Felix FaerberandClaude Opus 4.8
9840c2a860
Per maintainer: @qa must never change code — it only accepts a PR or sends it back to the dev with precise instructions. Replaces the halt-on-any-problem behavior with a bounce loop: - QA prompt: emit MERGE_PR (approve), or `BOUNCE: @<dev>` after spelling out exactly what to change. HALT_AUTOPILOT is now only for problems a dev can't fix (needs a human decision). - publish.sh: on BOUNCE, re-trigger the named dev (via AGENT_TOKEN) with "autopilot fix attempt N/3". Count prior attempts from the PR thread; at 3 it stops (removes the label) and hands to @ffaerber. - publish.sh: after a dev pushes a fix (resume), auto-re-trigger @qa to re-verify — closing the loop (dev fix -> qa re-check -> merge or bounce again). - Updated the initial @qa trigger wording (bounce, not halt). Verified: BOUNCE target parsing and the 3-strike counter (attempts 1/3,2/3,3/3 then HALT). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
297 lines
17 KiB
Bash
Executable File
297 lines
17 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Publish — PR (dev agents) or comment (pm/qa), always reply in the issue.
|
|
#
|
|
# Required env (provided by the workflow step):
|
|
# GT AGENT_TOKEN TOKEN_PM TOKEN_SENIOR TOKEN_JUNIOR TOKEN_LEAD TOKEN_QA
|
|
# NAME MODE NUM TITLE BRANCH NEW GITHUB_SERVER_URL GITHUB_REPOSITORY
|
|
# IS_PR AUTOPILOT ISSNUM (autopilot: @qa label-gated merge/halt + auto-trigger @qa on a fresh PR)
|
|
set +e # publish is best-effort: a grep-no-match / curl non-zero must NOT kill the step
|
|
# Post/PR as the agent's OWN Gitea user when its token is configured; else the built-in bot.
|
|
case "$NAME" in
|
|
pm) TOK="$TOKEN_PM";; senior) TOK="$TOKEN_SENIOR";; junior) TOK="$TOKEN_JUNIOR";;
|
|
lead) TOK="$TOKEN_LEAD";; qa) TOK="$TOKEN_QA";; *) TOK="";;
|
|
esac
|
|
[ -z "$TOK" ] && TOK="$GT"
|
|
git config user.name "$NAME"
|
|
git config user.email "$NAME@ffaerber.duckdns.org"
|
|
API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
|
|
hdr=(-H "Authorization: token $TOK" -H "Content-Type: application/json")
|
|
post() { curl -sS -w 'comment -> HTTP %{http_code}\n' -X POST "${hdr[@]}" \
|
|
"$API/issues/$NUM/comments" -d "$(jq -nc --arg b "$1" '{body:$b}')"; }
|
|
# Remove the 'autopilot' label from an issue by resolving its ID first (Gitea's DELETE label
|
|
# endpoint is by ID, not name). Arg $1 = issue number. Used as the autopilot kill switch.
|
|
del_autopilot_label() {
|
|
local iss="$1" lid
|
|
lid=$(curl -sS "${hdr[@]}" "$API/issues/$iss/labels" 2>/dev/null \
|
|
| jq -r 'if type=="array" then ([.[]|select(.name=="autopilot")][0].id // empty) else empty end')
|
|
if [ -n "$lid" ]; then
|
|
curl -sS -X DELETE "${hdr[@]}" "$API/issues/$iss/labels/$lid" \
|
|
-w '\nunlabel -> HTTP %{http_code}\n' || true
|
|
else
|
|
echo "no 'autopilot' label found on #$iss to remove"
