feat(ci): sync maintained branches through cloud CodingAgent after Draft Release

.github/main-sync.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "repository": "MemTensor/memmy-agent",
+  "targets": [
+    "v1.2.5",
+    "v1.2.6",
+    "v1.2.7"
+  ],
+  "maxRounds": 6,
+  "maxNoProgress": 2,
+  "maxDurationMinutes": 180
+}

.github/workflows/github-draft-release-v2.yml

@@ -4,8 +4,8 @@ on:
   # Use the base repository's trusted workflow and admit only its canonical
   # release branches in the job guard below.
   pull_request_target:
-    types: [closed]
-    branches: [main]
+    types: [ closed ]
+    branches: [ main ]
   workflow_dispatch:
     inputs:
       version:
@@ -37,8 +37,7 @@ permissions:
 jobs:
   release:
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
+      github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true &&
        github.event.pull_request.head.repo.full_name == github.repository &&
        startsWith(github.event.pull_request.head.ref, 'release/v'))
     concurrency:
@@ -937,6 +936,31 @@ jobs:
             exit 1
           fi
           trap - EXIT
+      - name: Verify completed draft for synchronization
+        id: sync-source
+        if: ${{ steps.release.outputs.create_draft == 'true' }}
+        env:
+          SYNC_TAG: ${{ steps.release.outputs.tag }}
+          SYNC_SOURCE_SHA: ${{ steps.release.outputs.target_sha }}
+          SYNC_CONTROLLER_SHA: ${{ github.workflow_sha }}
+          SYNC_ASSET_DIR: release-assets
+          MAIN_SYNC_REQUEST_PATH: ${{ runner.temp }}/memmy-main-sync-request/main-sync-request.json
+          SYNC_RELEASE_PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+        run: |-
+          set -euo pipefail
+          # Separate from upload cleanup: sync failure never deletes a complete Draft.
+          controller="$RUNNER_TEMP/main-sync-controller"
+          mkdir -p "$controller"
+          git archive "$SYNC_CONTROLLER_SHA" scripts/main-sync .github/main-sync.json | tar -x -C "$controller"
+          node "$controller/scripts/main-sync/cli.mjs" signal
+      - name: Publish CodingAgent synchronization request
+        if: ${{ steps.sync-source.outputs.sync_ready == 'true' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: memmy-main-sync-request-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/memmy-main-sync-request/main-sync-request.json
+          if-no-files-found: error
+          retention-days: 30
 
       - name: Record the manual publish boundary
         if: ${{ steps.release.outputs.create_draft == 'true' }}
@@ -975,3 +999,7 @@ jobs:
             fi
             echo "- Set create_draft=true only when intentionally creating a Draft Release."
           } >> "$GITHUB_STEP_SUMMARY"
+    outputs:
+      sync_ready: ${{ steps.sync-source.outputs.sync_ready }}
+      sync_release_id: ${{ steps.sync-source.outputs.release_id }}
+      sync_source_sha: ${{ steps.sync-source.outputs.source_sha }}

.github/workflows/main-sync-validation.yml

@@ -0,0 +1,143 @@
+name: Validate managed main synchronization
+run-name: Main sync validation ${{ inputs.source_sha }} ${{ inputs.validation_key }}
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Managed synchronization PR number
+        required: true
+        type: string
+      source_sha:
+        description: Exact current PR head
+        required: true
+        type: string
+      base_sha:
+        description: Exact maintained target head
+        required: true
+        type: string
+      validation_key:
+        description: Scheduler-owned snapshot/generation identity
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+jobs:
+  source:
+    name: Main sync source
+    if: ${{ github.repository == 'MemTensor/memmy-agent' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      head: ${{ steps.source.outputs.head }}
+      base: ${{ steps.source.outputs.base }}
+      pr: ${{ steps.source.outputs.pr }}
+      validation_key: ${{ steps.source.outputs.validation_key }}
+      head_repository: ${{ steps.source.outputs.head_repository }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.workflow_sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - id: source
+        name: Verify authoritative current candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SYNC_CANDIDATE_SHA: ${{ inputs.source_sha }}
+          SYNC_BASE_SHA: ${{ inputs.base_sha }}
+          SYNC_PR_NUMBER: ${{ inputs.pr_number }}
+          SYNC_VALIDATION_KEY: ${{ inputs.validation_key }}
+        run: node scripts/main-sync/validate-source.mjs
+  linux:
+    name: Main sync Linux
+    needs: source
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      MEMMY_LEGAL_CN_BASE_URL: https://memmy.cn
+      MEMMY_LEGAL_INTL_BASE_URL: https://memmy.bot
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ needs.source.outputs.head_repository }}
+          ref: ${{ needs.source.outputs.head }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install declared workspace and Agent dependencies
+        run: |-
+          npm ci
+          npm ci --prefix App/memmy-agent
+      - name: Build declared workspaces and Agent
+        run: |-
+          npm run build
+          npm --prefix App/memmy-agent run build
+      - name: Run repository lint and type checks
+        run: |-
+          npm run version:check
+          npm run lint
+          npm run typecheck
+          npm --prefix App/memmy-agent run typecheck
+      - name: Run full repository and standalone Agent suites
+        run: |-
+          npm test
+          npm --prefix App/memmy-agent test
+      - name: Run public critical smoke plans
+        run: |-
+          npm run smoke:memory-layer:test
+          npm run smoke:local-agent-memory:test
+      - name: Require unchanged verified source
+        env:
+          EXPECTED_SOURCE: ${{ needs.source.outputs.head }}
+        run: |-
+          test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE"
+          test -z "$(git status --porcelain --untracked-files=all)"
+  windows:
+    name: Main sync Windows
+    needs: source
+    uses: MemTensor/memmy-agent/.github/workflows/windows-computer-history-validation.yml@main
+    permissions:
+      contents: read
+    with:
+      source_sha: ${{ needs.source.outputs.head }}
+      source_repository: ${{ needs.source.outputs.head_repository }}
+  record:
+    name: Main sync record
+    needs:
+      - source
+      - linux
+      - windows
+    if: ${{ always() && needs.source.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Record provider outcomes for the exact snapshot
+        shell: node {0}
+        env:
+          SOURCE_SHA: ${{ needs.source.outputs.head }}
+          BASE_SHA: ${{ needs.source.outputs.base }}
+          PR_NUMBER: ${{ needs.source.outputs.pr }}
+          VALIDATION_KEY: ${{ needs.source.outputs.validation_key }}
+          CONTROLLER_SHA: ${{ github.workflow_sha }}
+          PROVIDER_RUN_ID: ${{ github.run_id }}
+          PROVIDER_ATTEMPT: ${{ github.run_attempt }}
+          JOB_RESULTS: ${{ toJSON(needs) }}
+        run: |-
+          const fs=require('node:fs');const path=require('node:path');
+          const results=JSON.parse(process.env.JOB_RESULTS);
+          const jobs=Object.fromEntries(['source','linux','windows'].map(name=>[name,results[name].result]));
+          const proof={schemaVersion:1,headSha:process.env.SOURCE_SHA,baseSha:process.env.BASE_SHA,prNumber:Number(process.env.PR_NUMBER),validationKey:process.env.VALIDATION_KEY,controllerSha:process.env.CONTROLLER_SHA,runId:process.env.PROVIDER_RUN_ID,runAttempt:Number(process.env.PROVIDER_ATTEMPT),jobs,passed:Object.values(jobs).every(value=>value==='success'),diagnostics:JSON.stringify(jobs)};
+          const directory=path.join(process.env.RUNNER_TEMP,'main-sync-validation');fs.mkdirSync(directory,{recursive:true});
+          fs.writeFileSync(path.join(directory,'main-sync-validation.json'),JSON.stringify(proof,null,2)+'\n');
+      - uses: actions/upload-artifact@v4
+        with:
+          name: memmy-main-sync-validation-${{ inputs.validation_key }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/main-sync-validation/main-sync-validation.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/main-sync.yml

@@ -0,0 +1,41 @@
+name: Recover CodingAgent main synchronization request
+on:
+  workflow_dispatch:
+    inputs:
+      release_id:
+        description: Existing stable Release database ID
+        required: true
+        type: string
+      source_sha:
+        description: Exact main commit recorded by that Release
+        required: true
+        type: string
+permissions:
+  contents: read
+  actions: read
+jobs:
+  request:
+    if: ${{ github.repository == 'MemTensor/memmy-agent' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.workflow_sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Read authoritative release facts and seal a recovery request
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SYNC_RELEASE_ID: ${{ inputs.release_id }}
+          SYNC_SOURCE_SHA: ${{ inputs.source_sha }}
+          MAIN_SYNC_REQUEST_PATH: ${{ runner.temp }}/memmy-main-sync-request/main-sync-request.json
+        run: node scripts/main-sync/cli.mjs recover
+      - uses: actions/upload-artifact@v4
+        with:
+          name: memmy-main-sync-request-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/memmy-main-sync-request/main-sync-request.json
+          if-no-files-found: error
+          retention-days: 30