Add push trigger on repository default branch for .github/workflows/*.md to agentic maintenance workflow generator

.github/workflows/agentics-maintenance.yml

@@ -35,6 +35,11 @@ name: Agentic Maintenance
 on:
   schedule:
     - cron: "37 */2 * * *"  # Every 2 hours (based on minimum expires: 1 days)
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/*.md'
   workflow_dispatch:
     inputs:
       operation:
@@ -84,7 +89,7 @@ permissions: {}
 
 jobs:
   close-expired-entities:
-    if: ${{ (!(github.event.repository.fork)) && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
     runs-on: ubuntu-slim
     permissions:
       discussions: write
@@ -131,7 +136,7 @@ jobs:
             await main();
 
   cleanup-cache-memory:
-    if: ${{ (!(github.event.repository.fork)) && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
+    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
     runs-on: ubuntu-slim
     permissions:
       actions: write
@@ -552,6 +557,9 @@ jobs:
   compile-workflows:
     if: ${{ (!(github.event.repository.fork)) && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
     runs-on: ubuntu-slim
+    concurrency:
+      group: ${{ github.workflow }}-compile-workflows-${{ github.repository }}
+      cancel-in-progress: true
     permissions:
       contents: read
       issues: write
@@ -590,7 +598,7 @@ jobs:
             await main();
 
   secret-validation:
-    if: ${{ (!(github.event.repository.fork)) && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
     runs-on: ubuntu-slim
     permissions:
       contents: read

pkg/cli/compile_post_processing.go

@@ -75,7 +75,7 @@ func generateMaintenanceWorkflowWrapper(
 		repoConfig = nil
 	}
 
-	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, compiler.GetVersion(), compiler.GetActionMode(), compiler.GetActionTag(), verbose, repoConfig); err != nil {
+	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, compiler.GetVersion(), compiler.GetActionMode(), compiler.GetActionTag(), verbose, repoConfig, compiler.GetRepositorySlug()); err != nil {
 		if strict {
 			return fmt.Errorf("failed to generate maintenance workflow: %w", err)
 		}

pkg/cli/init.go

@@ -238,7 +238,7 @@ func ensureMaintenanceWorkflow(verbose bool) error {
 		repoConfig = nil
 	}
 
-	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, GetVersion(), compiler.GetActionMode(), compiler.GetActionTag(), verbose, repoConfig); err != nil {
+	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, GetVersion(), compiler.GetActionMode(), compiler.GetActionTag(), verbose, repoConfig, compiler.GetRepositorySlug()); err != nil {
 		return fmt.Errorf("failed to generate maintenance workflow: %w", err)
 	}
 

pkg/workflow/compiler_types.go

@@ -278,6 +278,11 @@ func (c *Compiler) SetRepositorySlug(slug string) {
 	c.repositorySlug = slug
 }
 
+// GetRepositorySlug returns the repository slug (owner/repo) set on this compiler instance.
+func (c *Compiler) GetRepositorySlug() string {
+	return c.repositorySlug
+}
+
 // GetScheduleWarnings returns all accumulated schedule warnings for this compiler instance
 func (c *Compiler) GetScheduleWarnings() []string {
 	return c.scheduleWarnings

pkg/workflow/maintenance_conditions.go

@@ -33,31 +33,53 @@ func buildNotDispatchOrCallOrEmptyOperation() ConditionNode {
 	)
 }
 
-// buildNotForkAndScheduledOrOperation creates a condition for jobs that run on
-// schedule (or empty operation) AND when a specific operation is selected.
-// Condition: !fork && (not_dispatch_or_call || operation == ” || operation == op)
-func buildNotForkAndScheduledOrOperation(operation string) ConditionNode {
-	maintenanceConditionsLog.Printf("Building not-fork-and-scheduled-or-operation condition: %s", operation)
+// buildNotForkAndScheduled creates a condition for jobs that should run on any
+// non-dispatch/call event including push, or on workflow_dispatch/workflow_call
+// with an empty operation, and never on forks. Unlike buildNotForkAndScheduleOnly,
+// this function does NOT exclude push events.
+// Condition: !fork && ((event_name != 'workflow_dispatch' && event_name != 'workflow_call') || operation == ”)
+func buildNotForkAndScheduled() ConditionNode {
 	return BuildAnd(
 		buildNotForkCondition(),
-		BuildOr(
-			buildNotDispatchOrCallOrEmptyOperation(),
-			BuildEquals(
-				BuildPropertyAccess("inputs.operation"),
-				BuildStringLiteral(operation),
+		buildNotDispatchOrCallOrEmptyOperation(),
+	)
+}
+
+// buildNotForkAndScheduleOnly creates a condition for jobs that should run on schedule
+// (or empty dispatch/call) but NOT on push events, and never on forks.
+func buildNotForkAndScheduleOnly() ConditionNode {
+	return BuildAnd(
+		buildNotForkCondition(),
+		BuildAnd(
+			BuildNotEquals(
+				BuildPropertyAccess("github.event_name"),
+				BuildStringLiteral("push"),
 			),
+			buildNotDispatchOrCallOrEmptyOperation(),
 		),
 	)
 }
 
-// buildNotForkAndScheduled creates a condition for jobs that should run on any
-// non-dispatch/call event (e.g. schedule, push) or on workflow_dispatch/workflow_call
-// with an empty operation, and never on forks.
-// Condition: !fork && ((event_name != 'workflow_dispatch' && event_name != 'workflow_call') || operation == ”)
-func buildNotForkAndScheduled() ConditionNode {
+// buildNotForkAndScheduleOnlyOrOperation creates a condition for jobs that run on
+// schedule (or empty dispatch/call) or when a specific operation is selected,
+// but NOT on push events, and never on forks.
+func buildNotForkAndScheduleOnlyOrOperation(operation string) ConditionNode {
+	maintenanceConditionsLog.Printf("Building not-fork-and-schedule-only-or-operation condition: %s", operation)
 	return BuildAnd(
 		buildNotForkCondition(),
-		buildNotDispatchOrCallOrEmptyOperation(),
+		BuildAnd(
+			BuildNotEquals(
+				BuildPropertyAccess("github.event_name"),
+				BuildStringLiteral("push"),
+			),
+			BuildOr(
+				buildNotDispatchOrCallOrEmptyOperation(),
+				BuildEquals(
+					BuildPropertyAccess("inputs.operation"),
+					BuildStringLiteral(operation),
+				),
+			),
+		),
 	)
 }
 

pkg/workflow/maintenance_workflow.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
 	"github.com/github/gh-aw/pkg/logger"
@@ -83,11 +84,37 @@ func getCLICmdPrefix(actionMode ActionMode) string {
 	return "gh aw"
 }
 
+// FetchDefaultBranch queries the GitHub API to determine the default branch of the
+// given repository slug (owner/repo). Returns "main" as a fallback when the slug is
+// empty, not in owner/repo format, or when the API call fails.
+func FetchDefaultBranch(slug string) string {
+	const fallback = "main"
+	if slug == "" || strings.Count(slug, "/") != 1 {
+		maintenanceLog.Printf("No valid repository slug, using default branch fallback: %s", fallback)
+		return fallback
+	}
+	maintenanceLog.Printf("Fetching default branch for repository: %s", slug)
+	output, err := RunGH("Fetching default branch...", "api", "/repos/"+slug, "--jq", ".default_branch")
+	if err != nil {
+		maintenanceLog.Printf("Failed to fetch default branch for %s: %v, falling back to %s", slug, err, fallback)
+		return fallback
+	}
+	branch := strings.TrimSpace(string(output))
+	if branch == "" {
+		maintenanceLog.Printf("Empty default branch response for %s, falling back to %s", slug, fallback)
+		return fallback
+	}
+	maintenanceLog.Printf("Default branch for %s: %s", slug, branch)
+	return branch
+}
+
 // GenerateMaintenanceWorkflow generates the agentics-maintenance.yml workflow
 // if any workflows use the expires field for discussions or issues.
 // When repoConfig is non-nil and repoConfig.MaintenanceDisabled is true the
 // maintenance workflow is deleted and the function returns immediately.
-func GenerateMaintenanceWorkflow(workflowDataList []*WorkflowData, workflowDir string, version string, actionMode ActionMode, actionTag string, verbose bool, repoConfig *RepoConfig) error {
+// repoSlug is the owner/repo slug used to determine the default branch for the push
+// trigger; pass an empty string to fall back to "main".
+func GenerateMaintenanceWorkflow(workflowDataList []*WorkflowData, workflowDir string, version string, actionMode ActionMode, actionTag string, verbose bool, repoConfig *RepoConfig, repoSlug string) error {
 	maintenanceLog.Print("Checking if maintenance workflow is needed")
 
 	// Respect explicit opt-out from aw.json: maintenance: false
@@ -144,8 +171,12 @@ func GenerateMaintenanceWorkflow(workflowDataList []*WorkflowData, workflowDir s
 	cronSchedule, scheduleDesc := generateMaintenanceCron(minExpiresDays)
 	maintenanceLog.Printf("Maintenance schedule: %s (%s)", cronSchedule, scheduleDesc)
 
+	// Fetch the default branch for the push trigger (dev mode only)
+	// Resolved here to avoid passing it through multiple layers; empty slug falls back to "main"
+	defaultBranch := FetchDefaultBranch(repoSlug)
+
 	// Generate the YAML content for the maintenance workflow
-	content := buildMaintenanceWorkflowYAML(cronSchedule, scheduleDesc, minExpiresDays, runsOnValue, actionMode, version, actionTag, resolver, configuredRunsOn)
+	content := buildMaintenanceWorkflowYAML(cronSchedule, scheduleDesc, minExpiresDays, runsOnValue, actionMode, version, actionTag, resolver, configuredRunsOn, defaultBranch)
 
 	// Write the maintenance workflow file
 	maintenanceFile := filepath.Join(workflowDir, "agentics-maintenance.yml")