|
|
fi
|
|
}
|
|
|
|
# drop machine-readable markers: DELEGATE / CLOSE_ISSUE / MERGE_PR / HALT_AUTOPILOT, and the
|
|
# BEGIN_SUBTASKS..END_SUBTASKS and BEGIN_PR_DESCRIPTION..END_PR_DESCRIPTION blocks (the PR
|
|
# description is published separately).
|
|
reply=$(awk '
|
|
/^[[:space:]]*BEGIN_SUBTASKS/{s=1}
|
|
/^[[:space:]]*BEGIN_PR_DESCRIPTION/{p=1}
|
|
/^[[:space:]]*DELEGATE:[[:space:]]*@/{next}
|
|
/^[[:space:]]*CLOSE_ISSUE[[:space:]]*$/{next}
|
|
/^[[:space:]]*MERGE_PR[[:space:]]*$/{next}
|
|
/^[[:space:]]*HALT_AUTOPILOT[[:space:]]*$/{next}
|
|
/^[[:space:]]*BOUNCE:[[:space:]]*@/{next}
|
|
s{ if(/^[[:space:]]*END_SUBTASKS/){s=0}; next }
|
|
p{ if(/^[[:space:]]*END_PR_DESCRIPTION/){p=0}; next }
|
|
{print}
|
|
' /tmp/agent_out.md 2>/dev/null)
|
|
# Strip a leading self-header the model sometimes emits ("🤖 **@pm**" on its own line) so we don't
|
|
# double it when we prepend our own. Removes a leading run of such header lines and blank lines.
|
|
reply=$(printf '%s' "$reply" | awk '
|
|
BEGIN{s=1}
|
|
s && /^[^A-Za-z0-9]*\*\*@[A-Za-z]+\*\*[[:space:]]*$/ {next}
|
|
s && /^[[:space:]]*$/ {next}
|
|
{s=0; print}
|
|
')
|
|
[ -z "$reply" ] && reply="_(Made changes without a text summary — see the diff below.)_"
|
|
# Prefer the agent's clean delimited PR description; fall back to the whole reply.
|
|
prdesc=$(awk '/BEGIN_PR_DESCRIPTION/{f=1;next} /END_PR_DESCRIPTION/{f=0} f' /tmp/agent_out.md)
|
|
[ -z "$prdesc" ] && prdesc="$reply"
|
|
|
|
# comment-only roles (pm/qa): never change files
|
|
if [ "$MODE" != "pr" ]; then
|
|
git checkout -- . 2>/dev/null || true
|
|
git clean -fd 2>/dev/null || true
|
|
target=$(grep -oiE 'DELEGATE:[[:space:]]*@(junior|senior|lead|qa)' /tmp/agent_out.md 2>/dev/null | head -1 | grep -oiE '(junior|senior|lead|qa)' | tr '[:upper:]' '[:lower:]')
|
|
# Visible comment: the reply text, or a sensible line if the agent only emitted a marker.
|
|
msg="$reply"
|
|
case "$msg" in ""|"_(Made changes"*) msg=$([ -n "$target" ] && echo "Handing off to @$target." || echo "_(no further comment)_") ;; esac
|
|
# Close the issue if the agent flagged it (maintainer said it's not needed / duplicate).
|
|
if grep -qiE '^[[:space:]]*CLOSE_ISSUE[[:space:]]*$' /tmp/agent_out.md; then
|
|
echo "closing issue #$NUM"
|
|
curl -sS -X PATCH "${hdr[@]}" "$API/issues/$NUM" \
|
|
-d '{"state":"closed"}' -w '\nclose -> HTTP %{http_code}\n' || true
|
|
fi
|
|
# BREAKDOWN: from a BEGIN_SUBTASKS block, create a milestone + one sub-issue per line
|
|
# (linked to this issue). Sub-issues are NOT auto-started — maintainer mentions agents later.
|
|
# Process subtasks first so we can append the created-issues list to the SAME comment as
|
|
# the reply (issue #38 — one comment per run).
|
|
subtext=""
|
|
if grep -qiE '^[[:space:]]*BEGIN_SUBTASKS' /tmp/agent_out.md; then
|
|
block=$(awk '/^[[:space:]]*BEGIN_SUBTASKS/{f=1;next} /^[[:space:]]*END_SUBTASKS/{f=0} f' /tmp/agent_out.md)
|
|
ms=$(printf '%s\n' "$block" | sed -nE 's/^[[:space:]]*milestone:[[:space:]]*//Ip' | head -1)
|
|
msid=""
|
|
if [ -n "$ms" ]; then
|
|
msid=$(curl -sS "${hdr[@]}" "$API/milestones?state=open&limit=100" | jq -r --arg t "$ms" 'if type=="array" then ([.[]|select(.title==$t)][0].id // empty) else empty end')
|
|
[ -z "$msid" ] && msid=$(curl -sS -X POST "${hdr[@]}" "$API/milestones" -d "$(jq -nc --arg t "$ms" '{title:$t}')" | jq -r '.id // empty')
|
|
echo "milestone '$ms' -> id ${msid:-?}"
|
|
fi
|
|
printf '%s\n' "$block" | grep -E '^[[:space:]]*-[[:space:]]' > /tmp/subtasks.txt || true
|
|
links=""
|
|
while IFS= read -r line; do
|
|
item=$(printf '%s' "$line" | sed -E 's/^[[:space:]]*-[[:space:]]*//')
|
|
title=${item%%::*}; body=${item#*::}; [ "$body" = "$item" ] && body=""
|
|
title=$(printf '%s' "$title" | sed -E 's/[[:space:]]*$//')
|
|
body=$(printf '%s' "$body" | sed -E 's/^[[:space:]]*//')
|
|
[ -z "$title" ] && continue
|
|
ibody=$(printf 'Part of #%s\n\n%s' "$NUM" "$body")
|
|
if [ -n "$msid" ]; then
|
|
payload=$(jq -nc --arg t "$title" --arg b "$ibody" --argjson m "$msid" '{title:$t,body:$b,milestone:$m}')
|
|
else
|
|
payload=$(jq -nc --arg t "$title" --arg b "$ibody" '{title:$t,body:$b}')
|
|
fi
|
|
n=$(curl -sS -X POST "${hdr[@]}" "$API/issues" -d "$payload" | jq -r '.number // empty')
|
|
echo "created sub-issue #${n:-?}: $title"
|
|
[ -n "$n" ] && links="$links\n- #$n — $title"
|
|
done < /tmp/subtasks.txt
|
|
subtext=$(printf '\n\n---\n🤖 **@%s** — created sub-issues%s (mention an agent on each when ready):%b' "$NAME" "${ms:+ under milestone **$ms**}" "$links")
|
|
fi
|
|
post "$(printf '🤖 **@%s**\n\n%s%s' "$NAME" "$msg" "$subtext")"
|
|
|
|
# --- AUTOPILOT: @qa's narrow, label-gated merge / halt authority ---
|
|
# Only @qa, only when 'autopilot' is set, and only on a PR thread. The MERGE_PR / HALT_AUTOPILOT
|
|
# markers come from the QA prompt. Merge + label ops use TOKEN_QA (the QA user's PAT, which the
|
|
# maintainer must grant write+merge scope). ISSNUM is the origin issue (resolved from the branch).
|
|
if [ "$NAME" = "qa" ] && [ "$AUTOPILOT" = "true" ]; then
|
|
if grep -qiE '^[[:space:]]*MERGE_PR[[:space:]]*$' /tmp/agent_out.md; then
|
|
if [ -z "$IS_PR" ]; then
|
|
echo "MERGE_PR marker but this run is not on a PR thread — skipping merge"
|
|
else
|
|
echo "@qa autopilot: merging PR #$NUM (origin issue #${ISSNUM:-$NUM})"
|
|
mc=$(curl -sS -o /tmp/merge_resp.txt -w '%{http_code}' -X POST "${hdr[@]}" \
|
|
"$API/pulls/$NUM/merge" -d '{"Do":"merge"}')
|
|
echo "merge -> HTTP $mc"; cat /tmp/merge_resp.txt 2>/dev/null || true
|
|
case "$mc" in
|
|
200|201|204)
|
|
echo "closing origin issue #${ISSNUM:-$NUM}"
|
|
curl -sS -X PATCH "${hdr[@]}" "$API/issues/${ISSNUM:-$NUM}" \
|
|
-d '{"state":"closed"}' -w '\nclose -> HTTP %{http_code}\n' || true
|
|
post "$(printf '🤖 **@qa** — ✅ verified & merged PR #%s (autopilot). Closed issue #%s.' "$NUM" "${ISSNUM:-$NUM}")"
|
|
;;
|
|
*)
