Files
Vincent b75b7f351b fix: prepare complete issues and enforce delivery gates (#149)
* fix: unify execution-ready issue preparation

* fix: require prepared issues and explicit dispatch roles

* fix: provision prepared workflow skills with dispatch setup

* fix: gate prepared delivery on independent review and CI

* chore: record reviewed delivery adaptations

* fix: align legacy loops with prepared delivery contract

* fix: preserve dispatch claim ownership and validate runtime trust

* fix: synchronize reviewed workflow adapters and provenance

* fix: reject hidden plan input and isolate planner credentials
2026-09-14 14:55:42 +02:00

72 lines
2.7 KiB
YAML

name: Agent Dispatch
# Model/effort are explicit runtime variables. No provider or usage fallback.
# The shared guard/contract must be installed with these workflows.
on:
issues:
types: [labeled]
permissions:
contents: write
issues: write
pull-requests: write
jobs:
dispatch:
if: github.event.label.name == 'dispatch:claude'
runs-on: ubuntu-latest
timeout-minutes: 90
# Job-level gating avoids unrelated label events replacing pending dispatches.
# All provider lanes share this issue lock, including planning.
concurrency:
group: agent-issue-${{ github.repository }}-${{ github.event.issue.number }}
cancel-in-progress: false
env:
DISPATCH_LANE: claude
MODEL_ID: ${{ vars.CLAUDE_MODEL }}
MODEL_EFFORT: ${{ vars.CLAUDE_EFFORT }}
MODEL_PROVIDER: anthropic
steps:
- name: Checkout trusted default branch snapshot
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
with:
ref: ${{ github.event.repository.default_branch }}
fetch-depth: 0
persist-credentials: false
- name: Validate runtime, trusted actor, Backlog, and claim
id: guard
env:
GH_TOKEN: ${{ secrets.PROJECTS_TOKEN }}
MODEL_API_KEY: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
run: |
cp .github/agent-dispatch.cjs "$RUNNER_TEMP/agent-dispatch.cjs"
node "$RUNNER_TEMP/agent-dispatch.cjs" prepare
- name: Execute prepared issue with configured Claude model
id: agent
env:
GH_TOKEN: ${{ secrets.PROJECTS_TOKEN }}
uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
github_token: ${{ secrets.PROJECTS_TOKEN }}
track_progress: "true"
claude_args: --model ${{ vars.CLAUDE_MODEL }} --effort ${{ vars.CLAUDE_EFFORT }}
prompt: |
Run the execution role for issue #${{ github.event.issue.number }}.
Read and follow .github/agent-dispatch.md in full.
Resolve workflow skills from ${{ steps.guard.outputs.skill-root }}.
Runtime provider: anthropic; model: ${{ vars.CLAUDE_MODEL }}; effort: ${{ vars.CLAUDE_EFFORT }}.
The workflow owns claim release and status handoff.
- name: Release claim and report delivery handoff
if: always()
env:
GH_TOKEN: ${{ secrets.PROJECTS_TOKEN }}
AGENT_OUTCOME: ${{ steps.agent.outcome }}
run: |
if [ -f "$RUNNER_TEMP/agent-dispatch.cjs" ]; then
node "$RUNNER_TEMP/agent-dispatch.cjs" finalize
fi