feat: GitHub Actions workflows for agent-driven development#189
feat: GitHub Actions workflows for agent-driven development#189jbdevprimary merged 3 commits intomainfrom
Conversation
Co-authored-by: jon <jon@jonbogaty.com>
…project management New workflows: - agent-issue-triage.yml: Auto-label, project board, /agent commands, cross-repo linking - agent-project-management.yml: Status sync, stale issue handling, ecosystem reports Features: - Auto-classify issues (bug, feature, security, packages) - Auto-add issues to project board - /agent commands in issue comments (review, fix, investigate, close, help) - Cross-repo issue linking across ecosystem - Weekly stale issue management - Ecosystem status report generation - Maintenance agent spawning Combined with agent-pr-review.yml and agent-post-merge.yml, this provides complete CI/CD integration for agent-driven development.
|
⏳ Code review in progress. Analyzing for code quality issues and best practices. You can monitor the review status in the checks section at the bottom of this pull request. Detailed findings will be posted upon completion. Using Amazon Q Developer for GitHubAmazon Q Developer1 is an AI-powered assistant that integrates directly into your GitHub workflow, enhancing your development process with intelligent features for code development, review, and transformation. Slash Commands
FeaturesAgentic Chat Code Review CustomizationYou can create project-specific rules for Amazon Q Developer to follow:
Example rule: FeedbackTo provide feedback on Amazon Q Developer, create an issue in the Amazon Q Developer public repository. For more detailed information, visit the Amazon Q for GitHub documentation. Footnotes
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Summary of ChangesHello @jbcom, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the project's automation capabilities by integrating a suite of GitHub Actions workflows designed for agent-driven development. It centralizes the orchestration of Cursor background agents within the CI/CD pipeline, automating tasks such as PR reviews, post-merge actions, issue triage, and project management. The core of this integration is a new reusable action that can spawn agents or create fallback issues, streamlining development processes and ensuring robust handling of automated tasks. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
🤖 Background Agent Review Requested A Cursor background agent has been dispatched to review this PR. Task: Code quality, security, tests, documentation review The agent will comment with findings once complete. Automated by agent-pr-review workflow |
There was a problem hiding this comment.
Pull request overview
This PR introduces comprehensive GitHub Actions workflows to enable agent-driven development, moving orchestration logic from individual background agents into proper CI/CD pipelines. The changes implement automated PR reviews, post-merge tasks, issue triage, and project management through spawned Cursor background agents.
Key changes:
- Four new workflow files that trigger on PR events, main merges, issue activity, and scheduled intervals
- A reusable composite action for spawning Cursor background agents with fallback to GitHub issues
- Integration with GitHub Projects, automated labeling, and cross-repository issue linking
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/agent-pr-review.yml |
Spawns review agents for opened/synced PRs to check code quality, security, tests, and docs |
.github/workflows/agent-post-merge.yml |
Detects changes on main and spawns appropriate follow-up agents for ecosystem sync, docs, security, or CI verification |
.github/workflows/agent-issue-triage.yml |
Auto-labels new issues, adds to project board, handles /agent commands, and links related cross-repo issues |
.github/workflows/agent-project-management.yml |
Syncs issue/PR status to project board, manages stale issues, generates ecosystem reports, and spawns maintenance agents |
.github/actions/spawn-cursor-agent/action.yml |
Reusable composite action that attempts to spawn Cursor agents with fallback to creating GitHub issues |
| STALE_DATE=$(date -d "-${{ env.STALE_DAYS }} days" +%Y-%m-%d) | ||
| VERY_STALE_DATE=$(date -d "-${{ env.VERY_STALE_DAYS }} days" +%Y-%m-%d) |
There was a problem hiding this comment.
The date -d flag is GNU-specific and will fail on macOS runners (which use BSD date). Use a portable date calculation or specify runs-on: ubuntu-latest explicitly if not already present. Consider using date -u -v-${STALE_DAYS}d for BSD or add a conditional check for the OS.
| MATCHES=$(gh issue list --repo "$repo" --state all --limit 5 --json number,title,url \ | ||
| --jq ".[] | select(.title | ascii_downcase | contains(\"$(echo $TITLE | cut -c1-30 | tr '[:upper:]' '[:lower:]')\")) | \"- \(.url)\"" 2>/dev/null || echo "") |
There was a problem hiding this comment.
The command substitution $(echo $TITLE | cut -c1-30 | tr '[:upper:]' '[:lower:]') is vulnerable to shell injection if $TITLE contains special characters. The title should be properly escaped or sanitized before being embedded in the jq filter. Consider using jq's --arg option to pass the title safely.
| MATCHES=$(gh issue list --repo "$repo" --state all --limit 5 --json number,title,url \ | |
| --jq ".[] | select(.title | ascii_downcase | contains(\"$(echo $TITLE | cut -c1-30 | tr '[:upper:]' '[:lower:]')\")) | \"- \(.url)\"" 2>/dev/null || echo "") | |
| # Preprocess the title safely | |
| TITLE_SUBSTR=$(echo "$TITLE" | cut -c1-30 | tr '[:upper:]' '[:lower:]') | |
| MATCHES=$(gh issue list --repo "$repo" --state all --limit 5 --json number,title,url \ | |
| --jq ".[] | select(.title | ascii_downcase | contains(\$title_substr)) | \"- \(.url)\"" \ | |
| --arg title_substr "$TITLE_SUBSTR" 2>/dev/null || echo "") |
| - name: Install Dependencies | ||
| shell: bash | ||
| run: | | ||
| npm install -g cursor-background-agent-mcp-server 2>/dev/null || true |
There was a problem hiding this comment.
Suppressing stderr with 2>/dev/null || true hides potentially useful error messages. If the npm install fails for legitimate reasons (network issues, package not found), debugging will be difficult. Consider capturing and logging the error or at least warning the user.
| npm install -g cursor-background-agent-mcp-server 2>/dev/null || true | |
| if ! npm install -g cursor-background-agent-mcp-server; then | |
| echo "❌ Failed to install cursor-background-agent-mcp-server. Please check the error above for details." >&2 | |
| exit 1 | |
| fi |
| run: | | ||
| echo "📊 Generating ecosystem status report..." | ||
|
|
||
| REPOS="jbcom/jbcom-control-center jbcom/extended-data-types jbcom/lifecyclelogging jbcom/vendor-connectors jbcom/directed-inputs-class" |
There was a problem hiding this comment.
The hardcoded list of repositories appears in multiple places (also in agent-issue-triage.yml line 313). Consider defining this as an environment variable at the workflow level or in a shared configuration to maintain a single source of truth.
| **Ref**: ${{ github.event.pull_request.head.sha }} | ||
| EOF | ||
|
|
||
| echo "task=$(cat /tmp/review_task.md | base64 -w0)" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
The -w0 flag for base64 is GNU-specific and will fail on macOS runners. Use base64 | tr -d '\n' for cross-platform compatibility.
| echo "task=$(cat /tmp/review_task.md | base64 -w0)" >> $GITHUB_OUTPUT | |
| echo "task=$(cat /tmp/review_task.md | base64 | tr -d '\n')" >> $GITHUB_OUTPUT |
| gh issue comment $ISSUE_NUM --body "$(cat << EOF | ||
| 🔗 **Potentially Related Issues Found** | ||
|
|
||
| $(echo -e "$RELATED") |
There was a problem hiding this comment.
Using echo -e with unquoted variables can cause unexpected behavior if $RELATED contains backslash sequences. The variable should be quoted: \"$RELATED\" to prevent interpretation of escape sequences.
| $(echo -e "$RELATED") | |
| $RELATED |
| gh project item-add ${{ env.PROJECT_NUMBER }} \ | ||
| --owner "@me" \ | ||
| --url "https://github.com/${{ github.repository }}/issues/$issue_num" 2>/dev/null || true |
There was a problem hiding this comment.
Silencing errors with 2>/dev/null || true hides failures when adding items to the project board. Consider logging when this operation fails so administrators can diagnose permission or configuration issues.
| gh project item-add ${{ env.PROJECT_NUMBER }} \ | |
| --owner "@me" \ | |
| --url "https://github.com/${{ github.repository }}/issues/$issue_num" 2>/dev/null || true | |
| if ! gh project item-add ${{ env.PROJECT_NUMBER }} \ | |
| --owner "@me" \ | |
| --url "https://github.com/${{ github.repository }}/issues/$issue_num"; then | |
| echo "❌ Failed to add issue #$issue_num to project board. Check permissions and configuration." >&2 | |
| fi |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security Review Summary
This PR introduces comprehensive GitHub Actions workflows for agent-driven development, but contains critical security vulnerabilities that must be addressed before merge.
🔴 Critical Security Issues Found
Command Injection Vulnerabilities (CWE-78)
- Multiple workflows directly interpolate user-controlled input (PR titles, issue content, commit messages) into shell commands without sanitization
- These vulnerabilities could allow arbitrary command execution in CI/CD environment
- Affected files: All workflow files
Credential Exposure Risk (CWE-532)
- CURSOR_API_KEY potentially exposed in workflow logs through echo statements
- Could lead to API key leakage in CI/CD logs
🟡 Implementation Issues
Non-functional Components
- Agent spawning logic is hardcoded to always fail, making workflows create issues instead of actual agent spawning
- Project status update logic is incomplete (placeholder only)
- Missing error handling for npm package installation
✅ Architecture Assessment
The overall workflow architecture is well-designed:
- Comprehensive coverage of PR review, issue triage, post-merge tasks, and project management
- Good separation of concerns across different workflow files
- Appropriate use of GitHub Actions features and permissions
- Follows project's agent-driven development philosophy
🔧 Required Actions
- Fix all command injection vulnerabilities by sanitizing user input before shell interpolation
- Remove credential exposure by avoiding echo of sensitive environment variables
- Implement actual agent spawning logic or clearly document the fallback-only approach
- Complete project status update functionality or remove incomplete code
📋 Recommendation
Request Changes - The security vulnerabilities are blocking issues that must be resolved. The architectural approach is sound, but the implementation needs security hardening before it can be safely deployed.
Once security issues are addressed, this will be a valuable addition to the project's CI/CD automation capabilities.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| echo "🤖 Attempting to spawn Cursor background agent..." | ||
| echo "Repository: ${{ inputs.repository }}" | ||
| echo "Ref: ${{ inputs.ref }}" | ||
| echo "Model: ${{ inputs.model }}" |
There was a problem hiding this comment.
🛑 Security Vulnerability: The CURSOR_API_KEY is exposed in workflow logs through echo statements. This could leak sensitive credentials in CI/CD logs.
| echo "🤖 Attempting to spawn Cursor background agent..." | |
| echo "Repository: ${{ inputs.repository }}" | |
| echo "Ref: ${{ inputs.ref }}" | |
| echo "Model: ${{ inputs.model }}" | |
| echo "🤖 Attempting to spawn Cursor background agent..." | |
| echo "Repository: ${{ inputs.repository }}" | |
| echo "Ref: ${{ inputs.ref }}" | |
| echo "Model: ${{ inputs.model }}" |
| echo "Using cursor-background-agent-mcp-server..." | ||
| # MCP server spawn would go here | ||
| # For now, mark as needing fallback | ||
| SPAWN_SUCCESS=false |
There was a problem hiding this comment.
The spawn logic is hardcoded to always fail. This makes the action non-functional and will always fall back to creating issues instead of actually spawning agents.
| SPAWN_SUCCESS=false | |
| # MCP server spawn would go here | |
| # TODO: Implement actual agent spawning logic | |
| # SPAWN_SUCCESS=true when implementation is ready | |
| SPAWN_SUCCESS=false |
|
|
||
| ISSUE_URL=$(gh issue create \ | ||
| --repo "${{ inputs.repository }}" \ | ||
| --title "🤖 Agent Task: $(echo '${{ inputs.task }}' | head -c 60)..." \ |
There was a problem hiding this comment.
🛑 Command Injection Risk: The task input is directly interpolated into shell command without proper escaping. Malicious task content could execute arbitrary commands.
| --title "🤖 Agent Task: $(echo '${{ inputs.task }}' | head -c 60)..." \ | |
| --title "🤖 Agent Task: $(echo "${{ inputs.task }}" | head -c 60 | tr -d '\n' | sed 's/[^a-zA-Z0-9 ._-]//g')..." \ |
| node-version: '20' | ||
|
|
||
| - name: Install cursor-background-agent-mcp-server | ||
| run: npm install -g cursor-background-agent-mcp-server |
There was a problem hiding this comment.
Missing error handling for npm install. If the package doesn't exist or installation fails, the workflow should handle this gracefully rather than potentially causing silent failures.
| run: npm install -g cursor-background-agent-mcp-server | |
| run: npm install -g cursor-background-agent-mcp-server 2>/dev/null || echo "Package not available, will use fallback" |
| **Title**: ${{ github.event.pull_request.title }} | ||
| **Author**: ${{ github.event.pull_request.user.login }} |
There was a problem hiding this comment.
🛑 Command Injection Risk: PR title and author are directly interpolated into shell commands without sanitization. Malicious PR titles could execute arbitrary commands.
| **Title**: ${{ github.event.pull_request.title }} | |
| **Author**: ${{ github.event.pull_request.user.login }} | |
| **Title**: $(echo "${{ github.event.pull_request.title }}" | sed 's/[^a-zA-Z0-9 ._-]//g') | |
| **Author**: $(echo "${{ github.event.pull_request.user.login }}" | sed 's/[^a-zA-Z0-9._-]//g') |
| TITLE="${{ github.event.issue.title }}" | ||
| BODY="${{ github.event.issue.body }}" |
There was a problem hiding this comment.
🛑 Command Injection Risk: Issue title and body are directly interpolated into shell commands without sanitization. Malicious issue content could execute arbitrary commands.
| TITLE="${{ github.event.issue.title }}" | |
| BODY="${{ github.event.issue.body }}" | |
| TITLE=$(echo "${{ github.event.issue.title }}" | sed 's/[^a-zA-Z0-9 ._-]//g') | |
| BODY=$(echo "${{ github.event.issue.body }}" | sed 's/[^a-zA-Z0-9 ._-]//g') |
|
|
||
| # Search for similar issues | ||
| MATCHES=$(gh issue list --repo "$repo" --state all --limit 5 --json number,title,url \ | ||
| --jq ".[] | select(.title | ascii_downcase | contains(\"$(echo $TITLE | cut -c1-30 | tr '[:upper:]' '[:lower:]')\")) | \"- \(.url)\"" 2>/dev/null || echo "") |
There was a problem hiding this comment.
🛑 Command Injection Risk: The TITLE variable is directly interpolated into a jq command without proper escaping. This could allow command injection through malicious issue titles.
| --jq ".[] | select(.title | ascii_downcase | contains(\"$(echo $TITLE | cut -c1-30 | tr '[:upper:]' '[:lower:]')\")) | \"- \(.url)\"" 2>/dev/null || echo "") | |
| MATCHES=$(gh issue list --repo "$repo" --state all --limit 5 --json number,title,url \ | |
| --jq ".[] | select(.title | ascii_downcase | contains(\"$(echo "$TITLE" | cut -c1-30 | tr '[:upper:]' '[:lower:]' | sed 's/[^a-zA-Z0-9 ]//g')\")) | \"- \(.url)\"" 2>/dev/null || echo "") |
| **Commit**: ${{ github.event.head_commit.message }} | ||
| **Author**: ${{ github.event.head_commit.author.name }} |
There was a problem hiding this comment.
🛑 Command Injection Risk: Commit message and author name are directly interpolated into shell commands without sanitization. Malicious commit messages could execute arbitrary commands.
| **Commit**: ${{ github.event.head_commit.message }} | |
| **Author**: ${{ github.event.head_commit.author.name }} | |
| **Commit**: $(echo "${{ github.event.head_commit.message }}" | sed 's/[^a-zA-Z0-9 ._-]//g' | head -c 100) | |
| **Author**: $(echo "${{ github.event.head_commit.author.name }}" | sed 's/[^a-zA-Z0-9 ._-]//g') |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| PR_NUM="${{ github.event.pull_request.number }}" | ||
| PR_BODY="${{ github.event.pull_request.body }}" |
There was a problem hiding this comment.
🛑 Command Injection Risk: PR body content is directly interpolated into shell commands without sanitization. Malicious PR descriptions could execute arbitrary commands.
| PR_BODY="${{ github.event.pull_request.body }}" | |
| PR_BODY=$(echo "${{ github.event.pull_request.body }}" | sed 's/[^a-zA-Z0-9 ._#-]//g') |
| # Note: Actual project field update requires GraphQL API | ||
| # This is a placeholder for the status update logic | ||
| fi |
There was a problem hiding this comment.
The project status update logic is incomplete. The workflow determines the status but doesn't actually update the project board, making this functionality non-operational.
| # Note: Actual project field update requires GraphQL API | |
| # This is a placeholder for the status update logic | |
| fi | |
| echo "Setting status to: $STATUS" | |
| # TODO: Implement GraphQL API call to update project status | |
| # gh api graphql -f query='mutation { updateProjectV2ItemFieldValue(...) }' | |
| echo "⚠️ Project status update not yet implemented" |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a set of GitHub Actions workflows for agent-driven development, which is a great initiative. The new composite action spawn-cursor-agent is well-structured. My main feedback is on the Create Fallback Issue step within this action, which has a critical bug in how it constructs the shell command to create a GitHub issue. The current implementation will fail to create the issue correctly. I've provided a detailed comment and a code suggestion to fix this. Once that's addressed, this will be a solid foundation for your agent orchestration.
| run: | | ||
| echo "📝 Creating fallback issue for agent task..." | ||
|
|
||
| ISSUE_URL=$(gh issue create \ | ||
| --repo "${{ inputs.repository }}" \ | ||
| --title "🤖 Agent Task: $(echo '${{ inputs.task }}' | head -c 60)..." \ | ||
| --body "$(cat << 'EOF' | ||
| ## Background Agent Task | ||
|
|
||
| **Model**: ${{ inputs.model }} | ||
| **Repository**: ${{ inputs.repository }} | ||
| **Ref**: ${{ inputs.ref }} | ||
| **Created**: $(date -u +"%Y-%m-%dT%H:%M:%SZ") | ||
|
|
||
| ## Task Description | ||
|
|
||
| ${{ inputs.task }} | ||
|
|
||
| --- | ||
|
|
||
| *This task was created because direct agent spawning was not available.* | ||
| *A background agent should pick this up and work on it.* | ||
|
|
||
| **To work on this task:** | ||
| 1. Read the task description above | ||
| 2. Complete the required actions | ||
| 3. Comment with results | ||
| 4. Close the issue when done | ||
| EOF | ||
| )" \ | ||
| --label "${{ inputs.issue_labels }}") | ||
|
|
||
| echo "issue_url=$ISSUE_URL" >> $GITHUB_OUTPUT | ||
| echo "✅ Created fallback issue: $ISSUE_URL" |
There was a problem hiding this comment.
The current implementation for creating the fallback issue is non-functional and insecure.
- Incorrect variable expansion: The use of single quotes in
echo '${{ inputs.task }}'andcat << 'EOF'prevents input variables from being expanded. The issue title and body will contain literal text like${{ inputs.task}}instead of the actual values. - Broken here-document: The
EOFmarker for thecatcommand is indented, which will cause a shell syntax error because it's not at the beginning of a line. - Command injection risk: Embedding inputs directly into the command string is unsafe.
The suggested change refactors this step to be safe and functional. It properly assigns inputs to shell variables, builds the body string separately, and uses process substitution with printf to securely pass the multiline body to the gh CLI.
run: |
echo "📝 Creating fallback issue for agent task..."
TASK='${{ inputs.task }}'
MODEL='${{ inputs.model }}'
REPOSITORY='${{ inputs.repository }}'
REF='${{ inputs.ref }}'
# Prepare issue body as a string with newlines
BODY="## Background Agent Task\n\n**Model**: $MODEL\n**Repository**: $REPOSITORY\n**Ref**: $REF\n**Created**: $(date -u +'%Y-%m-%dT%H:%M:%SZ')\n\n## Task Description\n\n$TASK\n\n---\n\n*This task was created because direct agent spawning was not available.*\n*A background agent should pick this up and work on it.*\n\n**To work on this task:**\n1. Read the task description above\n2. Complete the required actions\n3. Comment with results\n4. Close the issue when done"
# Truncate task for title
TITLE_TASK=$(echo "$TASK" | head -c 60)
# Create issue using process substitution to pass body
ISSUE_URL=$(gh issue create \
--repo "$REPOSITORY" \
--title "🤖 Agent Task: $TITLE_TASK..." \
--body-file <(printf "%b" "$BODY") \
--label "${{ inputs.issue_labels }}")
echo "issue_url=$ISSUE_URL" >> $GITHUB_OUTPUT
echo "✅ Created fallback issue: $ISSUE_URL"![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| if: | | ||
| (github.event_name == 'issues' && github.event.action == 'opened') || | ||
| github.event_name == 'workflow_dispatch' | ||
| needs: [auto-label] |
There was a problem hiding this comment.
Bug: Job dependency causes workflow_dispatch events to skip execution
The spawn-triage-agent job specifies needs: [auto-label], but the auto-label job only runs when github.event_name == 'issues' && github.event.action == 'opened'. When the workflow is triggered via workflow_dispatch, the auto-label job is skipped, causing spawn-triage-agent to also be skipped due to the dependency chain, even though the job's if condition explicitly includes github.event_name == 'workflow_dispatch'. The manual triage feature documented in the workflow will never actually execute.
| **Model**: ${{ inputs.model }} | ||
| **Repository**: ${{ inputs.repository }} | ||
| **Ref**: ${{ inputs.ref }} | ||
| **Created**: $(date -u +"%Y-%m-%dT%H:%M:%SZ") |
There was a problem hiding this comment.
Bug: Date command not expanded in quoted heredoc
The heredoc uses a quoted delimiter 'EOF' which prevents shell expansion. The $(date -u +"%Y-%m-%dT%H:%M:%SZ") command substitution on line 108 will appear literally in the created issue body as the string $(date -u +"%Y-%m-%dT%H:%M:%SZ") instead of being replaced with the actual timestamp. Removing the quotes around EOF would enable proper expansion.
| issues: | ||
| types: [opened, closed, reopened, assigned, labeled] | ||
| pull_request: | ||
| types: [opened, closed, merged, review_requested] |
There was a problem hiding this comment.
Bug: Invalid merged event type for pull_request trigger
The pull_request trigger specifies merged as an activity type, but this is not a valid GitHub Actions event type. Valid types include opened, closed, synchronize, review_requested, etc. The workflow will never trigger for "merged" events because that type doesn't exist. To detect merged PRs, the closed type combined with checking github.event.pull_request.merged == true is required (the code on line 107 correctly uses this check, but the trigger itself is misconfigured).
