Skip to content

fix(gh-aw): converge on 0.89.22 and restore bootstrap - #2122

Merged
bradygaster merged 2 commits into
devfrom
bradygaster-squad-gh-aw-ga-plan
Oct 1, 2026
Merged

bradygaster merged 2 commits into
devfrom
bradygaster-squad-gh-aw-ga-plan

Conversation

@bradygaster

@bradygaster bradygaster commented Oct 1, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • upgrade the Squad gh-aw package contract, compiler action pins, enlistment guidance, CI, and hosted controller from v0.89.21 to v0.89.22
  • regenerate all eight workflow digest pairs and embedded verifier digests with the immutable github/gh-aw-actions v0.89.22 commit
  • preserve isolated bootstrap candidate validation while resolving committed Cast provenance from the trusted checkout, allowing materialization to create the Cast PR and research issue
  • add regression coverage proving a .git-less candidate fails without trusted history and succeeds only when the checkout is supplied as gitRoot
  • update deterministic mutation expectations, integrity manifests, package copies, and the reviewed plaintext validator mirror

This resolves the version convergence gap documented in octodemo/zava-social-cao-ops-20260929111840#18 and the bootstrap materialization regression documented in octodemo/zava-social-cao-ops-20260929111840#26.

Validation

  • npm run gh-aw:integrity:check — passed
  • CI=true npm run build — passed
  • node node_modules/vitest/vitest.mjs run test/gh-aw-bootstrap-workflow.test.ts test/gh-aw-cast-validator.test.ts test/gh-aw-enlistment-skill.test.ts test/gh-aw-review-workflow.test.ts test/gh-aw-quality.test.ts test/gh-aw-install-staging.test.ts test/gh-aw-hosted-e2e.test.ts — passed, 726 tests
  • independent bootstrap trust-boundary review — approved with no actionable findings

Review notes

  • candidate file bytes remain isolated under the candidate root; only committed registry/history provenance is read from the trusted gitRoot
  • missing or invalid trusted Git history remains a hard validation failure; there is no fallback or success-shaped bypass
  • no workflow permissions, triggers, safe-output limits, or credential surfaces changed
  • package topology remains 8 workflows, 17 runtime resources, and 1 skill

⚠️ Needs agentic-workflows-dev and integration-e2e-tester review before merging.

Closes octodemo/zava-social-cao-ops-20260929111840#18
Closes octodemo/zava-social-cao-ops-20260929111840#26

Closes octodemo/zava-social-cao-ops-20260929111840#18

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings October 1, 2026 09:15
@github-actions

github-actions Bot commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit b545508

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status Check Details
❌ Single commit 2 commits — consider squashing before review
✅ Not in draft Ready for review
✅ Branch up to date Up to date with dev
❌ Copilot review No Copilot review yet — it may still be processing
✅ Changeset present Changeset file found
✅ Scope clean No .squad/ or docs/proposals/ files
✅ No merge conflicts No merge conflicts
✅ Copilot threads resolved No Copilot review threads
✅ CI passing All checks passing

Files Changed (24 files, +119 −87)

File +/−
.changeset/bright-gh-aw-central-ops.md +6 −0
.github/workflows/squad-ci.yml +4 −4
.github/workflows/squad-gh-aw-hosted-e2e.yml +2 −2
.squad-templates/skills/gh-aw-enlistment/SKILL.md +4 −4
docs/src/content/docs/guide/gh-aw.md +5 −5
packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md +4 −4
packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md +4 −4
scripts/validate-gh-aw-cast.mjs +4 −4
templates/skills/gh-aw-enlistment/SKILL.md +4 −4
test/gh-aw-bootstrap-workflow.test.ts +24 −1
test/gh-aw-enlistment-skill.test.ts +1 −1
test/gh-aw-quality.test.ts +4 −4
test/gh-aw-review-workflow.test.ts +2 −2
test/helpers/gh-aw-install-fixture.ts +1 −1
workflows/aw.yml +1 −1
workflows/package/squad-bootstrap.md +4 −3
workflows/package/squad.md +1 −1
workflows/shared/squad-bootstrap-validator.mjs +2 −1
workflows/shared/squad-cast-validator.mjs +4 −4
workflows/shared/squad-install-verifier.mjs +6 −6
workflows/skills/gh-aw-enlistment/SKILL.md +4 −4
workflows/squad-bootstrap.md +4 −3
workflows/squad-workflows.manifest.json +23 −23
workflows/squad.md +1 −1

Total: +119 −87


This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

@github-actions

github-actions Bot commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor

🟠 Impact Analysis — PR #2122

Risk tier: 🟠 HIGH

📊 Summary

Metric Count
Files changed 24
Files added 1
Files modified 23
Files deleted 0
Modules touched 8

