11# gh-agentic-workflows
22
3- A minimal, standalone demonstration of a fully autonomous issue → draft PR → review →
4- fix → merge pipeline built on [ gh-aw ] ( https://github.com/github/gh-aw ) ( GitHub Agentic
5- Workflows ).
3+ [ GitHub Agentic Workflows ] ( https://github.com/github/gh-aw ) is generic tooling
4+ that compiles markdown defining agent tasks into GitHub Actions. It is very flexible,
5+ not defining any specific workflow (though there are reference examples upstream ).
66
7- GH-AW, like the underlying raw Github Actions is a very flexible system, this
8- demonstrates one possible pipeline.
7+ This repository serves as a place for workflows deployed in the bootc-dev GitHub
8+ organization.
9+
10+ There is a collection of things like CI failure analysis, as well as a full
11+ "issue to PR" style flow.
912
1013## Reusing this pipeline in your own repo
1114
@@ -27,95 +30,17 @@ than hardcoding it, so before anything will actually trigger you still need to:
2730
2831See "Repository setup checklist" below for the full details on each of these steps.
2932
30- ## How it works
31-
32- Four stages, each a separate workflow:
33-
34- ```
35- issue labeled pull_request label: agent/fixme label: agent/lgtm
36- 'agent/code' opened/synchronize (pull_request labeled) (pull_request labeled)
37- │ │ │ │
38- ▼ ▼ ▼ ▼
39- drafter.md ──opens PR──▶ review.md ──labels──▶ fix.md ──pushes──▶ (back to review.md)
40- (gh-aw agent) (gh-aw agent) (gh-aw agent)
41- │
42- └──labels 'agent/lgtm'──▶ merge.yml
43- (plain Actions workflow)
44- ```
33+ ## Overview
4534
46- - ** ` drafter.md ` ** — triggers when an issue is labeled ` agent/code ` . Reads the issue,
47- implements the change, validates it with whatever the repo provides, and opens a
48- ** draft** pull request on an ` agent/* ` branch via gh-aw's ` create-pull-request `
49- safe-output.
50- - ** ` review.md ` ** — triggers on ` pull_request: [opened, synchronize] ` for ` agent/* `
51- branches. Reviews the diff, posts a ` COMMENT ` review with concrete feedback, and
52- applies exactly one of ` agent/fixme ` (needs work) or ` agent/lgtm ` (ready to merge), removing
53- the other if present.
54- - ** ` fix.md ` ** — triggers on the ` agent/fixme ` label. Consumes the label (removes it so it
55- can't retrigger itself), reads the reviewer's feedback from the PR's reviews, pushes a
56- fix commit to the same branch via ` push-to-pull-request-branch ` , and stops. Pushing a
57- new commit fires ` review.md ` again, closing the loop. An iteration cap stops the loop
58- after 2 automated fix attempts and posts a PR comment asking a human to take over
59- instead of silently doing nothing — see "Troubleshooting and operations" below.
60- - ** ` merge.yml ` ** — triggers on the ` agent/lgtm ` label. A deliberately plain, non-gh-aw
61- Actions workflow: merging is mechanical once the reviewer has already made the
62- judgment call, so no LLM is involved. Marks the draft PR ready, squash-merges it, and
63- deletes the branch.
64-
65- ## Merge queue failure analyzer
66-
67- ` queue-triage.md ` is a fifth workflow, separate from the four-stage pipeline above. It's
68- for repos that use GitHub's merge queue and want an agent to triage merge-group CI
69- failures instead of having humans read logs every time a flaky test kicks a PR out of the
70- queue. It ships in this package but is inert until you name your CI workflow and create a
71- tracker issue.
72-
73- - ** Trigger:** ` workflow_run ` completion of a named CI workflow (default: ` "CI" ` ) on
74- ` gh-readonly-queue/** ` branches, gated to runs with ` conclusion == 'failure' ` and
75- ` event == 'merge_group' ` . Also accepts ` workflow_dispatch ` with a ` run_id ` input.
76- - ** Pre-fetch:** Downloads failed job logs, greps for error indicators, and resolves
77- affected PRs deterministically before the agent starts, so it works from small hint
78- files rather than raw logs.
79- - ** Classification:** Analyzes each failure as ` flake ` (environmental/transient — a
80- re-run would plausibly pass), ` real ` (this PR's change broke it), or ` unclear `
81- (deterministic but not this PR's fault — re-queueing won't help). Comments on each
82- verified PR with the verdict and a recommendation.
83- - ** Flake ledger:** Maintains a deduplicated ledger of known flake signatures on a
84- human-created tracker issue (labeled ` agent/flake-tracker ` ). Posts a narrative comment
85- only the first time a given signature appears.
86- - ** Constraints:** Never re-queues PRs or creates the tracker issue itself — both are
87- deliberately left to humans.
88-
89- See ` .github/workflows/queue-triage.md ` for the full prompt and workflow details.
90-
91- ## PR CI failure analyzer
92-
93- ` ci-triage.md ` is a sixth, similarly standalone workflow: the same idea as
94- ` queue-triage.md ` , but for CI failures on regular pull requests instead of
95- merge-group runs. It's useful in two situations: it's the * only* automated failure
96- feedback a repo has while its merge queue is temporarily disabled (no ` merge_group `
97- events fire at all in that mode), and even with the queue active, it gives contributors
98- fast feedback on lint/validate-type failures without waiting for the merge queue to
99- re-verify everything from scratch.
