From b0a50f303247e291682f70a34fc1167918640e76 Mon Sep 17 00:00:00 2001 From: Mara Nikola Kiefer Date: Fri, 28 Aug 2026 13:23:35 +0200 Subject: [PATCH] Add runtime import statements for workflow markdown files --- .../advisory-uk-ai-operational-resilience.md | 2 ++ .github/workflows/advisory.md | 2 ++ .../ambient-context-agents-md-curator.md | 2 ++ .../ambient-context-skills-curator.md | 2 ++ .github/workflows/ambient-context.md | 2 ++ .github/workflows/aw-failures-investigator.md | 2 ++ .github/workflows/aw-failures.md | 2 ++ .github/workflows/aw-maintenance-upgrade.md | 2 ++ .github/workflows/aw-maintenance.md | 2 ++ .../dependabot-release-train-updater.md | 2 ++ .github/workflows/dependabot.md | 2 ++ ...mpliance-article-14-reporting-readiness.md | 2 ++ ...-compliance-conformity-release-evidence.md | 2 ++ .../eu-cra-compliance-scope-classifier.md | 2 ++ ...ompliance-security-requirements-auditor.md | 2 ++ ...ra-compliance-supply-chain-sbom-auditor.md | 2 ++ ...mpliance-vulnerability-handling-auditor.md | 2 ++ .github/workflows/eu-cra-compliance.md | 2 ++ .../optimization-ai-credit-auditor.md | 2 ++ .../optimization-ai-credit-optimizer.md | 2 ++ .github/workflows/optimization.md | 2 ++ docs/configuration.md | 8 +++++ tests/unit/workflow-contract.test.mjs | 31 +++++++++++++++++++ 23 files changed, 81 insertions(+) diff --git a/.github/workflows/advisory-uk-ai-operational-resilience.md b/.github/workflows/advisory-uk-ai-operational-resilience.md index 5383baa0..23ad6102 100644 --- a/.github/workflows/advisory-uk-ai-operational-resilience.md +++ b/.github/workflows/advisory-uk-ai-operational-resilience.md @@ -286,6 +286,8 @@ steps: core.info(`Wrote bounded advisory evidence for ${payload.repository}.`); --- + {{#runtime-import? .github/aw/advisory.md}} + # Advisory / UK AI Operational Resilience diff --git a/.github/workflows/advisory.md b/.github/workflows/advisory.md index d471768a..ee3cc5c7 100644 --- a/.github/workflows/advisory.md +++ b/.github/workflows/advisory.md @@ -105,6 +105,8 @@ safe-outputs: max: 50 --- +{{#runtime-import? .github/aw/advisory.md}} + # Advisory diff --git a/.github/workflows/ambient-context-agents-md-curator.md b/.github/workflows/ambient-context-agents-md-curator.md index 59b07a8b..a63b05b0 100644 --- a/.github/workflows/ambient-context-agents-md-curator.md +++ b/.github/workflows/ambient-context-agents-md-curator.md @@ -457,6 +457,8 @@ steps: core.info(`Ambient context evidence written to ${OUT}`); --- +{{#runtime-import? .github/aw/ambient-context.md}} + You are the AGENTS.md Curator. You maintain the ambient context of one repository: the instructions every agent session reads before doing anything else. You never edit the repository yourself. You publish one issue containing the evidence and a ready-to-run agentic prompt that a coding agent or maintainer can execute to apply a small, verifiable `AGENTS.md` diff. ## Inputs diff --git a/.github/workflows/ambient-context-skills-curator.md b/.github/workflows/ambient-context-skills-curator.md index ed3ee27a..e90ffb9a 100644 --- a/.github/workflows/ambient-context-skills-curator.md +++ b/.github/workflows/ambient-context-skills-curator.md @@ -285,6 +285,8 @@ steps: core.info(`Skill evidence written to ${OUT}`); --- +{{#runtime-import? .github/aw/ambient-context.md}} + You are the Skills Curator. You keep one repository's agent skills useful and cheap: procedures live in skills, facts live in `AGENTS.md`, and every skill earns its place. You never edit the repository yourself. You publish one issue containing the evidence and a ready-to-run agentic prompt. ## Inputs diff --git a/.github/workflows/ambient-context.md b/.github/workflows/ambient-context.md index bafcecaf..bc311fb1 100644 --- a/.github/workflows/ambient-context.md +++ b/.github/workflows/ambient-context.md @@ -98,6 +98,8 @@ safe-outputs: max: 20 --- +{{#runtime-import? .github/aw/ambient-context.md}} + # Ambient Context Package orchestrator for the ambient context that agents read before they do anything else: `AGENTS.md` and the repository's agent skills. Ambient context decays silently, so this package runs on a weekly-or-slower cadence, selects repositories whose instructions have drifted the most from repository reality, and dispatches curators that propose evidence-backed pruning and refresh work. diff --git a/.github/workflows/aw-failures-investigator.md b/.github/workflows/aw-failures-investigator.md index 387a376c..27684579 