Repository navigation
fix(gh-aw): restore hosted E2E and migrate package identity - #2410
Draft
tamirdresher wants to merge 1 commit into
Draft
tamirdresher wants to merge 1 commit into
tamirdresher wants to merge 1 commit into
Conversation
- The hosted E2E guard keys on the repository ID instead of the owner name, so it runs again and fails loudly after any future rename - github/squad/workflows becomes the canonical package identity; existing bradygaster/squad/workflows installs still verify (exact allowlist), and mixed or duplicate ownership records fail with guidance - Install and upgrade docs check the revision's manifest before gh aw add - uses: github/squad/.github/actions/squad-init (same pinned SHA); the action's default release repository is github/squad - Package regenerated with squad-install-verifier --write-source Closes #2403 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ✅ | Single commit | 1 commit — clean history |
| ❌ | Not in draft | PR is still in draft — mark as ready for review when done |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ❌ | CI passing | 2 check(s) failing: test, Verify exact SHA and build evidence |
Files Changed (34 files, +1666 −221)
| File | +/− |
|---|---|
.changeset/repo-move-github-squad-gh-aw-identity.md |
+6 −0 |
.github/actions/squad-init/action.yml |
+2 −2 |
.github/agents.md |
+7 −1 |
.github/workflows/squad-gh-aw-hosted-e2e.yml |
+3 −1 |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
+109 −8 |
README.md |
+20 −1 |
docs/src/content/docs/features/standalone-install.md |
+1 −1 |
docs/src/content/docs/guide/gh-aw.md |
+108 −14 |
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md |
+109 −8 |
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md |
+109 −8 |
scripts/gh-aw-hosted-e2e.mjs |
+11 −7 |
templates/skills/gh-aw-enlistment/SKILL.md |
+109 −8 |
test/fixtures/squad-init-approved.json |
+1 −1 |
test/gh-aw-enlistment-skill.test.ts |
+313 −14 |
test/gh-aw-hosted-e2e.test.ts |
+101 −6 |
test/gh-aw-implement-workflow.test.ts |
+3 −2 |
test/gh-aw-install-staging.test.ts |
+92 −10 |
test/gh-aw-quality.test.ts |
+187 −20 |
test/gh-aw-review-workflow.test.ts |
+17 −4 |
test/gh-aw-verify-resource.test.ts |
+22 −4 |
test/helpers/gh-aw-install-fixture.ts |
+12 −6 |
test/helpers/refresh-squad-init-fixture.mjs |
+2 −2 |
test/squad-cli-latest.test.ts |
+2 −2 |
workflows/README.md |
+13 −1 |
workflows/package/squad-bootstrap.md |
+1 −1 |
workflows/package/squad-deps-worker.md |
+1 −1 |
workflows/package/squad-implement-worker.md |
+1 −1 |
workflows/package/squad-retro.md |
+1 −1 |
workflows/package/squad.md |
+1 −1 |
workflows/shared/squad-install-verifier.mjs |
+148 −32 |
workflows/shared/squad.md |
+3 −3 |
workflows/skills/gh-aw-enlistment/SKILL.md |
+109 −8 |
workflows/squad-bootstrap.md |
+1 −1 |
workflows/squad-workflows.manifest.json |
+41 −41 |
Total: +1666 −221
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The upgrade flow can delete legacy verification metadata after a failed reinstall, and its warning limit blocks valid migrations with committed legacy locks.
2 open issues
What changed in this PR
Updates Squad’s gh-aw distribution for the move to github/squad, restoring hosted end-to-end coverage and migrating package identity while retaining legacy-install compatibility.
Changes:
- Restores hosted E2E execution using the immutable repository ID and updated trusted-source identity.
- Adds canonical and legacy package verification, ownership-migration checks, and regenerated integrity digests.
- Updates action references, installation guides, shipped skills, and regression coverage.
| File | Description |
|---|---|
workflows/squad-workflows.manifest.json |
Updates canonical package identity and integrity digests. |
workflows/squad-bootstrap.md |
Refreshes the verifier integrity digest. |
workflows/skills/gh-aw-enlistment/SKILL.md |
Updates distributed installation and migration guidance. |
workflows/shared/squad.md |
Points the pinned squad-init action at the new owner. |
workflows/shared/squad-install-verifier.mjs |
Adds legacy identity compatibility and migration checks. |
workflows/README.md |
Documents identity support by revision and migration cleanup. |
workflows/package/squad.md |
Regenerates the squad-init action reference. |
workflows/package/squad-retro.md |
Regenerates the squad-init action reference. |
workflows/package/squad-implement-worker.md |
Regenerates the squad-init action reference. |
workflows/package/squad-deps-worker.md |
Regenerates the squad-init action reference. |
workflows/package/squad-bootstrap.md |
Refreshes the generated verifier digest. |
test/squad-cli-latest.test.ts |
Updates action-reference and fixture-source expectations. |
test/helpers/refresh-squad-init-fixture.mjs |
Retrieves pinned fixtures from the new repository. |
test/helpers/gh-aw-install-fixture.ts |
Supports fixtures for either package identity. |
test/gh-aw-verify-resource.test.ts |
Covers legacy installs and cross-identity rejection. |
test/gh-aw-review-workflow.test.ts |
Checks canonical identity across installation surfaces. |
test/gh-aw-quality.test.ts |
Covers identity normalization, ownership, and integrity checks. |
test/gh-aw-install-staging.test.ts |
Covers ownership staging, migration residue, and notices. |
test/gh-aw-implement-workflow.test.ts |
Updates documented installation expectations. |
test/gh-aw-hosted-e2e.test.ts |
Covers repository-ID guards and updated source identity. |
test/gh-aw-enlistment-skill.test.ts |
Covers identity gates and migration instructions. |
test/fixtures/squad-init-approved.json |
Updates source metadata; pinned action bytes remain unchanged. |
templates/skills/gh-aw-enlistment/SKILL.md |
Synchronizes the root skill mirror. |
scripts/gh-aw-hosted-e2e.mjs |
Updates trusted identity and requires canonical hosted installs. |
README.md |
Adds a manifest identity check before installation. |
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md |
Synchronizes the SDK skill mirror. |
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md |
Synchronizes the CLI skill mirror. |
docs/src/content/docs/guide/gh-aw.md |
Documents revision checks, migration, and lock normalization. |
docs/src/content/docs/features/standalone-install.md |
Updates the squad-init usage example. |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
Updates canonical enlistment and upgrade instructions. |
.github/workflows/squad-gh-aw-hosted-e2e.yml |
Replaces the owner-name guard with the repository ID. |
.github/agents.md |
Updates package references and revision requirements. |
.github/actions/squad-init/action.yml |
Changes the default release repository and usage example. |
.changeset/repo-move-github-squad-gh-aw-identity.md |
Records patch releases for the shipped skill updates. |
Review effort: Max (auto)
| fi | ||
| exit 1 | ||
| } | ||
| gh aw add "github/squad/workflows@${SQUAD_SHA}" --force |
| --strict-compile | ||
| ``` | ||
|
|
||
| Apply step 5's two-warning check to the compile output above, then stage and verify as in step 7. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
1151205052) instead of the owner name.github/squad/workflowsthe canonical gh-aw package identity. Existingbradygaster/squad/workflowsinstalls keep verifying (exact allowlist), and mixed identities or duplicate ownership records fail with guidance.uses:atgithub/squad/.github/actions/squad-init(same pinned SHA5c662ba…) and sets the action's default release repository togithub/squad.gh aw addblock (3 in the enlistment skill and its 4 mirrors, 3 in the gh-aw guide, 1 inREADME.md) first readsworkflows/squad-workflows.manifest.jsonat the chosen revision. It stops unless the manifest declaresgithub/squad/workflows..github/agents.mdandworkflows/README.mdstate the same rule.squad-install-verifier --write-source.Working as agentic-workflows-dev (Agentic Workflows Engineer).
Why
After the move,
github.repository == 'bradygaster/squad'is never true, so the hosted E2E stopped running without any error. The verifier enforced onlybradygaster/squad/workflows, so a consumer who installedgithub/squad/workflows@<sha>failed--verify-install. GitHub Actions doesn't follow repository redirects foruses:.Closes #2403
How
Identity
gh aw add bradygaster/squad/workflows@<sha>still works through the redirect. gh-aw records the identity exactly as typed (.github/aw/packages/github-squad-workflows-23a7638f599e.jsonfor the new one).github/squad/workflows(canonical) andbradygaster/squad/workflows(legacy). Case variants, other owners, and wildcards are rejected.github/squad/workflowsverifies only at revisions whoseworkflows/squad-workflows.manifest.jsondeclares it. For an older revision, the check says to install asbradygaster/squad/workflows. If the manifest can't be read, it gives a separate hint.Upgrading
gh aw add "github/squad/workflows@SHA" --force, then remove.github/aw/packages/bradygaster-squad-workflows-3632054824e8.json.Review
After merge
Size (>20 files): 34 files:
workflows/packagefiles and the manifestThree of the docs files (
README.md,gh-aw.md,standalone-install.md) carry only their gh-aw hunks. Their link fixes are in #2405.Validation: these suites need gh-aw v0.91.5 and
jq. They ran in an LF clone of this branch, with a checksum-verifiedgh-aw v0.91.5binary (SQUAD_GH_AW_BIN) and jq 1.7.1:node workflows/shared/squad-install-verifier.mjs --check-source --root .npm run gh-aw:integrity:checknpx vitest run --testTimeout=120000 --hookTimeout=120000 test/gh-aw-implement-workflow.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-verify-resource.test.ts test/gh-aw-install-staging.test.ts test/gh-aw-quality.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-hosted-e2e.test.ts test/squad-cli-latest.test.ts test/template-sync.test.tsrejects symlinked manifest leaves and runtime parentsThe other repo-move PRs are #2406, #2407, #2405, and #2404 (issues).
npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes)PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)Build & Test
npm run buildpasses: no package source changes (build verified on the combined repo-move tree)npm testpasses (all tests green): targeted suites above; the full suite runs in CInpm run lintpasses (type check clean)npm run lint:eslintpassesChangeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed):.changeset/repo-move-github-squad-gh-aw-identity.md(covers the shipped skill template)CHANGELOG.mdentry (maintainers only — write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)Docs
Exports
Breaking Changes
None for existing installs: the
bradygaster/squad/workflowsidentity still verifies. New installs at revisions that include this change should usegithub/squad/workflows; the upgrade path is documented.Waivers
None.