adcp-client-python/.github/workflows/sync-agent-roles.yml at main · adcontextprotocol/adcp-client-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: Sync agent roles from adcp

# Mirrors `.agents/roles/` from the canonical source in
# adcontextprotocol/adcp. The importer remains the reviewed local copy: code
# fetched from a mutable upstream branch must never execute with this
# workflow's write token. Opens a PR if drift is detected. Runs weekly on
# Mondays and on-demand.
#
# Action refs are pinned to immutable SHAs. Update them in a dedicated PR by
# verifying each SHA against its upstream release tag, reviewing release notes,
# and running actionlint before merge.

on:
  schedule:
    - cron: '17 6 * * 1'  # Mondays, 06:17 UTC (off-peak)
  workflow_dispatch:

jobs:
  sync:
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: '22'

      - name: Checkout canonical role data from adcp
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          repository: adcontextprotocol/adcp
          ref: main
          path: .adcp-upstream
          fetch-depth: 1
          persist-credentials: false

      - name: Import canonical .agents/roles/ from adcp
        id: upstream
        run: |
          set -euo pipefail
          rm -rf .agents/roles
          mkdir -p .agents
          cp -r .adcp-upstream/.agents/roles .agents/roles
          upstream_sha=$(git -C .adcp-upstream rev-parse HEAD)
          echo "sha=$upstream_sha" >> "$GITHUB_OUTPUT"
          rm -rf .adcp-upstream

      - name: Regenerate .claude/agents/ from synced roles
        run: node scripts/import-claude-agents.mjs

      - name: Detect drift
        id: diff
        run: |
          if git diff --quiet HEAD; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No drift — nothing to sync."
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "Drift detected:"
            git diff --stat HEAD
          fi

      - name: Add empty changeset (repos that use changesets)
        if: steps.diff.outputs.changed == 'true' && hashFiles('.changeset/config.json') != ''
        run: |
          mkdir -p .changeset
          cat > .changeset/sync-agent-roles.md <<'EOF'
          ---
          ---

          Sync `.agents/roles/` from canonical source in `adcontextprotocol/adcp`.
          EOF

      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        if: steps.diff.outputs.changed == 'true'
        with:
          branch: claude-routine/sync-agent-roles
          base: main
          title: 'chore(agents): sync .agents/roles/ from adcp'
          commit-message: 'chore(agents): sync .agents/roles/ from adcp'
          delete-branch: true
          body: |
            Automated weekly sync from `adcontextprotocol/adcp:.agents/roles/`.
            Upstream commit: `${{ steps.upstream.outputs.sha }}`

            The generated `.claude/agents/` files use this repository's
            reviewed local `scripts/import-claude-agents.mjs` importer.

            Run by `.github/workflows/sync-agent-roles.yml`.

            **CI note:** PRs opened by GitHub Actions' default `GITHUB_TOKEN`
            don't trigger downstream `pull_request` workflows. The same job
            re-ran `node scripts/import-claude-agents.mjs` before opening
            this PR, so `.claude/agents/` already matches the synced source.
            To force a fresh CI run, close and reopen this PR, or push an
            empty commit.