Skip to content

ci: configure Context7 and automate routine updates #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jbdevprimary wants to merge 2 commits into
base: main
Choose a base branch
from
Open

ci: configure Context7 and automate routine updates #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
89d49ee
ci: configure Context7 and automate routine updates
jbdevprimary Aug 24, 2026
81c271d
test: update automation workflow contract
jbdevprimary Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ updates:
schedule:
interval: weekly
groups:
major:
patterns: ["*"]
update-types: ["major"]
minor-and-patch:
patterns: ["*"]
update-types: ["minor", "patch"]
Expand All @@ -20,6 +23,9 @@ updates:
schedule:
interval: weekly
groups:
major:
patterns: ["*"]
update-types: ["major"]
minor-and-patch:
patterns: ["*"]
update-types: ["minor", "patch"]
Expand All @@ -28,6 +34,9 @@ updates:
schedule:
interval: weekly
groups:
major:
patterns: ["*"]
update-types: ["major"]
minor-and-patch:
patterns: ["*"]
update-types: ["minor", "patch"]
Expand All @@ -36,5 +45,8 @@ updates:
schedule:
interval: weekly
groups:
major:
patterns: ["*"]
update-types: ["major"]
actions:
patterns: ["*"]
4 changes: 2 additions & 2 deletions .github/workflows/automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,14 +18,14 @@ jobs:
name: Enable auto-merge
runs-on: ubuntu-latest
if: >
github.event.pull_request.user.login == 'dependabot[bot]' ||
(github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch')) ||

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Include the non-major Actions group in automation

For non-major GitHub Actions updates, .github/dependabot.yml puts the dependencies in the actions group because the preceding major group only accepts major updates. Those grouped PR titles identify the actions group rather than minor-and-patch, so this predicate—and the matching predicates in ci.yml and e2e-ollama.yml—remains false for every routine Actions update. Match the actions group here as well, or rename it consistently, so the newly separated non-major updates actually receive the intended skip-and-automerge policy.

Useful? React with 👍 / 👎.

(
github.event.pull_request.user.login == 'github-actions[bot]' &&
startsWith(github.event.pull_request.head.ref, 'release-please--')
Comment on lines 22 to 24

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Authenticate release-please before relying on its PR event

When .github/workflows/release.yml opens or synchronizes the release-please PR, the action still uses the default GITHUB_TOKEN because no token input is configured. GitHub documents that events triggered by GITHUB_TOKEN “will not create a new workflow run,” so this pull_request_target workflow never starts for those automatic PR updates; supplying CI_GITHUB_TOKEN inside the untriggered workflow cannot enable auto-merge. Configure release-please itself with a non-default token so its PR events can trigger this workflow. GitHub automatic token authentication

AGENTS.md reference: AGENTS.md:L70-L73

Useful? React with 👍 / 👎.

)
steps:
- name: Enable auto-merge (merge commit)
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ secrets.CI_GITHUB_TOKEN }}

@amazon-q-developer amazon-q-developer Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Risk: Using secrets.CI_GITHUB_TOKEN instead of the built-in github.token grants this workflow access to a custom token that may have elevated permissions beyond what's necessary for auto-merge operations. This increases the attack surface if the workflow is compromised. The built-in github.token with explicitly scoped permissions (contents: write, pull-requests: write) is sufficient and more secure for this use case. If CI_GITHUB_TOKEN is required for specific permissions, document why it's necessary and ensure it follows the principle of least privilege.

PR_URL: ${{ github.event.pull_request.html_url }}
run: gh pr merge --auto --merge "$PR_URL"
8 changes: 8 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ jobs:
test:
name: Python ${{ matrix.python-version }}
runs-on: ubuntu-latest
if: >
!(github.event_name == 'pull_request' &&
((github.event.pull_request.user.login == 'github-actions[bot]' && startsWith(github.event.pull_request.head.ref, 'release-please--')) ||
(github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch'))))
permissions:
contents: read
strategy:
Expand All @@ -36,6 +40,10 @@ jobs:
quality:
name: Quality, Sourcey docs, build
runs-on: ubuntu-latest
if: >
!(github.event_name == 'pull_request' &&
((github.event.pull_request.user.login == 'github-actions[bot]' && startsWith(github.event.pull_request.head.ref, 'release-please--')) ||
(github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch'))))
permissions:
contents: read
steps:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/e2e-ollama.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ jobs:
e2e:
name: E2E tests with local Ollama
runs-on: ubuntu-latest
if: >
!(github.event_name == 'pull_request' &&
((github.event.pull_request.user.login == 'github-actions[bot]' && startsWith(github.event.pull_request.head.ref, 'release-please--')) ||
(github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch'))))
timeout-minutes: 15
env:
OLLAMA_BASE_URL: http://localhost:11434
Expand Down
15 changes: 15 additions & 0 deletions context7.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"$schema": "https://context7.com/schema/context7.json",
"projectTitle": "Agentic Fabric",
"description": "Framework-agnostic discovery, runtime selection, and orchestration for YAML-defined agent fabrics.",
"branch": "main",
"folders": ["docs", "packages/agentic-fabric", "packages/pytest-agentic-fabric"],
"excludeFolders": [".agent-state", "**/tests", "**/__pycache__", "docs/dist", "docs/node_modules"],
"excludeFiles": ["CHANGELOG.md"],
"rules": [
"Keep the ownership chain ExtendedData -> VendorData -> AgenticData; agentic-fabric must not bypass vendor-fabric provider dispatch.",
"Keep optional framework imports lazy and registry-backed.",
"Route provider-backed tools through vendor-fabric capabilities rather than vendor SDKs or the Go binding directly.",
"Keep public documentation, package READMEs, examples, tests, and implementation aligned."
]
}
5 changes: 4 additions & 1 deletion packages/agentic-fabric/tests/test_workflow_contracts.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,13 @@ def test_automerge_uses_base_context_and_merge_commits() -> None:
}
assert workflow["permissions"] == {"contents": "write", "pull-requests": "write"}
assert "github-actions[bot]" in automerge["if"]
assert "minor-and-patch" in automerge["if"]
assert all("uses" not in step or "actions/checkout" not in step["uses"] for step in steps)
assert steps == [
{
"name": "Enable auto-merge (merge commit)",
"env": {
"GH_TOKEN": "${{ github.token }}",
"GH_TOKEN": "${{ secrets.CI_GITHUB_TOKEN }}",
"PR_URL": "${{ github.event.pull_request.html_url }}",
},
"run": 'gh pr merge --auto --merge "$PR_URL"',
Expand All @@ -59,6 +60,8 @@ def test_ci_has_a_sourcey_aware_machine_gate_and_fork_policy() -> None:
assert workflow["jobs"]["dependency-review"]["name"] == "Dependency Review / gate"
assert workflow["jobs"]["repository-policy"]["name"] == "Repository Policy / gate"
assert workflow["jobs"]["gate"]["name"] == "CI / gate"
assert "release-please--" in workflow["jobs"]["test"]["if"]
assert "minor-and-patch" in workflow["jobs"]["quality"]["if"]
policy_script = workflow["jobs"]["repository-policy"]["steps"][0]["with"]["script"]
assert "pull.head.repo.full_name" in policy_script
assert "docs/sourcey.config.ts" in policy_script
Expand Down