Support for Contributions of Agentic Workflows #786
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,125 @@ | ||||||
| name: Validate Agentic Workflow Contributions | ||||||
|
|
||||||
| on: | ||||||
| pull_request: | ||||||
| branches: [staged] | ||||||
| types: [opened, synchronize, reopened] | ||||||
| paths: | ||||||
| - "workflows/**" | ||||||
|
|
||||||
| permissions: | ||||||
| contents: read | ||||||
| pull-requests: write | ||||||
|
|
||||||
| jobs: | ||||||
| check-forbidden-files: | ||||||
| name: Block forbidden files | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - name: Checkout code | ||||||
| uses: actions/checkout@v4 | ||||||
| with: | ||||||
| fetch-depth: 0 | ||||||
|
|
||||||
| - name: Check for forbidden files | ||||||
| id: check | ||||||
| run: | | ||||||
| # Check for YAML/lock files in workflows/ and any .github/ modifications | ||||||
| forbidden=$(git diff --name-only --diff-filter=ACM origin/${{ github.base_ref }}...HEAD -- \ | ||||||
| 'workflows/**/*.yml' \ | ||||||
| 'workflows/**/*.yaml' \ | ||||||
| 'workflows/**/*.lock.yml' \ | ||||||
| '.github/*' \ | ||||||
| '.github/**') | ||||||
|
|
||||||
| if [ -n "$forbidden" ]; then | ||||||
| echo "❌ Forbidden files detected:" | ||||||
| echo "$forbidden" | ||||||
| echo "files<<EOF" >> "$GITHUB_OUTPUT" | ||||||
| echo "$forbidden" >> "$GITHUB_OUTPUT" | ||||||
| echo "EOF" >> "$GITHUB_OUTPUT" | ||||||
| exit 1 | ||||||
| else | ||||||
| echo "✅ No forbidden files found" | ||||||
| fi | ||||||
|
|
||||||
| - name: Comment on PR | ||||||
| if: failure() | ||||||
| uses: marocchino/sticky-pull-request-comment@v2 | ||||||
| with: | ||||||
|
Comment on lines
+46
to
+49
There was a problem hiding this comment. This PR-commenting step runs unconditionally on failure, but This issue also appears on line 108 of the same file.
Contributor
Author
There was a problem hiding this comment. @copilot open a new pull request to apply changes based on this feedback |
||||||
| header: workflow-forbidden-files | ||||||
| message: | | ||||||
| ## 🚫 Forbidden files in `workflows/` | ||||||
|
|
||||||
| Only `.md` markdown files are accepted in the `workflows/` directory. The following are **not allowed**: | ||||||
| - Compiled workflow files (`.yml`, `.yaml`, `.lock.yml`) — could contain untrusted Actions code | ||||||
| - `.github/` modifications — workflow contributions must not modify repository configuration | ||||||
|
|
||||||
| **Files that must be removed:** | ||||||
| ``` | ||||||
| ${{ steps.check.outputs.files }} | ||||||
| ``` | ||||||
|
|
||||||
| Contributors provide the workflow **source** (`.md`) only. Compilation happens downstream via `gh aw compile`. | ||||||
|
|
||||||
| Please remove these files and push again. | ||||||
|
|
||||||
| compile-workflows: | ||||||
| name: Compile and validate | ||||||
| needs: check-forbidden-files | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - name: Checkout code | ||||||
| uses: actions/checkout@v4 | ||||||
|
|
||||||
| - name: Install gh-aw CLI | ||||||
| uses: github/gh-aw/actions/setup-cli@main | ||||||
|
There was a problem hiding this comment.
Suggested change
Contributor
Author
There was a problem hiding this comment. @aaronpowell are we ok with using main from a GitHub Inc. maintained action? |
||||||
|
|
||||||
| - name: Compile workflow files | ||||||
| id: compile | ||||||
| run: | | ||||||
| exit_code=0 | ||||||
| found=0 | ||||||
|
|
||||||
| # Find all .md files directly in workflows/ | ||||||
| for workflow_file in workflows/*.md; do | ||||||
| [ -f "$workflow_file" ] || continue | ||||||
|
|
||||||
| found=$((found + 1)) | ||||||
| echo "::group::Compiling $workflow_file" | ||||||
| if gh aw compile --validate "$workflow_file"; then | ||||||
| echo "✅ $workflow_file compiled successfully" | ||||||
| else | ||||||
| echo "❌ $workflow_file failed to compile" | ||||||
| exit_code=1 | ||||||
| fi | ||||||
| echo "::endgroup::" | ||||||
| done | ||||||
|
|
||||||
| if [ "$found" -eq 0 ]; then | ||||||
| echo "No workflow .md files found to validate." | ||||||
| else | ||||||
| echo "Validated $found workflow file(s)." | ||||||
| fi | ||||||
|
|
||||||
| echo "status=$( [ $exit_code -eq 0 ] && echo success || echo failure )" >> "$GITHUB_OUTPUT" | ||||||
| exit $exit_code | ||||||
|
|
||||||
| - name: Comment on PR if compilation failed | ||||||
| if: failure() | ||||||
| uses: marocchino/sticky-pull-request-comment@v2 | ||||||
| with: | ||||||
| header: workflow-validation | ||||||
| message: | | ||||||
| ## ❌ Agentic Workflow compilation failed | ||||||
|
|
||||||
| One or more workflow files in `workflows/` failed to compile with `gh aw compile --validate`. | ||||||
|
|
||||||
| Please fix the errors and push again. You can test locally with: | ||||||
|
|
||||||
| ```bash | ||||||
| gh extension install github/gh-aw | ||||||
| gh aw compile --validate <your-workflow-file>.md | ||||||
| ``` | ||||||
|
|
||||||
| See the [Agentic Workflows documentation](https://github.github.com/gh-aw) for help. | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,6 +9,7 @@ on: | |
| - "prompts/**" | ||
| - "agents/**" | ||
| - "plugins/**" | ||
| - "workflows/**" | ||
| - "*.js" | ||
| - "README.md" | ||
| - "docs/**" | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| # ⚡ Agentic Workflows | ||
|
|
||
| [Agentic Workflows](https://github.github.com/gh-aw) are AI-powered repository automations that run coding agents in GitHub Actions. Defined in markdown with natural language instructions, they enable event-triggered and scheduled automation with built-in guardrails and security-first design. | ||
|
|
||
| ### How to Use Agentic Workflows | ||
|
|
||
| **What's Included:** | ||
| - Each workflow is a single `.md` file with YAML frontmatter and natural language instructions | ||
| - Workflows are compiled to `.lock.yml` GitHub Actions files via `gh aw compile` | ||
| - Workflows follow the [GitHub Agentic Workflows specification](https://github.github.com/gh-aw) | ||
|
|
||
| **To Install:** | ||
| - Install the `gh aw` CLI extension: `gh extension install github/gh-aw` | ||
| - Copy the workflow `.md` file to your repository's `.github/workflows/` directory | ||
| - Compile with `gh aw compile` to generate the `.lock.yml` file | ||
| - Commit both the `.md` and `.lock.yml` files | ||
|
|
||
| **To Activate/Use:** | ||
| - Workflows run automatically based on their configured triggers (schedules, events, slash commands) | ||
| - Use `gh aw run <workflow>` to trigger a manual run | ||
| - Monitor runs with `gh aw status` and `gh aw logs` | ||
|
|
||
| **When to Use:** | ||
| - Automate issue triage and labeling | ||
| - Generate daily status reports | ||
| - Maintain documentation automatically | ||
| - Run scheduled code quality checks | ||
| - Respond to slash commands in issues and PRs | ||
| - Orchestrate multi-step repository automation | ||
|
|
||
| _No entries found yet._ |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The forbidden-file check relies on
origin/${{ github.base_ref }}...HEADand--diff-filter=ACM. In Actions this ref can be missing/ambiguous depending on checkout mode, and the filter also ignores deletions/renames. Consider diffing${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}(or${{ github.event.pull_request.base.sha }}...${{ github.sha }}) and either removing--diff-filteror includingD/Rso forbidden deletions/renames are also caught. Also, this currently only blocks*.yml/*.yaml/*.lock.ymlunderworkflows/**; the PR description says all such files should be rejected for workflow contributions—please align implementation and docs.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@copilot open a new pull request to apply changes based on this feedback