GitHub Actions workflow topology¶
This report lists the workflow graph surfaces reviewers need to inspect when CI topology changes.
Drift on main self-heals: .github/workflows/ci-topology-heal.yml regenerates this report after workflow changes merge and opens a squash auto-merge PR when the committed copy is stale.
Workflow Summary¶
| Workflow | Name | Triggers | Concurrency | Jobs |
|---|---|---|---|---|
| .github/workflows/a2a-federation-e2e.yml | a2a-federation-e2e | pull_request, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "a2a-federation-e2e-${{ github.ref }}"} | 1 |
| .github/workflows/adapter-conformance-canary.yml | Adapter conformance canary | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "adapter-conformance-canary"} | 1 |
| .github/workflows/adapter-contract-drift.yml | Adapter contract drift | pull_request, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "adapter-contract-drift-${{ github.ref }}"} | 2 |
| .github/workflows/airgap-e2e.yml | Airgap E2E | pull_request, push, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "airgap-e2e-${{ github.ref }}"} | 1 |
| .github/workflows/auto-heal.yml | Auto-heal v2 | workflow_call | - | 2 |
| .github/workflows/auto-release.yml | Auto-release | workflow_call | - | 5 |
| .github/workflows/bernstein-ci-fix.yml | Bernstein CI Fix | workflow_call | - | 4 |
| .github/workflows/bernstein-issues-decompose.yml | Bernstein Issue Decompose | issues | {"cancel-in-progress": "true", "group": "bernstein-decompose-${{ github.event.issue.number }}"} | 4 |
| .github/workflows/bernstein-pr-review.yml | Bernstein PR Review | pull_request | {"cancel-in-progress": "true", "group": "bernstein-pr-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/bisect-on-red.yml | Bisect on Red | workflow_call | - | 1 |
| .github/workflows/branch-protection-audit.yml | Branch protection audit | schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "branch-protection-audit-${{ github.ref }}"} | 1 |
| .github/workflows/ci-gate-stub.yml | CI gate stub | pull_request | {"cancel-in-progress": "true", "group": "ci-gate-stub-${{ github.event.pull_request.number || github.ref }}"} | 1 |
| .github/workflows/ci-macos-nightly.yml | CI (macOS nightly) | push, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "ci-macos-nightly-${{ github.workflow }}-${{ github.ref }}"} | 2 |
| .github/workflows/ci-topology-heal.yml | CI topology heal | push, workflow_dispatch | {"cancel-in-progress": "true", "group": "ci-topology-heal"} | 1 |
| .github/workflows/ci-weekly-digest.yml | CI Weekly Digest | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "ci-weekly-digest"} | 1 |
| .github/workflows/ci.yml | CI | merge_group, pull_request, push, workflow_dispatch | {"cancel-in-progress": "true", "group": "ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('branch-{0}', github.ref) }}"} | 31 |
| .github/workflows/cifuzz-pr.yml | CIFuzz (ClusterFuzzLite, PR) | pull_request | {"cancel-in-progress": "true", "group": "cifuzz-pr-${{ github.ref }}"} | 1 |
| .github/workflows/cleanup-runs.yml | Cleanup Action Runs | workflow_dispatch | {"cancel-in-progress": "false", "group": "cleanup-runs-${{ github.ref }}"} | 1 |
| .github/workflows/cluster-e2e.yml | cluster-e2e | pull_request, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "cluster-e2e-${{ github.ref }}"} | 1 |
| .github/workflows/cluster-tunnel-e2e.yml | cluster-tunnel-e2e | schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "cluster-tunnel-e2e-${{ github.ref }}"} | 1 |
| .github/workflows/code-review-bots-ci.yml | Code review bots (CLI lane) | pull_request | {"cancel-in-progress": "true", "group": "code-review-bots-${{ github.event.pull_request.number || github.ref }}"} | 1 |
| .github/workflows/codeql.yml | CodeQL Security Analysis | pull_request, push, schedule | {"cancel-in-progress": "${{ github.event_name == 'pull_request' }}", "group": "codeql-${{ github.ref }}"} | 1 |
| .github/workflows/contract-drift-autofix.yml | Contract Drift Autofix | pull_request | {"cancel-in-progress": "true", "group": "contract-drift-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/coverage-ratchet-weekly.yml | Coverage ratchet (weekly floor bump) | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "coverage-ratchet-weekly"} | 1 |
| .github/workflows/coverage-ratchet.yml | Coverage ratchet (total) | push | {"cancel-in-progress": "false", "group": "coverage-ratchet"} | 1 |
| .github/workflows/dependabot-auto-merge.yml | Dependabot Auto-merge | pull_request | {"cancel-in-progress": "true", "group": "dependabot-merge-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/dependency-review.yml | Dependency Review | pull_request | {"cancel-in-progress": "true", "group": "dependency-review-${{ github.event.pull_request.number || github.ref }}"} | 1 |
| .github/workflows/docs-drift.yml | docs-drift | pull_request, push, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "docs-drift-${{ github.ref }}"} | 2 |
| .github/workflows/docs-observability-snapshot.yml | Observability daily snapshot | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "docs-observability-snapshot"} | 1 |
| .github/workflows/eval-nightly.yml | eval-nightly | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "eval-nightly-${{ github.ref }}"} | 3 |
| .github/workflows/flake-quarantine.yml | Flake quarantine | schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "flake-quarantine"} | 1 |
| .github/workflows/glitchtip-ingester.yml | GlitchTip event ingester | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "glitchtip-ingester"} | 1 |
| .github/workflows/glitchtip-insights.yml | glitchtip-insights | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "glitchtip-insights"} | 1 |
| .github/workflows/hotfix-r-tracker.yml | Hotfix R-counter | push | {"cancel-in-progress": "false", "group": "hotfix-r-tracker-${{ github.sha }}"} | 1 |
| .github/workflows/labeler.yml | PR Labeler | pull_request_target | {"cancel-in-progress": "true", "group": "labeler-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/license-compliance.yml | License Compliance | pull_request, push | {"cancel-in-progress": "true", "group": "license-${{ github.ref }}"} | 1 |
| .github/workflows/main-red-guard.yml | main-red-guard | pull_request | {"cancel-in-progress": "true", "group": "main-red-guard-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/main-sha-marker.yml | Main SHA marker | push | {"cancel-in-progress": "false", "group": "main-sha-marker-${{ github.sha }}"} | 1 |
| .github/workflows/mutation-fixed.yml | Mutation (fixed critical paths) | pull_request, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "mutation-fixed-${{ github.workflow }}-${{ github.ref }}"} | 2 |
| .github/workflows/nightly-canary.yml | Nightly real-run canary | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "nightly-canary"} | 1 |
| .github/workflows/nightly-deep-tests.yml | Nightly deep tests | schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "nightly-deep-tests"} | 7 |
| .github/workflows/nightly-drift-sweep.yml | Nightly drift sweep | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "nightly-drift-sweep"} | 1 |
| .github/workflows/notify-other-failures.yml | Telegram nightly-fanout notifications | workflow_run | {"cancel-in-progress": "true", "group": "notify-other-${{ github.event.workflow_run.name }}-${{ github.event.workflow_run.head_branch }}"} | 1 |
| .github/workflows/pentest.yml | Adversarial Pen-Test Suite | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "pentest-${{ github.ref }}"} | 1 |
| .github/workflows/post-ci-dispatcher.yml | Post-CI dispatcher | workflow_run | {"cancel-in-progress": "false", "group": "post-ci-dispatcher-${{ github.event.workflow_run.head_sha }}"} | 6 |
| .github/workflows/pr-observability-summary.yml | PR observability summary | pull_request, workflow_dispatch | {"cancel-in-progress": "true", "group": "pr-observability-${{ github.event.pull_request.number || github.event.inputs.pr_number }}"} | 1 |
| .github/workflows/pr-size.yml | PR Size Labeler | pull_request | {"cancel-in-progress": "true", "group": "pr-size-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/pr-text-hygiene.yml | PR text hygiene | pull_request | {"cancel-in-progress": "true", "group": "pr-text-hygiene-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/pre-merge-autosync.yml | Pre-merge autosync | pull_request | {"cancel-in-progress": "true", "group": "pre-merge-autosync-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/publish-docker.yml | Publish Docker Image | release, workflow_dispatch | {"cancel-in-progress": "false", "group": "publish-docker-${{ github.ref }}"} | 1 |
| .github/workflows/publish-extension.yml | Publish VS Code Extension | push, release | {"cancel-in-progress": "false", "group": "publish-extension-${{ github.ref }}"} | 1 |
| .github/workflows/publish-homebrew.yml | Publish Homebrew Formula | release, workflow_dispatch | {"cancel-in-progress": "false", "group": "publish-homebrew-${{ github.ref }}"} | 1 |
| .github/workflows/publish.yml | Publish | push, workflow_dispatch | - | 8 |
| .github/workflows/reconcile-release.yml | Reconcile release drift | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "reconcile-release"} | 1 |
| .github/workflows/release-major-minor.yml | Major/Minor Release | workflow_dispatch | {"cancel-in-progress": "false", "group": "release-major-minor-${{ github.ref }}"} | 1 |
| .github/workflows/release-please.yml | Release Please | workflow_dispatch | {"cancel-in-progress": "false", "group": "release-please-${{ github.ref }}"} | 1 |
| .github/workflows/required-check-canary.yml | Required-check name canary | pull_request, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "required-check-canary-${{ github.event.pull_request.number || github.ref }}"} | 1 |
| .github/workflows/review-bot-ack.yml | Review-bot acknowledgement gate | pull_request, pull_request_review | {"cancel-in-progress": "false", "group": "review-bot-ack-${{ github.event.pull_request.number || github.ref }}-${{ github.event.pull_request.head.sha || github.sha }}"} | 1 |
| .github/workflows/review-bot-sweep.yml | Review-bot post-merge sweep | schedule, workflow_dispatch | - | 1 |
| .github/workflows/sbom-upload.yml | SBOM upload | push, release | {"cancel-in-progress": "false", "group": "sbom-upload-${{ github.ref }}"} | 1 |
| .github/workflows/sbom.yml | SBOM | release, workflow_dispatch | {"cancel-in-progress": "false", "group": "sbom-${{ github.ref }}"} | 1 |
| .github/workflows/scorecard.yml | OSSF Scorecard | branch_protection_rule, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "scorecard-${{ github.ref }}"} | 2 |
| .github/workflows/soc2-evidence-nightly.yml | soc2-evidence-nightly | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "soc2-evidence-${{ github.ref }}"} | 2 |
| .github/workflows/sonar-code-scanning.yml | Sonar findings to code scanning | schedule, workflow_dispatch | {"cancel-in-progress": "false", "group": "sonar-code-scanning-${{ github.ref }}"} | 1 |
| .github/workflows/sonar-hotspot-review.yml | SonarQube hotspot review | workflow_dispatch | {"cancel-in-progress": "false", "group": "sonar-hotspot-review"} | 1 |
| .github/workflows/sonar-pr-comment.yml | SonarQube PR insights comment | pull_request | {"cancel-in-progress": "true", "group": "sonar-pr-comment-${{ github.event.pull_request.number }}"} | 1 |
| .github/workflows/sonar-scan.yml | SonarQube scan | schedule, workflow_dispatch, workflow_run | {"cancel-in-progress": "false", "group": "sonar-scan-${{ github.ref }}"} | 1 |
| .github/workflows/spiffe-extra-e2e.yml | SPIFFE Extra E2E | pull_request, push, workflow_dispatch | {"cancel-in-progress": "true", "group": "spiffe-extra-e2e-${{ github.ref }}"} | 1 |
| .github/workflows/stale.yml | Stale cleanup | schedule | {"cancel-in-progress": "false", "group": "stale-${{ github.ref }}"} | 1 |
| .github/workflows/static-analysis-extended.yml | static-analysis (extended) | pull_request, push, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "static-analysis-extended-${{ github.ref }}"} | 6 |
| .github/workflows/telegram-notify.yml | Telegram CI Notifications | workflow_call | - | 1 |
| .github/workflows/trend-scan.yml | Trend scan | workflow_dispatch | {"cancel-in-progress": "false", "group": "trend-scan"} | 1 |
| .github/workflows/trufflehog.yml | trufflehog (secret scanning) | pull_request, push, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "trufflehog-${{ github.ref }}"} | 1 |
| .github/workflows/trunk-andon-gate.yml | Trunk Andon Gate | pull_request, workflow_dispatch | {"cancel-in-progress": "true", "group": "trunk-andon-gate-${{ github.event.pull_request.number || github.ref }}"} | 1 |
| .github/workflows/trunk-health-slo.yml | Trunk Health SLO | schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "trunk-health-slo"} | 1 |
| .github/workflows/typecheck-ts.yml | TypeScript typecheck | pull_request, push | {"cancel-in-progress": "true", "group": "typecheck-ts-${{ github.event.pull_request.number || github.ref }}"} | 1 |
| .github/workflows/zizmor.yml | zizmor (workflow static analysis) | pull_request, push, schedule, workflow_dispatch | {"cancel-in-progress": "true", "group": "zizmor-${{ github.ref }}"} | 1 |
Check Emitters¶
| Workflow | Checks |
|---|---|
| .github/workflows/a2a-federation-e2e.yml | a2a-federation-e2e: a2a-federation-e2e (${{ matrix.os }}) |
| .github/workflows/adapter-conformance-canary.yml | canary: Canary matrix |
| .github/workflows/adapter-contract-drift.yml | aggregate: Aggregate drift report check: ${{ matrix.adapter }} |
| .github/workflows/airgap-e2e.yml | airgap-e2e: Airgap E2E (Linux, real cosign + gpg + unshare) |
| .github/workflows/auto-heal.yml | heal: Apply chosen strategy triage: Triage and classify |
| .github/workflows/auto-release.yml | alert-on-stale-release-trigger: Alert on stale release trigger detect-stale-alerts: Detect open auto-release-skipped issues gate: Release gate release: Tag release sweep-stale-alerts-on-success: Close auto-release-skipped issues on green main |
| .github/workflows/bernstein-ci-fix.yml | fallback-issue: Open ci-fix issue (fallback) fix: Auto-heal with Bernstein tier3-shadow: Tier-3 OpenRouter shadow-mode escalation triage: Triage CI failure |
| .github/workflows/bernstein-issues-decompose.yml | decompose: Implement approved issue plan plan: Plan issue decomposition reject-untrusted-issue: Reject untrusted issue decomposition scope_gate: Require approved file scope |
| .github/workflows/bernstein-pr-review.yml | review: Review with Bernstein |
| .github/workflows/bisect-on-red.yml | bisect: Identify culprit PR |
| .github/workflows/branch-protection-audit.yml | audit: Branch protection audit |
| .github/workflows/ci-gate-stub.yml | ci-gate: CI gate |
| .github/workflows/ci-macos-nightly.yml | open-failure-issue: Open / update macOS nightly failure issue test-macos-nightly: Test (macos-latest, Python ${{ matrix.python-version }}) |
| .github/workflows/ci-topology-heal.yml | heal: Regenerate topology report |
| .github/workflows/ci-weekly-digest.yml | digest: Build and publish weekly digest |
| .github/workflows/ci.yml | actionlint: Workflow lint adapter-conformance-windows: Adapter conformance + e2e (windows) adapter-integration: Adapter integration (fake-CLI) adapter-integration-macos: Adapter integration (fake-CLI, macOS) autofix: Auto-fix lint bandit: Bandit (security) beartype: Beartype (type contracts) ci-gate: CI gate close-ci-issues: Close resolved CI issues coverage-report: Coverage report dead-code: Dead code (Vulture) determine-changes: Determine changes diff-coverage: Diff coverage report dist-size: Package size check install-smoke-pipx: Install smoke - pipx (${{ matrix.os }}, Python ${{ matrix.python-version }}) install-smoke-uv: Install smoke - uv tool (${{ matrix.os }}) lineage-gate: Lineage Gate lint: Lint mutmut-diff: Mutation report (diff-only) pip-audit: pip-audit (deps) pr-summary: PR CI summary property-tests: Property tests (Hypothesis smoke) pyright-strict-zone: Pyright strict (security + cluster) repo-hygiene: Repo hygiene schemathesis-smoke: Schemathesis smoke semgrep: Semgrep (custom rules) snapshot-tests: Snapshot tests (syrupy) spelling: Spelling (typos) test: Test (${{ matrix.os }}, Python ${{ matrix.python-version }}, shard ${{ matrix.shard }}) test-macos: Test (macos-latest, Python 3.13) typecheck: Type check report |
| .github/workflows/cifuzz-pr.yml | cifuzz: Build and run fuzzers |
| .github/workflows/cleanup-runs.yml | cleanup |
| .github/workflows/cluster-e2e.yml | cluster-e2e: cluster-e2e (linux) |
| .github/workflows/cluster-tunnel-e2e.yml | cluster-tunnel-e2e: cluster-tunnel-e2e (linux) |
| .github/workflows/code-review-bots-ci.yml | sourcery-cli: Sourcery CLI review (advisory) |
| .github/workflows/codeql.yml | analyze: CodeQL (${{ matrix.language }}) |
| .github/workflows/contract-drift-autofix.yml | autofix: Detect and patch contract drift |
| .github/workflows/coverage-ratchet-weekly.yml | bump: Bump diff-coverage floor and open review PR |
| .github/workflows/coverage-ratchet.yml | ratchet: Total coverage ratchet |
| .github/workflows/dependabot-auto-merge.yml | auto-merge |
| .github/workflows/dependency-review.yml | review: Dependency review |
| .github/workflows/docs-drift.yml | docs-data-freshness: Data freshness (advisory) drift-check: Run drift check |
| .github/workflows/docs-observability-snapshot.yml | snapshot: Capture daily snapshot |
| .github/workflows/eval-nightly.yml | bench: bench (full) preflight: preflight (gate) smoke: smoke (synthetic) |
| .github/workflows/flake-quarantine.yml | detect-and-quarantine: Detect flaky tests and open quarantine PR |
| .github/workflows/glitchtip-ingester.yml | ingest: Ingest GlitchTip events |
| .github/workflows/glitchtip-insights.yml | sweep: sweep |
| .github/workflows/hotfix-r-tracker.yml | track: Detect hotfix-begets-hotfix |
| .github/workflows/labeler.yml | label |
| .github/workflows/license-compliance.yml | license-check |
| .github/workflows/main-red-guard.yml | guard: main-red-guard |
| .github/workflows/main-sha-marker.yml | marker: Main SHA marker |
| .github/workflows/mutation-fixed.yml | mutate: ${{ matrix.module }} summary: Summary + PR comment |
| .github/workflows/nightly-canary.yml | canary: Real-run canary |
| .github/workflows/nightly-deep-tests.yml | bandit-medium-and-high: Bandit (full -ll, advisory) crosshair-pure-fns: CrossHair (concolic, deep) hypothesis-deep: Hypothesis (deep, 1000 examples) mutmut-full: Mutation (full repo, advisory) pip-audit-deep: pip-audit (full closure) schemathesis-deep: Schemathesis (deep, full sweep) stress-leak-suite: Stress + resource-leak suite (TC-C) |
| .github/workflows/nightly-drift-sweep.yml | sweep: Open drift-sweep PR if mirrors drifted |
| .github/workflows/notify-other-failures.yml | notify |
| .github/workflows/pentest.yml | pentest: Pen-test: ${{ github.event.inputs.suite || 'all' }} |
| .github/workflows/post-ci-dispatcher.yml | auto-heal: Auto-heal v2 auto-release: Auto-release bernstein-ci-fix: Bernstein CI fix bisect-on-red: Bisect on red meta: Resolve upstream metadata telegram-notify: Telegram notify |
| .github/workflows/pr-observability-summary.yml | summary: Sticky observability comment |
| .github/workflows/pr-size.yml | labeler |
| .github/workflows/pr-text-hygiene.yml | text-hygiene: text-hygiene |
| .github/workflows/pre-merge-autosync.yml | autosync: Regenerate mirrors and format |
| .github/workflows/publish-docker.yml | publish: Build and push image to GHCR |
| .github/workflows/publish-extension.yml | publish |
| .github/workflows/publish-homebrew.yml | update-formula: Update Homebrew formula |
| .github/workflows/publish.yml | build: Build github-release: Create GitHub Release protocol-gate: Protocol Compatibility Gate publish: Publish to PyPI publish-mcp-registry: Publish MCP registry listing publish-npm: Publish npm wrapper test: Verify tests pass version-check: Verify tag matches pyproject.toml |
| .github/workflows/reconcile-release.yml | reconcile: Compare pyproject.toml vs PyPI |
| .github/workflows/release-major-minor.yml | release: ${{ inputs.bump }} release |
| .github/workflows/release-please.yml | release-please |
| .github/workflows/required-check-canary.yml | verify: Required-check name canary |
| .github/workflows/review-bot-ack.yml | review-bot-ack: review-bot-ack |
| .github/workflows/review-bot-sweep.yml | sweep: Sweep recently merged PRs for unprocessed bot findings |
| .github/workflows/sbom-upload.yml | upload: Generate and upload SBOM |
| .github/workflows/sbom.yml | sbom: Generate SBOM |
| .github/workflows/scorecard.yml | analysis: Scorecard analysis upload: Filter suppressions and upload to Code Scanning |
| .github/workflows/soc2-evidence-nightly.yml | pack: generate evidence pack preflight: preflight (gate) |
| .github/workflows/sonar-code-scanning.yml | sonar-sarif: Upload Sonar SARIF to code scanning |
| .github/workflows/sonar-hotspot-review.yml | review: Apply hotspot review manifest |
| .github/workflows/sonar-pr-comment.yml | comment: Sonar smells delta comment |
| .github/workflows/sonar-scan.yml | scan: SonarQube scan |
| .github/workflows/spiffe-extra-e2e.yml | spiffe-extra-e2e: SPIFFE extra E2E (built wheel, extra-present + no-extra suites) |
| .github/workflows/stale.yml | stale |
| .github/workflows/static-analysis-extended.yml | perflint: perflint (hot-path antipatterns) refurb: refurb (idioms) semgrep: Semgrep (CE rules) trivy-fs: Trivy (filesystem) trivy-iac: Trivy (IaC) vulture: vulture (dead code) |
| .github/workflows/telegram-notify.yml | notify |
| .github/workflows/trend-scan.yml | scan: Run trend scan |
| .github/workflows/trufflehog.yml | trufflehog: trufflehog scan |
| .github/workflows/trunk-andon-gate.yml | gate: Andon gate |
| .github/workflows/trunk-health-slo.yml | compute: Compute trunk red-rate and toggle TRUNK_UNSTABLE |
| .github/workflows/typecheck-ts.yml | typecheck: typecheck (${{ matrix.package }}) |
| .github/workflows/zizmor.yml | zizmor: zizmor static analysis |
Permissions And Secrets¶
| Workflow | Permissions | Secrets |
|---|---|---|
| .github/workflows/a2a-federation-e2e.yml | workflow: | - |
| .github/workflows/adapter-conformance-canary.yml | workflow: {"contents": "read"} canary: {"contents": "write", "issues": "write", "pull-requests": "write"} | GITHUB_TOKEN |
| .github/workflows/adapter-contract-drift.yml | workflow: {"contents": "read"} aggregate: {"contents": "read", "issues": "write"} check: {"contents": "read"} | ADAPTER_CONTRACT_ANTHROPIC_API_KEY, ADAPTER_CONTRACT_GEMINI_API_KEY, ADAPTER_CONTRACT_OPENAI_API_KEY, GITHUB_TOKEN |
| .github/workflows/airgap-e2e.yml | workflow: | - |
| .github/workflows/auto-heal.yml | heal: {"attestations": "write", "contents": "write", "id-token": "write", "pull-requests": "write"} triage: {"actions": "read", "contents": "read", "pull-requests": "read"} | GITHUB_TOKEN, GLITCHTIP_DSN, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/auto-release.yml | alert-on-stale-release-trigger: {"contents": "read", "issues": "write"} detect-stale-alerts: {"contents": "read", "issues": "read"} gate: {"contents": "read"} release: {"contents": "write"} sweep-stale-alerts-on-success: {"contents": "read", "issues": "write"} | GITHUB_TOKEN, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/bernstein-ci-fix.yml | fallback-issue: {"contents": "read", "issues": "write"} fix: {"contents": "write", "issues": "write", "pull-requests": "write"} tier3-shadow: {"actions": "read", "contents": "read"} triage: {"actions": "read", "contents": "read", "pull-requests": "read"} | GEMINI_API_KEY, GITHUB_TOKEN, GLITCHTIP_DSN, OPENROUTER_API_KEY_FREE |
| .github/workflows/bernstein-issues-decompose.yml | workflow: {"contents": "read"} decompose: {"contents": "write", "issues": "write", "pull-requests": "write"} plan: {"contents": "read"} reject-untrusted-issue: {"issues": "write"} scope_gate: {"issues": "write"} | ANTHROPIC_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY |
| .github/workflows/bernstein-pr-review.yml | workflow: | ANTHROPIC_API_KEY |
| .github/workflows/bisect-on-red.yml | bisect: | - |
| .github/workflows/branch-protection-audit.yml | audit: | BRANCH_PROTECTION_AUDIT_TOKEN |
| .github/workflows/ci-gate-stub.yml | workflow: {"contents": "read"} ci-gate: {"contents": "read"} | - |
| .github/workflows/ci-macos-nightly.yml | workflow: {"contents": "read"} open-failure-issue: {"contents": "read", "issues": "write"} test-macos-nightly: {"checks": "write", "contents": "read"} | GITHUB_TOKEN |
| .github/workflows/ci-topology-heal.yml | workflow: {"contents": "read"} heal: {"contents": "write", "pull-requests": "write"} | BERNSTEIN_AUTOSYNC_TOKEN, GITHUB_TOKEN |
| .github/workflows/ci-weekly-digest.yml | digest: | TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/ci.yml | workflow: {"contents": "read"} actionlint: {"contents": "read"} adapter-conformance-windows: {"contents": "read"} adapter-integration: {"contents": "read"} adapter-integration-macos: {"contents": "read"} autofix: {"contents": "write"} bandit: {"contents": "read"} beartype: {"contents": "read"} ci-gate: {"contents": "read"} close-ci-issues: {"contents": "read", "issues": "write"} coverage-report: {"contents": "read"} dead-code: {"contents": "read"} determine-changes: {"contents": "read"} diff-coverage: {"contents": "read"} dist-size: {"contents": "read"} install-smoke-pipx: {"contents": "read"} install-smoke-uv: {"contents": "read"} lineage-gate: {"contents": "read"} lint: {"contents": "read"} mutmut-diff: {"contents": "read"} pip-audit: {"contents": "read"} pr-summary: {"pull-requests": "write"} property-tests: {"contents": "read"} pyright-strict-zone: {"contents": "read"} repo-hygiene: {"contents": "read"} schemathesis-smoke: {"contents": "read"} semgrep: {"contents": "read"} snapshot-tests: {"contents": "read"} spelling: {"contents": "read"} test: {"contents": "read"} test-macos: {"contents": "read"} typecheck: {"contents": "read"} | CODECOV_TOKEN, GITHUB_TOKEN |
| .github/workflows/cifuzz-pr.yml | workflow: {"contents": "read"} cifuzz: {"actions": "read", "contents": "read"} | GITHUB_TOKEN |
| .github/workflows/cleanup-runs.yml | workflow: {"contents": "read"} cleanup: {"actions": "write"} | GITHUB_TOKEN |
| .github/workflows/cluster-e2e.yml | workflow: | - |
| .github/workflows/cluster-tunnel-e2e.yml | workflow: | CF_TUNNEL_HOSTNAME, CF_TUNNEL_TOKEN |
| .github/workflows/code-review-bots-ci.yml | workflow: {"contents": "read"} sourcery-cli: {"contents": "read"} | SOURCERY_API_KEY |
| .github/workflows/codeql.yml | workflow: {"contents": "read"} analyze: {"actions": "read", "contents": "read", "pull-requests": "write", "security-events": "write"} | - |
| .github/workflows/contract-drift-autofix.yml | workflow: {"contents": "write", "issues": "write", "pull-requests": "write"} autofix: {"contents": "write", "issues": "write", "pull-requests": "write"} | BOT_PAT, GITHUB_TOKEN |
| .github/workflows/coverage-ratchet-weekly.yml | bump: | GITHUB_TOKEN |
| .github/workflows/coverage-ratchet.yml | ratchet: | GITHUB_TOKEN |
| .github/workflows/dependabot-auto-merge.yml | workflow: {"contents": "read"} auto-merge: {"contents": "write", "pull-requests": "write"} | GITHUB_TOKEN |
| .github/workflows/dependency-review.yml | workflow: {"contents": "read"} review: {"contents": "read", "pull-requests": "write"} | - |
| .github/workflows/docs-drift.yml | workflow: {"contents": "read"} docs-data-freshness: {"contents": "read", "issues": "write"} drift-check: {"contents": "read", "pull-requests": "write"} | - |
| .github/workflows/docs-observability-snapshot.yml | workflow: {"contents": "read"} snapshot: {"contents": "write", "pull-requests": "write", "security-events": "read"} | DT_API_KEY, DT_API_URL, GITHUB_TOKEN, GLITCHTIP_API_TOKEN, SONAR_TOKEN, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/eval-nightly.yml | workflow: | EVAL_ENABLED, GLITCHTIP_DSN |
| .github/workflows/flake-quarantine.yml | workflow: {"contents": "read"} detect-and-quarantine: {"contents": "write", "pull-requests": "write"} | GITHUB_TOKEN |
| .github/workflows/glitchtip-ingester.yml | workflow: {"contents": "read"} ingest: {"contents": "write", "pull-requests": "write"} | GITHUB_TOKEN, GLITCHTIP_API_TOKEN |
| .github/workflows/glitchtip-insights.yml | workflow: | GITHUB_TOKEN, GLITCHTIP_API_TOKEN |
| .github/workflows/hotfix-r-tracker.yml | track: | - |
| .github/workflows/labeler.yml | workflow: {"contents": "read"} label: {"contents": "read", "pull-requests": "write"} | GITHUB_TOKEN |
| .github/workflows/license-compliance.yml | workflow: {"contents": "read"} license-check: {"contents": "read"} | - |
| .github/workflows/main-red-guard.yml | workflow: {"actions": "read", "contents": "read"} guard: {"actions": "read", "contents": "read"} | - |
| .github/workflows/main-sha-marker.yml | - | - |
| .github/workflows/mutation-fixed.yml | workflow: {"contents": "read"} mutate: {"contents": "read"} summary: {"contents": "read", "pull-requests": "write"} | - |
| .github/workflows/nightly-canary.yml | workflow: | GLITCHTIP_DSN |
| .github/workflows/nightly-deep-tests.yml | workflow: {"contents": "read"} bandit-medium-and-high: {"contents": "read"} crosshair-pure-fns: {"contents": "read"} hypothesis-deep: {"contents": "read"} mutmut-full: {"contents": "read"} pip-audit-deep: {"contents": "read"} schemathesis-deep: {"contents": "read"} stress-leak-suite: {"contents": "read"} | - |
| .github/workflows/nightly-drift-sweep.yml | workflow: {"contents": "read"} sweep: {"contents": "write", "pull-requests": "write"} | BERNSTEIN_AUTOSYNC_TOKEN, GITHUB_TOKEN |
| .github/workflows/notify-other-failures.yml | workflow: | TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/pentest.yml | workflow: | - |
| .github/workflows/post-ci-dispatcher.yml | auto-heal: {"actions": "read", "attestations": "write", "contents": "write", "id-token": "write", "pull-requests": "write"} auto-release: {"contents": "write", "issues": "write"} bernstein-ci-fix: {"actions": "read", "contents": "write", "issues": "write", "pull-requests": "write"} bisect-on-red: {"contents": "read", "issues": "write", "pull-requests": "write"} meta: {"contents": "read"} telegram-notify: {"actions": "read", "contents": "read"} | GEMINI_API_KEY, GLITCHTIP_DSN, OPENROUTER_API_KEY_FREE, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/pr-observability-summary.yml | workflow: {"contents": "read"} summary: {"contents": "read", "pull-requests": "write", "security-events": "read"} | BERNSTEIN_GLITCHTIP_TOKEN, DTRACK_TOKEN, GITHUB_TOKEN, SONAR_TOKEN |
| .github/workflows/pr-size.yml | workflow: {"contents": "read"} labeler: {"contents": "read", "issues": "write", "pull-requests": "write"} | GITHUB_TOKEN |
| .github/workflows/pr-text-hygiene.yml | workflow: | - |
| .github/workflows/pre-merge-autosync.yml | workflow: {"contents": "read"} autosync: {"contents": "write", "pull-requests": "read"} | BERNSTEIN_AUTOSYNC_TOKEN |
| .github/workflows/publish-docker.yml | publish: | GITHUB_TOKEN |
| .github/workflows/publish-extension.yml | workflow: {"contents": "read"} publish: {"contents": "write"} | OPEN_VSX_TOKEN, VS_MARKETPLACE_TOKEN |
| .github/workflows/publish-homebrew.yml | workflow: {"contents": "read"} update-formula: {"contents": "read"} | HOMEBREW_TAP_TOKEN |
| .github/workflows/publish.yml | build: {"contents": "read"} github-release: {"contents": "write"} protocol-gate: {"contents": "read"} publish: {"attestations": "write", "contents": "read", "id-token": "write"} publish-mcp-registry: {"contents": "read", "id-token": "write"} publish-npm: {"contents": "read"} test: {"contents": "read"} version-check: {"contents": "read"} | GITHUB_TOKEN, NPM_TOKEN |
| .github/workflows/reconcile-release.yml | reconcile: | TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/release-major-minor.yml | workflow: {"contents": "read"} release: {"attestations": "write", "contents": "write", "id-token": "write"} | GITHUB_TOKEN |
| .github/workflows/release-please.yml | workflow: {"contents": "read"} release-please: {"contents": "write", "issues": "write", "pull-requests": "write"} | GITHUB_TOKEN, RELEASE_PLEASE_PAT |
| .github/workflows/required-check-canary.yml | verify: | - |
| .github/workflows/review-bot-ack.yml | review-bot-ack: | - |
| .github/workflows/review-bot-sweep.yml | sweep: | GITHUB_TOKEN, LANDING_REPO_PAT |
| .github/workflows/sbom-upload.yml | workflow: | DT_API_KEY |
| .github/workflows/sbom.yml | workflow: {"contents": "read"} sbom: {"contents": "write"} | - |
| .github/workflows/scorecard.yml | workflow: {"contents": "read"} analysis: {"actions": "read", "contents": "read", "id-token": "write", "security-events": "write"} upload: {"contents": "read", "security-events": "write"} | - |
| .github/workflows/soc2-evidence-nightly.yml | workflow: | SOC2_EVIDENCE_ENABLED |
| .github/workflows/sonar-code-scanning.yml | workflow: {"contents": "read"} sonar-sarif: {"contents": "read", "security-events": "write"} | SONAR_TOKEN |
| .github/workflows/sonar-hotspot-review.yml | workflow: | SONAR_TOKEN |
| .github/workflows/sonar-pr-comment.yml | workflow: | SONAR_TOKEN |
| .github/workflows/sonar-scan.yml | workflow: | GITHUB_TOKEN, SONAR_TOKEN |
| .github/workflows/spiffe-extra-e2e.yml | workflow: | - |
| .github/workflows/stale.yml | workflow: | - |
| .github/workflows/static-analysis-extended.yml | workflow: {"contents": "read"} perflint: {"contents": "read", "security-events": "write"} refurb: {"contents": "read", "security-events": "write"} semgrep: {"contents": "read", "security-events": "write"} trivy-fs: {"contents": "read", "security-events": "write"} trivy-iac: {"contents": "read", "security-events": "write"} vulture: {"contents": "read", "security-events": "write"} | - |
| .github/workflows/telegram-notify.yml | workflow: | TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID |
| .github/workflows/trend-scan.yml | scan: | - |
| .github/workflows/trufflehog.yml | workflow: {"contents": "read"} trufflehog: {"contents": "read", "pull-requests": "read"} | - |
| .github/workflows/trunk-andon-gate.yml | gate: | - |
| .github/workflows/trunk-health-slo.yml | compute: | BOT_PAT |
| .github/workflows/typecheck-ts.yml | workflow: {"contents": "read"} typecheck: {"contents": "read"} | - |
| .github/workflows/zizmor.yml | workflow: {"contents": "read"} zizmor: {"actions": "read", "contents": "read", "security-events": "write"} | - |
Cross-Workflow Calls¶
| Caller workflow | Reusable workflow calls |
|---|---|
| .github/workflows/post-ci-dispatcher.yml | auto-heal -> ./.github/workflows/auto-heal.yml (needs: meta) auto-release -> ./.github/workflows/auto-release.yml (needs: meta) bernstein-ci-fix -> ./.github/workflows/bernstein-ci-fix.yml (needs: ["meta", "auto-heal"]) bisect-on-red -> ./.github/workflows/bisect-on-red.yml (needs: meta) telegram-notify -> ./.github/workflows/telegram-notify.yml (needs: meta) |
Artifact Hand-Offs¶
| Workflow | Artifact steps |
|---|---|
| .github/workflows/adapter-conformance-canary.yml | canary: upload adapter-canary-receipts |
| .github/workflows/adapter-contract-drift.yml | aggregate: download - check: upload drift-${{ matrix.adapter }} |
| .github/workflows/bernstein-ci-fix.yml | tier3-shadow: upload tier3-shadow-${{ needs.triage.outputs.short_sha }} |
| .github/workflows/bernstein-issues-decompose.yml | decompose: download issue-decompose-plan-${{ github.event.issue.number }} plan: upload issue-decompose-plan-${{ github.event.issue.number }} |
| .github/workflows/ci.yml | coverage-report: download - coverage-report: upload coverage-report diff-coverage: download coverage-report dist-size: upload install-smoke-wheel install-smoke-pipx: download install-smoke-wheel install-smoke-uv: download install-smoke-wheel test: upload coverage-data-${{ matrix.shard }} |
| .github/workflows/cifuzz-pr.yml | cifuzz: upload cifuzz-artifacts-address |
| .github/workflows/cluster-e2e.yml | cluster-e2e: upload cluster-e2e-logs |
| .github/workflows/cluster-tunnel-e2e.yml | cluster-tunnel-e2e: upload cluster-tunnel-e2e-logs |
| .github/workflows/coverage-ratchet.yml | ratchet: download coverage-report |
| .github/workflows/docs-drift.yml | drift-check: upload docs-drift-report |
| .github/workflows/eval-nightly.yml | bench: upload eval-nightly-${{ github.run_id }} smoke: upload eval-nightly-smoke |
| .github/workflows/flake-quarantine.yml | detect-and-quarantine: upload xflaky-reports |
| .github/workflows/license-compliance.yml | license-check: upload license-report |
| .github/workflows/mutation-fixed.yml | mutate: upload mutation-${{ matrix.module }} summary: download - |
| .github/workflows/nightly-deep-tests.yml | bandit-medium-and-high: upload nightly-bandit-results mutmut-full: upload nightly-mutmut-results |
| .github/workflows/pentest.yml | pentest: upload pentest-results-${{ github.run_number }} |
| .github/workflows/publish.yml | build: upload dist github-release: download dist publish: download dist |
| .github/workflows/sbom-upload.yml | upload: upload sbom-cyclonedx |
| .github/workflows/sbom.yml | sbom: upload sbom |
| .github/workflows/scorecard.yml | analysis: upload scorecard-results upload: download scorecard-results |
| .github/workflows/soc2-evidence-nightly.yml | pack: upload soc2-evidence-${{ github.run_id }} |
| .github/workflows/sonar-code-scanning.yml | sonar-sarif: upload sonar-sarif |
| .github/workflows/sonar-scan.yml | scan: download coverage-report scan: download coverage-report |
| .github/workflows/static-analysis-extended.yml | perflint: upload perflint-sarif refurb: upload refurb-sarif semgrep: upload semgrep-sarif trivy-fs: upload trivy-fs-sarif trivy-iac: upload trivy-iac-sarif vulture: upload vulture-sarif |
| .github/workflows/trend-scan.yml | scan: upload trend-scan-rollup |