|
|
# Merge failed (checks not green, conflicts, or TOKEN_QA lacks merge scope) — do NOT
|
|
# silently proceed: drop the label so it reverts to human control and report.
|
|
del_autopilot_label "${ISSNUM:-$NUM}"
|
|
post "$(printf '🤖 **@qa** — ⚠️ tried to merge PR #%s but the API returned HTTP %s (checks not green, a conflict, or missing merge permission on TOKEN_QA). Removed the `autopilot` label — @ffaerber please take a look.' "$NUM" "$mc")"
|
|
;;
|
|
esac
|
|
fi
|
|
elif grep -qiE '^[[:space:]]*BOUNCE:[[:space:]]*@(junior|senior|lead)' /tmp/agent_out.md; then
|
|
# @qa wants the dev to fix something. Send it back — never fix it ourselves. After 3 bounces,
|
|
# stop and hand to the human. QA's feedback is already posted (the reply comment above).
|
|
if [ -z "$IS_PR" ]; then
|
|
echo "BOUNCE marker but this run is not on a PR thread — skipping"
|
|
else
|
|
target=$(grep -oiE 'BOUNCE:[[:space:]]*@(junior|senior|lead)' /tmp/agent_out.md | head -1 \
|
|
| grep -oiE '(junior|senior|lead)' | tr '[:upper:]' '[:lower:]')
|
|
[ -z "$target" ] && target=$(curl -sS "${hdr[@]}" "$API/pulls/$NUM" | jq -r '.user.login // "junior"')
|
|
# Count how many times this PR has already been bounced (marker in the trigger comment).
|
|
prior=$(curl -sS "${hdr[@]}" "$API/issues/$NUM/comments?limit=100" \
|
|
| jq -r 'if type=="array" then [.[]|select(.body|test("autopilot fix attempt"))]|length else 0 end' 2>/dev/null)
|
|
prior=${prior:-0}
|
|
if [ "$prior" -ge 3 ]; then
|
|
echo "@qa autopilot: 3 bounces already — halting"
|
|
del_autopilot_label "${ISSNUM:-$NUM}"
|
|
post "$(printf '🤖 **@qa** — 🛑 still not right after 3 fix attempts. Stopping autopilot (removed the `autopilot` label). @ffaerber please take over — details in the comments above.')"
|
|
else
|
|
n=$((prior + 1))
|
|
echo "@qa autopilot: bounce $n/3 -> @$target"
|
|
curl -sS -X POST -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \
|
|
"$API/issues/$NUM/comments" \
|
|
-d "$(jq -nc --arg b "@$target please address @qa's feedback above and update this PR (autopilot fix attempt $n/3)." '{body:$b}')" \
|
|
-w '\nbounce -> HTTP %{http_code}\n' || true
|
|
fi
|
|
fi
|
|
elif grep -qiE '^[[:space:]]*HALT_AUTOPILOT[[:space:]]*$' /tmp/agent_out.md; then
|
|
echo "@qa autopilot: HALT — removing 'autopilot' label from #${ISSNUM:-$NUM}"
|
|
del_autopilot_label "${ISSNUM:-$NUM}"
|
|
post "$(printf '🤖 **@qa** — 🛑 this needs a human decision (not a dev fix). Removed the `autopilot` label (back to human control). @ffaerber please decide next steps (details above).')"
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
# Auto-delegate: if the plan names a teammate, trigger them via AGENT_TOKEN (a PAT, so it
|
|
# fires a new workflow run — the built-in token cannot). Never targets @pm or self, so the
|
|
# chain always terminates at a dev. The '🤖' guard on the trigger stops status-comment loops.
|
|
if [ -n "$AGENT_TOKEN" ]; then
|
|
# Only delegate on an explicit "DELEGATE: @<agent>" line — never on a prose mention,
|
|
# so an agent that is asking the maintainer a question does not hand off prematurely.
|
|
target=$(grep -oiE 'DELEGATE:[[:space:]]*@(junior|senior|lead|qa)' /tmp/agent_out.md 2>/dev/null \
|
|
| head -1 | grep -oiE '(junior|senior|lead|qa)' | tr '[:upper:]' '[:lower:]')
|
|
if [ -n "$target" ] && [ "$target" != "$NAME" ]; then
|
|
echo "auto-delegating to @$target"
|
|
curl -sS -X POST -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \
|
|
"$API/issues/$NUM/comments" \
|
|
-d "$(jq -nc --arg b "@$target please proceed with issue #$NUM per the plan above (delegated by $NAME)." '{body:$b}')" \
|
|
-w '\ndelegate -> HTTP %{http_code}\n' || true
|
|
else
|
|
echo "no DELEGATE marker — not delegating (agent is asking or finished)"
|
|
fi
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
# Scrub the runtime scripts checkout (.agents-workflow) from the tree so it never lands in a
|
|
# commit/PR and never confuses the git ops below (issue #33). The scripts we run live outside the
|
|
# workspace ($SCRIPTS -> runner.temp), so removing this in-tree copy is always safe. Handle every
|
|
# way an agent might have left it: untracked dir, tracked files, or a committed gitlink/submodule.
|
|
if git ls-files --error-unmatch .agents-workflow >/dev/null 2>&1 || \
|
|
[ -n "$(git ls-files .agents-workflow 2>/dev/null)" ]; then
|
|
git rm -r --cached --quiet --ignore-unmatch .agents-workflow 2>/dev/null || true
|
|
fi
|
|
git config -f .gitmodules --remove-section submodule..agents-workflow 2>/dev/null || true
|
|
[ -s .gitmodules ] || rm -f .gitmodules 2>/dev/null || true
|
|
rm -rf .agents-workflow 2>/dev/null || true
|
|
|
|
# The agent may have committed on the starting branch AND/OR created extra
|
|
# ai/issue-N-<slug> branches. Commit any leftover on the current branch, push it, then
|
|
# open a PR for EVERY ai/issue-N* branch that has commits beyond main.
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
git add -A
|
|
git commit -m "@$NAME: issue #$NUM"
|
|
fi
|
|
git push origin "HEAD:$BRANCH" || true
|
|
git fetch -q origin 2>/dev/null || true
|
|
|
|
prbody=$(printf '%s\n\n---\nResolves #%s · 🤖 @%s' "$prdesc" "$NUM" "$NAME")
|
|
owner=${GITHUB_REPOSITORY%%/*}
|
|
|
|
# Post the agent's activity trail (tool calls + reasoning) inline in the same comment so
|
|
# each run produces exactly ONE comment (issue #38). Computed once here so every dev-agent
|
|
# exit path (no-changes, PR-open-failed, normal) appends it to the single reply comment.
|
|
activity=""
|
|
if [ -s /tmp/activity_log.md ]; then
|
|
entries=$(wc -l < /tmp/activity_log.md 2>/dev/null || echo 0)
|
|
log=$(cat /tmp/activity_log.md)
|
|
activity=$(printf '\n\n<details>\n<summary>🔧 activity — %s tool calls</summary>\n\n%s\n\n</details>' "$entries" "$log")
|
|
fi
|
|
|
|
# One PR per run: publish ONLY this run's own branch ($BRANCH), never sibling
|
|
# ai/issue-N-* branches. This removes the multi-PR ambiguity that left the
|
|
# activity log stranded on the triggering issue instead of the PR thread.
|
|
br="$BRANCH"
|
|
ahead=$(git rev-list --count "origin/main..origin/$br" 2>/dev/null || echo 0)
|
|
if [ "${ahead:-0}" -eq 0 ]; then
|
|
# No changes on this branch — a plan / questions / analysis only.
|
|
post "$(printf '🤖 **@%s**\n\n%s%s' "$NAME" "$reply" "$activity")"
