Skip to content

docs: update CHANGELOG.md and README.md #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fig-ai-agent merged 1 commit into from
Sep 10, 2026
Merged

docs: update CHANGELOG.md and README.md #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ All notable changes to this repository. Dates are UTC.

### Added
- **PR #169** — deliverables: added `deliverables/pure-agent-dev/` (Issue #63 reference implementation — provider-agnostic Agent on FastAPI; `ComputeProvider` ABC with mock + BytePlus ECS adapters, planner/executor split, DI-based provider selection via `COMPUTE_PROVIDER`, external JSON Schema contract, Docker + compose, 47 tests). The guide's core rule — the Agent must not depend on the BytePlus SDK — is enforced by `tests/test_architecture.py` walking the real import graph, not by convention. All tests run on the mock provider; no cloud credentials needed.
- **PR #170** — docs: recorded PR #169 in this changelog.

### Fixed
- **Issue #63 closed** — the `pure-agent-dev` implementation merged to `main` via PR #169 (squash `590b8615`); the issue was closed by the PR's `Closes #63` reference. No `.github/workflows/` files were touched, so the merge was not blocked by the App's `workflows` restriction.

## [2026-09-09]

Expand Down Expand Up @@ -51,4 +55,5 @@ All notable changes to this repository. Dates are UTC.

### Notes
- Earlier `CHANGELOG.md` content describing a "Claude REST API ecosystem" described files not present in this repository; it has been replaced with this accurate record.
- CI on this repo is red at the "Set up job" step from the org's SHA-pin policy (workflow actions must be pinned to full commit SHAs). A SHA-pin fix for all workflow files is prepared on branch `fix/sha-pin-all-workflows` and awaits admin grant of the GitHub App's `workflows` permission to push.
- CI on this repo is red at the "Set up job" step from the org's SHA-pin policy: a job refuses to start when a referenced action is not pinned to a full commit SHA. Measured on **2026-09-10**, `main`'s workflows still mix full SHAs with mutable tags — `actions/checkout@v4` (17 refs), `actions/upload-artifact@v4` (6), `actions/setup-python@v5` (7), `subosito/flutter-action@v2` (5), `somaz94/compress-decompress@v1` (5), `gitleaks/gitleaks-action@v2`, and others.
- The SHA-pin fix requires writing `.github/workflows/`, which the Fig GitHub App is not permitted to do (pushes are rejected with `refusing to allow a GitHub App to create or update workflow ... without workflows permission`). It must therefore be applied by a maintainer, or with elevated App permissions. This is why feature PRs on this repo show red checks even when their own tests pass.
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ An opinionated FastAPI monorepo/boilerplate used by ZyntroAI as the foundation f
| `graphql_api/` | GraphQL service layer (Strawberry) |
| `main.py` | OAuth2 PKCE API entrypoint (`/auth`, `/callback`, `/health`) |
| `skills/` | Reusable AI-agent skill definitions (e.g. `fetching`, `changelog-auto-update`, `credential-management`) |
| `deliverables/` | Self-contained feature suites (security, notebooklm, gemini-cli, gh-devops-toolkit, azure-cli, agent-skill-template, …) |
| `deliverables/` | Self-contained feature suites, each with its own README, tests, and CI (e.g. `pure-agent-dev`, `cwe1321-protection-suite`, `onspace-ai`, `firecrawl-fastapi`, `manus-client`, `notebooklm-access-suite`, `agent-security-suite`, `azure-cli-2026`, `agent-skill-template`, …) |
| `docs/` | Reference & knowledge documentation (GraphQL, FireCrawl, Google Chat, GitHub Actions, incident drills) |
| `helm/` | Helm charts (OAuth app) |
| `k8s/` | Kubernetes manifests |
Expand Down Expand Up @@ -44,6 +44,7 @@ uvicorn main:app --reload
## Repository health & standards

- Secret scanning, coverage, and a test suite run in CI.
- **CI status:** jobs currently fail at the *Set up job* step because the org's SHA-pin policy rejects workflows that reference actions by mutable tag (e.g. `actions/checkout@v4`). A PR's own tests passing locally does not turn its checks green. Fixing this needs write access to `.github/workflows/`, which the automation App does not have — see the 2026-09-08 notes in `CHANGELOG.md`.
- External-service failures fail open (graceful degradation).
- Secrets live only in environment / CI secrets — never in source.
- See `SECURITY.md` (reporting), `CONTRIBUTING.md` (PRs), `RELEASE.md` (releases).
Expand Down
Loading