Codestin Search App

Copilot · 2026-05-22T13:03:16Z

This change extends aw.json so maintenance compile jobs can use a named secret for GitHub auth and optionally open a pull request when compilation produces workflow diffs. When PR mode is enabled, repeated runs reuse the same maintenance PR instead of creating duplicates.

Config surface
- Adds maintenance.compile.github_token_secret to select the secret used by the compile-workflows job.
- Adds maintenance.compile.create_pull_request to switch compile drift handling from issue creation to PR creation.
- Updates repo config schema and typed parsing for the new nested maintenance.compile block.
Maintenance workflow generation
- Wires the generated agentics-maintenance.yml compile job to pass the configured token into github-script.
- Adjusts compile job permissions for PR mode (contents: write, pull-requests: write) while preserving issue-based behavior when PR mode is disabled.
- Uses a fallback chain of configured secret -> GH_AW_GITHUB_TOKEN -> github.token.
Recompile handling
- Extends check_workflow_recompile_needed.cjs to support two paths:
  - existing behavior: search/create a single maintenance issue
  - new behavior: commit regenerated lock files to a fixed branch and create or update a single deduplicated PR
- Deduplication is branch-based, so subsequent maintenance runs update the existing PR instead of opening another one.
Validation and guardrails
- Adds value-level validation for maintenance.compile.github_token_secret.
- Updates Go and JS tests to cover config parsing, generated workflow output, PR mode, and deduplication behavior.

Example aw.json:

{
  "maintenance": {
    "compile": {
      "github_token_secret": "MAINTENANCE_GITHUB_TOKEN",
      "create_pull_request": true
    }
  }
}

Co-authored-by: pelikhan <[email protected]>

pelikhan · 2026-05-22T13:06:36Z

@copilot do not change permission, only use secret mentioned in config.

The GitHub action token does not have the rights to write to the .GitHub/workflows folder.

DO NOT do token fallbacks. Add extensive logging.

Co-authored-by: pelikhan <[email protected]>

pelikhan · 2026-05-22T13:18:51Z

@copilot

Merge fields github_token_secret"
"create_pull_request"

into

create_pull_request_github_token

to enable behavior. PR description should have "Fixes #issuenumber"

Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-05-22T13:22:09Z

@copilot do not change permission, only use secret mentioned in config.

The GitHub action token does not have the rights to write to the .GitHub/workflows folder....

Fixed in 700a532: compile PR mode now only uses maintenance.compile.github_token_secret, keeps the compile-workflows job permissions unchanged, removes token fallbacks, adds logging around the PR path, and requires the secret when create_pull_request is enabled.

Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-05-22T13:42:51Z

@copilot

Merge fields github_token_secret"...

Addressed in 4021db9. The maintenance compile config now uses maintenance.compile.create_pull_request_github_token, PR mode is enabled only by that configured secret, and maintenance PR bodies include Fixes #<issue> when an existing recompile issue is present.

pelikhan · 2026-05-22T13:49:06Z

+  return getRecompileToken() !== "";
+}
+
+async function execWithOutput(command, args, options = {}) {


@copilot look for existing helper

Addressed in 4e659d8: this now uses exec.getExecOutput() instead of the local output wrapper.

pelikhan · 2026-05-22T13:49:26Z

+}
+
+function getDefaultBranch() {
+  return context.payload?.repository?.default_branch || "main";


@copilot look for existing helper

Addressed in 4e659d8: the PR base branch now comes from the existing resolvePullRequestRepo() helper.

pelikhan · 2026-05-22T13:50:23Z

+<details>
+<summary>View diff</summary>
+
+\`\`\`diff
+${diffContent}
+\`\`\`
+
+</details>


@copilot not need, GitHub provides the diff UI

Addressed in 4e659d8: I removed the embedded diff from the maintenance PR body and now rely on GitHub’s diff UI.

pelikhan · 2026-05-22T13:50:40Z

+`;
+}
+
+async function configureGitIdentity() {


@copilot look for existing helper

Addressed in 4e659d8: I removed the local git identity/helper path and folded the branch publish flow into the existing helper-based logic.

pelikhan · 2026-05-22T13:51:11Z

+  await exec.exec("git", ["config", "user.name", "github-actions[bot]"]);
+}
+
+async function stageAndCommitRecompileBranch() {


@copilot use helper to create signed commits

Addressed in 4e659d8: the maintenance branch now publishes through the existing pushSignedCommits() helper instead of direct git push.

Co-authored-by: pelikhan <[email protected]>

pelikhan · 2026-05-22T14:35:00Z

@copilot ensure create PR uses signed commits, reuse existing helpers.

Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-05-22T14:45:26Z

@copilot ensure create PR uses signed commits, reuse existing helpers.

Addressed in ed42dbb: the maintenance recompile PR flow now reuses pushSignedCommits with git-push fallback disabled, so the branch update must succeed through the signed-commit path.

pelikhan · 2026-05-22T14:45:58Z

-      - name: Check for out-of-sync workflows and create issue if needed
+      - name: Check for out-of-sync workflows and create issue or pull request if needed
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:


@copilot dangling env:

Fixed in c7ded93.

Co-authored-by: pelikhan <[email protected]>

Copilot

Pull request overview

Extends maintenance compilation behavior so workflow compile drift can be handled using a configurable GitHub token secret and (optionally) by creating/updating a deduplicated pull request instead of opening an issue.

Changes:

Adds repo config schema + Go parsing/validation for a new maintenance.compile block (token secret name).
Updates generated maintenance workflow to pass the configured token into actions/github-script for compile drift handling.
Extends check_workflow_recompile_needed.cjs (and tests) to support a PR-based deduped branch/PR flow using signed commits, plus updates action pin metadata.

Show a summary per file

File	Description
pkg/workflow/repo_config.go	Adds `maintenance.compile` typed config + value validation for secret name.
pkg/workflow/repo_config_test.go	Tests for new maintenance compile config parsing + invalid secret name.
pkg/workflow/maintenance_workflow.go	Plumbs maintenance compile token config into workflow YAML generation.
pkg/workflow/maintenance_workflow_yaml.go	Emits optional env + `github-token` for the compile drift github-script step.
pkg/workflow/maintenance_workflow_test.go	Asserts generated YAML wiring for maintenance token and no empty env blocks.
pkg/workflow/github_token.go	Adds helper to render maintenance token secret expression.
pkg/parser/schemas/repo_config_schema.json	Adds schema for `maintenance.compile.create_pull_request_github_token`.
actions/setup/js/check_workflow_recompile_needed.cjs	Adds PR-mode flow (branch push + dedup PR) alongside existing issue mode.
actions/setup/js/check_workflow_recompile_needed.test.cjs	Adds PR-mode + deduplication + signed-commit requirements coverage.
actions/setup/js/push_signed_commits.cjs	Adds `allowGitPushFallback` option to refuse unsigned fallback paths when required.
actions/setup/js/push_signed_commits.test.cjs	Tests refusal behavior when git-push fallback is explicitly disabled.
pkg/workflow/data/action_pins.json	Adds docker/metadata-action@v6 pin entry.
pkg/actionpins/data/action_pins.json	Mirrors docker/metadata-action@v6 pin entry for actionpins package.
.github/aw/actions-lock.json	Adds docker/metadata-action@v6 pin entry to lock file.
.github/workflows/release.lock.yml	Updates docker/metadata-action pin to the new `@v6` entry/SHA.
.github/workflows/agentics-maintenance.yml	Regenerates maintenance workflow (step name updated in this repo snapshot).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 16/16 changed files
Comments generated: 8

@@ -59,7 +59,21 @@
            "label_triggers": {
              "description": "Set to false to disable all label-triggered jobs (disable_agentic_workflow, label_apply_safe_outputs, etc.). When absent or true (default), all label-triggered jobs are included in the maintenance workflow.",


+              "compile": {
+                "description": "Configuration for the compile-workflows maintenance job.",
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "create_pull_request_github_token": {
+                    "description": "GitHub Actions secret name used by the compile-workflows job for GitHub API calls and branch pushes when compile drift should create or update a deduplicated pull request instead of opening an issue.",
+                    "type": "string",
+                    "minLength": 1,
+                    "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
+                    "examples": ["GH_AW_GITHUB_TOKEN", "MAINTENANCE_GITHUB_TOKEN"]
+                  }


 // MaintenanceConfig holds maintenance-workflow-specific settings from aw.json.
+type MaintenanceCompileConfig struct {
+	// CreatePullRequestGitHubToken is the secret name used by the compile-workflows
+	// maintenance job for GitHub API calls and branch pushes. When configured,
+	// out-of-sync compiled workflows are reported via a deduplicated pull request
+	// instead of an issue.
+	CreatePullRequestGitHubToken string `json:"create_pull_request_github_token,omitempty"`
+}


+	enableCompileCreatePullRequest := false
 	if repoConfig != nil && repoConfig.Maintenance != nil {
 		configuredRunsOn = repoConfig.Maintenance.RunsOn
 		disableLabelTrigger = !repoConfig.Maintenance.IsLabelTriggerEnabled()
+		if repoConfig.Maintenance.Compile != nil {
+			compileGitHubTokenSecret = repoConfig.Maintenance.Compile.CreatePullRequestGitHubToken
+			enableCompileCreatePullRequest = strings.TrimSpace(compileGitHubTokenSecret) != ""


 	actionTag := opts.actionTag
 	resolver := opts.resolver
 	configuredRunsOn := opts.configuredRunsOn
 	defaultBranch := opts.defaultBranch
 	disableLabelTrigger := opts.disableLabelTrigger
-	maintenanceWorkflowYAMLLog.Printf("Building maintenance workflow YAML: actionMode=%s minExpiresDays=%d cronSchedule=%q defaultBranch=%q disableLabelTrigger=%v", actionMode, minExpiresDays, cronSchedule, defaultBranch, disableLabelTrigger)
+	compileGitHubToken := opts.compileGitHubToken
+	createCompilePR := opts.createCompilePR
+	maintenanceWorkflowYAMLLog.Printf("Building maintenance workflow YAML: actionMode=%s minExpiresDays=%d cronSchedule=%q defaultBranch=%q disableLabelTrigger=%v createCompilePR=%v", actionMode, minExpiresDays, cronSchedule, defaultBranch, disableLabelTrigger, createCompilePR)



+const RECOMPILE_ISSUE_TITLE = "[aw] agentic workflows out of sync";
+const RECOMPILE_PR_TITLE = "[aw] recompile agentic workflows";
+const RECOMPILE_PR_BRANCH = "aw/recompile-workflows";
+
+function shouldCreatePullRequest() {
+  return getRecompileToken() !== "";
+}


+async function getRemoteBranchHead(branchName) {
+  const { stdout, exitCode, stderr } = await exec.getExecOutput("git", ["ls-remote", "origin", `refs/heads/${branchName}`], {
+    ignoreReturnCode: true,
+  });
+  if (exitCode !== 0) {
+    core.info(`Could not query remote branch ${branchName}: ${stderr.trim() || `exit code ${exitCode}`}`);
+    return "";
+  }
+  const trimmed = stdout.trim();
+  if (!trimmed) {
+    core.info(`Remote branch ${branchName} does not exist yet`);
+    return "";
+  }
+  const remoteHead = trimmed.split(/\s+/)[0] || "";
+  core.info(`Remote branch ${branchName} currently points to ${remoteHead}`);
+  return remoteHead;
+}
+
+async function fetchRemoteBranch(branchName) {
+  core.info(`Fetching remote branch ${branchName} for comparison`);
+  await exec.exec("git", ["fetch", "origin", `refs/heads/${branchName}:refs/remotes/origin/${branchName}`]);
+}
+
+async function filterFilesNeedingUpdate(comparisonRef, changedFiles, workspaceDir) {
+  const filesToUpdate = [];
+  for (const file of changedFiles) {
+    const workingTreePath = `${workspaceDir}/${file}`;
+    const workingTreeContent = fs.readFileSync(workingTreePath, "utf8");
+    const { stdout, exitCode } = await exec.getExecOutput("git", ["show", `${comparisonRef}:${file}`], {
+      ignoreReturnCode: true,
+    });


+// getEffectiveMaintenanceGitHubToken returns the configured GitHub token secret
+// expression to use for maintenance compile-workflows operations.
+//
+// No fallback chain is applied here. Maintenance compile PR mode must use the
+// explicitly configured secret so the generated workflow does not silently fall
+// back to a token without permission to write workflow files.
+func getEffectiveMaintenanceGitHubToken(secretName string) string {
+	secretName = strings.TrimSpace(secretName)
+	if secretName == "" {
+		tokenLog.Print("No maintenance compile GitHub token secret configured")
+		return ""
+	}
+	tokenLog.Printf("Using configured maintenance compile GitHub token secret %q", secretName)
+	return wrapGitHubExpression(fmt.Sprintf("secrets.%s", secretName))
+}


Copilot AI and others added 2 commits May 22, 2026 12:57

Implement maintenance compile config

3f5e911

Co-authored-by: pelikhan <[email protected]>

Harden maintenance recompile PR flow

51335b0

Co-authored-by: pelikhan <[email protected]>

Copilot AI assigned Copilot and pelikhan May 22, 2026

Copilot AI changed the title ~~Allow maintenance compile job PRs and custom token secret~~ Add maintenance compile PR mode and configurable GitHub token secret May 22, 2026

Copilot finished work on behalf of pelikhan May 22, 2026 13:03

Copilot AI requested a review from pelikhan May 22, 2026 13:03

Copilot created this pull request from a session on behalf of pelikhan May 22, 2026 13:03 View session

Copilot started work on behalf of pelikhan May 22, 2026 13:06 View session

Plan comment follow-up

bde6ea8

Co-authored-by: pelikhan <[email protected]>

github-actions Bot mentioned this pull request May 22, 2026

[aw] No-Op Runs #33835

Closed

Address maintenance token review feedback

700a532

Co-authored-by: pelikhan <[email protected]>

Copilot finished work on behalf of pelikhan May 22, 2026 13:22

Copilot started work on behalf of pelikhan May 22, 2026 13:22 View session

Copilot AI and others added 3 commits May 22, 2026 13:28

Track review feedback plan

28086a1

Co-authored-by: pelikhan <[email protected]>

Address maintenance compile review feedback

5c7af93

Co-authored-by: pelikhan <[email protected]>

Sync maintenance workflow artifact

4021db9

Co-authored-by: pelikhan <[email protected]>

Copilot finished work on behalf of pelikhan May 22, 2026 13:43

pelikhan reviewed May 22, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 22, 2026 13:53 View session

Copilot AI and others added 4 commits May 22, 2026 13:59

Plan review feedback

3a60f0e

Co-authored-by: pelikhan <[email protected]>

Address recompile PR review feedback

5980862

Co-authored-by: pelikhan <[email protected]>

Tighten recompile PR helper usage

4634ff8

Co-authored-by: pelikhan <[email protected]>

Polish recompile review follow-up

4e659d8

Co-authored-by: pelikhan <[email protected]>

Copilot finished work on behalf of pelikhan May 22, 2026 14:13

Copilot AI requested a review from pelikhan May 22, 2026 14:13

Copilot started work on behalf of pelikhan May 22, 2026 14:35 View session

Require signed maintenance PR commits

ed42dbb

Co-authored-by: pelikhan <[email protected]>

pelikhan reviewed May 22, 2026

View reviewed changes

Copilot finished work on behalf of pelikhan May 22, 2026 14:46

Copilot AI requested a review from pelikhan May 22, 2026 14:46

Copilot started work on behalf of pelikhan May 22, 2026 14:46 View session

Remove dangling maintenance env block

c7ded93

Co-authored-by: pelikhan <[email protected]>

pelikhan marked this pull request as ready for review May 22, 2026 14:59

Copilot AI review requested due to automatic review settings May 22, 2026 14:59

pelikhan merged commit 15db345 into main May 22, 2026

pelikhan deleted the copilot/add-github-token-secret-support branch May 22, 2026 14:59

Copilot stopped work on behalf of pelikhan due to an error May 22, 2026 14:59
The session was cancelled by the user.

Copilot started reviewing on behalf of pelikhan May 22, 2026 15:00 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

		@@ -59,7 +59,21 @@
		"label_triggers": {
		"description": "Set to false to disable all label-triggered jobs (disable_agentic_workflow, label_apply_safe_outputs, etc.). When absent or true (default), all label-triggered jobs are included in the maintenance workflow.",

Conversation

Copilot AI commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented May 22, 2026

Uh oh!

pelikhan commented May 22, 2026

Uh oh!

Copilot AI commented May 22, 2026

Uh oh!

Copilot AI commented May 22, 2026

Uh oh!

pelikhan May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 22, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented May 22, 2026

Uh oh!

Copilot AI commented May 22, 2026

Uh oh!

pelikhan May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 22, 2026 •

edited

Loading