wedge stage 11: GitHub Action + Slack/webhook notifier

.github/workflows/zero-action-smoke.yml

@@ -0,0 +1,89 @@
+name: ZERO Action Smoke
+
+on:
+  pull_request:
+    paths:
+      - action.yml
+      - .github/workflows/zero-action-smoke.yml
+  push:
+    branches:
+      - main
+    paths:
+      - action.yml
+      - .github/workflows/zero-action-smoke.yml
+
+jobs:
+  validate:
+    name: Validate action.yml
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Parse action.yml and assert documented inputs
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          import sys, yaml
+
+          with open("action.yml", "r", encoding="utf-8") as handle:
+              doc = yaml.safe_load(handle)
+
+          assert isinstance(doc, dict), "action.yml must be a mapping"
+          assert doc.get("name"), "action must declare a name"
+          assert doc.get("description"), "action must declare a description"
+
+          runs = doc.get("runs") or {}
+          assert runs.get("using") == "composite", "action must be a composite action"
+          steps = runs.get("steps") or []
+          assert len(steps) >= 2, "composite action must define steps"
+
+          inputs = doc.get("inputs") or {}
+          expected_inputs = [
+              "prompt", "prompt-file", "provider", "api-key", "api-key-env",
+              "model", "mode", "auto", "self-correct", "add-dir", "worktree",
+              "output-format", "post-to", "slack-webhook-url", "github-token",
+              "working-directory", "zero-version", "zero-repo",
+          ]
+          missing = [name for name in expected_inputs if name not in inputs]
+          assert not missing, f"action.yml is missing inputs: {missing}"
+
+          # Conservative CI default: autonomy must default to 'low'.
+          assert inputs["auto"].get("default") == "low", "auto must default to low"
+          # stream-json is the documented default capture format.
+          assert inputs["output-format"].get("default") == "stream-json", \
+              "output-format must default to stream-json"
+
+          outputs = doc.get("outputs") or {}
+          for name in ("exit-code", "output-file", "summary"):
+              assert name in outputs, f"action.yml is missing output: {name}"
+
+          # The action must never enable unsafe mode implicitly.
+          serialized = yaml.safe_dump(doc)
+          assert "--skip-permissions-unsafe" not in serialized, \
+              "action must never pass --skip-permissions-unsafe"
+
+          print(f"action.yml OK: {len(inputs)} inputs, {len(outputs)} outputs, {len(steps)} steps")
+          PY
+
+      - name: Shell-syntax-check embedded run blocks
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import yaml
+          with open("action.yml", "r", encoding="utf-8") as handle:
+              doc = yaml.safe_load(handle)
+          steps = (doc.get("runs") or {}).get("steps") or []
+          for index, step in enumerate(steps):
+              run = step.get("run")
+              if run:
+                  with open(f"/tmp/zero_step_{index}.sh", "w", encoding="utf-8") as out:
+                      out.write(run)
+          PY
+          for script in /tmp/zero_step_*.sh; do
+            echo "bash -n ${script}"
+            bash -n "${script}"
+          done

action.yml

@@ -0,0 +1,297 @@
+name: ZERO
+description: >-
+  Run the ZERO coding agent headlessly in a GitHub workflow. ZERO is
+  model- and provider-agnostic: you supply the provider and API key as inputs.
+author: Gitlawb
+
+branding:
+  icon: terminal
+  color: green
+
+inputs:
+  prompt:
+    description: The instruction for ZERO to execute. Mutually exclusive with prompt-file.
+    required: false
+    default: ""
+  prompt-file:
+    description: Path (relative to working-directory) to a file whose contents are the prompt.
+    required: false
+    default: ""
+  provider:
+    description: >-
+      Provider id to activate (for example openai, anthropic, gemini, ollama, or
+      any configured OpenAI-/Anthropic-compatible endpoint). Optional when the
+      repository already carries a .zero/config.json with an active provider.
+    required: false
+    default: ""
+  api-key:
+    description: >-
+      The provider API key. Pass it from a repository or organization secret;
+      it is exported into the step environment and never written to the log.
+    required: false
+    default: ""
+  api-key-env:
+    description: >-
+      Name of the environment variable the chosen provider reads its key from
+      (for example OPENAI_API_KEY or ANTHROPIC_API_KEY). When set together with
+      api-key, that variable is exported for the run. Leave the action
+      provider-agnostic by passing the env name your provider expects rather
+      than hardcoding one here.
+    required: false
+    default: ""
+  model:
+    description: Model id to use for the run. Defaults to the resolved provider's default.
+    required: false
+    default: ""
+  mode:
+    description: Run mode passed to `zero exec --mode` (for example smart, deep, or fast).
+    required: false
+    default: ""
+  auto:
+    description: >-
+      Autonomy ceiling passed to `zero exec --auto` (low, medium, or high).
+      Defaults to the conservative `low` so an unattended CI run cannot take
+      high-impact actions implicitly.
+    required: false
+    default: low
+  self-correct:
+    description: >-
+      When true, allow ZERO to request a stronger model mid-run if it hits a
+      wall (maps to `zero exec --allow-escalation`).
+    required: false
+    default: "false"
+  add-dir:
+    description: >-
+      Newline- or comma-separated extra write roots granted to the run (each
+      passed as `zero exec --add-dir`). The checked-out repository is always
+      writable; everything else stays read-only unless listed here.
+    required: false
+    default: ""
+  worktree:
+    description: When true, run inside an isolated git worktree (`zero exec --worktree`).
+    required: false
+    default: "false"
+  output-format:
+    description: >-
+      Output format for `zero exec` (text, json, or stream-json). Defaults to
+      stream-json, which is captured to a file and exposed as the output-file
+      output and uploaded by the caller if desired.
+    required: false
+    default: stream-json
+  post-to:
+    description: >-
+      Optional destination for a run summary after ZERO finishes: `pr-comment`
+      posts to the triggering pull request using github-token, `slack` posts to
+      slack-webhook-url, or `none` (default) posts nowhere.
+    required: false
+    default: none
+  slack-webhook-url:
+    description: >-
+      Slack incoming-webhook (or generic webhook) URL used when post-to is
+      slack. Pass it from a secret; it is never written to the log.
+    required: false
+    default: ""
+  github-token:
+    description: >-
+      Token used to post a PR comment when post-to is pr-comment. Defaults to
+      the workflow's GITHUB_TOKEN; the workflow must grant pull-requests: write.
+    required: false
+    default: ${{ github.token }}
+  working-directory:
+    description: Directory to run ZERO in. Defaults to the workspace root.
+    required: false
+    default: ${{ github.workspace }}
+  zero-version:
+    description: >-
+      ZERO release version/tag to install (for example v1.2.3 or latest).
+      Defaults to the ref this action was resolved at, falling back to latest.
+    required: false
+    default: ""
+  zero-repo:
+    description: Repository to install the ZERO release from (owner/repo).
+    required: false
+    default: Gitlawb/zero
+
+outputs:
+  exit-code:
+    description: The exit code ZERO returned (0 success, 2 usage, 3 provider, non-zero otherwise).
+    value: ${{ steps.run.outputs.exit-code }}
+  output-file:
+    description: Path to the captured ZERO stdout (the raw output-format stream).
+    value: ${{ steps.run.outputs.output-file }}
+  summary:
+    description: A short human-readable summary line parsed from the run, when available.
+    value: ${{ steps.run.outputs.summary }}
+
+runs:
+  using: composite
+  steps:
+    - name: Install ZERO
+      shell: bash
+      env:
+        ZERO_REPO: ${{ inputs.zero-repo }}
+        ZERO_VERSION_INPUT: ${{ inputs.zero-version }}
+        ACTION_REF: ${{ github.action_ref }}
+        ACTION_PATH: ${{ github.action_path }}
+        RUNNER_TEMP: ${{ runner.temp }}
+      run: |
+        set -euo pipefail
+        if [ "${RUNNER_OS}" = "Windows" ]; then
+          echo "::error::The ZERO action currently supports Linux and macOS runners only." >&2
+          exit 1
+        fi
+        # Resolve the version to install: explicit input wins; otherwise the ref
+        # this action was checked out at (a tag); otherwise the latest release.
+        version="${ZERO_VERSION_INPUT}"
+        if [ -z "${version}" ]; then
+          version="${ACTION_REF}"
+        fi
+        # A commit-SHA pin (github.action_ref is the 40-hex SHA) is not a release
+        # tag, so fall back to latest rather than fetching releases/download/v<sha>.
+        case "${version}" in
+          ""|refs/*|*/*) version="latest" ;;
+        esac
+        if printf '%s' "${version}" | grep -qiE '^[0-9a-f]{40}$'; then
+          version="latest"
+        fi
+        install_dir="${RUNNER_TEMP}/zero-bin"
+        mkdir -p "${install_dir}"
+        # Reuse ZERO's own checksum-verifying installer, shipped with the action.
+        ZERO_REPO="${ZERO_REPO}" ZERO_VERSION="${version}" ZERO_INSTALL_DIR="${install_dir}" \
+          bash "${ACTION_PATH}/scripts/install.sh"
+        echo "${install_dir}" >> "${GITHUB_PATH}"
+
+    - name: Run ZERO
+      id: run
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        # Secrets are passed via the environment and never echoed. `set +x` and
+        # the absence of any `echo` of these values keep them out of the log.
+        ZERO_INPUT_API_KEY: ${{ inputs.api-key }}
+        ZERO_INPUT_API_KEY_ENV: ${{ inputs.api-key-env }}
+        ZERO_INPUT_PROVIDER: ${{ inputs.provider }}
+        ZERO_INPUT_PROMPT: ${{ inputs.prompt }}
+        ZERO_INPUT_PROMPT_FILE: ${{ inputs.prompt-file }}
+        ZERO_INPUT_MODEL: ${{ inputs.model }}
+        ZERO_INPUT_MODE: ${{ inputs.mode }}
+        ZERO_INPUT_AUTO: ${{ inputs.auto }}
+        ZERO_INPUT_SELF_CORRECT: ${{ inputs.self-correct }}
+        ZERO_INPUT_ADD_DIR: ${{ inputs.add-dir }}
+        ZERO_INPUT_WORKTREE: ${{ inputs.worktree }}
+        ZERO_INPUT_OUTPUT_FORMAT: ${{ inputs.output-format }}
+        RUNNER_TEMP: ${{ runner.temp }}
+      run: |
+        set -euo pipefail
+
+        # Export the provider key under the env name the provider expects. This
+        # keeps the action provider-agnostic: no provider->env mapping is baked
+        # in. The value is never printed.
+        if [ -n "${ZERO_INPUT_API_KEY}" ] && [ -n "${ZERO_INPUT_API_KEY_ENV}" ]; then
+          if ! printf '%s' "${ZERO_INPUT_API_KEY_ENV}" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
+            echo "::error::api-key-env must be a valid environment variable name." >&2
+            exit 2
+          fi
+          # Export in-process so the zero invocation in this same run block sees
+          # it, and append to GITHUB_ENV so any later steps inherit it too.
+          export "${ZERO_INPUT_API_KEY_ENV}=${ZERO_INPUT_API_KEY}"
+          printf '%s=%s\n' "${ZERO_INPUT_API_KEY_ENV}" "${ZERO_INPUT_API_KEY}" >> "${GITHUB_ENV}"
+        fi
+        if [ -n "${ZERO_INPUT_PROVIDER}" ]; then
+          export ZERO_PROVIDER="${ZERO_INPUT_PROVIDER}"
+        fi
+
+        args=(exec)
+
+        if [ -n "${ZERO_INPUT_PROMPT_FILE}" ] && [ -n "${ZERO_INPUT_PROMPT}" ]; then
+          echo "::error::The 'prompt' and 'prompt-file' inputs are mutually exclusive." >&2
+          exit 2
+        fi
+        if [ -n "${ZERO_INPUT_PROMPT_FILE}" ]; then
+          args+=(--file "${ZERO_INPUT_PROMPT_FILE}")
+        elif [ -n "${ZERO_INPUT_PROMPT}" ]; then
+          args+=(--prompt "${ZERO_INPUT_PROMPT}")
+        else
+          echo "::error::Provide either the 'prompt' or 'prompt-file' input." >&2
+          exit 2
+        fi
+
+        [ -n "${ZERO_INPUT_MODEL}" ] && args+=(--model "${ZERO_INPUT_MODEL}")
+        [ -n "${ZERO_INPUT_MODE}" ] && args+=(--mode "${ZERO_INPUT_MODE}")
+        [ -n "${ZERO_INPUT_AUTO}" ] && args+=(--auto "${ZERO_INPUT_AUTO}")
+        [ "${ZERO_INPUT_SELF_CORRECT}" = "true" ] && args+=(--allow-escalation)
+        [ "${ZERO_INPUT_WORKTREE}" = "true" ] && args+=(--worktree)
+        args+=(--output-format "${ZERO_INPUT_OUTPUT_FORMAT}")
+        # No --notify in CI (no terminal); the optional Slack post is handled
+        # separately below so it works regardless of output format.
+        args+=(--no-notify)
+
+        # Split add-dir on newlines and commas; each non-empty entry is a root.
+        if [ -n "${ZERO_INPUT_ADD_DIR}" ]; then
+          while IFS= read -r dir; do
+            # Trim only surrounding whitespace so paths with internal spaces survive.
+            dir="$(printf '%s' "${dir}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+            [ -n "${dir}" ] && args+=(--add-dir "${dir}")
+          done < <(printf '%s' "${ZERO_INPUT_ADD_DIR}" | tr ',' '\n')
+        fi
+
+        output_file="${RUNNER_TEMP}/zero-output.txt"
+
+        # Run ZERO. Capture stdout to a file AND echo it to the log. Surface the
+        # real exit code as the step's status. The sandbox is active by default;
+        # this action never enables unsafe permission-skipping.
+        set +e
+        zero "${args[@]}" | tee "${output_file}"
+        code=${PIPESTATUS[0]}
+        set -e
+
+        echo "exit-code=${code}" >> "${GITHUB_OUTPUT}"
+        echo "output-file=${output_file}" >> "${GITHUB_OUTPUT}"
+
+        # Best-effort one-line summary: last non-empty line of the captured output.
+        summary="$(grep -v '^[[:space:]]*$' "${output_file}" | tail -n 1 || true)"
+        # Keep the summary single-line and bounded for the step output.
+        summary="$(printf '%s' "${summary}" | cut -c1-280)"
+        {
+          echo "summary<<ZERO_EOF"
+          printf '%s\n' "${summary}"
+          echo "ZERO_EOF"
+        } >> "${GITHUB_OUTPUT}"
+
+        exit "${code}"
+
+    - name: Post run summary to pull request
+      if: ${{ always() && inputs.post-to == 'pr-comment' && github.event.pull_request.number != '' }}
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        ZERO_EXIT: ${{ steps.run.outputs.exit-code }}
+        ZERO_SUMMARY: ${{ steps.run.outputs.summary }}
+      run: |
+        set -euo pipefail
+        status="succeeded"
+        [ "${ZERO_EXIT}" != "0" ] && status="failed (exit ${ZERO_EXIT})"
+        body="$(printf 'ZERO run %s.\n\n%s' "${status}" "${ZERO_SUMMARY}")"
+        gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
+          -f body="${body}" >/dev/null
+
+    - name: Post run summary to Slack
+      if: ${{ always() && inputs.post-to == 'slack' && inputs.slack-webhook-url != '' }}
+      shell: bash
+      env:
+        SLACK_WEBHOOK_URL: ${{ inputs.slack-webhook-url }}
+        ZERO_EXIT: ${{ steps.run.outputs.exit-code }}
+        ZERO_SUMMARY: ${{ steps.run.outputs.summary }}
+        RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |
+        set -euo pipefail
+        status="succeeded"
+        [ "${ZERO_EXIT}" != "0" ] && status="failed (exit ${ZERO_EXIT})"
+        text="ZERO run ${status} for ${GITHUB_REPOSITORY}@${GITHUB_REF_NAME}. ${ZERO_SUMMARY} ${RUN_URL}"
+        # Slack incoming webhooks accept {"text": "..."}; jq escapes the body and
+        # the URL is never echoed. A delivery failure is a warning, not a failure.
+        payload="$(jq -n --arg text "${text}" '{text: $text}')"
+        curl --fail --silent --show-error -X POST -H 'Content-Type: application/json' \
+          -d "${payload}" "${SLACK_WEBHOOK_URL}" >/dev/null || \
+          echo "::warning::Slack webhook delivery failed (run not affected)."