100-
101- - ** Trigger:** ` workflow_run ` completion of the same named CI workflow (default: ` "CI" ` )
102- as ` queue-triage.md ` , gated to runs with ` conclusion == 'failure' ` and
103- ` event == 'pull_request' ` — the disjoint counterpart of ` queue-triage.md ` 's
104- ` event == 'merge_group' ` check, so the two workflows never double-process the same run.
105- Also accepts ` workflow_dispatch ` with a ` run_id ` input.
106- - ** Pre-fetch:** Downloads failed job logs and greps for error indicators, same as
107- ` queue-triage.md ` . Resolves the affected PR(s) via the commit-associated-PRs API
108- (works uniformly for same-repo and fork PRs) rather than parsing the branch name, and
109- verifies each candidate's head SHA still matches the analyzed commit before treating it
110- as safe to comment on — a PR that has since moved on to a newer push is reported as
111- stale and skipped, not commented on.
112- - ** Classification:** The same ` flake ` /` real ` /` unclear ` taxonomy as ` queue-triage.md ` .
113- Comments on each verified PR with the verdict and a recommendation.
114- - ** No ledger:** Unlike ` queue-triage.md ` , this workflow maintains no cross-PR tracker —
115- each comment stands on its own, and older comments from this workflow on the same PR
116- are automatically hidden as new ones are posted.
117-
118- See ` .github/workflows/ci-triage.md ` for the full prompt and workflow details.
35+ This repository provides reusable workflows. Its issue-to-PR pipeline drafts changes from
36+ an issue, iterates through review and fixes, and mechanically merges approved pull
37+ requests. Its CI failure analysis covers normal pull-request and merge-queue runs. The
38+ canonical authored workflow definitions are [ ` drafter.md ` ] ( .github/workflows/drafter.md ) ,
39+ [ ` review.md ` ] ( .github/workflows/review.md ) , [ ` fix.md ` ] ( .github/workflows/fix.md ) ,
40+ [ ` merge.yml ` ] ( .github/workflows/merge.yml ) ,
41+ [ ` ci-triage.md ` ] ( .github/workflows/ci-triage.md ) , and
42+ [ ` queue-triage.md ` ] ( .github/workflows/queue-triage.md ) . The ` .md ` files are the
43+ canonical gh-aw sources; their matching ` .lock.yml ` files are generated artifacts.
11944
12045## Design notes and gotchas
12146
@@ -289,8 +214,8 @@ now at least readable by the agent, but it was never the intended recovery path.
289214 ` agent/flake-tracker` (see "Letting the agent edit protected files" above). The three
290215 ` agent/*-working` labels just need to exist; their color is cosmetic (see "a per-workflow
291216 ` agent/*-working` label is added and removed via frontmatter `jobs:`" above).
292- ` agent/flake-tracker` is only needed if you're using the merge queue failure analyzer
293- (see "Merge queue failure analyzer " above).
217+ ` agent/flake-tracker` is only needed for merge- queue CI failure analysis (see
218+ " Overview " above).
294219
295220 The easiest way is to run the included install script via the **Install Labels** workflow
296221 in the Actions tab, or manually via :
@@ -316,8 +241,7 @@ now at least readable by the agent, but it was never the intended recovery path.
316241
317242 See [`scripts/README.md`](scripts/README.md) for more installation options.
3182432. Register a GitHub App to act as the pipeline's bot identity (this must be a real App,
319- not the default `GITHUB_TOKEN` — see "GITHUB_TOKEN doesn't retrigger workflows"
320- above) :
244+ not the default `GITHUB_TOKEN`, which cannot trigger subsequent workflows) :
321245 - Go to Settings → Developer settings → GitHub Apps → New GitHub App.
322246 - Grant repository permissions : Contents (Read & Write), Issues (Read & Write), Pull
323247 requests (Read & Write), Workflows (Read & Write). Metadata (Read) is auto-granted.
@@ -432,8 +356,8 @@ gap, expected to reach `agent/lgtm` on the first review).
432356
433357## Adapting to your project
434358
435- Copy `.github/workflows/{drafter,review,fix}.md` (+ their compiled `.lock. yml`
436- counterparts) and `merge. yml`.
359+ Copy `.github/workflows/{drafter,review,fix}.md` and `merge. yml`. Recompile the Markdown
360+ sources to generate their `.lock. yml` counterparts .
437361
438362Safe to edit: the prompt bodies under each `---` frontmatter block — the task
439363description, validation instructions, and review criteria are all plain English and
@@ -511,15 +435,8 @@ standard pipeline across `bootc-dev`'s other active repos. Roughly in order:
511435
512436## Files
513437
514- The pipeline lives entirely in
515- [`.github/workflows/drafter.md`](.github/workflows/drafter.md),
516- [`review.md`](.github/workflows/review.md), [`fix.md`](.github/workflows/fix.md), and
517- [`merge.yml`](.github/workflows/merge.yml) — see "How it works" above for what each does.
518- The two standalone triage add-ons live in
519- [`queue-triage.md`](.github/workflows/queue-triage.md) and
520- [`ci-triage.md`](.github/workflows/ci-triage.md) — see "Merge queue failure analyzer" and
521- "PR CI failure analyzer" above. The matching `*.lock.yml` files are gh-aw's compiled
522- output, checked in as generated artifacts.
438+ Workflow sources live under `.github/workflows/`; see "Overview" above for the canonical
439+ definitions. Matching `*.lock.yml` files are generated artifacts checked into the repo.
523440[`upgrade.yml`](.github/workflows/upgrade.yml) is a separate, plain maintenance workflow:
524441weekly, it self-upgrades the `gh-aw` CLI, refreshes `.github/aw/gh-aw-version` and
525442`.github/aw/actions-lock.json` to match, recompiles every `.md` workflow, and opens a PR
0 commit comments