elastic / elastic/ai-github-actions

[product-manager-impersonator] Example Trigger Lint Gate

Open
#796 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
11
Forks
16
Avg merge
22h 9m
Merged PRs (30d)
31

Description

## Feature Idea

**Summary:** Add CI linting for all `gh-agent-workflows/*/example.yml` files so broken copy-paste trigger templates are caught before release.

## Why a Customer Would Want This
Teams adopt these workflows by copying `example.yml` files directly into `.github/workflows/`. When an example file is invalid, users only discover it after setup, which erodes trust and creates avoidable support churn.

## Rough Implementation Sketch
- Extend `make lint-workflows` to include `gh-agent-workflows/*/example.yml` (and `.yaml`) in the `actionlint` loop.
- Keep current lint coverage for `claude-workflows` examples and `.github/workflows/trigger-*.yml`; add this as an additional source set.
- Fail CI when any published example trigger is invalid.
- Add a short note to `gh-agent-workflows/DEVELOPING.md` documenting that `example.yml` must pass workflow lint.

## Why It Won't Be That Hard
This is a small, low-risk CI guardrail: mostly a `Makefile` path expansion plus a docs note. It reuses existing tooling (`bin/actionlint`) and current lint targets, with no runtime/workflow architecture changes.

## Evidence
- `Makefile` currently lints `claude-workflows` examples and selected `.github/workflows` files, but not `gh-agent-workflows/*/example.yml` (`Makefile:204-217`).
- `gh-agent-workflows/DEVELOPING.md` defines `example.yml` as the source users copy into consuming repos (`gh-agent-workflows/DEVELOPING.md:38`, `gh-agent-workflows/DEVELOPING.md:204-209`).
- `scripts/quick-setup.sh` downloads `gh-agent-workflows/$workflow/example.yml` directly during setup (`scripts/quick-setup.sh:194-203`).
- A recent defect came from an invalid example file and required a fix PR (#712), showing this exact failure mode is real.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 169 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - issue:elastic/ai-github-actions#795 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#765 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#718 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#749 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#770 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#774 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#779 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#785 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#782 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#786 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#784 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#753 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#783 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#781 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#780 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/ai-github-actions#778 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - ... and 153 more items
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/23535913081)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.