Security fixes across all agent workflows: 1. Command Injection Prevention: - Sanitize all user inputs (PR titles, issue titles/bodies, commit messages) - Use environment variables instead of direct interpolation - Use jq --arg for safe JSON query interpolation 2. Cross-Platform Compatibility: - Replace GNU-specific date -d with fallback to BSD date -v - Replace base64 -w0 with base64 | tr -d '\n' 3. Credential Protection: - Remove CURSOR_API_KEY from echo statements (CWE-532) - Use env vars for sensitive data 4. Error Handling: - Replace silent 2>/dev/null || true with explicit error logging - Add meaningful warnings when operations fail 5. Code Quality: - Centralize ECOSYSTEM_REPOS as env variable - Fix heredoc indentation issues - Add TODO markers for incomplete features Files modified: - agent-pr-review.yml - agent-post-merge.yml - agent-issue-triage.yml - agent-project-management.yml - spawn-cursor-agent/action.yml
|
🤖 Background Agent Review Requested A Cursor background agent has been dispatched to review this PR. Task: Code quality, security, tests, documentation review The agent will comment with findings once complete. Automated by agent-pr-review workflow |
|
@Amazon-Q-Developer Thank you for the comprehensive security review! I've addressed all the findings in commit 441cf9f: Security Fixes✅ Command Injection Prevention (CWE-78)
✅ Credential Exposure (CWE-532)
✅ Cross-Platform Compatibility
✅ Error Handling
✅ Code Quality
Please verify these changes resolve your concerns. |
…Checkpoint before follow-up message Co-authored-by: jon <jon@jonbogaty.com> * feat: Add GitHub Actions workflows for agent-driven issue triage and project management New workflows: - agent-issue-triage.yml: Auto-label, project board, /agent commands, cross-repo linking - agent-project-management.yml: Status sync, stale issue handling, ecosystem reports Features: - Auto-classify issues (bug, feature, security, packages) - Auto-add issues to project board - /agent commands in issue comments (review, fix, investigate, close, help) - Cross-repo issue linking across ecosystem - Weekly stale issue management - Ecosystem status report generation - Maintenance agent spawning Combined with agent-pr-review.yml and agent-post-merge.yml, this provides complete CI/CD integration for agent-driven development. * security: Address Amazon Q code review findings Security fixes across all agent workflows: 1. Command Injection Prevention: - Sanitize all user inputs (PR titles, issue titles/bodies, commit messages) - Use environment variables instead of direct interpolation - Use jq --arg for safe JSON query interpolation 2. Cross-Platform Compatibility: - Replace GNU-specific date -d with fallback to BSD date -v - Replace base64 -w0 with base64 | tr -d '\n' 3. Credential Protection: - Remove CURSOR_API_KEY from echo statements (CWE-532) - Use env vars for sensitive data 4. Error Handling: - Replace silent 2>/dev/null || true with explicit error logging - Add meaningful warnings when operations fail 5. Code Quality: - Centralize ECOSYSTEM_REPOS as env variable - Fix heredoc indentation issues - Add TODO markers for incomplete features Files modified: - agent-pr-review.yml - agent-post-merge.yml - agent-issue-triage.yml - agent-project-management.yml - spawn-cursor-agent/action.yml --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Summary
Complete CI/CD integration for Cursor background agent-driven development.
New Workflows
1.
agent-pr-review.yml(PR Events)2.
agent-post-merge.yml(Main Merge Events)3.
agent-issue-triage.yml(Issue Events)/agentcommands in comments:/agent review- Request detailed analysis/agent fix- Request fix PR/agent investigate- Deep investigation/agent close- Verify can close/agent help- Show commands4.
agent-project-management.yml(Scheduled + Dispatch)New Action
spawn-cursor-agentReusable action for spawning Cursor background agents:
Secrets Required
CURSOR_API_KEY- ✅ Already setTest Plan
/agentcommands work in issue commentsMoving agent orchestration OUTSIDE single background agent into proper CI/CD
Note
Adds a composite action to spawn Cursor agents (with fallback issues) and four GitHub workflows for PR review, issue triage, post-merge follow-ups, and project maintenance.
/.github/actions/spawn-cursor-agentcursor_api_key,task,repository,ref,model)agent-taskissue; outputsagent_id,issue_url,status.github/workflows/agent-pr-review.yml).github/workflows/agent-post-merge.yml).github/workflows/agent-issue-triage.yml)/agentcommands, and cross-repo related issue hints.github/workflows/agent-project-management.yml)Written by Cursor Bugbot for commit 50f0431. This will update automatically on new commits. Configure here.