Scaffold autonomous automation: deps auto-merge + idea-to-PR pipeline#221
Draft
rjayasinghe wants to merge 4 commits into
Draft
Scaffold autonomous automation: deps auto-merge + idea-to-PR pipeline#221rjayasinghe wants to merge 4 commits into
rjayasinghe wants to merge 4 commits into
Conversation
Adds three automation lanes, all opt-in via .github/AUTOMATION.md:
Lane 1 — dependency hygiene
- Group dependabot patch+minor into weekly PRs (keep majors separate)
- auto-merge-deps.yml: approve + enable auto-merge for non-major bumps;
label majors needs-review
- dependabot-triage.yml: Claude summarises changelog risk on major bumps
- dependabot-stuck-sweep.yml: weekly cron, Claude attempts fixes on
Dependabot PRs stuck >7 days
Lane 2 — idea-to-PR
- ideas/ directory with README convention + example spec
- idea-pr-opened.yml: Claude critiques spec PRs
- idea-implement.yml: on push-to-main of a 'status: ready' idea,
Claude implements on a branch, runs mvn verify, opens a PR for
human review (never auto-merges)
Lane 3 — maintenance
- Weekly cron: README drift, snippet check, stale TODOs, dependency:analyze.
Findings filed as draft idea PRs, feeding back into Lane 2.
Hardening
- .github/CODEOWNERS gates ideas/ and workflow changes
- .github/AUTOMATION.md documents required GitHub UI toggles
(branch protection, fork-PR approval gate, code-owner reviews,
ANTHROPIC_API_KEY secret)
Contributor
SummaryThe following content is AI-generated and provides a summary of the pull request: Scaffold Autonomous Automation: Dependency Auto-Merge + Idea-to-PR PipelineNew Feature✨ Introduces three automation lanes powered by GitHub Actions and Claude AI to reduce maintenance toil while keeping all code changes behind a human review gate. No existing runtime behavior is changed — this PR only adds files. Activation requires a maintainer to configure secrets, branch protection rules, and labels as described in the new ChangesThree automation lanes: Lane 1 — Dependency hygiene (autonomous)
Lane 2 — Idea-to-PR (semi-autonomous)
Lane 3 — Weekly maintenance
Supporting files
PR Bot InformationVersion:
|
Replace placeholder @cap-java/maintainers with the actual team @cap-java/cds-feature-advanced-event-mesh-team. Update AUTOMATION.md note accordingly.
When this fork runs Dependabot / idea-implement / maintenance, changes
land on the fork's main while upstream's main moves independently.
Without sync, drift compounds and reconciliation gets painful.
upstream-sync.yml runs daily:
- in-sync / ahead: no-op
- behind: fast-forward main, push
- diverged: rebase, force-push with --force-with-lease
- conflicts: leave main alone, file an issue with the conflicting
files and a suggested resolution recipe
Guarded with 'if: github.repository \!= cap-java/...' so it never runs
on the upstream repo even if accidentally merged there.
…s/claude-code-action We don't call Anthropic directly — LLM access is routed through SAP AI Core. Adopting the pattern from cap/sherlock: - opencode CLI (headless, 'opencode run') replaces claude-code-action. Provider is opencode's built-in sap-ai-core; auth via XSUAA OAuth2 client-credentials, handled internally by the provider. No proxy process needed. - AICORE_SERVICE_KEY (JSON service key) replaces ANTHROPIC_API_KEY as the single secret. - Model is configured in .github/bot-config/opencode.json — defaults to sap-ai-core/anthropic--claude-4.6-opus, swappable to sonnet/gpt-5/ gemini-2.5-pro without touching workflows. - .github/actions/setup-opencode is a reusable composite action that installs opencode at a pinned version with SHA256 verification. Five workflows updated to the new pattern: dependabot-triage, dependabot-stuck-sweep, idea-pr-opened, idea-implement, maintenance. AUTOMATION.md rewritten to document the new auth model and credit the sherlock pattern.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft — for discussion. Not ready to merge.
This PR scaffolds three automation lanes for the repo. None of them
activate until a maintainer flips the corresponding switches in the
GitHub UI — see
.github/AUTOMATION.mdfor thechecklist. So merging this is safe; it adds files but changes no
runtime behavior on its own.
Why
The goal is to drive maintenance and feature development with as little
human toil as possible, while keeping every code change behind a human
review gate.
Three lanes
Lane 1 — Dependency hygiene (autonomous)
.github/dependabot.ymlauto-merge-deps.ymldependabot-triage.ymldependabot-stuck-sweep.ymlBranch protection (required CI green) remains the hard gate. Auto-merge
just clicks the button when it's safe.
Lane 2 — Idea-to-PR (semi-autonomous)
Drop a markdown spec in
ideas/, iterate it on a PR (Claude critiques),merge it with
status: ready, andidea-implement.ymlopens a code PRimplementing it. Code PRs are never auto-merged — humans review.
ideas/README.mdideas/_example.mdidea-pr-opened.ymlidea-implement.ymlstatus: readyideasFork hardening:
idea-implement.ymltriggers onpush: main, notpull_request. Forks can't push to main. Combined withCODEOWNERSrequiring code-owner review on/ideas/, this means onlycontributors can authorize implementation.
Lane 3 — Weekly maintenance
maintenance.ymlruns Mondays: README drift, snippet validity, staleTODOs,
mvn dependency:analyze. Findings are filed as draft ideaPRs, feeding back into Lane 2. No code is changed directly.
What a maintainer needs to do to activate
See
.github/AUTOMATION.md— TL;DR:ANTHROPIC_API_KEYsecretmain: required checks, code-owner review, allow auto-mergeneeds-review,major-update,automation,ideaCODEOWNERSto use the real team handle (placeholder is@cap-java/maintainers)What's deliberately conservative
--max-turnscapsANTHROPIC_API_KEY) breaks Claude jobs cleanlyWhat's not in this PR
ANTHROPIC_API_KEY; swap if you prefer.issue → ideaconverter — easy to add later if you want external contributors to funnel ideas via Issues.Happy to split this into smaller PRs (Lane 1 first, then Lane 2, then Lane 3) if that's easier to land.