🎯 Risk Factors

  • 24 files changed (21-50 → HIGH)
  • 8 modules touched (5-8 → HIGH)

📦 Modules Affected

ci-workflows (2 files)
  • .github/workflows/squad-ci.yml
  • .github/workflows/squad-gh-aw-hosted-e2e.yml
docs (1 file)
  • docs/src/content/docs/guide/gh-aw.md
root (12 files)
  • .changeset/bright-gh-aw-central-ops.md
  • templates/skills/gh-aw-enlistment/SKILL.md
  • workflows/aw.yml
  • workflows/package/squad-bootstrap.md
  • workflows/package/squad.md
  • workflows/shared/squad-bootstrap-validator.mjs
  • workflows/shared/squad-cast-validator.mjs
  • workflows/shared/squad-install-verifier.mjs
  • workflows/skills/gh-aw-enlistment/SKILL.md
  • workflows/squad-bootstrap.md
  • workflows/squad-workflows.manifest.json
  • workflows/squad.md
scripts (1 file)
  • scripts/validate-gh-aw-cast.mjs
squad-cli (1 file)
  • packages/squad-cli/templates/skills/gh-aw-enlistment/SKILL.md
squad-sdk (1 file)
  • packages/squad-sdk/templates/skills/gh-aw-enlistment/SKILL.md
templates (1 file)
  • .squad-templates/skills/gh-aw-enlistment/SKILL.md
tests (5 files)
  • test/gh-aw-bootstrap-workflow.test.ts
  • test/gh-aw-enlistment-skill.test.ts
  • test/gh-aw-quality.test.ts
  • test/gh-aw-review-workflow.test.ts
  • test/helpers/gh-aw-install-fixture.ts

This report is generated automatically for every PR. See #733 for details.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The cryptographic workflow contract and hosted execution changes still require the two specialist reviews identified in the PR description.

Review effort: Balanced
Findings: None

What changed in this PR

Updates Squad’s gh-aw contract to v0.89.22, resolving the central-operations version convergence gap.

Changes:

  • Updates compiler, CI, hosted E2E, documentation, and templates to v0.89.22.
  • Regenerates workflow, verifier, and skill integrity digests.
  • Updates fixtures and mutation expectations for new compiler output.
File Description
workflows/​squad-workflows.manifest.json Updates contract version and digests.
workflows/​squad-bootstrap.md Refreshes embedded verifier digest.
workflows/​skills/​gh-aw-enlistment/​SKILL.md Updates installation guidance.
workflows/​shared/​squad-install-verifier.mjs Updates compiler and action pins.
workflows/​package/​squad-bootstrap.md Refreshes generated verifier digest.
workflows/​aw.yml Raises package minimum version.
test/​helpers/​gh-aw-install-fixture.ts Updates fixture installer metadata.
test/​gh-aw-review-workflow.test.ts Updates version assertions.
test/​gh-aw-quality.test.ts Updates compiler mutation digests.
test/​gh-aw-enlistment-skill.test.ts Updates skill pin assertion.
templates/​skills/​gh-aw-enlistment/​SKILL.md Synchronizes root template.
packages/​squad-sdk/​templates/​skills/​gh-aw-enlistment/​SKILL.md Synchronizes SDK template.
packages/​squad-cli/​templates/​skills/​gh-aw-enlistment/​SKILL.md Synchronizes CLI template.
docs/​src/​content/​docs/​guide/​gh-aw.md Updates documented version contract.
.squad-templates/​skills/​gh-aw-enlistment/​SKILL.md Updates canonical skill template.
.github/​workflows/​squad-gh-aw-hosted-e2e.yml Updates hosted E2E compiler.
.github/​workflows/​squad-ci.yml Updates CI compiler pins.
.changeset/​bright-gh-aw-central-ops.md Records CLI and SDK patches.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Validate candidate bytes from the isolated tree while resolving committed Cast provenance from the trusted checkout. Adds regression coverage for CAO integration issue octodemo/zava-social-cao-ops-20260929111840#26.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@bradygaster bradygaster changed the title fix(gh-aw): require 0.89.22 for central ops fix(gh-aw): converge on 0.89.22 and restore bootstrap Oct 1, 2026
@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

🏗️ Architectural Review

Authoritative evidence: base-controlled pull_request_target reporter.

⚠️ Architectural review: 1 warning(s).

Severity Category Finding Files
🟡 warning sweeping-refactor This PR touches 24 files (24 modified/added, 0 deleted). Large PRs are harder to review — consider splitting if possible. —

Automated architectural review — informational only.

@bradygaster
bradygaster merged commit 5c3bf35 into dev Oct 1, 2026
19 of 20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants