spawn/.github/workflows/refactor.yml
Ahmed Abushagur 3fbdf56c4c
fix: add guardrails to prevent bots from inventing unnecessary work (#1347)
- Add team lead pre-approval gate: teammates spawn in plan mode and must
  get approval before creating any PR (hard gate, not just prompt rules)
- Add diminishing returns rule: default posture is "code is good, shut down"
- Add dedup rule: check for existing open/closed PRs before creating new ones
- Require concrete PR justification (what breaks without this change)
- Add off-limits files list (.github/workflows, .claude/skills, CLAUDE.md)
- Use git pathspec exclusions in refactor.sh to never stage protected files
- Constrain pr-maintainer to only act on approved or feedback PRs
- Reduce refactor cron from every 5 minutes to every 2 hours

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-16 20:24:25 -05:00

53 lines
1.9 KiB
YAML

name: Trigger Refactor
on:
schedule:
- cron: '0 */2 * * *'
issues:
types: [opened, reopened, labeled]
workflow_dispatch:
concurrency:
group: refactor-sprite-trigger
cancel-in-progress: false
jobs:
trigger:
runs-on: ubuntu-latest
timeout-minutes: 90
# Only trigger on issues with safe-to-work AND (bug, cli, enhancement, or maintenance) labels, or schedule/manual
if: >-
github.event_name != 'issues' ||
(contains(github.event.issue.labels.*.name, 'safe-to-work') &&
(contains(github.event.issue.labels.*.name, 'bug') ||
contains(github.event.issue.labels.*.name, 'cli') ||
contains(github.event.issue.labels.*.name, 'enhancement') ||
contains(github.event.issue.labels.*.name, 'maintenance')))
steps:
- name: Trigger and stream refactor cycle
env:
SPRITE_URL: ${{ secrets.REFACTOR_SPRITE_URL }}
TRIGGER_SECRET: ${{ secrets.REFACTOR_TRIGGER_SECRET }}
run: |
set +e
# --fail-with-body: exit 22 on HTTP errors but still print the body
# -N: no output buffering (stream chunks in real-time)
# --max-time: hard cap matching the Sprite's cycle timeout + grace
curl -sSN --http1.1 --fail-with-body --max-time 5400 -X POST \
"${SPRITE_URL}/trigger?reason=${{ github.event_name }}&issue=${{ github.event.issue.number || '' }}" \
-H "Authorization: Bearer ${TRIGGER_SECRET}"
CURL_EXIT=$?
set -e
if [ "$CURL_EXIT" -eq 0 ]; then
echo ""
echo "=== Cycle completed ==="
elif [ "$CURL_EXIT" -eq 22 ]; then
# HTTP error — body was already printed above (429 = already running, 409 = dedup, etc.)
echo ""
echo "=== Trigger returned HTTP error (see output above) ==="
else
echo ""
echo "=== curl failed (exit=$CURL_EXIT) ==="
exit 1
fi