Skip to content

chore(gh-aw): add gh aw init tooling (skills, MCP, setup + maintenance workflows) - #1592

Open
bradygaster wants to merge 2 commits into
devfrom
squad/gh-aw-init-tooling
Open

chore(gh-aw): add gh aw init tooling (skills, MCP, setup + maintenance workflows)#1592
bradygaster wants to merge 2 commits into
devfrom
squad/gh-aw-init-tooling

Conversation

@bradygaster

Copy link
Copy Markdown
Owner

What

gh aw init had never been run in this repository. This PR adds the standard scaffolding that gh aw init generates for a repo that authors and ships GitHub Agentic Workflows, as its own reviewable change — separate from the gh-aw shared-component work in #1587.

Why

We are now a gh-aw publisher: we ship .github/workflows/shared/squad.md, .github/workflows/squad-backlog-triage.md, and a root aw.yml package manifest (all in #1587). This tooling exists to keep what we publish correct:

  • .github/skills/agentic-workflows/SKILL.md + .github/skills/agentic-workflow-designer/SKILL.md — the gh-aw designer/dispatcher skills. Because we ship gh-aw workflows, these protect frontmatter validity and compiled .lock.yml correctness.
  • .github/agents/agentic-workflows.md — the gh-aw authoring sub-agent.
  • .github/workflows/copilot-setup-steps.yml — lets @copilot run gh aw compile in CI rather than hand-editing generated .lock.yml files (which must never be edited by hand).
  • .github/workflows/agentics-maintenance.ymlrequired, not gratuitous: squad-backlog-triage.md (line 30, expires: 7) creates expiring entities, and this workflow is what closes them.
  • .github/mcp.json — configures the gh-aw MCP server for the cloud coding agent. The local-CLI equivalent lives in root .mcp.json and is intentionally NOT included in this PR.

⚠️ Reviewer callout — maintenance workflow permissions

agentics-maintenance.yml runs daily at cron 37 0 * * * and holds write permissions:

  • issues: write
  • pull-requests: write
  • discussions: write

These are scoped to closing the gh-aw-created expiring entities (driven by the minimum expires: 7 in our triage workflow), but the daily cadence + write scope are called out explicitly so this can be weighed before merge.

Notes for reviewers

Copilot AI lite review requested due to automatic review settings August 4, 2026 15:39
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit dcdad08

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status Check Details
Single commit 2 commits — consider squashing before review
Not in draft Ready for review
Branch up to date Up to date with dev
Copilot review No Copilot review yet — it may still be processing
Changeset present No source files changed — changeset not required
Scope clean No .squad/ or docs/proposals/ files
No merge conflicts No merge conflicts
Copilot threads resolved 0 active Copilot thread(s) resolved (3 outdated skipped)
CI passing 1 check(s) failing: test

Files Changed (6 files, +1372 −0)

File +/−
.github/agents/agentic-workflows.md +226 −0
.github/mcp.json +20 −0
.github/skills/agentic-workflow-designer/SKILL.md +390 −0
.github/skills/agentic-workflows/SKILL.md +96 −0
.github/workflows/agentics-maintenance.yml +614 −0
.github/workflows/copilot-setup-steps.yml +26 −0

Total: +1372 −0


This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

🔒 Security Review

🔒 Security review: 6 warning(s), 18 info.

Severity Category Finding Location
🟡 warning pii-env-var Environment variable with sensitive name pattern (CREDENTIALS) — ensure this isn't hardcoded. .github/workflows/agentics-maintenance.yml:163
🟡 warning pii-env-var Environment variable with sensitive name pattern (CREDENTIALS) — ensure this isn't hardcoded. .github/workflows/agentics-maintenance.yml:256
🟡 warning pii-env-var Environment variable with sensitive name pattern (CREDENTIALS) — ensure this isn't hardcoded. .github/workflows/agentics-maintenance.yml:302
🟡 warning pii-env-var Environment variable with sensitive name pattern (CREDENTIALS) — ensure this isn't hardcoded. .github/workflows/agentics-maintenance.yml:348
🟡 warning pii-env-var Environment variable with sensitive name pattern (CREDENTIALS) — ensure this isn't hardcoded. .github/workflows/agentics-maintenance.yml:453
🟡 warning pii-env-var Environment variable with sensitive name pattern (CREDENTIALS) — ensure this isn't hardcoded. .github/workflows/agentics-maintenance.yml:582
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:94
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:95
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:96
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:134
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:154
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:155
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:156
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:209
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:210
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:244
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:245
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:246
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:247
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:297
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:343
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:448
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:545
ℹ️ info workflow-permissions Workflow grants write permission — verify this is the minimum required scope. .github/workflows/agentics-maintenance.yml:577

Automated security review — informational only.

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

🟡 Impact Analysis — PR #1592

Risk tier: 🟡 MEDIUM

📊 Summary

Metric Count
Files changed 6
Files added 6
Files modified 0
Files deleted 0
Modules touched 1

🎯 Risk Factors

  • 6 files changed (6-20 → MEDIUM)
  • 1 module(s) touched (≤1 → LOW)

📦 Modules Affected

ci-workflows (6 files)
  • .github/agents/agentic-workflows.md
  • .github/mcp.json
  • .github/skills/agentic-workflow-designer/SKILL.md
  • .github/skills/agentic-workflows/SKILL.md
  • .github/workflows/agentics-maintenance.yml
  • .github/workflows/copilot-setup-steps.yml

This report is generated automatically for every PR. See #733 for details.

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

🏗️ Architectural Review

⚠️ Architectural review: 1 info.

Severity Category Finding Files
ℹ️ info template-sync Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too. Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

Automated architectural review — informational only.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Not ready to approve

There are a few concrete correctness/convention issues in newly added dispatcher docs/skills and workflow action pinning that should be fixed before merge.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds the standard gh aw init scaffolding needed for authoring/publishing GitHub Agentic Workflows in this repo, including Copilot cloud-agent setup, gh-aw maintenance automation, and routing skills/agents.

Changes:

  • Adds a Copilot setup-steps workflow to install gh-aw in CI/agent environments.
  • Adds the generated gh-aw maintenance workflow to close expiring entities and support manual maintenance operations.
  • Adds gh-aw dispatcher assets: skills (agentic-workflows, agentic-workflow-designer), an authoring sub-agent, and a cloud-agent MCP config.
File summaries
File Description
.github/workflows/copilot-setup-steps.yml Adds Copilot setup-steps job to install gh-aw tooling.
.github/workflows/agentics-maintenance.yml Adds generated scheduled/manual maintenance workflow for gh-aw entities.
.github/skills/agentic-workflows/SKILL.md Adds router/dispatcher skill for gh-aw workflow tasks.
.github/skills/agentic-workflow-designer/SKILL.md Adds interactive workflow-design interview skill.
.github/mcp.json Adds cloud-agent MCP server config for gh-aw commands.
.github/agents/agentic-workflows.md Adds gh-aw dispatcher sub-agent documentation and routing guidance.
Review details
  • Files reviewed: 6/6 changed files
  • Comments generated: 3
  • Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

Comment on lines +21 to +22
- name: Checkout repository
uses: actions/checkout@v6
Comment thread .github/agents/agentic-workflows.md Outdated
## Important Notes

- Always reference the instructions file at `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md` for complete documentation
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
- Choose workflow architecture and patterns: `.github/aw/patterns.md`
- Optimize token usage and cost: `.github/aw/token-optimization.md`

When the task involves OTEL, OTLP, traces, observability backends, or telemetry-driven analysis, also read and follow `skills/otel-queries/SKILL.md` after loading the matching workflow prompt or skill.
bradygaster added a commit that referenced this pull request Aug 5, 2026
)

* fix(ci): skip DO-NOT-EDIT gh-aw generated workflows in lint; widen agents guard

actionlint v1.7.12 is the current latest release — upgrading cannot fix
this. The tool lags GitHub's evolving feature set on two specific
constructs:

  • 'copilot-requests: write' — a real current Actions permission scope
    used by GitHub's own gh-aw toolchain.
  • 'concurrency.queue: max' — a newer Actions concurrency feature.

