From fc75c75e862a188947b99f5dcbd46d5b880b252c Mon Sep 17 00:00:00 2001 From: Nivedit Jain Date: Fri, 17 Jul 2026 07:33:59 +0000 Subject: [PATCH 1/2] ci(bump): bump the failproofai/oss pointer in agenteye too The bump job only knew about platform, so agenteye's new failproofai/oss submodule would pin its initial commit forever. Turn the single job into a matrix over the downstream repos that carry the submodule. Both downstreams sit behind the same org-level failproofai-rules ruleset, so the existing version-bot bypass covers agenteye with no new credentials. The token stays scoped per matrix leg, concurrency is keyed per repo so the two bumps never queue behind each other, and fail-fast is off so one downstream failing does not cancel the other. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/bump-platform-submodule.yml | 59 ++++++++++++------- 1 file changed, 37 insertions(+), 22 deletions(-) diff --git a/.github/workflows/bump-platform-submodule.yml b/.github/workflows/bump-platform-submodule.yml index 5ebd6362..174327bd 100644 --- a/.github/workflows/bump-platform-submodule.yml +++ b/.github/workflows/bump-platform-submodule.yml @@ -1,31 +1,45 @@ -name: Bump platform submodule pointer +name: Bump downstream submodule pointers -# When this repo's main moves, push a matching gitlink bump to the -# FailproofAI/platform monorepo so its `failproofai/oss` submodule tracks -# upstream automatically. Direct push to platform `main` — no PR. +# When this repo's main moves, push a matching gitlink bump to every downstream +# repo that carries this one as a `failproofai/oss` submodule, so their pinned +# commits track upstream automatically. Direct push to each downstream `main` — +# no PR. # -# The platform repo is governed by the `failproofai-rules` ruleset (PR + 1 review -# required on main), which rejects a plain GITHUB_TOKEN push with GH013. We -# instead mint a token for the version-bot GitHub App — a bypass actor on that -# ruleset — so the push is accepted. +# Both downstreams are governed by the org-level `failproofai-rules` ruleset +# (PR + 1 review required on main), which rejects a plain GITHUB_TOKEN push with +# GH013. We instead mint a token for the version-bot GitHub App — a bypass actor +# on that ruleset — so the push is accepted. The same ruleset object governs both +# repos, so one bypass covers both. +# +# The filename still says `platform` so the Actions run history — which GitHub +# keys by workflow path — survives; the matrix below is the source of truth for +# which repos actually get bumped. on: push: branches: [main] workflow_dispatch: -# Serialize runs so back-to-back merges produce sequential bumps, -# not a race that loses one of them. -concurrency: - group: bump-platform-submodule - cancel-in-progress: false - jobs: bump: runs-on: ubuntu-latest + strategy: + # Independent repos: a failure bumping one must not cancel the other. + fail-fast: false + matrix: + # Every repo carrying this one at `failproofai/oss`. Add a repo here and + # it gets bumped — nothing else in this file is downstream-specific. + repo: [platform, agenteye] + # Serialize per downstream so back-to-back merges produce sequential bumps, + # not a race that loses one of them. Keyed by repo so a slow platform bump + # never delays agenteye's. + concurrency: + group: bump-submodule-${{ matrix.repo }} + cancel-in-progress: false steps: # Token for the version-bot GitHub App — a bypass actor on the org - # ruleset, so pushes to platform main bypass the PR requirement. + # ruleset, so pushes to the downstream main bypass the PR requirement. + # Scoped to just the one repo this matrix leg touches. - name: Mint version-bot app token id: app-token uses: actions/create-github-app-token@v3 @@ -33,14 +47,14 @@ jobs: app-id: ${{ secrets.VERSION_BOT_APP_ID }} private-key: ${{ secrets.VERSION_BOT_PRIVATE_KEY }} # Without an explicit owner/repository, the action scopes the token - # to this repository, which cannot checkout the private platform repo. + # to this repository, which cannot checkout the private downstream repo. owner: FailproofAI - repositories: platform + repositories: ${{ matrix.repo }} - - name: Checkout FailproofAI/platform main + - name: Checkout FailproofAI/${{ matrix.repo }} main uses: actions/checkout@v7 with: - repository: FailproofAI/platform + repository: FailproofAI/${{ matrix.repo }} # Persist the app token so `git push` below bypasses the ruleset. # The version-bot App is a bypass actor on `failproofai-rules`. token: ${{ steps.app-token.outputs.token }} @@ -54,6 +68,7 @@ jobs: NEW_SHA: ${{ github.sha }} COMMIT_SUBJECT: ${{ github.event.head_commit.message }} UPSTREAM_REPO: ${{ github.repository }} + DOWNSTREAM_REPO: ${{ matrix.repo }} run: | set -euo pipefail @@ -62,7 +77,7 @@ jobs: CURRENT_SHA=$(git ls-tree HEAD failproofai/oss | awk '{print $3}') if [ -z "$CURRENT_SHA" ]; then - echo "::error::failproofai/oss is not a gitlink in platform main — aborting." + echo "::error::failproofai/oss is not a gitlink in $DOWNSTREAM_REPO main — aborting." exit 1 fi if [ "$CURRENT_SHA" = "$NEW_SHA" ]; then @@ -87,8 +102,8 @@ jobs: -m "Upstream: $SUBJECT_LINE" \ -m "https://github.com/$UPSTREAM_REPO/commit/$NEW_SHA" - # Race-safe push: if platform main moved between checkout and push, - # rebase the single bump commit on top and try again. + # Race-safe push: if the downstream main moved between checkout and + # push, rebase the single bump commit on top and try again. for attempt in 1 2 3; do if git push origin main; then echo "Pushed bump on attempt $attempt" From d43c1403a66a4fec66dd5ddcfcdd8f1b474da913 Mon Sep 17 00:00:00 2001 From: Nivedit Jain Date: Fri, 17 Jul 2026 07:35:51 +0000 Subject: [PATCH 2/2] docs(changelog): note the agenteye submodule bump (#558) Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a8843603..53adb4d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ - AgentEye docs: lead the Agent Observability sidebar with a Features group (one page per top-level feature), move Deployment to the last group, and publish the new per-feature pages, autoplaying demo embeds, and an AI assistant screenshot. (#548) ### Features +- Bump the pinned `failproofai/oss` gitlink in `FailproofAI/agenteye` as well as `FailproofAI/platform` on every merge into this repo's `main`. AgentEye now carries the same `failproofai/oss` submodule the platform monorepo does, so `bump-platform-submodule.yml`'s single job became a matrix over both downstreams — everything but the repo name was already downstream-agnostic (same submodule path, same auth, same rebase-and-retry push loop). No new credentials: both repos sit behind the same org-level `failproofai-rules` ruleset, on which the version-bot App is already a bypass actor. Concurrency moved from workflow-level to job-level so it can key off `matrix.repo`, which keeps the "back-to-back merges produce sequential bumps" guarantee per repo while letting the two downstreams bump in parallel instead of queueing behind each other. (#558) - Brand the dashboard launch splash (bare `failproofai`) to match the `configure` wizard: the plain emoji title/version block is replaced with the half-block logomark, the `failproof ai` wordmark (pink "il"), the tagline, and a tidy teal-labelled version/links column (24-bit color where advertised, monochrome shape otherwise, plain text off a TTY). The logomark rendering is now shared via `renderBrandLogo` / `renderLaunchBanner` in `tui.ts`, so the wizard intro and the launch banner stay in lockstep. (#516) - Add an "Everything available" row to the wizard's assistants step that protects every supported CLI (detected + set-up-ahead) in one tick — it wins over the individual boxes, mirroring the policies "Everything" option. Detected CLIs stay pre-selected, so the default (hit ↵) is unchanged. (#516) - Make the wizard's "What should we guard against?" step a multi-select, so bundles combine: tick any mix of Secrets & data / Git safety / Ship discipline / Cloud & infra and the enabled set is the **union** of their policies (deduped), or tick **Everything** for the full set (it wins over any presets). Dropped only the "Custom…" entry — an action-as-checkbox that didn't fit the list (the full searchable picker stays available via `failproofai policies --install`). Replaces the single-choice radio; `resolvePolicySource` → `resolvePresetSelection`. (#516)