fix: improve workflow templates for security and reliability

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.3"
@@ -20,7 +20,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.3"

.rubocop.yml

@@ -5,7 +5,9 @@ AllCops:
   NewCops: enable
   TargetRubyVersion: 3.1
   Exclude:
+    - '.bundle/**/*'
     - 'spec/**/*'
+    - 'vendor/**/*'
 
 Style/Documentation:
   Enabled: false

Gemfile

@@ -4,10 +4,11 @@ source 'https://rubygems.org'
 
 gemspec
 
-gem 'telos-agent-toolkit', path: '../telos-agent-toolkit'
+gem 'telos-agent-toolkit', github: 'TelosLabs/telos-agent-toolkit', ref: '8e8b9b5bda7d6c0bc47b382b5f168d39a5faa77a'
 
 group :development, :test do
   gem 'rspec', '~> 3.0'
   gem 'rubocop-harness', github: 'TelosLabs/rubocop-harness'
+  gem 'rubocop-rspec', require: false
   gem 'webmock', '~> 3.0'
 end

lib/generators/baymax/install/templates/baymax_settings.yml

@@ -25,7 +25,7 @@ filter:
     - Interrupt
 
 decision:
-  confidence_threshold: 0.7
+  confidence_threshold: 0.8
 
 triage:
   max_triage_per_hour: 10

lib/generators/baymax/install/templates/baymax_triage.yml

@@ -5,7 +5,9 @@ on:
 
 concurrency:
   group: baymax-triage
-  cancel-in-progress: false  # Queue, don't drop alerts
+  # GitHub Actions queues at most 1 pending run; additional dispatches
+  # during an active run will replace the pending one (not unbounded queue).
+  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -14,11 +16,12 @@ permissions:
 jobs:
   triage:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 1
+          fetch-depth: 50
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
@@ -30,10 +33,13 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          APPSIGNAL_API_KEY: ${{ secrets.APPSIGNAL_API_KEY }}
-          ROLLBAR_API_TOKEN: ${{ secrets.ROLLBAR_API_TOKEN }}
           AGENT_ASSIGN_TOKEN: ${{ secrets.AGENT_ASSIGN_TOKEN }}
         run: |
           bundle exec baymax triage \
             --config config/baymax_settings.yml \
             --prompt .github/prompts/baymax_triage.md
+
+      - name: Notify on failure
+        if: failure()
+        run: |
+          echo "::error::Baymax triage failed. Production alerts may be going unprocessed."

lib/generators/baymax/install/templates/baymax_verify.yml

@@ -12,6 +12,7 @@ jobs:
   verify:
     if: contains(github.event.pull_request.labels.*.name, 'baymax-fix')
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -28,7 +29,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           bundle exec baymax verify \
-            --pr ${{ github.event.pull_request.number }} \
+            --pr "$PR_NUMBER" \
             --config config/baymax_settings.yml

spec/generators/baymax/install_generator_spec.rb

@@ -45,7 +45,7 @@
 
     it "sets a confidence threshold" do
       config = YAML.safe_load(content)
-      expect(config.dig("decision", "confidence_threshold")).to eq(0.7)
+      expect(config.dig("decision", "confidence_threshold")).to eq(0.8)
     end
   end