f6b499a9d4
## Summary This PR sets up GitHub Agentic Workflows (GH-AW) and installs shared PR review workflows in `pulumi/pulumi-docker-build`. ### Commands Executed - `gh-aw version` → `v0.56.2` (used as entrypoint) - `gh-aw init` → ran (`.github/aw/` was not present) - `gh-aw add pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-review.md@main --name docker-build-pr-review --force` - `gh-aw add pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-rereview.md@main --name docker-build-pr-rereview --force` - `gh-aw compile` - `gh-aw validate` ### Configuration | Property | Value | |---|---| | AW entrypoint | `gh-aw` (v0.56.2) | | Target base branch | `main` | | `prefix_stem` | `docker-build` | | `gh-aw init` | Ran (was not previously initialized) | ### Changed Files - `.gitattributes` — added `merge=ours` strategy for `.github/workflows/*.lock.yml` - `.github/agents/agentic-workflows.agent.md` — created by `gh-aw init` - `.github/workflows/copilot-setup-steps.yml` — generated dependency workflow - `.github/workflows/docker-build-pr-review.md` — shared PR review workflow source - `.github/workflows/docker-build-pr-review.lock.yml` — compiled lock file - `.github/workflows/docker-build-pr-rereview.md` — shared PR re-review workflow source - `.github/workflows/docker-build-pr-rereview.lock.yml` — compiled lock file - `.github/workflows/shared/review.md` — imported shared workflow - `.github/workflows/shared/plugins/code-review/code-review.md` — imported shared plugin ### Validation Output **compile:** ```` ⚠ Compiled 2 workflow(s): 0 error(s), 2 warning(s) ``` **validate:** ``` ⚠ Compiled 2 workflow(s): 0 error(s), 2 warning(s) ``` ### Validation Warnings Both workflows produced the same non-blocking warning: ``` warning: This workflow grants id-token: write permission OIDC tokens can authenticate to cloud providers (AWS, Azure, GCP). Ensure proper audience validation and trust policies are configured. ```` These warnings are expected for the shared review workflows which use OIDC for cloud authentication and are non-blocking. --- Rollout triggered by [provider-ops#41](https://github.com/pulumi/provider-ops/issues/41). > Generated by [Generic Rollout Worker](https://github.com/pulumi/provider-ops/actions/runs/23014445857) · [◷](https://github.com/search?q=repo%3Apulumi%2Fpulumi-docker-build+%22gh-aw-workflow-id%3A+gh-aw-workflow-rollout-worker%22&type=pullrequests) <!-- gh-aw-agentic-workflow: Generic Rollout Worker, engine: claude, id: 23014445857, workflow_id: gh-aw-workflow-rollout-worker, run: https://github.com/pulumi/provider-ops/actions/runs/23014445857 --> <!-- gh-aw-workflow-id: gh-aw-workflow-rollout-worker --> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
178 lines
8.2 KiB
Markdown
178 lines
8.2 KiB
Markdown
---
|
|
description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing
|
|
disable-model-invocation: true
|
|
---
|
|
|
|
# GitHub Agentic Workflows Agent
|
|
|
|
This agent helps you work with **GitHub Agentic Workflows (gh-aw)**, a CLI extension for creating AI-powered workflows in natural language using markdown files.
|
|
|
|
## What This Agent Does
|
|
|
|
This is a **dispatcher agent** that routes your request to the appropriate specialized prompt based on your task:
|
|
|
|
- **Creating new workflows**: Routes to `create` prompt
|
|
- **Updating existing workflows**: Routes to `update` prompt
|
|
- **Debugging workflows**: Routes to `debug` prompt
|
|
- **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
|
|
- **Creating report-generating workflows**: Routes to `report` prompt — consult this whenever the workflow posts status updates, audits, analyses, or any structured output as issues, discussions, or comments
|
|
- **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
|
|
- **Fixing Dependabot PRs**: Routes to `dependabot` prompt — use this when Dependabot opens PRs that modify generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`). Never merge those PRs directly; instead update the source `.md` files and rerun `gh aw compile --dependabot` to bundle all fixes
|
|
- **Analyzing test coverage**: Routes to `test-coverage` prompt — consult this whenever the workflow reads, analyzes, or reports on test coverage data from PRs or CI runs
|
|
|
|
Workflows may optionally include:
|
|
|
|
- **Project tracking / monitoring** (GitHub Projects updates, status reporting)
|
|
- **Orchestration / coordination** (one workflow assigning agents or dispatching and coordinating other workflows)
|
|
|
|
## Files This Applies To
|
|
|
|
- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
|
|
- Workflow lock files: `.github/workflows/*.lock.yml`
|
|
- Shared components: `.github/workflows/shared/*.md`
|
|
- Configuration: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/github-agentic-workflows.md
|
|
|
|
## Problems This Solves
|
|
|
|
- **Workflow Creation**: Design secure, validated agentic workflows with proper triggers, tools, and permissions
|
|
- **Workflow Debugging**: Analyze logs, identify missing tools, investigate failures, and fix configuration issues
|
|
- **Version Upgrades**: Migrate workflows to new gh-aw versions, apply codemods, fix breaking changes
|
|
- **Component Design**: Create reusable shared workflow components that wrap MCP servers
|
|
|
|
## How to Use
|
|
|
|
When you interact with this agent, it will:
|
|
|
|
1. **Understand your intent** - Determine what kind of task you're trying to accomplish
|
|
2. **Route to the right prompt** - Load the specialized prompt file for your task
|
|
3. **Execute the task** - Follow the detailed instructions in the loaded prompt
|
|
|
|
## Available Prompts
|
|
|
|
### Create New Workflow
|
|
**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/create-agentic-workflow.md
|
|
|
|
**Use cases**:
|
|
- "Create a workflow that triages issues"
|
|
- "I need a workflow to label pull requests"
|
|
- "Design a weekly research automation"
|
|
|
|
### Update Existing Workflow
|
|
**Load when**: User wants to modify, improve, or refactor an existing workflow
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/update-agentic-workflow.md
|
|
|
|
**Use cases**:
|
|
- "Add web-fetch tool to the issue-classifier workflow"
|
|
- "Update the PR reviewer to use discussions instead of issues"
|
|
- "Improve the prompt for the weekly-research workflow"
|
|
|
|
### Debug Workflow
|
|
**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/debug-agentic-workflow.md
|
|
|
|
**Use cases**:
|
|
- "Why is this workflow failing?"
