fix: improve workflow templates for security and reliability - #1
Merged
Conversation
…tness
- Add timeout-minutes: 10 to triage and verify jobs
- Remove ROLLBAR_API_TOKEN from triage template (adapter-specific secrets
should be added per-project, not in the default template)
- Fix concurrency comment to accurately describe GitHub Actions behavior
- Increase fetch-depth to 50 in triage for git blame support
- Use env var for PR number instead of direct ${{ }} shell interpolation
- Align confidence_threshold (0.8) with triage prompt guidance
- Add failure notification step to triage workflow
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace the local path dependency with a pinned GitHub ref so GitHub Actions can resolve dependencies without requiring a sibling checkout. This fixes CI failures where bundler could not find ../telos-agent-toolkit.
The lint workflow loads RuboCop config from rubocop-harness that references rubocop-rspec. Add rubocop-rspec to development/test dependencies so Inspecting 16 files ................ 16 files inspected, no offenses detected The following RuboCop extension libraries are installed but not loaded in config: * rubocop-rspec You can opt out of this message by adding the following to your config (see https://docs.rubocop.org/rubocop/extensions.html#extension-suggestions for more options): AllCops: SuggestExtensions: false can load all configured cops in CI.
Prevent CI lint jobs from traversing dependency install directories by excluding vendor and .bundle paths explicitly in RuboCop config.
Move CI to actions/checkout@v5 to avoid upcoming Node 20 deprecation warnings on GitHub-hosted runners.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Code review of the astro integration (TelosLabs/astro#625) surfaced 7 issues that originate in the generator templates. Fixing them here ensures every project that runs
rails generate baymax:installgets them right.What Changed
baymax_triage.yml:
timeout-minutes: 10(was defaulting to 6 hours)ROLLBAR_API_TOKEN— adapter-specific secrets should be added per-projectfetch-depthfrom 1 to 50 for git blame support (triage prompt expects blame data)baymax_verify.yml:
timeout-minutes: 10${{ }}shell interpolation (security anti-pattern)baymax_settings.yml:
confidence_thresholdfrom 0.7 to 0.8 to match triage prompt guidance ("only rate above 0.8 if root cause is clearly identifiable")How to Test
bundle exec rspec— 87 examples, 0 failures🤖 Generated with Claude Code