Repository navigation
feat: bring agentic bootstrap upstream with gh-aw 1.x integrity support - #2413
Open
bradygaster wants to merge 4 commits into
Open
bradygaster wants to merge 4 commits into
bradygaster wants to merge 4 commits into
Conversation
Relates to bradygaster#1. Preserve canonical upstream references and the intended unpinned 1.x target without claiming an unsupported installation contract. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Draft
7 of 9 tasks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| Bootstrap this repository with GitHub's Squad agentic workflows from `github/squad`. Inspect the repo first, make only the necessary changes, validate them, and open a PR for human review if your tools permit it. Do not merge. | ||
| Before editing: | ||
| - Check the default branch, working tree, authentication, and existing `.github/aw/`, `.github/workflows/`, and `.github/skills/` files. |
| - Require published compatibility evidence for that revision, `github/squad/workflows` ownership, and the installed 1.x compiler. The current package still binds ownership to `bradygaster/squad/workflows`, requires v0.91.5 compiler/action pins, and verifies complete compiled-lock digests. Until those contracts are migrated and validated together, STOP before installation and report the incompatibility. Do not rewrite ownership, regenerate trusted digests in the consumer repo, or weaken the verifier. | ||
| - Check that Issues are enabled and Actions permissions match the documented Profile A (`default_workflow_permissions=read`, `can_approve_pull_request_reviews=false`). Don't change settings without explicit authorization. | ||
| Only after every prerequisite passes, install on `chore/squad-gh-aw-bootstrap`, without overwriting existing work: |
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 4 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ❌ | CI passing | 4 check(s) failing: test, test, Verify exact SHA and build evidence, submit-nuget |
Files Changed (48 files, +750 −360)
| File | +/− |
|---|---|
.changeset/gh-aw-upstream-one.md |
+6 −0 |
.github/agents.md |
+2 −2 |
.github/workflows/squad-ci.yml |
+4 −4 |
.github/workflows/squad-gh-aw-hosted-e2e.yml |
+3 −3 |
.github/workflows/squad-release-verify.yml |
+2 −2 |
.github/workflows/squad-standalone-release.yml |
+1 −1 |
.squad-templates/skills/gh-aw-enlistment/SKILL.md |
+39 −27 |
README.md |
+1 −1 |
agents-agentic-workflows.md |
+31 −0 |
cspell.json |
+1 −0 |
docs/src/content/docs/guide/gh-aw.md |
+114 −40 |
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md |
+39 −27 |
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md |
+39 −27 |
scripts/gh-aw-hosted-e2e.mjs |
+5 −5 |
templates/skills/gh-aw-enlistment/SKILL.md |
+39 −27 |
test/gh-aw-activate-fast-path-label-provisioning.test.ts |
+1 −1 |
test/gh-aw-activation-capacity.test.ts |
+2 −2 |
test/gh-aw-activation-finalization.test.ts |
+15 −4 |
test/gh-aw-activation-label-provisioning.test.ts |
+1 −1 |
test/gh-aw-activation-temporary-ids.test.ts |
+2 −2 |
test/gh-aw-command-authorization.test.ts |
+30 −4 |
test/gh-aw-compiler-compatibility.test.ts |
+89 −0 |
test/gh-aw-enlistment-skill.test.ts |
+39 −23 |
test/gh-aw-hosted-e2e.test.ts |
+5 −3 |
test/gh-aw-implement-workflow.test.ts |
+5 −2 |
test/gh-aw-install-staging.test.ts |
+22 −1 |
test/gh-aw-quality.test.ts |
+38 −32 |
test/gh-aw-review-workflow.test.ts |
+4 −4 |
test/gh-aw-verify-resource.test.ts |
+1 −1 |
test/helpers/gh-aw-diagnostic-runtime.ts |
+18 −8 |
test/helpers/gh-aw-install-fixture.ts |
+2 −2 |
test/squad-cli-latest.test.ts |
+2 −1 |
workflows/README.md |
+1 −1 |
workflows/aw.yml |
+1 −1 |
workflows/package/squad-bootstrap.md |
+1 −1 |
workflows/package/squad-deps-worker.md |
+2 −1 |
workflows/package/squad-implement-worker.md |
+2 −1 |
workflows/package/squad-retro.md |
+2 −1 |
workflows/package/squad-review.md |
+1 −0 |
workflows/package/squad.md |
+9 −4 |
workflows/shared/squad-command-contract.mjs |
+2 −2 |
workflows/shared/squad-install-verifier.mjs |
+31 −13 |
workflows/shared/squad.md |
+4 −3 |
workflows/skills/gh-aw-enlistment/SKILL.md |
+39 −27 |
workflows/squad-bootstrap.md |
+1 −1 |
workflows/squad-review.md |
+1 −0 |
workflows/squad-workflows.manifest.json |
+44 −44 |
workflows/squad.md |
+7 −3 |
Total: +750 −360
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Refs #2413. Preserve immutable compiler actions, native ownership, full lock digests and unconditional final review enforcement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
bradygaster
changed the title
Refs #2413. Validate unsized attributed issue bodies before reservation, accept the pinned serialized-plan envelope, and preserve unapproved compiler auxiliary files. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Refs #2413. Add the compiler-generated filename term to the existing documentation dictionary. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
bradygaster
marked this pull request as ready for review
November 8, 2026 08:58
Copilot stopped reviewing on behalf of
bradygaster due to an error
November 8, 2026 08:58
Contributor
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
1 open issue
What changed in this PR
Migrates the Squad gh-aw package identity from the fork to github/squad, upgrades the pinned gh-aw toolchain to v1.0.1, and updates the workflow/runtime contracts, documentation, and tests to match the new compiler and install surfaces.
Changes:
- Bump pinned gh-aw and gh-aw-actions references from v0.91.5 to v1.0.1 across workflows, verifier, CI, and docs.
- Switch package/install identity from
bradygaster/squad/workflowstogithub/squad/workflows(including ownership paths/digests). - Update activation issue-body rendering to gh-aw v1.0.1 report rendering, and add/extend verification + compatibility tests.
| File | Description |
|---|---|
| workflows/squad.md | Update pinned gh-aw-actions setup version and adjust issue body rendering glue for v1.0.1. |
| workflows/squad-workflows.manifest.json | Update package identity, minimum gh-aw version, and digests/lock hashes for the new contract. |
| workflows/squad-review.md | Add new detection-gate: status-only metadata for the review job. |
| workflows/squad-bootstrap.md | Update embedded resource digest for the updated verifier runtime. |
| workflows/skills/gh-aw-enlistment/SKILL.md | Migrate install instructions to github/squad, shift to “stable 1.x” compiler family guidance, and update staging exclusions. |
| workflows/shared/squad.md | Use github/squad action namespace and pass repository to force canonical releases. |
| workflows/shared/squad-install-verifier.mjs | Update package constants to github/squad, bump min/version pins to v1.0.1, expand action pin contract, and update ownership validation. |
| workflows/shared/squad-command-contract.mjs | Update structured-data parsing regex for v1.0.1 report formatting. |
| workflows/package/squad.md | Mirror workflows/squad.md changes in the packaged source workflow. |
| workflows/package/squad-review.md | Mirror workflows/squad-review.md detection gate metadata. |
| workflows/package/squad-retro.md | Move standalone installer action reference to github/squad and pass repository. |
| workflows/package/squad-implement-worker.md | Move standalone installer action reference to github/squad and pass repository. |
| workflows/package/squad-deps-worker.md | Move standalone installer action reference to github/squad and pass repository. |
| workflows/package/squad-bootstrap.md | Update embedded resource digest for the updated verifier runtime. |
| workflows/aw.yml | Bump minimum gh-aw version required by the package manifest to v1.0.1. |
| workflows/README.md | Update installation command to new package identity (github/squad/workflows). |
| test/squad-cli-latest.test.ts | Assert the shared workflow uses github/squad action and sets repository. |
| test/helpers/gh-aw-install-fixture.ts | Update source annotations and installer strings to new github/squad + v1.0.1 contract. |
| test/helpers/gh-aw-diagnostic-runtime.ts | Update pinned runtime SHA and tighten sandbox allow/deny rules with better error attribution. |
| test/gh-aw-verify-resource.test.ts | Update mutation tests to reflect github/ owner in source binding checks. |
| test/gh-aw-review-workflow.test.ts | Update expected min-version and package install surfaces to github/squad. |
| test/gh-aw-quality.test.ts | Update pinned setup SHA, adjust compile-failure expectations, and expand pin/credential failure checks. |
| test/gh-aw-install-staging.test.ts | Add coverage that staging excludes auxiliary gh-aw outputs while preserving pre-existing files; update recovery command text. |
| test/gh-aw-implement-workflow.test.ts | Update expected install command and tighten assertions around if: expression shape. |
| test/gh-aw-hosted-e2e.test.ts | Update expected ownership path and trusted source identity to github. |
| test/gh-aw-enlistment-skill.test.ts | Update the enlistment skill contract tests for stable 1.x preflight behavior and new package identity. |
| test/gh-aw-compiler-compatibility.test.ts | New: explicit tests for the gh-aw 1.x upstream installation/ownership contract and pin mutation rejection. |
| test/gh-aw-command-authorization.test.ts | Extend sandbox IO forbiddance coverage and update report/handler expectations for v1.0.1 formatting. |
| test/gh-aw-activation-temporary-ids.test.ts | Update required compiler version strings to v1.0.1. |
| test/gh-aw-activation-label-provisioning.test.ts | Update required compiler version strings to v1.0.1. |
| test/gh-aw-activation-finalization.test.ts | Wire report AST module into the compiled fixture and adjust sizing logic to new renderer behavior. |
| test/gh-aw-activation-capacity.test.ts | Update required compiler version strings to v1.0.1. |
| test/gh-aw-activate-fast-path-label-provisioning.test.ts | Update required compiler version strings to v1.0.1. |
| templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill updates in the template. |
| scripts/gh-aw-hosted-e2e.mjs | Update trusted source identity from bradygaster to github and docs references accordingly. |
| packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill template updates for squad-sdk packaging. |
| packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill template updates for squad-cli packaging. |
| docs/src/content/docs/guide/gh-aw.md | Update the guide for the new compiler contract (v1.0.1), new package identity, staging exclusions, and add a 1.x compatibility section. |
| cspell.json | Add agentics to dictionary. |
| agents-agentic-workflows.md | New: bootstrap prompt aligned to the new v1.0.1/github/squad contract and auxiliary-output handling. |
| README.md | Update install command to use github/squad/workflows. |
| .squad-templates/skills/gh-aw-enlistment/SKILL.md | Mirror enlistment skill changes in the .squad-templates copy. |
| .github/workflows/squad-standalone-release.yml | Update release automation URL references to the new github/squad repo. |
| .github/workflows/squad-release-verify.yml | Bump pinned gh-aw install in CI to v1.0.1. |
| .github/workflows/squad-gh-aw-hosted-e2e.yml | Update repo gate from fork to github/squad and bump gh-aw pin to v1.0.1. |
| .github/workflows/squad-ci.yml | Bump pinned gh-aw install steps in CI to v1.0.1. |
| .github/agents.md | Update installation command and narrative to v1.0.1 + github/squad. |
| .changeset/gh-aw-upstream-one.md | New changeset documenting the gh-aw 1.x + upstream github/squad migration for published packages. |
Review effort: Lite (auto)
Comment on lines
+46
to
66
| # 1. Verify GitHub access and require the stable gh-aw 1.x compiler family | ||
| gh auth status | ||
|
|
||
| # gh-aw-exact-version-start | ||
| required_gh_aw_version="v0.91.5" | ||
| gh_aw_version_output="$(gh aw --version 2>&1)" || gh_aw_version_output="" | ||
| gh_aw_version="$(printf '%s\n' "${gh_aw_version_output}" | awk 'END {print $NF}')" | ||
|
|
||
| if [ "${gh_aw_version}" != "${required_gh_aw_version}" ]; then | ||
| echo "Installing exact supported gh-aw ${required_gh_aw_version}." | ||
| if [ -z "${gh_aw_version}" ] || [[ "${gh_aw_version}" =~ ^v0\. ]]; then | ||
| echo "Installing the current stable gh-aw release." | ||
| gh extension remove gh-aw >/dev/null 2>&1 || true | ||
| gh extension install --pin "${required_gh_aw_version}" github/gh-aw | ||
| gh extension install github/gh-aw | ||
| gh_aw_version_output="$(gh aw --version 2>&1)" || { | ||
| echo "STOP: gh-aw version could not be verified after clean installation." >&2 | ||
| exit 1 | ||
| } | ||
| gh_aw_version="$(printf '%s\n' "${gh_aw_version_output}" | awk 'END {print $NF}')" | ||
| fi | ||
|
|
||
| test "${gh_aw_version}" = "${required_gh_aw_version}" || { | ||
| echo "STOP: required gh-aw v0.91.5, but found ${gh_aw_version:-unavailable} after clean installation." >&2 | ||
| [[ "${gh_aw_version}" =~ ^v1\.[0-9]+\.[0-9]+$ ]] || { | ||
| echo "STOP: stable gh-aw 1.x is required, but found ${gh_aw_version:-unavailable}." >&2 | ||
| exit 1 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bring the bootstrap prompt from bradygaster#1 to
github/squad:devand complete the native Squad workflow package's migration to canonical upstream ownership and the reviewed gh-aw 1.0.1 compiler/runtime contract. Customer-facing installation no longer pins an exact patch version. Final published HEAD:2c4a0d9f076b7a6ae160d5ed89cb11fdc6ae7494. Kept as a draft; nothing has been merged.Why
Relates to bradygaster#1. @pelikhan requested “Don't lock to a version”, “let's upgrade to 1.x”, and “Otherwise LGTM, let's test it.” GitHub cannot change an existing PR's base repository, so this is its upstream replacement. No closing issue was supplied.
How
Working as agentic-workflows-dev (Agentic Workflows Engineer). Update package ownership, repository identity, the actual immutable upstream init action, compiler/action pins and deterministic no-auth action-cache resolution together. Regenerate package sources and complete-lock/runtime digests instead of weakening verification. CI reproducibly uses the reviewed 1.0.1 compiler; customers install stable 1.x and must pass the approved package contract. Future compiler outputs require reviewed regeneration, not automatic acceptance.
Preserve immutable Squad revisions, conflict/ownership inspection, strict installation/staged verification and human review. Synchronize shipped enlistment skills and add a SDK/CLI patch changeset. Accommodate actual pinned-runtime Markdown/provenance behavior while retaining authorization and fail-closed boundaries. Measure full attributed issue reports before the 1.x runtime can redact oversized context: exact 65,535/65,536/65,537-code-unit ASCII and supplementary-Unicode regressions cover reservation safety. Constrain diagnostic-harness IO and exclude unapproved maintenance/editor outputs from default staging without deleting pre-existing files.
npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes).changeset/gh-aw-upstream-one.mdcovers shipped SDK/CLI template changes.PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)git fetch origin dev --quiet && git merge-base --is-ancestor origin/dev HEAD— passed; upstream dev remains7b731ec97f35346bdc4fa87c3edaf16b808fc0ae. Four scoped integration commits; no force push or history rewriting. Cumulative diff: 48 files, 750 insertions, 360 deletions.Build & Test
npm run buildpassesnpm testpasses (all tests green)npm run lintpasses (type check clean)npm run lint:eslintpassesLocal validation used the checksum-verified official v1.0.1 binary through
SQUAD_GH_AW_BIN; the specialist's full run also used a shim so directgh awinvocations select that same binary. Final HEAD differs from the runtime follow-up only by a one-linecspell.jsontechnical-word addition.SKIP_BUILD_BUMP=1 npm run buildSQUAD_GH_AW_BIN="$SQUAD_GH_AW_BIN" node workflows/shared/squad-install-verifier.mjs --check-sourcenpm run lintnpm run lint:eslintnode_modules/.bin/vitest run test/gh-aw-compiler-compatibility.test.ts test/gh-aw-install-staging.test.tsnode_modules/.bin/vitest run test/gh-aw-activation-finalization.test.ts test/gh-aw-command-authorization.test.ts test/gh-aw-install-staging.test.ts test/squad-cli-latest.test.ts --maxWorkers=2node_modules/.bin/markdownlint-cli2 agents-agentic-workflows.md docs/src/content/docs/guide/gh-aw.mdnode_modules/.bin/cspell --no-progress --dot 'docs/src/content/**/*.md' README.mdagentics, 186 files, zero issues.git diff origin/dev...HEAD --checkFull bounded run, with canonical local temporary path, approved compiler shim and binary:
TMPDIR="$(cd "${TMPDIR:-/tmp}" && pwd -P)" PATH="$GH_AW_SHIM/bin:$PATH" SQUAD_GH_AW_BIN="$SQUAD_GH_AW_BIN" node_modules/.bin/vitest run --maxWorkers=4— 12,765 passed, 8 failed, 35 expected failures, 152 skipped, 46 todo (13,006 total); 378 suites passed, four failed, two skipped. No migration-coupled failures remain.Remaining failures were not patched:
test/cli-packaging-smoke.test.tscases: forced-missing node-pty and unknown command. Reproduced on the earlier documentation-only CI baseline, wherevscode-jsonrpc/node.jspackage exports prevent startup.test/cli/export-import.test.tsexternal-state fixtures: export from the external state directory and preference over stale local files.Mutation evidence: reverting the live attributed-body formatter makes both 65,537-code-unit cases fail (ASCII and supplementary Unicode), while 65,535/65,536 remain green; restoring the formatter passes all six boundaries. Original compiler/ownership regressions were red before migration. The actual guide staging command was red before the auxiliary exclusion; the revised command preserves pre-existing editor bytes and excludes maintenance/editor paths. TLS/SQLite/socket IO remains explicitly rejected by diagnostic-runtime tests.
Fresh native consumer validation against final published HEAD, with no remote consumer repository created:
../gh-aw add github/squad/workflows@2c4a0d9f076b7a6ae160d5ed89cb11fdc6ae7494— passed.node .github/workflows/shared/squad-install-verifier.mjs --materialize-runtime— passed.../gh-aw compile --strict --no-check-update— passed, 8/8 workflows, the two documented source warnings (pull_request_target, combinedslash_command/bots) and outdated authored-action notices.node .github/workflows/shared/squad-install-verifier.mjs --verify-install --source-revision 2c4a0d9f076b7a6ae160d5ed89cb11fdc6ae7494 --strict-compile— passed.node .github/workflows/shared/squad-install-verifier.mjs --verify-staged-install --stage-ownership --source-revision 2c4a0d9f076b7a6ae160d5ed89cb11fdc6ae7494— passed;.vscode/settings.jsonandagentics-maintenance.ymlexcluded..github/workflows/shared/squad.mdwas rejected:Installed digest mismatch for .github/workflows/shared/squad.md.Restoring exact bytes returned native and staged verification to green.Final HEAD CI is running. No entirely-green full-suite claim is made. No hosted activation, hosted settings changes, secrets or consumer-repository writes were performed; successful local installation/verification does not claim hosted execution.
Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only — write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)Patch changeset added directly in the existing Markdown format; no new SDK/CLI source APIs.
Docs
README canonical upstream link, bootstrap prompt, gh-aw guide and canonical/synchronized enlistment skills updated. No new standalone module requiring a README feature section. Auxiliary compiler maintenance/editor output and preservation of pre-existing files are explicitly documented.
Exports
N/A: no new SDK module or subpath export.
Breaking Changes
The native workflow package now uses
github/squad/workflowsownership and the reviewed 1.0.1 compiler/action/digest contract. Existing fork-owned installations must follow conflict/ownership checks; do not silently overwrite ownership or accept unreviewed future compiler outputs. No public SDK/CLI API change.Waivers
None approved. The requested migration is implemented and locally verified, but the PR remains draft: final hosted CI is running and the full local suite still has the eight unrelated failures documented above. Any decision to merge with outstanding failures requires Lead/Quality approval; no waiver or merge authorization is implied.