diff --git a/pkg/cli/copilot-agents.go b/pkg/cli/copilot-agents.go index 9fb5f66a85..98cab016e1 100644 --- a/pkg/cli/copilot-agents.go +++ b/pkg/cli/copilot-agents.go @@ -305,6 +305,10 @@ func deleteOldAgentFiles(verbose bool) error { "create-agentic-workflow.agent.md", "debug-agentic-workflow.agent.md", "create-shared-agentic-workflow.agent.md", + "create-agentic-workflow.md", + "setup-agentic-workflows.md", + "update-agentic-workflows.md", + "upgrade-agentic-workflows.md", } // Also delete the dangling singular form file from .github/aw/ diff --git a/pkg/cli/copilot_agents_test.go b/pkg/cli/copilot_agents_test.go index adf9e0f435..32bf3e45d4 100644 --- a/pkg/cli/copilot_agents_test.go +++ b/pkg/cli/copilot_agents_test.go @@ -249,6 +249,44 @@ func TestDeleteOldAgentFiles(t *testing.T) { ".github/aw/upgrade-agentic-workflow.md", }, }, + { + name: "deletes old non-.agent.md files from .github/agents", + filesToCreate: []string{ + ".github/agents/create-agentic-workflow.md", + ".github/agents/setup-agentic-workflows.md", + ".github/agents/update-agentic-workflows.md", + ".github/agents/upgrade-agentic-workflows.md", + }, + expectedDeleted: []string{ + ".github/agents/create-agentic-workflow.md", + ".github/agents/setup-agentic-workflows.md", + ".github/agents/update-agentic-workflows.md", + ".github/agents/upgrade-agentic-workflows.md", + }, + }, + { + name: "deletes all old agent files together", + filesToCreate: []string{ + ".github/agents/create-agentic-workflow.agent.md", + ".github/agents/debug-agentic-workflow.agent.md", + ".github/agents/create-shared-agentic-workflow.agent.md", + ".github/agents/create-agentic-workflow.md", + ".github/agents/setup-agentic-workflows.md", + ".github/agents/update-agentic-workflows.md", + ".github/agents/upgrade-agentic-workflows.md", + ".github/aw/upgrade-agentic-workflow.md", + }, + expectedDeleted: []string{ + ".github/agents/create-agentic-workflow.agent.md", + ".github/agents/debug-agentic-workflow.agent.md", + ".github/agents/create-shared-agentic-workflow.agent.md", + ".github/agents/create-agentic-workflow.md", + ".github/agents/setup-agentic-workflows.md", + ".github/agents/update-agentic-workflows.md", + ".github/agents/upgrade-agentic-workflows.md", + ".github/aw/upgrade-agentic-workflow.md", + }, + }, { name: "handles no files to delete", filesToCreate: []string{}, diff --git a/pkg/cli/templates/create-agentic-workflow.md b/pkg/cli/templates/create-agentic-workflow.md index 161444b155..1b31386fde 100644 --- a/pkg/cli/templates/create-agentic-workflow.md +++ b/pkg/cli/templates/create-agentic-workflow.md @@ -181,7 +181,7 @@ DO NOT ask all these questions at once; instead, engage in a back-and-forth conv - 📋 **DO NOT include other fields with good defaults** - Let the compiler use sensible defaults unless customization is needed. - Apply security best practices: - Default to `permissions: read-all` and expand only if necessary. - - Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`) over granting write perms. + - Prefer `safe-outputs` (`create-issue`, `add-comment`, `create-pull-request`, `create-pull-request-review-comment`, `update-issue`, `dispatch-workflow`) over granting write perms. - For custom write operations to external services (email, Slack, webhooks), use `safe-outputs.jobs:` to create custom safe output jobs. - Constrain `network:` to the minimum required ecosystems/domains. - Use sanitized expressions (`${{ needs.activation.outputs.text }}`) instead of raw event text. diff --git a/pkg/cli/templates/create-shared-agentic-workflow.md b/pkg/cli/templates/create-shared-agentic-workflow.md index 76e0675728..577bc3660c 100644 --- a/pkg/cli/templates/create-shared-agentic-workflow.md +++ b/pkg/cli/templates/create-shared-agentic-workflow.md @@ -34,7 +34,7 @@ You are a conversational chat agent that interacts with the user to design secur **Move Write Operations to Safe Outputs** - Never grant direct write permissions in shared components - Use `safe-outputs:` configuration for all write operations -- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue` +- Common safe outputs: `create-issue`, `add-comment`, `create-pull-request`, `update-issue`, `dispatch-workflow` - Let consuming workflows decide which safe outputs to enable **Process Agent Output in Safe Jobs** diff --git a/pkg/cli/templates/github-agentic-workflows.md b/pkg/cli/templates/github-agentic-workflows.md index 0724608609..f350e65b03 100644 --- a/pkg/cli/templates/github-agentic-workflows.md +++ b/pkg/cli/templates/github-agentic-workflows.md @@ -568,6 +568,14 @@ The YAML frontmatter supports these fields: target-repo: "owner/repo" # Optional: cross-repository ``` Publishes workflow artifacts to an orphaned git branch for persistent storage. Default allowed extensions include common non-executable types. Maximum file size is 50MB (51200 KB). + - `dispatch-workflow:` - Trigger other workflows with inputs + ```yaml + safe-outputs: + dispatch-workflow: + workflows: [workflow-name] # Required: list of workflow names to allow + max: 3 # Optional: max dispatches (default: 1, max: 3) + ``` + Triggers other agentic workflows in the same repository using workflow_dispatch. Agent output includes `workflow_name` (without .md extension) and optional `inputs` (key-value pairs). Not supported for cross-repository operations. - `create-code-scanning-alert:` - Generate SARIF security advisories ```yaml safe-outputs: