Skip to content

Extend Scrutineer with GitHub Actions monitoring and evidence bundles - #124

Open
leynos wants to merge 1 commit into
mainfrom
feat/scrutineer-github-actions-monitoring
Open

Extend Scrutineer with GitHub Actions monitoring and evidence bundles#124
leynos wants to merge 1 commit into
mainfrom
feat/scrutineer-github-actions-monitoring

Conversation

@leynos

@leynos leynos commented Sep 9, 2026

Copy link
Copy Markdown
Owner

Summary

Extend the existing Scrutineer sub-agent with GitHub Actions monitoring through gh run watch, alongside its deterministic gate execution and optional CodeRabbit review duties. The description now advertises all three capabilities and the summary-bundle hand-off to the summoning agent.

Only agents/subagents.yml and tests/test_subagent_definitions.py change. Other sub-agents, provider models, sandbox settings, and tool grants are unchanged.

Monitoring and evidence contract

  • Support monitoring-only assignments without launching unrequested local gates or CodeRabbit reviews. Combined assignments retain the existing gate and review prerequisites.
  • Identify the repository, candidate SHA, workflow, run ID, and attempt explicitly. Keep PR-head, synthetic merge, and post-merge integration evidence distinct; detect stale or superseded attempts.
  • Use gh run watch --exit-status --interval 30, preserving output and exit status. Capture final attempt-specific metadata even after a nonzero watcher exit; do not confuse authentication/API errors with workflow failures.
  • Capture gh run view --attempt ... --log-failed on completed non-successful runs, with full job-log fallback from recorded job IDs. Keep retrieval errors separate from the workflow conclusion and report missing, expired, or inaccessible logs explicitly.
  • Return a private, unique bundle containing summary.md, per-run metadata, watcher output, captured failure logs, retrieval stderr, exit codes, URLs, and bounded decisive excerpts. Provide a usable hand-off to the summoning agent rather than only a bare verdict.
  • Preserve pending, cancelled, skipped, neutral, and other non-success states instead of collapsing them into success. Respect the observation deadline without cancelling hosted work.
  • Keep monitoring observational: no automatic rerun, dispatch, approval, merge, workflow edit, or permission escalation. Keep raw logs private and redact secrets from excerpts.

Validation

  • python -m pytest tests/test_subagent_definitions.py -q: 74 passed.
  • Red/green check: the extended tests produced 34 failures against the original manifest, then all passed against the new instructions.
  • Extracted and syntax-checked all three new Bash capture examples; executed them under set -eu with a local gh stand-in across five success/failure combinations, confirming that watcher failures do not prevent metadata/failure-log capture and retrieval exit statuses remain distinct.
  • YAML parsing, Python compilation, and git diff --check passed.
  • Verified that only Scrutineer's description/instructions changed in the manifest and that every provider block is preserved.

Local validation used an isolated snapshot of the exact GitHub-sourced manifest, tests, and loader, with the original blobs verified against GitHub. Full repository make ci was not run locally, and the shell smoke checks are not authenticated live GitHub Actions integration tests. Hosted CI is a separate check.

CLI references

Command flags and known limitations were checked against the official GitHub CLI documentation:

Base: 065863ab6b86bd97f7bf9254ec45b1ee28bebe2d.

Summary by Sourcery

Extend Scrutineer with read-only GitHub Actions monitoring and evidence-bundle hand-off while preserving its deterministic gates and optional CodeRabbit review duties.

New Features:

  • Extend Scrutineer to monitor GitHub Actions runs and collect attempt-specific failure evidence.
  • Provide private summary bundles that hand off run metadata, watcher output, logs, and evidence gaps to the summoning agent.

Enhancements:

  • Clarify monitoring-only assignments, candidate-bound run identity, non-success state handling, and read-only observation requirements.
  • Preserve the existing deterministic gate execution and optional CodeRabbit review contract while expanding the structured report.
  • Add coverage for Actions monitoring commands, safety constraints, evidence hand-off, and retained Scrutineer capabilities.

Tests:

  • Add manifest tests validating GitHub Actions monitoring, failure-log capture, candidate identity and safety rules, summary-bundle hand-off, and existing gate/review behavior.

Add explicit run and attempt selection, gh run watch guidance, failed-log
capture, and a summary bundle for the summoning agent. Preserve existing
gate, CodeRabbit, and provider contracts; pin the new guidance in tests.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 hours and 28 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@coderabbitai

coderabbitai Bot commented Sep 9, 2026

Copy link
Copy Markdown

Warning

Review limit reached

Next included review available in 10 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 81 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 7b24dd4c-a708-440d-80d7-af644c964db5

📥 Commits

Reviewing files that changed from the base of the PR and between 065863a and 78590fd.

📒 Files selected for processing (2)
  • agents/subagents.yml
  • tests/test_subagent_definitions.py

Comment @coderabbitai help to get the list of available commands.

@sourcery-ai

sourcery-ai Bot commented Sep 9, 2026

Copy link
Copy Markdown

Reviewer's Guide

Extends Scrutineer with deterministic, read-only GitHub Actions monitoring that preserves run identity and failure evidence, packages results into a private summary bundle, and adds tests enforcing the new contract without weakening existing gate or CodeRabbit behavior.

Sequence diagram for GitHub Actions evidence monitoring

sequenceDiagram
    participant S as Scrutineer
    participant GH as GitHub CLI
    participant B as Private evidence bundle
    participant A as Summoning agent

    S->>GH: gh run view --json status,conclusion,headSha,attempt,jobs,url
    S->>GH: gh run watch --exit-status --interval 30
    GH-->>S: watcher output and exit code
    S->>GH: gh run view --attempt --json ...
    alt completed non-successful run
        S->>GH: gh run view --attempt --log-failed
        GH-->>S: failed-step logs and retrieval status
        alt logs empty or incomplete
            S->>GH: gh run view --job --log
            GH-->>S: full job logs and retrieval status
        end
    end
    S->>B: Write metadata, logs, excerpts, and summary.md
    S-->>A: Return verdict, bundle path, gaps, and next action
Loading

File-Level Changes

Change Details Files
Expands Scrutineer from local gate execution into candidate-bound, read-only GitHub Actions evidence monitoring.
  • Adds monitoring-only and combined-assignment behavior.
  • Defines explicit repository, SHA, PR/merge scope, run, and attempt identification, including stale-attempt handling.
  • Uses gh run watch and attempt-pinned gh run view while preserving watcher, metadata, and retrieval exit statuses.
  • Preserves non-success and infrastructure states without cancelling or modifying hosted work.
agents/subagents.yml
Adds robust failure-log collection and private evidence-bundle hand-off requirements.
  • Captures failed-step logs with job-log fallback and separates workflow conclusions from retrieval errors.
  • Requires private per-attempt bundle contents, redacted decisive excerpts, metadata, URLs, gaps, and summary.md.
  • Extends the structured report with GitHub Actions and Summary Bundle sections.
agents/subagents.yml
Adds manifest contract tests covering advertised capabilities and monitoring safety.
  • Checks the description advertises gates, CodeRabbit, Actions watching, and summary bundles.
  • Asserts required CLI commands, exit-status handling, candidate binding, non-success states, read-only behavior, and hand-off artifacts.
  • Verifies existing sequential gates and optional CodeRabbit prerequisites remain intact.
tests/test_subagent_definitions.py

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant