open PR in Pinata when new cagent-version is released

[derekmisler]

Summary

Adds a new update-pinata job to .github/workflows/release.yml that automatically opens (or updates) a PR in the docker/pinata repository whenever a new cagent-action release is published. This removes the manual step of bumping the cagent-action reference in Pinata's pr-review.yml workflow after each release.

Changes

• .github/workflows/release.yml — release job: Exposes the release commit SHA as a job output (sha) so downstream jobs can reference the exact pinned commit.
• .github/workflows/release.yml — new update-pinata job: Runs after a successful release job and:
  • Authenticates to docker/pinata using a GitHub App token (CAGENT_REVIEWER_APP_ID / CAGENT_REVIEWER_APP_PRIVATE_KEY).
  • Validates that the expected cagent-action reference pattern exists in pinata/.github/workflows/pr-review.yml, then updates it to the new SHA + version tag via sed.
  • Skips the PR step if the file is already up to date.
  • Force-pushes to the auto/update-cagent-action branch and either creates a new PR or edits the existing open one, assigning the team/gordon and merge/auto labels and requesting a review from derekmisler.

How to Test

• Trigger a release in this repo and confirm a PR is opened in docker/pinata targeting auto/update-cagent-action with the correct SHA and version in the body.
• Trigger a second release without merging the first PR and confirm the existing PR is updated (title, body) rather than a duplicate being created.
• Manually set SHA or VERSION to empty in a test run and confirm the workflow exits with an appropriate ::error:: message rather than silently writing a broken reference.

Closes: https://github.com/docker/gordon/issues/203

[derekmisler]

/describe

[docker-agent]

✅ PR description has been generated and updated!

[docker-agent]

Review Summary

Assessment: 🟡 NEEDS ATTENTION

Summary

The workflow adds automation to update the pinata repository when new cagent-action versions are released. The implementation is well-structured with good error handling and validation. However, there is one confirmed race condition issue that should be addressed.

Key Findings

• 1 MEDIUM severity issue: Race condition when multiple releases trigger simultaneously
• 4 issues dismissed: The drafter's concerns about regex escaping, sed failure detection, token scoping, and output validation were all found to have adequate safeguards already in place

Details

The race condition occurs because there's no concurrency control on the update-pinata job. If two releases happen in quick succession (e.g., v1.5.0 followed immediately by v1.5.1), both workflows could force-push to the same branch, potentially resulting in the PR pointing to an older version if the timing is unlucky.

Recommendation: Add a concurrency group to serialize executions of this job.

[derekmisler]

/describe

[docker-agent]

✅ PR description has been generated and updated!

[derekmisler]

/review

[docker-agent]

Review Summary

Assessment: 🟡 NEEDS ATTENTION

This PR adds automation to update the cagent-action reference in docker/pinata after each release. The implementation is well-structured with good error handling, but there is one confirmed bug that could cause the workflow to fail under certain conditions.

Findings

1 MEDIUM severity issue found:

The sed pattern used to match SHA references only supports lowercase hexadecimal digits. While Git typically displays SHAs in lowercase, there's no guarantee that the target file in docker/pinata will always contain lowercase SHAs (it could be manually edited or written by different tooling). This will cause the workflow to fail with a false-positive error if an uppercase SHA is encountered.

Recommendation

Fix the pattern to support both uppercase and lowercase hex digits before merging. The fix is straightforward and will make the workflow more robust.

---

Review posted by cagent-action

[derekmisler]

/review

[docker-agent]

Review Summary

Assessment: 🟢 APPROVE

Summary

I've reviewed the changes in this PR and found no bugs in the added code. The implementation is solid:

✅ Workflow structure: The new update-pinata job correctly depends on the release job and uses proper concurrency controls
✅ Authentication: Uses GitHub App token with appropriate repository scope
✅ Repository access: Uses actions/checkout with proper token authentication (not manual cloning)
✅ Branch management: Consistently uses BRANCH="auto/update-cagent-action" throughout
✅ Validation: Checks for empty SHA/VERSION, validates file existence, and verifies expected pattern before replacement
✅ Sed pattern: Uses a highly specific pattern that matches the exact format (workflow path + 40-char SHA + version comment)
✅ PR handling: Correctly checks for existing PRs and either creates or updates as appropriate
✅ Platform compatibility: Runs on ubuntu-latest where sed -i works without backup extension
✅ Version field additions: The version: "6" additions to agent YAML files are benign metadata changes

The code follows GitHub Actions best practices and includes appropriate error handling, validation, and documentation comments.

---

No issues found. The implementation is ready for merge.