From ad28b405234d0a443430af01e9f456c9fcc26354 Mon Sep 17 00:00:00 2001 From: aliciapaz Date: Fri, 3 Apr 2026 11:30:25 -0600 Subject: [PATCH 1/5] fix: improve workflow templates for security, reliability, and correctness - Add timeout-minutes: 10 to triage and verify jobs - Remove ROLLBAR_API_TOKEN from triage template (adapter-specific secrets should be added per-project, not in the default template) - Fix concurrency comment to accurately describe GitHub Actions behavior - Increase fetch-depth to 50 in triage for git blame support - Use env var for PR number instead of direct ${{ }} shell interpolation - Align confidence_threshold (0.8) with triage prompt guidance - Add failure notification step to triage workflow Co-Authored-By: Claude Opus 4.6 (1M context) --- .../baymax/install/templates/baymax_settings.yml | 2 +- .../baymax/install/templates/baymax_triage.yml | 14 ++++++++++---- .../baymax/install/templates/baymax_verify.yml | 4 +++- spec/generators/baymax/install_generator_spec.rb | 2 +- 4 files changed, 15 insertions(+), 7 deletions(-) diff --git a/lib/generators/baymax/install/templates/baymax_settings.yml b/lib/generators/baymax/install/templates/baymax_settings.yml index b278386..51cc75f 100644 --- a/lib/generators/baymax/install/templates/baymax_settings.yml +++ b/lib/generators/baymax/install/templates/baymax_settings.yml @@ -25,7 +25,7 @@ filter: - Interrupt decision: - confidence_threshold: 0.7 + confidence_threshold: 0.8 triage: max_triage_per_hour: 10 diff --git a/lib/generators/baymax/install/templates/baymax_triage.yml b/lib/generators/baymax/install/templates/baymax_triage.yml index a57eb4c..65351d7 100644 --- a/lib/generators/baymax/install/templates/baymax_triage.yml +++ b/lib/generators/baymax/install/templates/baymax_triage.yml @@ -5,7 +5,9 @@ on: concurrency: group: baymax-triage - cancel-in-progress: false # Queue, don't drop alerts + # GitHub Actions queues at most 1 pending run; additional dispatches + # during an active run will replace the pending one (not unbounded queue). + cancel-in-progress: false permissions: contents: read @@ -14,11 +16,12 @@ permissions: jobs: triage: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Checkout uses: actions/checkout@v4 with: - fetch-depth: 1 + fetch-depth: 50 - name: Setup Ruby uses: ruby/setup-ruby@v1 @@ -30,10 +33,13 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} - APPSIGNAL_API_KEY: ${{ secrets.APPSIGNAL_API_KEY }} - ROLLBAR_API_TOKEN: ${{ secrets.ROLLBAR_API_TOKEN }} AGENT_ASSIGN_TOKEN: ${{ secrets.AGENT_ASSIGN_TOKEN }} run: | bundle exec baymax triage \ --config config/baymax_settings.yml \ --prompt .github/prompts/baymax_triage.md + + - name: Notify on failure + if: failure() + run: | + echo "::error::Baymax triage failed. Production alerts may be going unprocessed." diff --git a/lib/generators/baymax/install/templates/baymax_verify.yml b/lib/generators/baymax/install/templates/baymax_verify.yml index 5a84b1a..ddf73de 100644 --- a/lib/generators/baymax/install/templates/baymax_verify.yml +++ b/lib/generators/baymax/install/templates/baymax_verify.yml @@ -12,6 +12,7 @@ jobs: verify: if: contains(github.event.pull_request.labels.