micro--go-micro
Claude
4b61facf0d
Run Tests / Unit Tests (push) Has been cancelled
Harness (E2E) / Harnesses (mock LLM) (push) Has been cancelled
Harness (E2E) / Provider harnesses (live LLM conformance) (push) Has been cancelled
Lint / golangci-lint (push) Has been cancelled
govulncheck / govulncheck (push) Has been cancelled
Run Tests / Etcd Integration Tests (push) Has been cancelled
Comment out the automatic triggers on every loop workflow so the autonomous engine stops firing on its own while we land the current round of fixes 1:1: - planner / builder / coherence / security / release: drop the cron schedules (no more hourly/daily/weekly runs, no nightly auto-release). - triage: drop the workflow_run trigger so CI failures no longer auto-dispatch agent tasks. Each keeps workflow_dispatch, so any loop can still be run on demand, and re-enabling is just uncommenting the trigger. No prompts, tokens, or logic changed — only when the workflows fire. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
64 行
2.5 KiB
YAML
64 行
2.5 KiB
YAML
name: "Loop: Security"
|
|
|
|
# Generated by `micro loop init`. A dispatch role of the autonomous loop: on a
|
|
# cadence it opens a fresh tracking issue and posts the instruction in
|
|
# .github/loop/prompts/security.md to the agent (@codex).
|
|
#
|
|
# The workflow is the MECHANISM; that prompt file is the editable POLICY —
|
|
# change what this role does by editing the prompt, not this YAML. A FRESH
|
|
# issue per run is deliberate: agents derive the PR branch name from the
|
|
# triggering issue, so reusing one tracker collapses every run onto one branch.
|
|
#
|
|
# Gated on CODEX_TRIGGER_TOKEN: the agent ignores @mentions from the
|
|
# github-actions bot, so dispatch posts as a real user (a PAT). No token → no-op.
|
|
|
|
on:
|
|
workflow_dispatch: {}
|
|
# PAUSED 2026-07-12: automatic schedule disabled while the team does focused
|
|
# 1:1 fixes. Still runnable on demand via workflow_dispatch. Re-enable by
|
|
# uncommenting the schedule below.
|
|
# schedule:
|
|
# - cron: "0 6 * * 1"
|
|
|
|
permissions:
|
|
issues: write
|
|
|
|
concurrency:
|
|
group: loop-security
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
dispatch:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4 # needed to read the prompt file
|
|
- name: Dispatch security
|
|
env:
|
|
GH_TOKEN: ${{ secrets.CODEX_TRIGGER_TOKEN || github.token }}
|
|
HAS_TOKEN: ${{ secrets.CODEX_TRIGGER_TOKEN != '' }}
|
|
REPO: ${{ github.repository }}
|
|
RUN_NUMBER: ${{ github.run_number }}
|
|
run: |
|
|
if [ "$HAS_TOKEN" != "true" ]; then
|
|
echo "CODEX_TRIGGER_TOKEN is not set — skipping (the agent ignores bot @mentions)."
|
|
exit 0
|
|
fi
|
|
PROMPT=".github/loop/prompts/security.md"
|
|
if [ ! -f "$PROMPT" ]; then
|
|
echo "missing $PROMPT — run 'micro loop init'." >&2
|
|
exit 1
|
|
fi
|
|
ISSUE_URL=$(gh issue create --repo "$REPO" \
|
|
--title "Loop: security review #$RUN_NUMBER" \
|
|
--body "Autonomous security pass. Direction: .github/loop/NORTH_STAR.md; queue: .github/loop/PRIORITIES.md.")
|
|
ISSUE_NUM="${ISSUE_URL##*/}"
|
|
echo "Opened issue #$ISSUE_NUM — dispatching security."
|
|
# The prompt file is the policy; strip its editorial <!-- --> header and
|
|
# substitute the tracking issue number (__ISSUE__) at runtime.
|
|
{
|
|
echo "@codex"
|
|
echo
|
|
sed -e '/<!--/,/-->/d' -e "s/__ISSUE__/$ISSUE_NUM/g" "$PROMPT"
|
|
} > "$RUNNER_TEMP/loop-body.md"
|
|
gh issue comment "$ISSUE_NUM" --repo "$REPO" --body-file "$RUNNER_TEMP/loop-body.md"
|