The files triggering these errors are DO-NOT-EDIT compiler output from
gh-aw's 'gh aw compile' toolchain (*.lock.yml) and gh-aw's code
generators (e.g. agentics-maintenance.yml). Editing them is not
acceptable — they are clobbered on each compile/generate cycle and are
validated upstream by gh-aw's own toolchain.

Fix 1 (.github/workflows/squad-workflow-lint.yml):
  Detect generated files by their header ('automatically generated' /
  'DO NOT EDIT' within the first 5 lines) and skip them. Header-based
  detection automatically covers future gh-aw generated files without
  manual maintenance. Hand-authored workflows are always linted. Verified
  with a sabotage test: intentionally broken hand-authored workflow still
  fails the gate. Skipped files are echoed in CI logs for debuggability.

Fix 2 (test/template-sync.test.ts):
  The '.github/agents/ negative guard' asserted strict directory equality,
  which over-reaches. 'gh aw init' legitimately installs its own
  agentic-workflows.md in that directory. Narrowed the guard to its actual
  intent: squad.agent.md must be present, no *unexpected* files allowed,
  with an explicit allowlist of known non-Squad agents. A truly random
  stray file still fails the test.

Unblocks PRs #1587 and #1592 (does NOT close them).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(test): add section-1 beforeAll sync to guard against init-scaffolding race

test/init-scaffolding.test.ts runs runInit() from a subdirectory of the repo
root.  In monorepo mode the init command detects the git root and places
squad.agent.md at .github/agents/ in the REAL repo root, then calls
stampVersion() to rewrite that file in place.  This runs concurrently with
template-sync.test.ts in a different Vitest worker.

The file-level beforeAll sync in template-sync.test.ts is correct but leaves
a race window: if init-scaffolding's stampVersion write lands between the
file-level sync and section 1's readFileBytes calls, the byte comparison sees
the stamped file (which differs from the canonical) and fails.

Fix: add a describe-scoped beforeAll inside section 1 that re-runs the sync
immediately before the byte comparisons start.  This collapses the race
window from 'entire beforeAll + test-collection time' to near-zero.

The byte-for-byte assertion itself is unchanged; this only makes the setup
more resilient.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bradygaster and others added 2 commits August 9, 2026 04:05
…e workflows)

gh aw init had never been run in this repo; this adds the standard scaffolding
gh-aw generates for a repository that authors and ships agentic workflows.

We are now a gh-aw publisher (.github/workflows/shared/squad.md,
squad-backlog-triage.md, aw.yml in PR #1587), so this tooling protects the
correctness of what we ship:

- .github/skills/agentic-workflows/ and agentic-workflow-designer/: designer /
  dispatcher skills that keep gh-aw frontmatter and compiled .lock.yml correct.
- .github/agents/agentic-workflows.md: the gh-aw authoring sub-agent.
- .github/workflows/copilot-setup-steps.yml: lets @copilot run 'gh aw compile'
  in CI rather than hand-editing generated .lock.yml files.
- .github/workflows/agentics-maintenance.yml: REQUIRED because
  squad-backlog-triage.md uses 'expires: 7' — this workflow closes the
  gh-aw-created expiring issues/PRs/discussions.
- .github/mcp.json: configures the gh-aw MCP server for the CLOUD coding agent.
  The local-CLI equivalent lives in root .mcp.json and is intentionally NOT
  included here.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Pin actions/checkout to SHA (supply-chain hardening)
- Fix MCP tool name: agentic-workflows → github-agentic-workflows
- Remove reference to non-existent skills/otel-queries/SKILL.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bradygaster
bradygaster force-pushed the squad/gh-aw-init-tooling branch from 88d34c8 to dcdad08 Compare August 9, 2026 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants