fix: request Actions capability for auto-pilot handoff

[stranske]

Summary

• Request Actions capability when the monitor-pr stall handler lists repository secrets and dispatches a keepalive workflow.
• Keep the consumer template byte-aligned with the Workflows source.

Validation

• python scripts/validate_template_completeness.py
• node --test .github/scripts/__tests__/agent-stall-rotation.test.js
• python -m pytest -q tests/workflows/test_workflow_agents_consolidation.py tests/workflows/test_sync_manifest_delivery.py

Source fix for active sync review feedback on stranske/Manager-Database#1510.

Summary by CodeRabbit

• Bug Fixes
  • Improved automated workflow monitoring by enabling required permissions for workflow-triggered operations.
  • Applied the permission update to both the main workflow and the consumer repository template.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

📝 Walkthrough

Walkthrough

The primary and consumer-repository auto-pilot workflows now grant monitor-pr the actions:write capability alongside existing permissions.

Changes

Workflow permission declarations

Layer / File(s)	Summary
Monitor-pr permission declarations .github/workflows/agents-auto-pilot.yml, templates/consumer-repo/.github/workflows/agents-auto-pilot.yml	The monitor-pr clients now include actions:write with their existing workflow permissions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• stranske/Workflows#2814: Modifies the same auto-pilot workflows for stall-rotation integration.
• stranske/Workflows#2826: Modifies monitor-pr permissions in the same workflows.

Suggested labels: github:actions, automation, sync

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the added Actions capability required for the auto-pilot handoff.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/auto-pilot-dispatch-capabilities

---

_{Comment @coderabbitai help to get the list of available commands.}

[agents-workflows-bot]

Workflow source detected

PR #2869 now has valid workflow source context (origin=review_followup).

No linked GitHub issue is required for this PR.

[agents-workflows-bot]

Automated Status Summary

Head SHA: 81e5821
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[Copilot]

Pull request overview

Updates the auto-pilot “monitor PR” stall handler to request the GitHub Actions dispatch capability so it can successfully trigger keepalive workflows when a stall is detected. This aligns with the repo’s token-capability routing (via token_load_balancer.js) and keeps the consumer template synced with the Workflows source.

Changes:

• Add actions:write to the capability request for the auto-pilot-monitor-pr task (needed for client.rest.actions.createWorkflowDispatch).
• Mirror the same change into templates/consumer-repo/ to avoid template drift.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/agents-auto-pilot.yml	Requests actions:write for the monitor-PR token selection so workflow dispatch calls can succeed.
templates/consumer-repo/.github/workflows/agents-auto-pilot.yml	Mirrors the same capability change to keep the consumer template aligned.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4d2256ccc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Provider Comparison Report

Provider Summary

Provider	Model	Verdict	Confidence	Summary
openai	gpt-5.6-terra	PASS	97%	The monitor-pr stall-handler capability request now includes actions:write, which is appropriate for the repository-secret/keepalive-workflow-dispatch handoff path. The identical one-line update...
anthropic	claude-sonnet-5	PASS	85%	The PR makes a minimal, targeted change: adding 'actions:write' to the capabilities requested by the auto-pilot stall handler's monitor-pr task, applied identically to both the source workflow (.gi...

📋 Full Provider Details (click to expand)

openai

• Model: gpt-5.6-terra
• Verdict: PASS
• Confidence: 97%
• Scores:
  • Correctness: 10.0/10
  • Completeness: 10.0/10
  • Quality: 10.0/10
  • Testing: 8.0/10
  • Risks: 9.0/10
• Summary: The monitor-pr stall-handler capability request now includes actions:write, which is appropriate for the repository-secret/keepalive-workflow-dispatch handoff path. The identical one-line update in both the source workflow and consumer template preserves required byte alignment. The change is minimal, readable, and scoped to the stated permission need. No tests were added, but this is a narrowly targeted declarative capability update and the specified existing validation coverage is appropriate.

anthropic

• Model: claude-sonnet-5
• Verdict: PASS
• Confidence: 85%
• Scores:
  • Correctness: 9.0/10
  • Completeness: 8.0/10
  • Quality: 9.0/10
  • Testing: 6.0/10
  • Risks: 7.0/10
• Summary: The PR makes a minimal, targeted change: adding 'actions:write' to the capabilities requested by the auto-pilot stall handler's monitor-pr task, applied identically to both the source workflow (.github/workflows/agents-auto-pilot.yml) and the consumer template counterpart, satisfying the byte-alignment requirement. This directly addresses the stated task of requesting Actions capability for keepalive workflow dispatch. All three specified acceptance criteria test suites (validate_template_completeness.py, agent-stall-rotation.test.js, and the workflow_agents_consolidation/sync_manifest_delivery pytest suites) are reported as passing in CI (selftest-ci.yml and pr-00-gate.yml both green), which is consistent with a correctly synchronized template change. No new dedicated tests were added in this PR, but the existing acceptance-criteria test suites already cover template parity and capability-request behavior, and CI confirms they pass on the merge commit. The change is small, low-risk, and logically necessary for the auto-pilot handoff functionality to work as intended (dispatching a keepalive workflow requires actions:write). No security or compatibility issues are introduced beyond the expected, intentional permission escalation scoped to the specific task.
• Concerns:
  • No new test coverage was added specifically for the capability change; the PR relies on existing test suites (agent-stall-rotation, template completeness) to validate behavior indirectly.
  • The diff only touches the capability array; there is no explicit assertion in the diff confirming the keepalive workflow dispatch will now succeed with actions:write, though this is the expected fix for GitHub Actions dispatch permission requirements.

Agreement

• Verdict: PASS (all providers)
• Correctness: scores within 1 point (avg 9.5/10, range 9.0-10.0)
• Quality: scores within 1 point (avg 9.5/10, range 9.0-10.0)

Disagreement

Dimension	openai	anthropic
Completeness	10.0/10	8.0/10
Testing	8.0/10	6.0/10
Risks	9.0/10	7.0/10

Unique Insights

• openai: The monitor-pr stall-handler capability request now includes actions:write, which is appropriate for the repository-secret/keepalive-workflow-dispatch handoff path. The identical one-line update in both the source workflow and consumer template preserves required byte alignment. The change is m...
• anthropic: No new test coverage was added specifically for the capability change; the PR relies on existing test suites (agent-stall-rotation, template completeness) to validate behavior indirectly.; The diff only touches the capability array; there is no explicit assertion in the diff confirming the keepalive workflow dispatch will now succeed with actions:write, though this is the expected fix for GitHub Actions dispatch permission requirements.

🔍 LangSmith Traces

• openai
• anthropic