100644 --- a/.github/workflows/aw-failures-investigator.md +++ b/.github/workflows/aw-failures-investigator.md @@ -346,6 +346,8 @@ steps: core.info(`Existing tracking issues: ${existingTrackingIssues.length}`); --- + {{#runtime-import? .github/aw/aw-failures.md}} + You are the AW Failure Investigator — a worker that analyzes recent GitHub Agentic Workflow failures in one target repository, buckets them into failure clusters, and files focused fix issues for the buckets that are not already tracked. ## Workspace Layout diff --git a/.github/workflows/aw-failures.md b/.github/workflows/aw-failures.md index 5c8e54cb..09fd48a9 100644 --- a/.github/workflows/aw-failures.md +++ b/.github/workflows/aw-failures.md @@ -97,6 +97,8 @@ safe-outputs: max: 50 --- +{{#runtime-import? .github/aw/aw-failures.md}} + # AW Failures Package orchestrator for organization-wide agentic workflow failure triage. Use the shared control plane to select repositories that run their own custom Agentic Workflows, then dispatch `aw-failures-investigator` once per selected repository. The orchestrator only selects and ranks repositories; the worker owns failure bucketization and issue creation inside each target repository. diff --git a/.github/workflows/aw-maintenance-upgrade.md b/.github/workflows/aw-maintenance-upgrade.md index cb76147b..159be57c 100644 --- a/.github/workflows/aw-maintenance-upgrade.md +++ b/.github/workflows/aw-maintenance-upgrade.md @@ -256,6 +256,8 @@ steps: key: aw-maintenance-gh-aw-releases-${{ github.run_id }} --- +{{#runtime-import? .github/aw/aw-maintenance.md}} + You are the AW Maintenance / Upgrade worker — you keep one target repository's GitHub Agentic Workflows (gh-aw) current by detecting available releases, running `gh aw upgrade` to compute the upgrade diff, and filing one issue a maintainer can assign to Copilot to open the upgrade pull request. Traditional, hand-written GitHub Actions YAML is out of scope for this worker. ## Workspace Layout diff --git a/.github/workflows/aw-maintenance.md b/.github/workflows/aw-maintenance.md index d86c8b0f..59605fa3 100644 --- a/.github/workflows/aw-maintenance.md +++ b/.github/workflows/aw-maintenance.md @@ -97,6 +97,8 @@ safe-outputs: max: 50 --- +{{#runtime-import? .github/aw/aw-maintenance.md}} + # AW Maintenance Package orchestrator for organization-wide GitHub Agentic Workflows (gh-aw) maintenance. Use the shared control plane to select repositories that install their own GitHub Agentic Workflows, then dispatch `aw-maintenance-upgrade` once per selected repository. The orchestrator only selects and ranks repositories; the worker owns release detection, the `gh aw upgrade` run, and issue filing inside each target repository. diff --git a/.github/workflows/dependabot-release-train-updater.md b/.github/workflows/dependabot-release-train-updater.md index e676c294..122ed4e6 100644 --- a/.github/workflows/dependabot-release-train-updater.md +++ b/.github/workflows/dependabot-release-train-updater.md @@ -385,6 +385,8 @@ timeout-minutes: 60 source: githubnext/central-agentic-ops/.github/workflows/dependabot-release-train-updater.md@main --- +{{#runtime-import? .github/aw/dependabot.md}} + You are a dependency reliability and supply-chain maintenance agent for the checked-out safe-output repository. Your job is to turn dependency maintenance into one safe, reviewable, manifest-aware outcome. You do **not** auto-merge. You create pull requests, PR updates, comments, issues, or noop results through safe outputs only. diff --git a/.github/workflows/dependabot.md b/.github/workflows/dependabot.md index 1be9c786..e1244019 100644 --- a/.github/workflows/dependabot.md +++ b/.github/workflows/dependabot.md @@ -102,6 +102,8 @@ safe-outputs: source: githubnext/central-agentic-ops@2de9130ff1709fccdacbe5261fd5da71995e6721 --- +{{#runtime-import? .github/aw/dependabot.md}} + # Dependabot Package orchestrator for organization-wide dependency release-train maintenance. Use the shared control plane to select target repositories and dispatch `dependabot-release-train-updater`; keep dispatch repository-scoped and let the updater own manifest-aware bundle construction inside each selected repository. diff --git a/.github/workflows/eu-cra-compliance-article-14-reporting-readiness.md b/.github/workflows/eu-cra-compliance-article-14-reporting-readiness.md index 92d3aa5f..f33da170 100644 --- a/.github/workflows/eu-cra-compliance-article-14-reporting-readiness.md +++ b/.github/workflows/eu-cra-compliance-article-14-reporting-readiness.md @@ -111,6 +111,8 @@ safe-outputs: timeout-minutes: 30 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor / Article 14 Reporting Readiness Audit operational readiness for Article 14 reporting. This worker never decides reportability without human review and never sends a notification. diff --git a/.github/workflows/eu-cra-compliance-conformity-release-evidence.md b/.github/workflows/eu-cra-compliance-conformity-release-evidence.md index c8a2e4c3..751cca9d 100644 --- a/.github/workflows/eu-cra-compliance-conformity-release-evidence.md +++ b/.github/workflows/eu-cra-compliance-conformity-release-evidence.md @@ -111,6 +111,8 @@ safe-outputs: timeout-minutes: 30 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor / Conformity Release Evidence Audit evidence used by human conformity and market-release gates. Do not select a conformity route, approve a declaration, authorize CE marking, or approve market release. diff --git a/.github/workflows/eu-cra-compliance-scope-classifier.md b/.github/workflows/eu-cra-compliance-scope-classifier.md index 61c62725..f8b3cffb 100644 --- a/.github/workflows/eu-cra-compliance-scope-classifier.md +++ b/.github/workflows/eu-cra-compliance-scope-classifier.md @@ -109,6 +109,8 @@ safe-outputs: timeout-minutes: 25 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor / Scope Classifier Build a repository-level CRA scope evidence record. Assist human decision-makers; do not issue a legal conclusion. diff --git a/.github/workflows/eu-cra-compliance-security-requirements-auditor.md b/.github/workflows/eu-cra-compliance-security-requirements-auditor.md index 1eebd77d..7d5d4943 100644 --- a/.github/workflows/eu-cra-compliance-security-requirements-auditor.md +++ b/.github/workflows/eu-cra-compliance-security-requirements-auditor.md @@ -111,6 +111,8 @@ safe-outputs: timeout-minutes: 30 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor / Security Requirements Auditor Audit repository evidence for applicable CRA product cybersecurity requirements. This is implementation assistance and evidence gathering, not a legal conformity decision. diff --git a/.github/workflows/eu-cra-compliance-supply-chain-sbom-auditor.md b/.github/workflows/eu-cra-compliance-supply-chain-sbom-auditor.md index fbb74812..d094d358 100644 --- a/.github/workflows/eu-cra-compliance-supply-chain-sbom-auditor.md +++ b/.github/workflows/eu-cra-compliance-supply-chain-sbom-auditor.md @@ -112,6 +112,8 @@ safe-outputs: timeout-minutes: 30 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor / Supply Chain SBOM Auditor Audit repository-level software supply-chain and SBOM evidence relevant to the CRA. Do not make a legal conformity determination. diff --git a/.github/workflows/eu-cra-compliance-vulnerability-handling-auditor.md b/.github/workflows/eu-cra-compliance-vulnerability-handling-auditor.md index 71851d60..25d83e89 100644 --- a/.github/workflows/eu-cra-compliance-vulnerability-handling-auditor.md +++ b/.github/workflows/eu-cra-compliance-vulnerability-handling-auditor.md @@ -111,6 +111,8 @@ safe-outputs: timeout-minutes: 30 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor / Vulnerability Handling Auditor Audit vulnerability-handling evidence relevant to CRA implementation. Do not decide legal conformity or submit notifications. diff --git a/.github/workflows/eu-cra-compliance.md b/.github/workflows/eu-cra-compliance.md index e32b61c1..19a9d4d4 100644 --- a/.github/workflows/eu-cra-compliance.md +++ b/.github/workflows/eu-cra-compliance.md @@ -111,6 +111,8 @@ safe-outputs: max: 48 --- +{{#runtime-import? .github/aw/eu-cra-compliance.md}} + # EU CRA Advisor diff --git a/.github/workflows/optimization-ai-credit-auditor.md b/.github/workflows/optimization-ai-credit-auditor.md index 4be83fe3..63b2a29a 100644 --- a/.github/workflows/optimization-ai-credit-auditor.md +++ b/.github/workflows/optimization-ai-credit-auditor.md @@ -241,6 +241,8 @@ steps: source: githubnext/central-agentic-ops/.github/workflows/optimization-ai-credit-auditor.md@main --- +{{#runtime-import? .github/aw/optimization.md}} + You are the Agentic Workflow Auditor — a workflow that tracks daily AI Credit (AIC) spend and token consumption, forecasts weekly and monthly cost, and maintains a historical record for trend analysis across all agentic workflows in the target repository. ## Workspace Layout diff --git a/.github/workflows/optimization-ai-credit-optimizer.md b/.github/workflows/optimization-ai-credit-optimizer.md index 0494b230..2c590877 100644 --- a/.github/workflows/optimization-ai-credit-optimizer.md +++ b/.github/workflows/optimization-ai-credit-optimizer.md @@ -257,6 +257,8 @@ steps: source: githubnext/central-agentic-ops/.github/workflows/optimization-ai-credit-optimizer.md@main --- +{{#runtime-import? .github/aw/optimization.md}} + You are the Agentic Workflow Optimizer. Pick one high AI credit workflow, audit recent runs, and create a conservative optimization issue with measurable improvements. Your recommendations may include prompt, tool, reliability, setup-prefix, and inline sub-agent improvements when the evidence supports them. ## Objectives diff --git a/.github/workflows/optimization.md b/.github/workflows/optimization.md index 52eb3b23..9eadbab2 100644 --- a/.github/workflows/optimization.md +++ b/.github/workflows/optimization.md @@ -98,6 +98,8 @@ safe-outputs: source: githubnext/central-agentic-ops@2de9130ff1709fccdacbe5261fd5da71995e6721 --- +{{#runtime-import? .github/aw/optimization.md}} + # Optimization ## Discovery diff --git a/docs/configuration.md b/docs/configuration.md index 6f26ab58..1a2410a8 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -37,6 +37,14 @@ gh variable set CENTRAL_AGENTIC_OPS_DEPENDABOT_MAX_REPOS \ Add an App or PAT when the target is private or internal. Keep the mode at `review` until the promotion checks pass. +## Markdown Steering + +Each operation orchestrator can load repository-specific instructions from `.github/aw/.md` in the control repository. For example, `.github/aw/dependabot.md` can describe organization-specific dependency priorities, repositories to prefer or avoid, or additional evidence to consider. + +The supported operation names are `advisory`, `ambient-context`, `aw-failures`, `aw-maintenance`, `dependabot`, `eu-cra-compliance`, and `optimization`. These files are optional runtime imports: an operation continues with its packaged instructions when its steering file does not exist. Because steering files are separate from package-owned workflow sources, `gh aw update` does not overwrite them. + +Keep steering instructions within the operation's existing permissions, safety policy, and dispatch limits. Steering can refine selection and prioritization, but it cannot grant tools, credentials, permissions, or safe-output capabilities. + ## Repository Variables | Name | Scope | Required | Default | Purpose | diff --git a/tests/unit/workflow-contract.test.mjs b/tests/unit/workflow-contract.test.mjs index b35356b4..ce06bab0 100644 --- a/tests/unit/workflow-contract.test.mjs +++ b/tests/unit/workflow-contract.test.mjs @@ -714,6 +714,37 @@ test("orchestrators expose scheduled variables and independent manual inputs", ( } }); +test("operation workflows optionally load per-operation markdown steering", () => { + for (const [name, operation] of [ + ["advisory.md", "advisory"], + ["advisory-uk-ai-operational-resilience.md", "advisory"], + ["ambient-context.md", "ambient-context"], + ["ambient-context-agents-md-curator.md", "ambient-context"], + ["ambient-context-skills-curator.md", "ambient-context"], + ["aw-failures.md", "aw-failures"], + ["aw-failures-investigator.md", "aw-failures"], + ["aw-maintenance.md", "aw-maintenance"], + ["aw-maintenance-upgrade.md", "aw-maintenance"], + ["dependabot.md", "dependabot"], + ["dependabot-release-train-updater.md", "dependabot"], + ["eu-cra-compliance.md", "eu-cra-compliance"], + ["eu-cra-compliance-article-14-reporting-readiness.md", "eu-cra-compliance"], + ["eu-cra-compliance-conformity-release-evidence.md", "eu-cra-compliance"], + ["eu-cra-compliance-scope-classifier.md", "eu-cra-compliance"], + ["eu-cra-compliance-security-requirements-auditor.md", "eu-cra-compliance"], + ["eu-cra-compliance-supply-chain-sbom-auditor.md", "eu-cra-compliance"], + ["eu-cra-compliance-vulnerability-handling-auditor.md", "eu-cra-compliance"], + ["optimization.md", "optimization"], + ["optimization-ai-credit-auditor.md", "optimization"], + ["optimization-ai-credit-optimizer.md", "optimization"], + ]) { + assert.match( + workflow(name), + new RegExp(`\\{\\{#runtime-import\\? \\.github/aw/${operation}\\.md\\}\\}`), + ); + } +}); + test("review destinations must be isolated, accessible, and private", () => { const precompute = workflow("shared/control-precompute.md");