From 4bda60eced0a1fd61756d47fe97e19e8d729fc25 Mon Sep 17 00:00:00 2001 From: fig-ai-agent Date: Thu, 10 Sep 2026 08:03:44 +0000 Subject: [PATCH] docs: update CHANGELOG.md and README.md CHANGELOG - [2026-09-10]: record PR #170, and a Fixed note for Issue #63 closing via PR #169 (squash 590b8615). - Replace the stale `fix/sha-pin-all-workflows` note with the measured state: as of 2026-09-10 main's workflows still mix full SHAs with mutable tags (checkout@v4 x17, upload-artifact@v4 x6, setup-python@v5 x7, and others), and the pin fix needs write access to .github/workflows/ which the App lacks. README - Refresh the deliverables row: it listed suites that no longer match what is in the directory, and omitted pure-agent-dev, onspace-ai, firecrawl-fastapi and manus-client. - State the CI reality under 'Repository health & standards' instead of implying all checks are green: jobs fail at 'Set up job' on the org's SHA-pin policy, so a PR passing its own tests locally still shows red. Docs only - no code, no workflow files. --- CHANGELOG.md | 7 ++++++- README.md | 3 ++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 86bea94..967efed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ All notable changes to this repository. Dates are UTC. ### Added - **PR #169** — deliverables: added `deliverables/pure-agent-dev/` (Issue #63 reference implementation — provider-agnostic Agent on FastAPI; `ComputeProvider` ABC with mock + BytePlus ECS adapters, planner/executor split, DI-based provider selection via `COMPUTE_PROVIDER`, external JSON Schema contract, Docker + compose, 47 tests). The guide's core rule — the Agent must not depend on the BytePlus SDK — is enforced by `tests/test_architecture.py` walking the real import graph, not by convention. All tests run on the mock provider; no cloud credentials needed. +- **PR #170** — docs: recorded PR #169 in this changelog. + +### Fixed +- **Issue #63 closed** — the `pure-agent-dev` implementation merged to `main` via PR #169 (squash `590b8615`); the issue was closed by the PR's `Closes #63` reference. No `.github/workflows/` files were touched, so the merge was not blocked by the App's `workflows` restriction. ## [2026-09-09] @@ -51,4 +55,5 @@ All notable changes to this repository. Dates are UTC. ### Notes - Earlier `CHANGELOG.md` content describing a "Claude REST API ecosystem" described files not present in this repository; it has been replaced with this accurate record. -- CI on this repo is red at the "Set up job" step from the org's SHA-pin policy (workflow actions must be pinned to full commit SHAs). A SHA-pin fix for all workflow files is prepared on branch `fix/sha-pin-all-workflows` and awaits admin grant of the GitHub App's `workflows` permission to push. +- CI on this repo is red at the "Set up job" step from the org's SHA-pin policy: a job refuses to start when a referenced action is not pinned to a full commit SHA. Measured on **2026-09-10**, `main`'s workflows still mix full SHAs with mutable tags — `actions/checkout@v4` (17 refs), `actions/upload-artifact@v4` (6), `actions/setup-python@v5` (7), `subosito/flutter-action@v2` (5), `somaz94/compress-decompress@v1` (5), `gitleaks/gitleaks-action@v2`, and others. +- The SHA-pin fix requires writing `.github/workflows/`, which the Fig GitHub App is not permitted to do (pushes are rejected with `refusing to allow a GitHub App to create or update workflow ... without workflows permission`). It must therefore be applied by a maintainer, or with elevated App permissions. This is why feature PRs on this repo show red checks even when their own tests pass. diff --git a/README.md b/README.md index 7ee761a..936fe92 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ An opinionated FastAPI monorepo/boilerplate used by ZyntroAI as the foundation f | `graphql_api/` | GraphQL service layer (Strawberry) | | `main.py` | OAuth2 PKCE API entrypoint (`/auth`, `/callback`, `/health`) | | `skills/` | Reusable AI-agent skill definitions (e.g. `fetching`, `changelog-auto-update`, `credential-management`) | -| `deliverables/` | Self-contained feature suites (security, notebooklm, gemini-cli, gh-devops-toolkit, azure-cli, agent-skill-template, …) | +| `deliverables/` | Self-contained feature suites, each with its own README, tests, and CI (e.g. `pure-agent-dev`, `cwe1321-protection-suite`, `onspace-ai`, `firecrawl-fastapi`, `manus-client`, `notebooklm-access-suite`, `agent-security-suite`, `azure-cli-2026`, `agent-skill-template`, …) | | `docs/` | Reference & knowledge documentation (GraphQL, FireCrawl, Google Chat, GitHub Actions, incident drills) | | `helm/` | Helm charts (OAuth app) | | `k8s/` | Kubernetes manifests | @@ -44,6 +44,7 @@ uvicorn main:app --reload ## Repository health & standards - Secret scanning, coverage, and a test suite run in CI. +- **CI status:** jobs currently fail at the *Set up job* step because the org's SHA-pin policy rejects workflows that reference actions by mutable tag (e.g. `actions/checkout@v4`). A PR's own tests passing locally does not turn its checks green. Fixing this needs write access to `.github/workflows/`, which the automation App does not have — see the 2026-09-08 notes in `CHANGELOG.md`. - External-service failures fail open (graceful degradation). - Secrets live only in environment / CI secrets — never in source. - See `SECURITY.md` (reporting), `CONTRIBUTING.md` (PRs), `RELEASE.md` (releases).