.github/workflows/daily-caveman-optimizer.lock.yml index 462db532f40..506b15a6ff6 100644 --- a/.github/workflows/daily-caveman-optimizer.lock.yml +++ b/.github/workflows/daily-caveman-optimizer.lock.yml @@ -115,7 +115,7 @@ jobs: model: ${{ steps.generate_aw_info.outputs.model }} model_size: ${{ steps.pick-experiment.outputs.model_size }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -281,6 +281,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -546,7 +562,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2414,7 +2430,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-code-debt-aider.lock.yml b/.github/workflows/daily-code-debt-aider.lock.yml index 459b520e10b..3030bf3dd8e 100644 --- a/.github/workflows/daily-code-debt-aider.lock.yml +++ b/.github/workflows/daily-code-debt-aider.lock.yml @@ -111,7 +111,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -262,6 +262,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -468,7 +484,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: @@ -1748,7 +1764,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml index 3b6ead6e386..3ba10d5c8c6 100644 --- a/.github/workflows/daily-community-attribution.lock.yml +++ b/.github/workflows/daily-community-attribution.lock.yml @@ -115,7 +115,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -281,6 +281,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -552,7 +568,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2574,7 +2590,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml index 1a60a900abc..ba99be547f8 100644 --- a/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml +++ b/.github/workflows/daily-compiler-threat-spec-optimizer.lock.yml @@ -115,7 +115,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -280,6 +280,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -496,7 +512,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2280,7 +2296,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml index 889b6d1a72f..19c1887b17e 100644 --- a/.github/workflows/daily-doc-healer.lock.yml +++ b/.github/workflows/daily-doc-healer.lock.yml @@ -119,7 +119,7 @@ jobs: model: ${{ steps.generate_aw_info.outputs.model }} model_size: ${{ steps.pick-experiment.outputs.model_size }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -285,6 +285,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -552,7 +568,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2525,7 +2541,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml index f0f4542676d..159753551a2 100644 --- a/.github/workflows/daily-doc-updater.lock.yml +++ b/.github/workflows/daily-doc-updater.lock.yml @@ -116,7 +116,7 @@ jobs: model: ${{ steps.generate_aw_info.outputs.model }} model_size: ${{ steps.pick-experiment.outputs.model_size }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -282,6 +282,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -540,7 +556,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2306,7 +2322,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-documentation-diagram.lock.yml b/.github/workflows/daily-documentation-diagram.lock.yml index c8074f43815..1a505c8c8ae 100644 --- a/.github/workflows/daily-documentation-diagram.lock.yml +++ b/.github/workflows/daily-documentation-diagram.lock.yml @@ -91,7 +91,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -242,6 +242,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -490,7 +506,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2200,7 +2216,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml index c2a72ae64f0..56d95f80d53 100644 --- a/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml +++ b/.github/workflows/daily-elixir-credo-snippet-audit.lock.yml @@ -104,7 +104,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -267,6 +267,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -482,7 +498,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Elixir # zizmor: ignore[github_action_from_unverified_creator_used] uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 @@ -2203,7 +2219,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-go-test-parallelizer.lock.yml b/.github/workflows/daily-go-test-parallelizer.lock.yml index 614ada66b3c..acffc4d9dae 100644 --- a/.github/workflows/daily-go-test-parallelizer.lock.yml +++ b/.github/workflows/daily-go-test-parallelizer.lock.yml @@ -99,7 +99,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -257,6 +257,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -477,7 +493,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2251,7 +2267,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-go-test-stubs-aider.lock.yml b/.github/workflows/daily-go-test-stubs-aider.lock.yml index 9006df4b6d5..261402dface 100644 --- a/.github/workflows/daily-go-test-stubs-aider.lock.yml +++ b/.github/workflows/daily-go-test-stubs-aider.lock.yml @@ -111,7 +111,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -262,6 +262,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -468,7 +484,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: @@ -1748,7 +1764,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml index dc866e8bb71..5b50b2b356d 100644 --- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml +++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml @@ -122,7 +122,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -283,6 +283,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -512,7 +528,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Go for CLI build uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -2119,7 +2135,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml index d2062e84db1..89ca82276d9 100644 --- a/.github/workflows/daily-safe-output-integrator.lock.yml +++ b/.github/workflows/daily-safe-output-integrator.lock.yml @@ -111,7 +111,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -262,6 +262,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -479,7 +495,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2204,7 +2220,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml index a4f5ddf28f6..091366e81e5 100644 --- a/.github/workflows/daily-safeoutputs-git-simulator.lock.yml +++ b/.github/workflows/daily-safeoutputs-git-simulator.lock.yml @@ -94,7 +94,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -250,6 +250,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -476,7 +492,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Fetch additional refs env: GH_AW_FETCH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} @@ -2358,7 +2374,7 @@ jobs: with: persist-credentials: true fetch-depth: 0 - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Fetch additional refs if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch') diff --git a/.github/workflows/daily-trajectory-grader-implementer.lock.yml b/.github/workflows/daily-trajectory-grader-implementer.lock.yml index ff5d245eced..e88e558037f 100644 --- a/.github/workflows/daily-trajectory-grader-implementer.lock.yml +++ b/.github/workflows/daily-trajectory-grader-implementer.lock.yml @@ -98,7 +98,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -256,6 +256,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -470,7 +486,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1915,7 +1931,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml index d17764da99a..00e6369a228 100644 --- a/.github/workflows/daily-workflow-updater.lock.yml +++ b/.github/workflows/daily-workflow-updater.lock.yml @@ -108,7 +108,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -259,6 +259,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -473,7 +489,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2166,7 +2182,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/daily-yamllint-fixer.lock.yml b/.github/workflows/daily-yamllint-fixer.lock.yml index ac387553fae..64f23e42d38 100644 --- a/.github/workflows/daily-yamllint-fixer.lock.yml +++ b/.github/workflows/daily-yamllint-fixer.lock.yml @@ -113,7 +113,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -273,6 +273,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -492,7 +508,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2260,7 +2276,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml index 1a490ecec88..bfec20c8d21 100644 --- a/.github/workflows/dead-code-remover.lock.yml +++ b/.github/workflows/dead-code-remover.lock.yml @@ -114,7 +114,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -267,6 +267,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -499,7 +515,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -1950,7 +1966,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml index d2dae3912ba..8c3affd2956 100644 --- a/.github/workflows/dependabot-burner.lock.yml +++ b/.github/workflows/dependabot-burner.lock.yml @@ -130,7 +130,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -308,6 +308,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -559,7 +575,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2412,7 +2428,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml index abf4fc5c031..5fe713a6343 100644 --- a/.github/workflows/developer-docs-consolidator.lock.yml +++ b/.github/workflows/developer-docs-consolidator.lock.yml @@ -117,7 +117,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -275,6 +275,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -514,7 +530,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2490,7 +2506,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml index 1af10faa3ae..59d1f6fcedd 100644 --- a/.github/workflows/dictation-prompt.lock.yml +++ b/.github/workflows/dictation-prompt.lock.yml @@ -109,7 +109,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -259,6 +259,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -474,7 +490,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2160,7 +2176,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/eslint-miner.lock.yml b/.github/workflows/eslint-miner.lock.yml index b2a0a74a15d..eaef1a227be 100644 --- a/.github/workflows/eslint-miner.lock.yml +++ b/.github/workflows/eslint-miner.lock.yml @@ -96,7 +96,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -244,6 +244,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -466,7 +482,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -2186,7 +2202,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/evoskill-evolver.lock.yml b/.github/workflows/evoskill-evolver.lock.yml index caf2d7e412b..66bb8ebe3d2 100644 --- a/.github/workflows/evoskill-evolver.lock.yml +++ b/.github/workflows/evoskill-evolver.lock.yml @@ -96,7 +96,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -245,6 +245,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -466,7 +482,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2196,7 +2212,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml index 4a7e14b3699..cbda07fda99 100644 --- a/.github/workflows/functional-pragmatist.lock.yml +++ b/.github/workflows/functional-pragmatist.lock.yml @@ -109,7 +109,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -266,6 +266,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -482,7 +498,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2166,7 +2182,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml index 06462dd5203..62283380ff3 100644 --- a/.github/workflows/github-mcp-tools-report.lock.yml +++ b/.github/workflows/github-mcp-tools-report.lock.yml @@ -111,7 +111,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -269,6 +269,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -495,7 +511,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1944,7 +1960,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml index 45edd29e1c9..8a4fb2a7617 100644 --- a/.github/workflows/glossary-maintainer.lock.yml +++ b/.github/workflows/glossary-maintainer.lock.yml @@ -120,7 +120,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -285,6 +285,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -527,7 +543,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Merge remote .github folder uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: @@ -2458,7 +2474,7 @@ jobs: with: persist-credentials: true fetch-depth: 0 - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml index 48ecf799267..1cb9f9a5f3d 100644 --- a/.github/workflows/go-logger.lock.yml +++ b/.github/workflows/go-logger.lock.yml @@ -116,7 +116,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -274,6 +274,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -496,7 +512,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -2284,7 +2300,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml index 2df62c1d62c..d1606521be5 100644 --- a/.github/workflows/hourly-ci-cleaner.lock.yml +++ b/.github/workflows/hourly-ci-cleaner.lock.yml @@ -117,7 +117,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -274,6 +274,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -502,7 +518,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Merge remote .github folder uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: @@ -2294,7 +2310,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml index 2f7faf5a99a..c23988d2b21 100644 --- a/.github/workflows/instructions-janitor.lock.yml +++ b/.github/workflows/instructions-janitor.lock.yml @@ -111,7 +111,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -269,6 +269,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -491,7 +507,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1928,7 +1944,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml index 28c5b6b2011..992ce299976 100644 --- a/.github/workflows/layout-spec-maintainer.lock.yml +++ b/.github/workflows/layout-spec-maintainer.lock.yml @@ -112,7 +112,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -269,6 +269,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -483,7 +499,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1875,7 +1891,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/linter-miner.lock.yml b/.github/workflows/linter-miner.lock.yml index c02d7104f7d..b20fd91c35c 100644 --- a/.github/workflows/linter-miner.lock.yml +++ b/.github/workflows/linter-miner.lock.yml @@ -115,7 +115,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -272,6 +272,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -507,7 +523,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1958,7 +1974,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/purelock.lock.yml b/.github/workflows/purelock.lock.yml index d5809e6cc7d..33cf6d23973 100644 --- a/.github/workflows/purelock.lock.yml +++ b/.github/workflows/purelock.lock.yml @@ -117,7 +117,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -277,6 +277,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -507,7 +523,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2499,7 +2515,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml index 318e64b91bb..e449a15d26e 100644 --- a/.github/workflows/q.lock.yml +++ b/.github/workflows/q.lock.yml @@ -130,7 +130,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -308,6 +308,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -579,7 +595,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Go for CLI build uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -2139,7 +2155,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml index d32b0fa71e1..3c3d2784817 100644 --- a/.github/workflows/refiner.lock.yml +++ b/.github/workflows/refiner.lock.yml @@ -131,7 +131,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -299,6 +299,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -538,7 +554,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2459,7 +2475,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/ruflo-backed-task.lock.yml b/.github/workflows/ruflo-backed-task.lock.yml index 4fae57830fb..b49600e17a3 100644 --- a/.github/workflows/ruflo-backed-task.lock.yml +++ b/.github/workflows/ruflo-backed-task.lock.yml @@ -103,7 +103,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -277,6 +277,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -531,7 +547,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -2089,7 +2105,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml index c56e49dd4c3..1446254cc36 100644 --- a/.github/workflows/slide-deck-maintainer.lock.yml +++ b/.github/workflows/slide-deck-maintainer.lock.yml @@ -118,7 +118,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -278,6 +278,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -515,7 +531,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -2043,7 +2059,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml index c1b3617451b..755473c2567 100644 --- a/.github/workflows/smoke-project.lock.yml +++ b/.github/workflows/smoke-project.lock.yml @@ -124,7 +124,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -303,6 +303,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -595,7 +611,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2794,7 +2810,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/spec-enforcer.lock.yml b/.github/workflows/spec-enforcer.lock.yml index b958a8c0b62..47c83305cf5 100644 --- a/.github/workflows/spec-enforcer.lock.yml +++ b/.github/workflows/spec-enforcer.lock.yml @@ -116,7 +116,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -274,6 +274,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -496,7 +512,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2171,7 +2187,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/spec-extractor.lock.yml b/.github/workflows/spec-extractor.lock.yml index 9ccfade9ae2..d6881d1641c 100644 --- a/.github/workflows/spec-extractor.lock.yml +++ b/.github/workflows/spec-extractor.lock.yml @@ -113,7 +113,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -264,6 +264,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -493,7 +509,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1952,7 +1968,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml index 06a2b6757f6..2f493b850f5 100644 --- a/.github/workflows/technical-doc-writer.lock.yml +++ b/.github/workflows/technical-doc-writer.lock.yml @@ -115,7 +115,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -273,6 +273,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -512,7 +528,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Merge remote .github folder uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: @@ -2462,7 +2478,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml index 88a0bf29c48..d5b90df805b 100644 --- a/.github/workflows/tidy.lock.yml +++ b/.github/workflows/tidy.lock.yml @@ -116,7 +116,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -293,6 +293,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -542,7 +558,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -2372,7 +2388,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') || (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'push_to_pull_request_branch') diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml index 92aba39e263..e65dae59944 100644 --- a/.github/workflows/ubuntu-image-analyzer.lock.yml +++ b/.github/workflows/ubuntu-image-analyzer.lock.yml @@ -114,7 +114,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -273,6 +273,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -492,7 +508,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1923,7 +1939,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml index 99f7e615b91..3a64059f102 100644 --- a/.github/workflows/unbloat-docs.lock.yml +++ b/.github/workflows/unbloat-docs.lock.yml @@ -118,7 +118,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -296,6 +296,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -2340,7 +2356,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml index 28110e90c12..e001bc057e1 100644 --- a/.github/workflows/update-astro.lock.yml +++ b/.github/workflows/update-astro.lock.yml @@ -114,7 +114,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -273,6 +273,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -500,7 +516,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1952,7 +1968,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml index 960f984fe4e..a7f75ee51b1 100644 --- a/.github/workflows/weekly-blog-post-writer.lock.yml +++ b/.github/workflows/weekly-blog-post-writer.lock.yml @@ -115,7 +115,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -273,6 +273,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -549,7 +565,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Setup Go for CLI build uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -2574,7 +2590,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml index f182846039b..2742fac0e91 100644 --- a/.github/workflows/weekly-editors-health-check.lock.yml +++ b/.github/workflows/weekly-editors-health-check.lock.yml @@ -107,7 +107,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -264,6 +264,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -480,7 +496,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1891,7 +1907,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml index e7ea000ef25..d36abc5f529 100644 --- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml +++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml @@ -110,7 +110,7 @@ jobs: lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }} model: ${{ steps.generate_aw_info.outputs.model }} oauth_token_check_failed: ${{ steps.check-oauth-tokens.outputs.oauth_token_check_failed == 'true' }} - pre_created_pull_request_branch: ${{ steps.pre-create-pull-request.outputs.branch }} + pre_created_pull_request_branch: ${{ steps.validate-pre-created-pull-request.outputs.branch }} pre_created_pull_request_check_run_id: ${{ steps.pre-create-pull-request.outputs.check_run_id }} pre_created_pull_request_number: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} pre_created_pull_request_url: ${{ steps.pre-create-pull-request.outputs.pull_request_url }} @@ -267,6 +267,22 @@ jobs: setupGlobals(core, github, context, exec, io, getOctokit); const { main } = require(path.join(actionsDir, 'pre_create_pull_request.cjs')); await main(); + - name: Validate pre-created pull request branch + id: validate-pre-created-pull-request + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + env: + GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }} + GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }} + GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const path = require('path'); + const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions'); + const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs')); + setupGlobals(core, github, context, exec, io, getOctokit); + const { main } = require(path.join(actionsDir, 'validate_pre_created_pull_request.cjs')); + await main(); - name: Check workflow lock file id: check-lock-file uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -480,7 +496,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} - name: Create gh-aw temp directory run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh" - name: Configure gh CLI for GitHub Enterprise @@ -1861,7 +1877,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }} + ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }} token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - name: Configure Git credentials if: (!cancelled()) && needs.agent.result != 'skipped' && contains(needs.agent.outputs.output_types, 'create_pull_request') diff --git a/actions/setup/js/pre_create_pull_request.cjs b/actions/setup/js/pre_create_pull_request.cjs index ff1ccaede66..aea2db5d2b7 100644 --- a/actions/setup/js/pre_create_pull_request.cjs +++ b/actions/setup/js/pre_create_pull_request.cjs @@ -10,6 +10,16 @@ const { applyTitlePrefix, sanitizeTitle } = require("./sanitize_title.cjs"); const WIP_TITLE_MARKER = "[WIP] "; const MAX_PULL_REQUEST_TITLE_LENGTH = 256; const MAX_PRE_CREATED_TITLE_BODY_LENGTH = MAX_PULL_REQUEST_TITLE_LENGTH - WIP_TITLE_MARKER.length; +const DEFAULT_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "gh-aw/pre-created/"; + +function getPreCreatedPullRequestBranchPrefix() { + const branchPrefix = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX || DEFAULT_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX; + const normalizedBranchPrefix = normalizeBranchName(branchPrefix); + if (!normalizedBranchPrefix || branchPrefix.trim() === "" || normalizedBranchPrefix !== branchPrefix) { + throw new Error(`Invalid pre-created pull request branch prefix: "${branchPrefix}"`); + } + return branchPrefix; +} /** * Best-effort deletion of a pre-allocated branch so a failed allocation does not @@ -32,7 +42,7 @@ async function deleteBranch(branch) { async function main() { const workflowName = process.env.GH_AW_WORKFLOW_NAME || context.workflow || "Agentic workflow"; const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`; - const branch = `gh-aw/pre-created/${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || "1"}`; + const branch = `${getPreCreatedPullRequestBranchPrefix()}${context.runId}-${process.env.GITHUB_RUN_ATTEMPT || "1"}`; // Resolve the base branch the eventual pull request will target (configured base-branch, // otherwise the event-derived branch) so the pre-created branch is forked from the same diff --git a/actions/setup/js/pre_create_pull_request.test.cjs b/actions/setup/js/pre_create_pull_request.test.cjs index b38e688a2b9..01a5029df9c 100644 --- a/actions/setup/js/pre_create_pull_request.test.cjs +++ b/actions/setup/js/pre_create_pull_request.test.cjs @@ -53,6 +53,7 @@ describe("pre_create_pull_request", () => { process.env.GITHUB_RUN_ATTEMPT = "2"; delete process.env.GH_AW_CUSTOM_BASE_BRANCH; delete process.env.GH_AW_PR_TITLE_PREFIX; + delete process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX; delete process.env.GITHUB_BASE_REF; }); @@ -112,6 +113,40 @@ describe("pre_create_pull_request", () => { ); }); + it("uses the configured branch prefix", async () => { + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "signed/"; + const { main } = await import("./pre_create_pull_request.cjs"); + await main(); + + expect(global.github.rest.git.createRef).toHaveBeenCalledWith( + expect.objectContaining({ + ref: "refs/heads/signed/123-2", + }) + ); + expect(global.github.rest.pulls.create).toHaveBeenCalledWith( + expect.objectContaining({ + head: "signed/123-2", + }) + ); + expect(global.core.setOutput).toHaveBeenCalledWith("branch", "signed/123-2"); + }); + + it("rejects invalid configured branch prefixes", async () => { + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = "bad prefix/"; + const { main } = await import("./pre_create_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/Invalid pre-created pull request branch prefix/); + expect(global.github.rest.git.createRef).not.toHaveBeenCalled(); + }); + + it("rejects whitespace-only configured branch prefixes", async () => { + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX = " "; + const { main } = await import("./pre_create_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/Invalid pre-created pull request branch prefix/); + expect(global.github.rest.git.createRef).not.toHaveBeenCalled(); + }); + it("sanitizes and truncates the fully assembled title after applying the WIP marker and prefix", async () => { process.env.GH_AW_PR_TITLE_PREFIX = "[bot] @team "; process.env.GH_AW_WORKFLOW_NAME = "A".repeat(300); diff --git a/actions/setup/js/validate_pre_created_pull_request.cjs b/actions/setup/js/validate_pre_created_pull_request.cjs new file mode 100644 index 00000000000..10b0be9ee00 --- /dev/null +++ b/actions/setup/js/validate_pre_created_pull_request.cjs @@ -0,0 +1,36 @@ +// @ts-check +/// + +async function main() { + const expectedBranch = process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH || ""; + const branch = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH || ""; + if (!expectedBranch) { + throw new Error("Expected pre-created pull request branch is not set"); + } + if (branch !== expectedBranch) { + throw new Error(`Pre-created pull request branch did not match expected workflow branch: ${branch}`); + } + + const pullNumberString = process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER || ""; + if (!/^[1-9]\d*$/.test(pullNumberString)) { + throw new Error("Pre-created pull request number is invalid"); + } + const pullNumber = Number(pullNumberString); + if (!Number.isSafeInteger(pullNumber)) { + throw new Error("Pre-created pull request number is invalid"); + } + + const { data: pullRequest } = await github.rest.pulls.get({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: pullNumber, + }); + const expectedRepo = `${context.repo.owner}/${context.repo.repo}`.toLowerCase(); + if (pullRequest.head.ref !== expectedBranch || pullRequest.head.repo?.full_name?.toLowerCase() !== expectedRepo || pullRequest.base.repo?.full_name?.toLowerCase() !== expectedRepo) { + throw new Error("Pre-created pull request does not target the expected trusted repository branch"); + } + + core.setOutput("branch", expectedBranch); +} + +module.exports = { main }; diff --git a/actions/setup/js/validate_pre_created_pull_request.test.cjs b/actions/setup/js/validate_pre_created_pull_request.test.cjs new file mode 100644 index 00000000000..b2e204c09cc --- /dev/null +++ b/actions/setup/js/validate_pre_created_pull_request.test.cjs @@ -0,0 +1,124 @@ +// @ts-check +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; + +describe("validate_pre_created_pull_request", () => { + let originalGlobals; + let originalEnv; + + beforeEach(() => { + originalGlobals = { + core: global.core, + github: global.github, + context: global.context, + }; + originalEnv = { ...process.env }; + + global.core = { setOutput: vi.fn(), info: vi.fn(), warning: vi.fn(), debug: vi.fn() }; + global.context = { + repo: { owner: "owner", repo: "repo" }, + }; + global.github = { + rest: { + pulls: { + get: vi.fn().mockResolvedValue({ + data: { + head: { + ref: "gh-aw/pre-created/123-2", + repo: { full_name: "owner/repo" }, + }, + base: { + repo: { full_name: "owner/repo" }, + }, + }, + }), + }, + }, + }; + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = "42"; + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = "gh-aw/pre-created/123-2"; + process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH = "gh-aw/pre-created/123-2"; + }); + + afterEach(() => { + global.core = originalGlobals.core; + global.github = originalGlobals.github; + global.context = originalGlobals.context; + vi.resetModules(); + process.env = originalEnv; + }); + + it("validates the branch and repository before emitting the trusted branch output", async () => { + const { main } = await import("./validate_pre_created_pull_request.cjs"); + await main(); + + expect(global.github.rest.pulls.get).toHaveBeenCalledWith({ + owner: "owner", + repo: "repo", + pull_number: 42, + }); + expect(global.core.setOutput).toHaveBeenCalledWith("branch", "gh-aw/pre-created/123-2"); + }); + + it("rejects unexpected branch output without fetching the pull request", async () => { + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = "attacker"; + const { main } = await import("./validate_pre_created_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/did not match expected workflow branch/); + expect(global.github.rest.pulls.get).not.toHaveBeenCalled(); + expect(global.core.setOutput).not.toHaveBeenCalled(); + }); + + it("rejects a missing expected branch without fetching the pull request", async () => { + process.env.GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH = ""; + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH = ""; + const { main } = await import("./validate_pre_created_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/expected pre-created pull request branch is not set/i); + expect(global.github.rest.pulls.get).not.toHaveBeenCalled(); + expect(global.core.setOutput).not.toHaveBeenCalled(); + }); + + it.each(["0", "42junk", "42.0", "042"])("rejects invalid pull request number %s", async pullNumber => { + process.env.GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER = pullNumber; + const { main } = await import("./validate_pre_created_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/pull request number is invalid/); + expect(global.github.rest.pulls.get).not.toHaveBeenCalled(); + }); + + it("rejects pull requests outside the expected repository branch", async () => { + global.github.rest.pulls.get.mockResolvedValue({ + data: { + head: { + ref: "gh-aw/pre-created/123-2", + repo: { full_name: "fork/repo" }, + }, + base: { + repo: { full_name: "owner/repo" }, + }, + }, + }); + const { main } = await import("./validate_pre_created_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/does not target the expected trusted repository branch/); + expect(global.core.setOutput).not.toHaveBeenCalled(); + }); + + it("rejects pull requests without a head repository", async () => { + global.github.rest.pulls.get.mockResolvedValue({ + data: { + head: { + ref: "gh-aw/pre-created/123-2", + repo: null, + }, + base: { + repo: { full_name: "owner/repo" }, + }, + }, + }); + const { main } = await import("./validate_pre_created_pull_request.cjs"); + + await expect(main()).rejects.toThrow(/does not target the expected trusted repository branch/); + expect(global.core.setOutput).not.toHaveBeenCalled(); + }); +}); diff --git a/docs/src/content/docs/reference/frontmatter-full.md b/docs/src/content/docs/reference/frontmatter-full.md index 7527f13adbe..5a7656f38d6 100644 --- a/docs/src/content/docs/reference/frontmatter-full.md +++ b/docs/src/content/docs/reference/frontmatter-full.md @@ -8866,7 +8866,9 @@ safe-outputs: max: "example-value" # Optional prefix to prepend to the pull request branch name (e.g. "signed/"). - # Applied before the agent-specified or auto-generated branch name. + # Applied before the agent-specified or auto-generated branch name. In steer + # mode, this prefix is also used for the workflow-owned pre-created pull request + # branch and must be a static valid branch-name prefix. # (optional) branch-prefix: "example-value" diff --git a/docs/src/content/docs/reference/safe-outputs-pull-requests.md b/docs/src/content/docs/reference/safe-outputs-pull-requests.md index 243536905a6..b643ad6eb82 100644 --- a/docs/src/content/docs/reference/safe-outputs-pull-requests.md +++ b/docs/src/content/docs/reference/safe-outputs-pull-requests.md @@ -66,7 +66,7 @@ See [Cross-Repository Operations](/gh-aw/reference/cross-repository/) for `targe `steer` is an experimental option. `gh aw compile` emits an experimental feature warning when a workflow uses it. ::: -Set `steer: true` to allocate a draft pull request during the activation job, before the agent starts. The activation job creates a run-specific branch from the resolved base branch, opens a draft PR titled `[WIP] : work in progress` (the configured `title-prefix` is inserted after the `[WIP]` marker) whose body explains that the run is still in progress, links to the workflow run, and attaches a check linking back to that run. The agent and `safe_outputs` jobs check out the allocated branch, the eventual `create_pull_request` output updates the existing PR instead of opening another one, and the conclusion job completes the check. When the run ends without any changes (for example with `if-no-changes: ignore`, a `noop` output, or a failure before the safe output runs), the conclusion job closes the pre-created pull request and deletes its branch, so empty placeholders are not left behind. +Set `steer: true` to allocate a draft pull request during the activation job, before the agent starts. The activation job creates a run-specific workflow-owned branch from the resolved base branch, opens a draft PR titled `[WIP] : work in progress` (the configured `title-prefix` is inserted after the `[WIP]` marker) whose body explains that the run is still in progress, links to the workflow run, and attaches a check linking back to that run. After creation, the activation job validates that the pull request number is valid, that the PR head ref is the expected workflow-owned branch, and that both the head and base repositories are the workflow repository. The agent and `safe_outputs` jobs check out the deterministic workflow-owned branch ref directly, rather than using the activation output as their checkout `ref`. The eventual `create_pull_request` output updates the existing PR instead of opening another one, and the conclusion job completes the check. When the run ends without any changes (for example with `if-no-changes: ignore`, a `noop` output, or a failure before the safe output runs), the conclusion job closes the pre-created pull request and deletes its branch, so empty placeholders are not left behind. `steer` also lets the agent read user-authored comments and review comments containing the keyword `steer` on that pull request as feedback during the run. Steering enables the GitHub MCP pull request toolset for comment reads, and requires top-level `pull-requests: read` permission. The compiler reports an error instead of adding that permission automatically. @@ -80,7 +80,9 @@ safe-outputs: steer: true ``` -Pre-creation requires a safe-output token with `contents: write`, `pull-requests: write`, and `checks: write`. It supports one same-repository PR per run and cannot be combined with `target-repo`, `head-repo`, `allowed-repos`, `branch-prefix`, `allowed-branches`, `allowed-base-branches`, or `checkout: false`. In [staged mode](/gh-aw/reference/safe-outputs/#staged-mode) no pull request is allocated, because staged runs must not perform API side effects. The allocated pull request is always opened as a draft, regardless of the `draft` setting; when `draft: false` is configured, it is marked ready for review in the safe output phase, once the agent's changes are applied. +Pre-creation requires a safe-output token with `contents: write`, `pull-requests: write`, and `checks: write`. It supports one same-repository PR per run and cannot be combined with `target-repo`, `head-repo`, `allowed-repos`, `allowed-branches`, `allowed-base-branches`, or `checkout: false`. In [staged mode](/gh-aw/reference/safe-outputs/#staged-mode) no pull request is allocated, because staged runs must not perform API side effects. The allocated pull request is always opened as a draft, regardless of the `draft` setting; when `draft: false` is configured, it is marked ready for review in the safe output phase, once the agent's changes are applied. + +For security, pre-created pull request mode is limited to same-repository operation. The pre-created branch name is derived from a static workflow-configured `branch-prefix` plus trusted workflow run metadata. By default, generated workflows use `gh-aw/pre-created/-`; with `branch-prefix: "signed/"`, they use `signed/-`. The prefix must be a static valid branch-name prefix, not a GitHub Actions expression. Downstream jobs must not treat an arbitrary activation output as a trusted checkout ref. ### Branch targeting diff --git a/docs/src/content/docs/specs/safe-outputs-specification.md b/docs/src/content/docs/specs/safe-outputs-specification.md index 12d0b9ddde5..4c86dea7b63 100644 --- a/docs/src/content/docs/specs/safe-outputs-specification.md +++ b/docs/src/content/docs/specs/safe-outputs-specification.md @@ -7,9 +7,9 @@ sidebar: # Safe Outputs MCP Gateway Specification -**Version**: 1.28.5
+**Version**: 1.28.6
**Status**: Working Draft
-**Publication Date**: 2026-08-20
+**Publication Date**: 2026-08-24
**Editor**: GitHub Agentic Workflows Team
**This Version**: [safe-outputs-specification](/gh-aw/specs/safe-outputs-specification/)
**Latest Published Version**: This document @@ -77,6 +77,10 @@ This specification uses the following terms with precise definitions: **Cache Poisoning**: A Bell-LaPadula write-up violation where a lower-integrity agent writes data to a shared cache store that is subsequently consumed by a higher-integrity run without provenance verification. +**Pre-created Pull Request**: A draft pull request allocated during the activation phase before agent execution when `safe-outputs.create-pull-request.steer` is enabled. + +**Workflow-Owned Pre-created Branch**: The deterministic branch ref allocated by the workflow for a pre-created pull request. In the reference implementation this ref has the default form `gh-aw/pre-created/-` and MAY use a static workflow-configured branch prefix. The non-prefix suffix is derived only from trusted GitHub Actions run metadata. + --- ## 1. Introduction @@ -397,6 +401,24 @@ Agent execution context MUST NOT gain access to safe output job credentials thro accessible_credentials(agent_context, t) ∩ safe_output_credentials = ∅ ``` +**Requirement AR5: Pre-created Pull Request Branch Provenance** + +When an implementation supports pre-created pull requests, it MUST derive the pre-created branch name from trusted workflow-controlled state. The branch ref MUST be deterministic for the workflow run and MUST NOT be selected from agent-controlled content, pull request comments, event payload branch names, or unvalidated activation outputs. Implementations MAY allow a static workflow-configured branch prefix; that prefix MUST NOT be derived from runtime expressions or attacker-influenced inputs. + +After creating a pre-created pull request and before exporting branch or pull request metadata to downstream jobs, the activation phase MUST validate all of the following: + +1. The branch output exactly equals the expected workflow-owned pre-created branch ref. +2. The pull request number is a positive safe integer. +3. The pull request head ref exactly equals the expected workflow-owned pre-created branch ref. +4. The pull request head repository exactly matches the workflow repository. +5. The pull request base repository exactly matches the workflow repository. + +If any validation fails, the implementation MUST fail the activation phase and MUST NOT allow downstream agent, safe-output, or conclusion jobs to treat the pre-created pull request as trusted workflow state. + +Agent and safe-output checkouts for a pre-created pull request MUST use the deterministic workflow-owned branch ref directly. Implementations MUST NOT use `needs.activation.outputs.pre_created_pull_request_branch`, or any equivalent activation output, as the `actions/checkout` `ref` in any privileged checkout step. + +*Rationale*: Activation outputs cross a job boundary and may be influenced by implementation defects or compromised action behavior. Recomputing the expected branch ref in each checkout prevents a poisoned activation output from redirecting agent or privileged safe-output execution to an attacker-controlled branch. + ### 3.2 Threat Model and Mitigations This specification addresses five primary threat scenarios: @@ -2428,6 +2450,8 @@ safe-outputs: 9. **Owner-Qualified Head Reference**: When `head-repo` differs from `target-repo`, the created pull request MUST use an owner-qualified head reference identifying the head repository owner and pushed branch. Unqualified same-name branch references MUST NOT be used in fork-backed mode. 10. **Ephemeral Fork Branch Model**: When `head-repo` differs from `target-repo`, implementations SHOULD create or refresh an ephemeral branch in `head-repo` from the resolved upstream base SHA, apply the agent changes, and open the pull request back to the upstream base. Implementations MAY support explicit synchronization of that ephemeral branch with a newer upstream base, but implicit reuse of arbitrary pre-existing fork branches MUST NOT occur. 11. **Summary and Manifest Provenance**: Successful executions MUST record `head_repo` in the safe-output summary and machine-readable manifest. +12. **Pre-created Pull Request Validation**: When `steer: true` is configured, the activation phase MUST create the draft pull request on a workflow-owned pre-created branch, validate that the created pull request head and base repositories are the workflow repository, and validate that the head ref equals the expected deterministic branch before downstream jobs consume the pull request metadata. +13. **Pre-created Checkout Reference**: In pre-created pull request mode, the agent job and safe-output job MUST check out the deterministic workflow-owned pre-created branch ref directly. Implementations MUST NOT derive checkout `ref` values from activation outputs such as `pre_created_pull_request_branch`. **Configuration Parameters**: @@ -2449,6 +2473,7 @@ safe-outputs: - `head-github-app`: Optional GitHub App configuration to mint an ephemeral credential for `head-repo` branch writes at runtime. When `head-github-app` is configured, the minted token takes precedence over `head-github-token`. The app installation MUST have `contents: write` on `head-repo` - `preserve-branch-name`: When `true`, use the agent-supplied branch name verbatim without appending a random salt suffix (default: `false`) - `recreate-ref`: When `true` (and `preserve-branch-name: true`), allows the handler to force-delete an existing remote branch ref and recreate it from the agent's local HEAD on collision. When `false` (default), an existing remote branch under `preserve-branch-name: true` causes a fallback rather than overwriting the remote ref. Has no effect when `preserve-branch-name: false`. (default: `false`) +- `steer`: Experimental. When `true`, pre-creates a same-repository draft pull request during activation and allows the agent to read user-authored pull request comments as steering feedback. This mode requires `max: 1`, the default workflow-repository checkout, and a statically knowable base branch; it MUST NOT be combined with `target-repo`, `head-repo`, `allowed-repos`, `allowed-branches`, `allowed-base-branches`, `checkout: false`, or expression-valued staged mode. If `branch-prefix` is configured, it MUST be a static valid branch-name prefix. **Security Requirements**: @@ -2458,6 +2483,10 @@ safe-outputs: - `head-repo` MUST be either the same repository as `target-repo` or an explicitly configured automation-owned fork; arbitrary contributor forks MUST NOT be used as write targets - Both `target-repo` and `head-repo` MUST be validated against the configured allowlist before any push or pull request API call - When distinct upstream and head credentials are configured, implementations MUST use the least-privilege head-repository credential only for branch writes and the upstream credential only for upstream pull request management +- Pre-created pull request branches MUST be validated against the expected workflow-owned branch ref before any downstream privileged checkout or pull request update uses the pre-created pull request metadata. +- Agent and safe-output checkout steps in pre-created pull request mode MUST use the deterministic workflow-owned branch ref directly and MUST NOT use an activation output as the checkout ref. +- Pre-created pull request validation MUST confirm that both the head repository and base repository are the workflow repository; fork-backed or cross-repository pre-created pull requests are non-conforming. +- If a pre-created pull request branch prefix is configurable, the configured prefix MUST be static workflow-controlled configuration and MUST NOT be a runtime expression or selected from attacker-influenced input. **Required Permissions**: @@ -5501,6 +5530,13 @@ This specification revision aligns with directly relevant `CHANGELOG.md` entries - **Earlier changelog entry**: status comments were decoupled from default AI reaction behavior; explicit `on.status-comment` configuration is required when status comments are desired. - **Earlier changelog entry**: `command` trigger was renamed to `slash_command` with deprecation compatibility. +**Version 1.28.6** (2026-08-24): + +- **Specified**: Pre-created pull request branches MUST be validated after creation and before downstream jobs treat them as trusted workflow state. +- **Specified**: Pre-created pull request validation MUST confirm the expected deterministic branch ref, valid pull request number, workflow-repository head, and workflow-repository base. +- **Specified**: Agent and safe-output checkouts in pre-created pull request mode MUST use the deterministic workflow-owned branch ref directly rather than activation-output-derived refs. +- **Updated**: Publication metadata to 1.28.6. + **Version 1.28.5** (2026-08-20): - **Changed**: Default value of the `discussions` field on `hide-comment` inverted from `true` to `false`. The `discussions:write` permission is now opt-in, matching `add-comment`. Set `discussions: true` to hide comments on discussions; omitting the field no longer requests `discussions:write`. diff --git a/pkg/parser/schemas/main_workflow_schema.json b/pkg/parser/schemas/main_workflow_schema.json index a12f33ce937..acce11d1b7d 100644 --- a/pkg/parser/schemas/main_workflow_schema.json +++ b/pkg/parser/schemas/main_workflow_schema.json @@ -7471,7 +7471,7 @@ }, "branch-prefix": { "type": "string", - "description": "Optional prefix to prepend to the pull request branch name (e.g. \"signed/\"). Applied before the agent-specified or auto-generated branch name." + "description": "Optional prefix to prepend to the pull request branch name (e.g. \"signed/\"). Applied before the agent-specified or auto-generated branch name. In steer mode, this prefix is also used for the workflow-owned pre-created pull request branch and must be a static valid branch-name prefix." }, "require-temporary-id": { "type": "boolean", diff --git a/pkg/workflow/compiler_precreate_pull_request.go b/pkg/workflow/compiler_precreate_pull_request.go index aa9f98e43b2..b7389492286 100644 --- a/pkg/workflow/compiler_precreate_pull_request.go +++ b/pkg/workflow/compiler_precreate_pull_request.go @@ -3,6 +3,18 @@ package workflow import "fmt" const preCreatePullRequestAppTokenStepID = "pre-create-pull-request-app-token" +const defaultPreCreatedPullRequestBranchPrefix = "gh-aw/pre-created/" + +func preCreatedPullRequestBranchPrefix(data *WorkflowData) string { + if data != nil && data.SafeOutputs != nil && data.SafeOutputs.CreatePullRequests != nil && data.SafeOutputs.CreatePullRequests.BranchPrefix != "" { + return data.SafeOutputs.CreatePullRequests.BranchPrefix + } + return defaultPreCreatedPullRequestBranchPrefix +} + +func preCreatedPullRequestBranchRef(data *WorkflowData) string { + return preCreatedPullRequestBranchPrefix(data) + "${{ github.run_id }}-${{ github.run_attempt }}" +} func isPreCreatePullRequestEnabled(data *WorkflowData) bool { if data == nil || data.SafeOutputs == nil || data.SafeOutputs.CreatePullRequests == nil || !isPreCreatePullRequestConfigured(data.SafeOutputs.CreatePullRequests) { @@ -88,15 +100,31 @@ func (c *Compiler) addActivationPreCreatePullRequestStep(ctx *activationJobBuild if titlePrefix := ctx.data.SafeOutputs.CreatePullRequests.TitlePrefix; titlePrefix != "" { ctx.steps = append(ctx.steps, fmt.Sprintf(" GH_AW_PR_TITLE_PREFIX: %q\n", titlePrefix)) } + if branchPrefix := ctx.data.SafeOutputs.CreatePullRequests.BranchPrefix; branchPrefix != "" { + ctx.steps = append(ctx.steps, fmt.Sprintf(" GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX: %q\n", branchPrefix)) + } ctx.steps = append(ctx.steps, " with:\n", fmt.Sprintf(" github-token: %s\n", token), " script: |\n", generateGitHubScriptWithRequire("pre_create_pull_request.cjs"), ) + ctx.steps = append(ctx.steps, + " - name: Validate pre-created pull request branch\n", + " id: validate-pre-created-pull-request\n", + fmt.Sprintf(" uses: %s\n", getCachedActionPin("actions/github-script", ctx.data)), + " env:\n", + " GH_AW_PRE_CREATED_PULL_REQUEST_NUMBER: ${{ steps.pre-create-pull-request.outputs.pull_request_number }}\n", + " GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH: ${{ steps.pre-create-pull-request.outputs.branch }}\n", + fmt.Sprintf(" GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: %s\n", preCreatedPullRequestBranchRef(ctx.data)), + " with:\n", + fmt.Sprintf(" github-token: %s\n", token), + " script: |\n", + generateGitHubScriptWithRequire("validate_pre_created_pull_request.cjs"), + ) ctx.outputs["pre_created_pull_request_number"] = "${{ steps.pre-create-pull-request.outputs.pull_request_number }}" ctx.outputs["pre_created_pull_request_url"] = "${{ steps.pre-create-pull-request.outputs.pull_request_url }}" - ctx.outputs["pre_created_pull_request_branch"] = "${{ steps.pre-create-pull-request.outputs.branch }}" + ctx.outputs["pre_created_pull_request_branch"] = "${{ steps.validate-pre-created-pull-request.outputs.branch }}" ctx.outputs["pre_created_pull_request_check_run_id"] = "${{ steps.pre-create-pull-request.outputs.check_run_id }}" } diff --git a/pkg/workflow/compiler_precreate_pull_request_integration_test.go b/pkg/workflow/compiler_precreate_pull_request_integration_test.go index cfd3627a203..f40ca5183f3 100644 --- a/pkg/workflow/compiler_precreate_pull_request_integration_test.go +++ b/pkg/workflow/compiler_precreate_pull_request_integration_test.go @@ -26,6 +26,7 @@ permissions: safe-outputs: create-pull-request: steer: true + branch-prefix: "signed/" --- # Pre-create test @@ -47,11 +48,16 @@ Create a change and open a pull request. conclusion := extractJobSection(yaml, "conclusion") assert.Contains(t, activation, "id: pre-create-pull-request") + assert.Contains(t, activation, "id: validate-pre-created-pull-request") + assert.Contains(t, activation, `GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX: "signed/"`) + assert.Contains(t, activation, "GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: signed/${{ github.run_id }}-${{ github.run_attempt }}") assert.Contains(t, activation, "contents: write") assert.Contains(t, activation, "pull-requests: write") assert.Contains(t, activation, "checks: write") - assert.Contains(t, agent, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}") - assert.Contains(t, safeOutputs, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}") + assert.Contains(t, agent, "ref: signed/${{ github.run_id }}-${{ github.run_attempt }}") + assert.Contains(t, safeOutputs, "ref: signed/${{ github.run_id }}-${{ github.run_attempt }}") + assert.NotContains(t, agent, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}") + assert.NotContains(t, safeOutputs, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}") assert.Contains(t, safeOutputs, "pre_created_pull_request_number") assert.Contains(t, conclusion, "complete_pre_created_check_run.cjs") assert.Contains(t, conclusion, "GH_AW_SAFE_OUTPUT_CREATED_PR_NUMBER") diff --git a/pkg/workflow/compiler_precreate_pull_request_test.go b/pkg/workflow/compiler_precreate_pull_request_test.go index db14b0cf832..ccbbd413a59 100644 --- a/pkg/workflow/compiler_precreate_pull_request_test.go +++ b/pkg/workflow/compiler_precreate_pull_request_test.go @@ -28,10 +28,12 @@ func TestBuildActivationJobPreCreatesPullRequest(t *testing.T) { assert.NotContains(t, steps, "name: Checkout repository") assert.Contains(t, steps, "id: pre-create-pull-request") assert.Contains(t, steps, "pre_create_pull_request.cjs") + assert.Contains(t, steps, "id: validate-pre-created-pull-request") + assert.Contains(t, steps, "validate_pre_created_pull_request.cjs") assert.Contains(t, job.Permissions, "contents: write") assert.Contains(t, job.Permissions, "pull-requests: write") assert.Contains(t, job.Permissions, "checks: write") - assert.Equal(t, "${{ steps.pre-create-pull-request.outputs.branch }}", job.Outputs["pre_created_pull_request_branch"]) + assert.Equal(t, "${{ steps.validate-pre-created-pull-request.outputs.branch }}", job.Outputs["pre_created_pull_request_branch"]) } func TestBuildConclusionJobCompletesPreCreatedCheck(t *testing.T) { @@ -76,13 +78,27 @@ func TestBuildConclusionJobPassesNoOpCommentToPreCreatedCheck(t *testing.T) { func TestPreCreatePullRequestCheckoutOverride(t *testing.T) { manager := NewCheckoutManager(nil) - manager.SetDefaultRefOverride("${{ needs.activation.outputs.pre_created_pull_request_branch }}") + manager.SetDefaultRefOverride(preCreatedPullRequestBranchRef(nil)) steps := strings.Join(manager.GenerateDefaultCheckoutStep(false, "", func(action string) string { return action + "@sha" }), "") - assert.Contains(t, steps, "ref: ${{ needs.activation.outputs.pre_created_pull_request_branch }}") + assert.Contains(t, steps, "ref: gh-aw/pre-created/${{ github.run_id }}-${{ github.run_attempt }}") +} + +func TestPreCreatePullRequestCheckoutOverrideUsesConfiguredBranchPrefix(t *testing.T) { + data := &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "signed/"}, + }} + manager := NewCheckoutManager(nil) + manager.SetDefaultRefOverride(preCreatedPullRequestBranchRef(data)) + + steps := strings.Join(manager.GenerateDefaultCheckoutStep(false, "", func(action string) string { + return action + "@sha" + }), "") + + assert.Contains(t, steps, "ref: signed/${{ github.run_id }}-${{ github.run_attempt }}") } func TestValidatePreCreatePullRequest(t *testing.T) { @@ -137,6 +153,47 @@ func TestValidatePreCreatePullRequest(t *testing.T) { }}, wantErr: "allowed-base-branches", }, + { + name: "branch prefix", + data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "signed/"}, + }}, + }, + { + name: "expression branch prefix", + data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "${{ inputs.branch_prefix }}"}, + }}, + wantErr: "requires branch-prefix to be a static string", + }, + { + name: "invalid branch prefix", + data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "bad prefix/"}, + }}, + wantErr: "branch-prefix must be a valid git branch prefix", + }, + { + name: "whitespace branch prefix", + data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: " "}, + }}, + wantErr: "branch-prefix must contain valid git branch prefix characters", + }, + { + name: "reserved ref branch prefix", + data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "refs/heads/"}, + }}, + wantErr: "branch-prefix must form a valid git branch ref", + }, + { + name: "ambiguous branch prefix", + data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "foo//"}, + }}, + wantErr: "branch-prefix must form a valid git branch ref", + }, { name: "cross repository", data: &WorkflowData{SafeOutputs: &SafeOutputsConfig{ @@ -158,6 +215,31 @@ func TestValidatePreCreatePullRequest(t *testing.T) { } } +func TestValidatePreCreatedPullRequestBranchPrefix(t *testing.T) { + tests := map[string]struct { + prefix string + wantErr bool + }{ + "valid": {prefix: "signed/"}, + "leading slash": {prefix: "/", wantErr: true}, + "double slash": {prefix: "foo//", wantErr: true}, + "double dot": {prefix: "..", wantErr: true}, + "dot component": {prefix: ".foo/", wantErr: true}, + "reserved ref": {prefix: "refs/heads/", wantErr: true}, + "lock component": {prefix: "foo/.lock/", wantErr: true}, + } + + for name, tt := range tests { + t.Run(name, func(t *testing.T) { + if tt.wantErr { + require.Error(t, validatePreCreatedPullRequestBranchPrefix(tt.prefix)) + } else { + require.NoError(t, validatePreCreatedPullRequestBranchPrefix(tt.prefix)) + } + }) + } +} + func TestValidatePreCreatePullRequestSteerPermissions(t *testing.T) { tests := []struct { name string @@ -288,6 +370,24 @@ func TestActivationPreCreateStepPassesConfiguredTitlePrefix(t *testing.T) { assert.Contains(t, steps, `GH_AW_PR_TITLE_PREFIX: "[bot] "`) } +func TestActivationPreCreateStepPassesConfiguredBranchPrefix(t *testing.T) { + compiler := NewCompiler() + data := &WorkflowData{ + Name: "Pre-create test", + MarkdownContent: "# Test", + SafeOutputs: &SafeOutputsConfig{ + CreatePullRequests: &CreatePullRequestsConfig{Steer: true, BranchPrefix: "signed/"}, + }, + } + + job, err := compiler.buildActivationJob(data, false, "", "test.lock.yml") + require.NoError(t, err) + + steps := strings.Join(job.Steps, "") + assert.Contains(t, steps, `GH_AW_PRE_CREATED_PULL_REQUEST_BRANCH_PREFIX: "signed/"`) + assert.Contains(t, steps, "GH_AW_EXPECTED_PRE_CREATED_PULL_REQUEST_BRANCH: signed/${{ github.run_id }}-${{ github.run_attempt }}") +} + func TestActivationPreCreateStepOmitsEmptyTitlePrefix(t *testing.T) { compiler := NewCompiler() data := &WorkflowData{ diff --git a/pkg/workflow/compiler_safe_outputs_steps.go b/pkg/workflow/compiler_safe_outputs_steps.go index bca6e554c7d..dd2313a3e37 100644 --- a/pkg/workflow/compiler_safe_outputs_steps.go +++ b/pkg/workflow/compiler_safe_outputs_steps.go @@ -35,7 +35,7 @@ func (c *Compiler) buildSharedPRCheckoutSteps(data *WorkflowData) []string { // Build the same CheckoutManager the agent job builds from the workflow's checkout: config. checkoutMgr := NewCheckoutManager(data.CheckoutConfigs) if isPreCreatePullRequestEnabled(data) { - checkoutMgr.SetDefaultRefOverride("${{ needs.activation.outputs.pre_created_pull_request_branch }}") + checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef(data)) } // Unlike the agent job, the safe_outputs job performs git fetch/push against the diff --git a/pkg/workflow/compiler_yaml_checkout.go b/pkg/workflow/compiler_yaml_checkout.go index b93436be0c1..1f389c4b6e3 100644 --- a/pkg/workflow/compiler_yaml_checkout.go +++ b/pkg/workflow/compiler_yaml_checkout.go @@ -39,7 +39,7 @@ func (c *Compiler) generateInitialAndCheckoutSteps(yaml *strings.Builder, data * // Build a CheckoutManager with any user-configured checkouts checkoutMgr := NewCheckoutManager(data.CheckoutConfigs) if isPreCreatePullRequestEnabled(data) { - checkoutMgr.SetDefaultRefOverride("${{ needs.activation.outputs.pre_created_pull_request_branch }}") + checkoutMgr.SetDefaultRefOverride(preCreatedPullRequestBranchRef(data)) } // Propagate the platform (host) repo resolved by the activation job so that diff --git a/pkg/workflow/create_pull_request.go b/pkg/workflow/create_pull_request.go index 3760b173bc0..766b79c641b 100644 --- a/pkg/workflow/create_pull_request.go +++ b/pkg/workflow/create_pull_request.go @@ -2,13 +2,19 @@ package workflow import ( "errors" + "fmt" "strconv" + "strings" "github.com/github/gh-aw/pkg/logger" ) var createPRLog = logger.New("workflow:create_pull_request") +// Matches actions/setup/js/normalize_branch_name.cjs so pre-created branch prefix +// validation and runtime branch construction agree. +const maxPreCreatedPullRequestBranchPrefixLength = 128 + var createPRStringOrArrayFields = []string{"reviewers", "team-reviewers", "assignees"} var createPRExpressionArrayFields = []string{"labels", "allowed-repos", "allowed-base-branches", "allowed-branches"} @@ -69,8 +75,11 @@ func validatePreCreatePullRequest(data *WorkflowData) error { if config.TargetRepoSlug != "" || config.HeadRepoSlug != "" || len(config.AllowedRepos) > 0 { return errors.New("safe-outputs.create-pull-request.steer only supports pull requests in the workflow repository") } - if config.BranchPrefix != "" || len(config.AllowedBranches) > 0 { - return errors.New("safe-outputs.create-pull-request.steer cannot be combined with branch-prefix or allowed-branches") + if err := validatePreCreatedPullRequestBranchPrefix(config.BranchPrefix); err != nil { + return err + } + if len(config.AllowedBranches) > 0 { + return errors.New("safe-outputs.create-pull-request.steer cannot be combined with allowed-branches") } if len(config.AllowedBaseBranches) > 0 { return errors.New("safe-outputs.create-pull-request.steer cannot be combined with allowed-base-branches because the base branch must be known when the pull request is allocated") @@ -82,6 +91,82 @@ func validatePreCreatePullRequest(data *WorkflowData) error { return nil } +func validatePreCreatedPullRequestBranchPrefix(prefix string) error { + if prefix == "" { + return nil + } + if isExpression(prefix) { + return errors.New("safe-outputs.create-pull-request.steer requires branch-prefix to be a static string") + } + normalized := normalizePreCreatedPullRequestBranchPrefix(prefix) + if normalized == "" { + return errors.New("safe-outputs.create-pull-request.steer branch-prefix must contain valid git branch prefix characters") + } + if normalized != prefix { + return fmt.Errorf("safe-outputs.create-pull-request.steer branch-prefix must be a valid git branch prefix; normalized form would be %q", normalized) + } + if !isValidPreCreatedPullRequestBranch(prefix + "1-1") { + return errors.New("safe-outputs.create-pull-request.steer branch-prefix must form a valid git branch ref") + } + return nil +} + +func isValidPreCreatedPullRequestBranch(branch string) bool { + if branch == "" || + strings.HasPrefix(branch, "refs/") || + strings.HasPrefix(branch, "-") || + strings.HasSuffix(branch, ".") || + strings.Contains(branch, "//") || + strings.Contains(branch, "..") || + strings.Contains(branch, "@{") { + return false + } + for component := range strings.SplitSeq(branch, "/") { + if component == "" || strings.HasPrefix(component, ".") || strings.HasSuffix(component, ".lock") { + return false + } + } + return true +} + +func normalizePreCreatedPullRequestBranchPrefix(prefix string) string { + if prefix == "" { + return prefix + } + if strings.TrimSpace(prefix) == "" { + return "" + } + + var builder strings.Builder + lastDash := false + for _, r := range prefix { + if builder.Len() >= maxPreCreatedPullRequestBranchPrefixLength { + break + } + valid := (r >= 'a' && r <= 'z') || + (r >= 'A' && r <= 'Z') || + (r >= '0' && r <= '9') || + r == '-' || + r == '_' || + r == '/' || + r == '.' + if !valid { + if !lastDash { + builder.WriteByte('-') + lastDash = true + } + continue + } + if r == '-' && lastDash { + continue + } + builder.WriteRune(r) + lastDash = r == '-' + } + + return strings.Trim(builder.String(), "-") +} + // isPreCreatePullRequestConfigured reports whether the workflow should allocate // a pull request during activation. steer is the only way to enable pre-creation; // it pre-creates a draft pull request and lets the agent read feedback from it.