*.name, 'baymax-fix') runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Checkout uses: actions/checkout@v4 @@ -28,7 +29,8 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + PR_NUMBER: ${{ github.event.pull_request.number }} run: | bundle exec baymax verify \ - --pr ${{ github.event.pull_request.number }} \ + --pr "$PR_NUMBER" \ --config config/baymax_settings.yml diff --git a/spec/generators/baymax/install_generator_spec.rb b/spec/generators/baymax/install_generator_spec.rb index a59b3d4..f48f80e 100644 --- a/spec/generators/baymax/install_generator_spec.rb +++ b/spec/generators/baymax/install_generator_spec.rb @@ -45,7 +45,7 @@ it "sets a confidence threshold" do config = YAML.safe_load(content) - expect(config.dig("decision", "confidence_threshold")).to eq(0.7) + expect(config.dig("decision", "confidence_threshold")).to eq(0.8) end end From 37a0a25a1c525400243d223ad79c379803c3ada6 Mon Sep 17 00:00:00 2001 From: aliciapaz Date: Fri, 3 Apr 2026 17:56:13 -0600 Subject: [PATCH 2/5] fix: use git source for telos-agent-toolkit in CI Replace the local path dependency with a pinned GitHub ref so GitHub Actions can resolve dependencies without requiring a sibling checkout. This fixes CI failures where bundler could not find ../telos-agent-toolkit. --- Gemfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index c0ec0f4..60a1942 100644 --- a/Gemfile +++ b/Gemfile @@ -4,7 +4,7 @@ source 'https://rubygems.org' gemspec -gem 'telos-agent-toolkit', path: '../telos-agent-toolkit' +gem 'telos-agent-toolkit', github: 'TelosLabs/telos-agent-toolkit', ref: '8e8b9b5bda7d6c0bc47b382b5f168d39a5faa77a' group :development, :test do gem 'rspec', '~> 3.0' From 098add1f4af29efa4ba5259a4895fc3545e72962 Mon Sep 17 00:00:00 2001 From: aliciapaz Date: Fri, 3 Apr 2026 17:58:17 -0600 Subject: [PATCH 3/5] fix: install rubocop-rspec for CI lint config The lint workflow loads RuboCop config from rubocop-harness that references rubocop-rspec. Add rubocop-rspec to development/test dependencies so Inspecting 16 files ................ 16 files inspected, no offenses detected The following RuboCop extension libraries are installed but not loaded in config: * rubocop-rspec You can opt out of this message by adding the following to your config (see https://docs.rubocop.org/rubocop/extensions.html#extension-suggestions for more options): AllCops: SuggestExtensions: false can load all configured cops in CI. --- Gemfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Gemfile b/Gemfile index 60a1942..09f9d29 100644 --- a/Gemfile +++ b/Gemfile @@ -9,5 +9,6 @@ gem 'telos-agent-toolkit', github: 'TelosLabs/telos-agent-toolkit', ref: '8e8b9b group :development, :test do gem 'rspec', '~> 3.0' gem 'rubocop-harness', github: 'TelosLabs/rubocop-harness' + gem 'rubocop-rspec', require: false gem 'webmock', '~> 3.0' end From 7ac2a94dfa2f3e08952eb0a64aab6c3cb8a48247 Mon Sep 17 00:00:00 2001 From: aliciapaz Date: Fri, 3 Apr 2026 18:01:35 -0600 Subject: [PATCH 4/5] fix: exclude vendored paths from rubocop scan Prevent CI lint jobs from traversing dependency install directories by excluding vendor and .bundle paths explicitly in RuboCop config. --- .rubocop.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.rubocop.yml b/.rubocop.yml index 86ddcee..ba6f1a2 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -5,7 +5,9 @@ AllCops: NewCops: enable TargetRubyVersion: 3.1 Exclude: + - '.bundle/**/*' - 'spec/**/*' + - 'vendor/**/*' Style/Documentation: Enabled: false From 8c2649320f9947e92c545f0b2e8319836696d199 Mon Sep 17 00:00:00 2001 From: aliciapaz Date: Fri, 3 Apr 2026 18:03:33 -0600 Subject: [PATCH 5/5] chore: upgrade checkout action to v5 Move CI to actions/checkout@v5 to avoid upcoming Node 20 deprecation warnings on GitHub-hosted runners. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e089a55..b232bd7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: ruby/setup-ruby@v1 with: ruby-version: "3.3" @@ -20,7 +20,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - uses: ruby/setup-ruby@v1 with: ruby-version: "3.3"