chore: sync gh-aw workflows to upstream HEAD (cb66d12 → 524090c)#109
Open
chore: sync gh-aw workflows to upstream HEAD (cb66d12 → 524090c)#109
Conversation
Pulls 8 upstream commits from verkyyi/github-agent-runner catalog, most notably: - reviewer-agent.md: fix the gh run list --workflow= lookup to use the display name (e.g. "Spec Agent") instead of the file basename — the previous form returned empty results, breaking the pipeline-summary run-ID links silently. (c99b00f, v0.2 audit fix) - Tier-2/3 catalog tests upstream — not adopted, catalog-only. - github/gh-aw-actions/setup v0.68.3 → v0.68.7. Known advisories surfaced by gh aw update (acknowledged, not acted on): - implementer-agent.md source still @main (not a SHA). gh aw update preserved the install-time ref value; rewriting to a pinned SHA is tracked upstream as verkyyi/github-agent-runner#47. - New restricted secret ANTHROPIC_API_KEY appears in compiled lock manifests. We use CLAUDE_CODE_OAUTH_TOKEN at runtime (engine: claude); the ANTHROPIC_API_KEY reference is an unused fallback path in the compiled YAML. Safe to carry. - pull-requests: read permission missing on spec-agent / planner-agent per new toolset requirements. Kept as-is for now — current runs don't need pull-requests access at those stages. - Local digest resolution unavailable (Docker/crane not in this env) so 6 container images in lock files stay on tag refs rather than sha256: digests. GitHub Actions runtime unaffected. Companion upstream work: verkyyi/github-agent-runner#60 proposes a /sync-workflows skill to orchestrate both layers of the update path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Catches the
.github/workflows/*.mdfiles up to upstreamverkyyi/github-agent-runner@main. Our install was 8 commits behind, including thev0.2 audit fixthat repairs a silently-broken pipeline-summary lookup in the reviewer agent.What changed
Behavior change
gh run list --workflow=<file>.ymlreplaced withgh run list --workflow="Spec Agent"etc. The old form returned empty results — every pipeline-summary comment on approve had stale / blank run links. Fixed upstream inc99b00f.Housekeeping
.mdsource SHAs bumpedcb66d12→524090c.implementer-agent.mdgets a trailing newline (cosmetic).github/gh-aw-actions/setupaction pinnedv0.68.3→v0.68.7.Known advisories
Surfaced by
gh aw updateand intentionally not addressed in this PR:implementer-agent.mdsource still@main, not a SHAgh aw updatepreserves the install-time source ref string; the rewrite to a uniform SHA pin is tracked upstream asverkyyi/github-agent-runner#47.ANTHROPIC_API_KEYin compiled manifestengine: claudewithCLAUDE_CODE_OAUTH_TOKEN; theANTHROPIC_API_KEYreference is an unused fallback path baked into the upstream lock template. Benign.pull-requests: readpermission missing on spec/plannerRelated
verkyyi/github-agent-runner#60—/sync-workflowsskill to orchestrate this whole flow (layer-A plugin update + layer-B workflow update + preview + PR) in one command. The manual process done for this PR is what that skill would automate.verkyyi/github-agent-runner#58.Test plan