|
|
exit 0
|
|
fi
|
|
|
|
# NOTE: Gitea ignores the ?head= filter, so match the head branch client-side.
|
|
resp=$(curl -sS "${hdr[@]}" "$API/pulls?state=open&limit=50" \
|
|
| jq -r --arg br "$br" 'if type=="array" then (map(select(.head.ref==$br)) | .[0] // empty) else empty end' 2>/dev/null)
|
|
url=$(printf '%s' "$resp" | jq -r '.html_url // empty' 2>/dev/null)
|
|
prnum=$(printf '%s' "$resp" | jq -r '.number // empty' 2>/dev/null)
|
|
if [ -z "$url" ]; then
|
|
title="@$NAME: $TITLE"
|
|
resp=$(curl -sS -X POST "${hdr[@]}" "$API/pulls" \
|
|
-d "$(jq -nc --arg t "$title" --arg h "$br" --arg b "$prbody" \
|
|
'{title:$t, head:$h, base:"main", body:$b}')")
|
|
echo "PR create ($br): $resp"
|
|
url=$(printf '%s' "$resp" | jq -r '.html_url // empty' 2>/dev/null)
|
|
prnum=$(printf '%s' "$resp" | jq -r '.number // empty' 2>/dev/null)
|
|
fi
|
|
[ -z "$url" ] && { echo "PR open/lookup failed for $br — posting reply on issue instead"; post "$(printf '🤖 **@%s**\n\n%s%s' "$NAME" "$reply" "$activity")"; exit 0; }
|
|
|
|
# Posts to the PR thread when we have a PR number, else to the origin issue ($NUM).
|
|
prpost() {
|
|
local n="$1"; shift; local t="$NUM"
|
|
[ -n "$n" ] && [ "$n" != "$NUM" ] && t="$n"
|
|
echo "posting to #$t"
|
|
curl -sS -w 'comment -> HTTP %{http_code}\n' -X POST "${hdr[@]}" \
|
|
"$API/issues/$t/comments" -d "$(jq -nc --arg b "$1" '{body:$b}')"
|
|
}
|
|
|
|
if [ "$NEW" = "true" ]; then
|
|
prpost "$prnum" "$(printf '🤖 **@%s** — ✅ PR ready for review — @ffaerber please review & merge:\n- %s%s' "$NAME" "$url" "$activity")"
|
|
# AUTOPILOT: hand the fresh PR to @qa automatically (via AGENT_TOKEN, so it fires a new run).
|
|
# @qa then verifies and — if green — merges + closes via its MERGE_PR marker. The comment lands
|
|
# on the PR thread ($prnum) so the next run resolves the origin issue's label from the branch
|
|
# name. The '🤖' guard on the trigger gate stops status-comment loops.
|
|
if [ "$AUTOPILOT" = "true" ] && [ -n "$AGENT_TOKEN" ] && [ -n "$prnum" ]; then
|
|
echo "autopilot: auto-triggering @qa to review PR #$prnum"
|
|
curl -sS -X POST -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \
|
|
"$API/issues/$prnum/comments" \
|
|
-d "$(jq -nc --arg b "@qa please verify this PR (autopilot: issue #$NUM is labeled autopilot). Merge it if correct, or bounce it back to the dev with exactly what needs fixing." '{body:$b}')" \
|
|
-w '\ntrigger-qa -> HTTP %{http_code}\n' || true
|
|
fi
|
|
else
|
|
# Resume: just link the PR — its body and the diff already carry the description, so we don't
|
|
# repeat the full write-up in the comment (the reasoning trail below shows what this run did).
|
|
prpost "$prnum" "$(printf '🤖 **@%s** — pushed an update to the PR:\n- %s%s' "$NAME" "$url" "$activity")"
|
|
# AUTOPILOT: after a dev pushes a fix (e.g. following a @qa bounce), hand back to @qa to re-verify.
|
|
if [ "$AUTOPILOT" = "true" ] && [ -n "$AGENT_TOKEN" ] && [ -n "$prnum" ]; then
|
|
case "$NAME" in
|
|
junior|senior|lead)
|
|
echo "autopilot: dev pushed a fix — re-triggering @qa to re-verify PR #$prnum"
|
|
curl -sS -X POST -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \
|
|
"$API/issues/$prnum/comments" \
|
|
-d "$(jq -nc --arg b "@qa please re-verify this PR (autopilot). Merge it if now correct, or bounce it back with exactly what still needs fixing." '{body:$b}')" \
|
|
-w '\ntrigger-qa -> HTTP %{http_code}\n' || true
|
|
;;
|
|
esac
|
|
fi
|
|
fi
|