From 408b515e67616ade94f79a88f3de4ccebd7fe4ee Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 29 May 2026 01:02:10 +0000 Subject: [PATCH] docs: update state-machine with security scan workflow and infra changes - Add labelops-pr-security-scan (hourly PR safety classifier) - Update aw-auto-update to reflect create-agent-session delegation - Add all security scan labels to label dictionary - Update source hashes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/docs/state-machine.md | 78 ++++++++++++++++++++++++++++++----- 1 file changed, 67 insertions(+), 11 deletions(-) diff --git a/.github/docs/state-machine.md b/.github/docs/state-machine.md index 7dde7f9a82c..1b590ac96fa 100644 --- a/.github/docs/state-machine.md +++ b/.github/docs/state-machine.md @@ -10,7 +10,8 @@ Auto-generated documentation of all agentic workflows in this repository. | **labelops-pr-maintenance** | ⏰ every 3h | PRs with AI-Auto-Resolve-* labels, CI status | comment, push, labels, dispatch | `AI-Auto-Resolve-CI`, `AI-Auto-Resolve-Conflicts`, `AI-needs-CI-fix-input` | | **regression-pr-shepherd** | ⏰ every 4h | PRs with `AI-Issue-Regression-PR` | comment, push, remove-labels | `AI-Issue-Regression-PR`, `AI-thinks-issue-fixed` | | **labelops-flake-fix** | 🤖 dispatched by labelops-pr-maintenance | Test results, PR diffs | PR, comment, issue | `Flaky`, `automation` | -| **aw-auto-update** | ⏰ every 24h | `.github/workflows/*` files | PR, push | `automation` | +| **labelops-pr-security-scan** | ⏰ every 1h | PR diffs, file lists | labels, comment | `AI-Tooling-Check-Scanned-Clean`, `AI-Tooling-Check-Bypassed`, `⚠️ Affects-*`, `⚠️ Suspicious-Prompting`, `⚠️ Scope-Review-Needed` | +| **aw-auto-update** | ⏰ every 24h | `.github/workflows/*` files | agent-session | `automation` | ## Issue Lifecycle @@ -124,6 +125,46 @@ stateDiagram-v2 Merged --> [*] ``` +## PR Security Scan Lifecycle + +```mermaid +stateDiagram-v2 + direction LR + + [*] --> ScanQueue: ⏰ labelops-pr-security-scan (1h) + + state "Per-PR Classification" as ScanLoop { + ScanQueue --> CheckMemory: 🤖 security-scan reads state.json + + state memcheck <> + CheckMemory --> memcheck + memcheck --> AlreadyScanned: sha unchanged + memcheck --> ClassifyOrigin: new or updated PR + + AlreadyScanned --> [*]: skip + + state origin <> + ClassifyOrigin --> origin + origin --> NonFork: headRepository == this repo + origin --> ForkPR: headRepository != this repo + + NonFork --> Bypassed: 🤖 adds AI-Tooling-Check-Bypassed + ForkPR --> ReadDiff: 🤖 reads file list + diff + + state classify <> + ReadDiff --> classify + classify --> Clean: no categories match + classify --> Flagged: ≥1 category matches + + Clean --> ScannedClean: 🤖 adds AI-Tooling-Check-Scanned-Clean + Flagged --> Labelled: 🤖 adds ⚠️ labels + comment (if changed) + } + + Bypassed --> [*] + ScannedClean --> [*] + Labelled --> [*]: 👤 maintainer reviews flagged areas +``` + ## Infrastructure Lifecycle ```mermaid @@ -139,16 +180,17 @@ stateDiagram-v2 UpToDate --> [*]: 🤖 aw-auto-update noops - ChangesDetected --> PRExists: 🤖 checks for existing PR + ChangesDetected --> DedupeCheck: 🤖 checks for existing PR/session - state prcheck <> - PRExists --> prcheck - prcheck --> UpdateExisting: open PR found - prcheck --> CreateNew: no open PR + state dedup <> + DedupeCheck --> dedup + dedup --> AlreadyOpen: open PR or session exists + dedup --> Delegate: no existing PR/session - UpdateExisting --> WaitReview: 🤖 aw-auto-update pushes to branch - CreateNew --> WaitReview: 🤖 aw-auto-update creates PR + AlreadyOpen --> [*]: 🤖 aw-auto-update noops + Delegate --> AgentSession: 🤖 aw-auto-update creates agent-session + AgentSession --> WaitReview: 🤖 Copilot Coding Agent opens PR WaitReview --> Merged: 👤 maintainer reviews + merges Merged --> [*] ``` @@ -164,6 +206,17 @@ stateDiagram-v2 | `AI-needs-CI-fix-input` | 🤖 labelops-pr-maintenance | 🤖 labelops-pr-maintenance, 👤 maintainer | CI failure requires human intervention | | `AI-Issue-Regression-PR` | 🤖 repo-assist | 🤖 regression-pr-shepherd, 🤖 labelops-pr-maintenance (exclude) | PR is a regression test created by repo-assist | | `Flaky` | 🤖 labelops-flake-fix | 👤 maintainer | Test identified as non-deterministic | +| `AI-Tooling-Check-Scanned-Clean` | 🤖 labelops-pr-security-scan | 👤 maintainer | Fork PR scanned, no safety concerns found | +| `AI-Tooling-Check-Bypassed` | 🤖 labelops-pr-security-scan | 👤 maintainer | Non-fork PR, scan bypassed (trusted origin) | +| `⚠️ Affects-Build-Infra` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR modifies build infrastructure | +| `⚠️ Affects-Compiler-Output` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR affects compiler output | +| `⚠️ Affects-Bootstrap` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR affects bootstrap process | +| `⚠️ Affects-Restore` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR modifies restore/package resolution | +| `⚠️ Affects-Design-Time` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR affects design-time behavior | +| `⚠️ Affects-Test-Tooling` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR modifies test tooling | +| `⚠️ Affects-Agent-Config` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR modifies AI agent configuration | +| `⚠️ Suspicious-Prompting` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR contains prompt injection patterns | +| `⚠️ Scope-Review-Needed` | 🤖 labelops-pr-security-scan | 👤 maintainer | PR diff exceeds stated scope | | `automation` | 🤖 aw-auto-update, 🤖 labelops-flake-fix | 👤 maintainer | PR was created by automation | | `NO_RELEASE_NOTES` | 🤖 repo-assist, 🤖 labelops-flake-fix | ⚙️ CI | PR does not need release notes entry | | `repo-assist` | 🤖 repo-assist | 🤖 repo-assist | Issue is managed by repo-assist (monthly summary) | @@ -182,14 +235,17 @@ stateDiagram-v2 | ⏰ scheduler | 🤖 repo-assist | Every 12h | Cron schedule | | ⏰ scheduler | 🤖 labelops-pr-maintenance | Every 3h | Cron schedule | | ⏰ scheduler | 🤖 regression-pr-shepherd | Every 4h | Cron schedule | +| ⏰ scheduler | 🤖 labelops-pr-security-scan | Every 1h | Cron schedule | | ⏰ scheduler | 🤖 aw-auto-update | Every 24h | Cron schedule | +| 🤖 aw-auto-update | 🤖 Copilot Coding Agent | Changes detected | `create-agent-session` safe output | | 🤖 repo-assist | 🤖 repo-assist | Own PR has CI failure or conflicts | `push-to-pull-request-branch` (self-heal) | | 🤖 labelops-flake-fix | 🤖 labelops-pr-maintenance | Fix PR created | Originating PR comment posted |