ci: migrate workflows to shared reusable workflows

.github/workflows/agent-restricted.yml

@@ -2,22 +2,21 @@ name: Restricted Agent
 
 # RESTRICTED ACCESS VERSION
 # Only specific users can trigger this workflow manually
-
 on:
   workflow_dispatch:
     inputs:
       prompt:
-        description: 'Prompt for the agent'
+        description: Prompt for the agent
         required: true
-        default: 'What are my active pull requests?'
+        default: What are my active pull requests?
         type: string
       system_prompt:
-        description: 'System prompt'
+        description: System prompt
         required: false
         type: string
       provider:
-        description: 'Provider'
-        default: 'bedrock'
+        description: Provider
+        default: bedrock
         required: false
         type: choice
         options:
@@ -26,22 +25,22 @@ on:
           - openai
           - anthropic
       model:
-        description: 'Model ID (e.g., us.anthropic.claude-sonnet-4-5-20250929-v1:0)'
+        description: Model ID (e.g., us.anthropic.claude-sonnet-4-5-20250929-v1:0)
         required: false
-        default: 'us.anthropic.claude-sonnet-4-5-20250929-v1:0'
+        default: us.anthropic.claude-sonnet-4-5-20250929-v1:0
         type: string
       max_tokens:
-        description: 'Maximum tokens for model response'
+        description: Maximum tokens for model response
         required: false
         default: '10000'
         type: string
       tools:
-        description: 'Tool config (e.g., strands_tools:shell;strands_action:use_github)'
+        description: Tool config (e.g., strands_tools:shell;strands_action:use_github)
         required: false
-        default: 'strands_tools:shell;tools:use_github'
+        default: strands_tools:shell;tools:use_github
         type: string
       agent_runner:
-        description: 'Custom agent runner URL'
+        description: Custom agent runner URL
         required: false
         type: string
 
@@ -52,39 +51,15 @@ permissions:
   issues: write
 
 jobs:
-  agent:
-    runs-on: codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }}
-    steps:
-      - name: Check authorization
-        run: |
-          AUTHORIZED_USERS="${{ secrets.AUTHORIZED_USERS }}"
-          if [[ ",$AUTHORIZED_USERS," != *",${{ github.actor }},"* ]]; then
-            echo "❌ User ${{ github.actor }} is NOT authorized"
-            exit 1
-          fi
-          echo "✅ User ${{ github.actor }} is authorized"
-
-      - uses: actions/checkout@v7
-
-      - name: Generate GitHub App Token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Run Strands Agent
-        uses: ./.github/actions/strands-action
-        with:
-          prompt: ${{ inputs.prompt }}
-          provider: ${{ inputs.provider }}
-          model: ${{ inputs.model }}
-          max_tokens: ${{ inputs.max_tokens }}
-          system_prompt: ${{ inputs.system_prompt }}
-          tools: ${{ inputs.tools }}
-          agent_runner: ${{ inputs.agent_runner }}
-          aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
-          aws_region: 'us-west-2'
-          pat_token: ${{ steps.app-token.outputs.token }}
-        env:
-          STRANDS_TOOLS_DIRECTORY: 'true'
+  call:
+    uses: aws/agentcore-devx-devtools/.github/workflows/reusable-agent-restricted.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
+    with:
+      runner: codebuild
+      prompt: ${{ inputs.prompt || 'What are my active pull requests?' }}
+      system_prompt: ${{ inputs.system_prompt || '' }}
+      provider: ${{ inputs.provider || 'bedrock' }}
+      model: ${{ inputs.model || 'us.anthropic.claude-sonnet-4-5-20250929-v1:0' }}
+      max_tokens: ${{ inputs.max_tokens || '10000' }}
+      tools: ${{ inputs.tools || 'strands_tools:shell;tools:use_github' }}
+      agent_runner: ${{ inputs.agent_runner || '' }}
+    secrets: inherit

.github/workflows/ci-failure-issue.yml

@@ -2,53 +2,18 @@ name: CI Failure Issue
 
 on:
   workflow_run:
-    # These names must match the `name:` field in each workflow file exactly
     workflows:
-      - 'Build and Test'
-      - 'Quality and Safety Checks'
-      - 'E2E Tests (Full Suite)'
-      - 'CodeQL'
+      - Build and Test
+      - Quality and Safety Checks
+      - E2E Tests (Full Suite)
+      - CodeQL
     types: [completed]
 
-jobs:
-  create-issue:
-    concurrency: ci-failure-issue-${{ github.event.workflow_run.name }}
-    # Stays on a GitHub-hosted runner on purpose: this workflow is the alarm that
-    # opens an issue when main CI fails, so it must not depend on the CodeBuild
-    # runner it may need to report on. If CodeBuild is unhealthy (webhook drift,
-    # quota exhaustion, broken image), a CodeBuild-hosted alarm couldn't start
-    # either and the failure would be silently swallowed. It's GitHub-API-only
-    # (no AWS calls), so it gains nothing from running inside the AWS network.
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.head_branch == 'main' }}
-    permissions:
-      issues: write
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '20.x'
-
-      - name: Generate GitHub App Token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+permissions:
+  contents: read
+  issues: write
 
-      - name: Create CI failure issue
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
-          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-          RUN_URL: ${{ github.event.workflow_run.html_url }}
-        run: |
-          npx -y tsx .github/scripts/create-failure-issue.ts \
-            --title-prefix "CI Failure" \
-            --name "$WORKFLOW_NAME" \
-            --branch "$HEAD_BRANCH" \
-            --commit "$HEAD_SHA" \
-            --run-url "$RUN_URL" \
-            --labels "high-severity,ci"
+jobs:
+  call:
+    uses: aws/agentcore-devx-devtools/.github/workflows/reusable-ci-failure-issue.yml@458c0a684af0f9e3a013ec05cd23851def4f9cab
+    secrets: inherit