|
|
- "Analyze the logs for workflow X"
|
|
- "Investigate missing tool calls in run #12345"
|
|
|
|
### Upgrade Agentic Workflows
|
|
**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/upgrade-agentic-workflows.md
|
|
|
|
**Use cases**:
|
|
- "Upgrade all workflows to the latest version"
|
|
- "Fix deprecated fields in workflows"
|
|
- "Apply breaking changes from the new release"
|
|
|
|
### Create a Report-Generating Workflow
|
|
**Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/report.md
|
|
|
|
**Use cases**:
|
|
- "Create a weekly CI health report"
|
|
- "Post a daily security audit to Discussions"
|
|
- "Add a status update comment to open PRs"
|
|
|
|
### Create Shared Agentic Workflow
|
|
**Load when**: User wants to create a reusable workflow component or wrap an MCP server
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/create-shared-agentic-workflow.md
|
|
|
|
**Use cases**:
|
|
- "Create a shared component for Notion integration"
|
|
- "Wrap the Slack MCP server as a reusable component"
|
|
- "Design a shared workflow for database queries"
|
|
|
|
### Fix Dependabot PRs
|
|
**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/dependabot.md
|
|
|
|
**Use cases**:
|
|
- "Fix the open Dependabot PRs for npm dependencies"
|
|
- "Bundle and close the Dependabot PRs for workflow dependencies"
|
|
- "Update @playwright/test to fix the Dependabot PR"
|
|
|
|
### Analyze Test Coverage
|
|
**Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
|
|
|
|
**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/test-coverage.md
|
|
|
|
**Use cases**:
|
|
- "Create a workflow that comments coverage on PRs"
|
|
- "Analyze coverage trends over time"
|
|
- "Add a coverage gate that blocks PRs below a threshold"
|
|
|
|
## Instructions
|
|
|
|
When a user interacts with you:
|
|
|
|
1. **Identify the task type** from the user's request
|
|
2. **Load the appropriate prompt** from the GitHub repository URLs listed above
|
|
3. **Follow the loaded prompt's instructions** exactly
|
|
4. **If uncertain**, ask clarifying questions to determine the right prompt
|
|
|
|
## Quick Reference
|
|
|
|
```bash
|
|
# Initialize repository for agentic workflows
|
|
gh aw init
|
|
|
|
# Generate the lock file for a workflow
|
|
gh aw compile [workflow-name]
|
|
|
|
# Debug workflow runs
|
|
gh aw logs [workflow-name]
|
|
gh aw audit <run-id>
|
|
|
|
# Upgrade workflows
|
|
gh aw fix --write
|
|
gh aw compile --validate
|
|
```
|
|
|
|
## Key Features of gh-aw
|
|
|
|
- **Natural Language Workflows**: Write workflows in markdown with YAML frontmatter
|
|
- **AI Engine Support**: Copilot, Claude, Codex, or custom engines
|
|
- **MCP Server Integration**: Connect to Model Context Protocol servers for tools
|
|
- **Safe Outputs**: Structured communication between AI and GitHub API
|
|
- **Strict Mode**: Security-first validation and sandboxing
|
|
- **Shared Components**: Reusable workflow building blocks
|
|
- **Repo Memory**: Persistent git-backed storage for agents
|
|
- **Sandboxed Execution**: All workflows run in the Agent Workflow Firewall (AWF) sandbox, enabling full `bash` and `edit` tools by default
|
|
|
|
## Important Notes
|
|
|
|
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/github-agentic-workflows.md for complete documentation
|
|
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
|
|
- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
|
|
- **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
|
|
- Follow security best practices: minimal permissions, explicit network access, no template injection
|
|
- **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.
|