Add branch-actions-detective for failed main CI runs

[strawgate]

Problem

We only have PR-oriented failure detectives today. Failed CI runs on main are not auto-triaged into a tracking issue.

Why now

• Current CI workflow is named Internal: CI, while detective triggers watch CI/Build/Test.
• Existing pr-actions-detective flow requires an associated PR and noops otherwise.

Proposal

Add a new workflow: branch-actions-detective.

Scope:

• Trigger on failed workflow_run for Internal: CI on main.
• Analyze failing jobs/logs.
• Create or update a concise issue with root cause, impact, and suggested next fix.

Acceptance Criteria

• A failed Internal: CI run on main produces/updates one actionable issue.
• Repeated failures dedupe/update instead of creating issue spam.

[github-actions]

3 related issues

• Post issues when mention and triage fall #287 — it tracks creating investigation issues when key workflows fail, which can help with issue-creation and dedupe behavior for this issue.
• Split pr check fix into pr ci detective and pr ci fixer #121 — it established the PR-focused detective/fixer split referenced by this issue, providing context for introducing a branch-oriented detective.
• Add buildkite version of pr failure investigation workflow #239 — it implemented a parallel failure-investigation workflow variant, which may help with trigger and reporting patterns for this issue.

---

What is this? | From workflow: Duplicate Issue Detector

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

tl;dr: I recommend adding a new branch-actions-detective workflow (not extending pr-actions-detective) that triggers on failed Internal: CI runs on main, then updates one rolling issue (or creates it if missing) to avoid issue spam.

Recommendation

Implement branch-actions-detective as a separate event-driven workflow with issue-oriented safe outputs (create-issue + add-comment) and explicit dedupe logic:

1. Trigger only on workflow_run failures for Internal: CI and only when the source branch is main.
2. Search for an existing open issue with a stable prefix (for example [branch-actions-detective] Internal: CI failures on main).
3. If found, post an update comment; if not found, create the issue.

Findings

• Current CI workflow name is Internal: CI on main (.github/workflows/ci.yml:2, .github/workflows/ci.yml:5).
• Existing detective triggers watch only "CI", "Build", "Test" and require a PR association:
  • gh-agent-workflows/pr-actions-detective/example.yml:4
  • gh-agent-workflows/pr-actions-detective/example.yml:17
  • mirrored in dogfood trigger: .github/workflows/trigger-pr-actions-detective.yml:6, .github/workflows/trigger-pr-actions-detective.yml:19.
• The detective prompt explicitly noops when no PR is associated (.github/workflows/gh-aw-pr-actions-detective.md:97).
• Repo conventions for adding a workflow are clear (gh-agent-workflows/DEVELOPING.md:153-159): add .github/workflows/gh-aw-(name).md, gh-agent-workflows/(name)/example.yml, gh-agent-workflows/(name)/README.md, then make compile.
• Related history confirms intent to keep PR-focused detective/fixer workflows (#121, PR #123, PR #271) and therefore supports a separate branch-focused workflow rather than overloading PR detective.

Verification

I ran repository workflow linting to confirm current baseline is clean:

$ make lint-workflows
Setting up actionlint...
Downloading actionlint v1.7.10...
...
Checking .github/workflows/trigger-pr-actions-detective.yml...
Checking .github/workflows/ci.yml...
...
(exited with exit code 0)

I also verified trigger mismatch in code:

gh-agent-workflows/pr-actions-detective/example.yml:4: workflows: ["CI", "Build", "Test"]
gh-agent-workflows/pr-actions-detective/example.yml:17: toJSON(github.event.workflow_run.pull_requests) != '[]'
.github/workflows/ci.yml:2: name: "Internal: CI"

Detailed Action Plan

1. Create workflow shim: .github/workflows/gh-aw-branch-actions-detective.md

   • Base it on .github/workflows/gh-aw-pr-actions-detective.md structure.
   • Keep tools.github including actions, issues, and search.
   • Safe outputs: enable both create-issue and add-comment (single output action per run).
   • Prompt logic: read failed jobs/logs, synthesize root cause + impact + next fix, then dedupe/update issue.

2. Create consumer trigger: gh-agent-workflows/branch-actions-detective/example.yml

   • on.workflow_run.workflows: ["Internal: CI"]
   • types: [completed]
   • Job if: failure + main branch filter (for workflow_run, use github.event.workflow_run.head_branch == 'main').
   • uses: elastic/ai-github-actions/.github/workflows/gh-aw-branch-actions-detective.lock.yml@v0.

3. Create workflow README: gh-agent-workflows/branch-actions-detective/README.md

   • Document trigger, expected issue behavior, dedupe strategy, and required secret(s).

4. Hook docs/navigation

   • Add workflow entry where event-driven workflows are listed (docs/workflows/gh-agent-workflows.md, near current PR detective entries at :61-63).
   • Update nav in mkdocs.yml (current detective entries around mkdocs.yml:31-32).
   • Optionally include in starter set if desired (README.md:24, gh-agent-workflows/README.md:55, scripts/quick-setup.sh:121-127).

5. Compile + validate

   • Run make compile (generates .lock.yml and trigger-*.yml).
   • Run make lint-workflows.
   • Verify generated .github/workflows/trigger-branch-actions-detective.yml has expected trigger and guard.

6. Dedupe behavior details (important)

   • Use a stable title prefix (e.g. [branch-actions-detective]).
   • Before creating an issue, search open issues for that prefix + Internal: CI + main.
   • If match found: add-comment with latest run details.
   • Else: create-issue with concise report and actionable next fix.

Related Items

Type	Link	Relevance
Issue	#370	Current request
Issue	#121	Prior split to PR-specific detective/fixer model
Issue	#268	Duplicate workflow cleanup initiative
PR	#123	Added PR CI detective/fixer foundations
PR	#271	Removed duplicate PR failure workflow, reinforces clear role separation
PR	#312	Renamed to pr-actions-detective; current trigger pattern established
File	.github/workflows/ci.yml:2	CI workflow name is Internal: CI
File	gh-agent-workflows/pr-actions-detective/example.yml:4	Trigger currently watches CI/Build/Test only
File	gh-agent-workflows/pr-actions-detective/example.yml:17	Current flow requires associated PR
File	.github/workflows/gh-aw-pr-actions-detective.md:97	Explicit noop when no PR exists
File	gh-agent-workflows/DEVELOPING.md:153-159	Canonical “add new workflow” process

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.