Staging

.github/workflows/auto-integrate.yml

@@ -27,7 +27,13 @@ name: auto-integrate
 
 on:
   schedule:
-    - cron: '0 * * * *'
+    # 5-minute cadence (GitHub Actions minimum). `concurrency` block
+    # below ensures only one run executes at a time; overlapping
+    # cron triggers queue rather than parallelize. Combined with
+    # the self-dispatch step at the end of the workflow, this gives
+    # near-continuous processing when the producer queue has work,
+    # and 5-minute polling when it doesn't.
+    - cron: '*/5 * * * *'
   workflow_dispatch:
     inputs:
       provider:
@@ -46,7 +52,7 @@ on:
 
 permissions:
   contents: write
-  actions: read
+  actions: write  # `write` (not `read`) so the workflow can self-dispatch on success
   id-token: write
 
 concurrency:
@@ -88,46 +94,6 @@ jobs:
           .venv/bin/pip install --upgrade pip
           .venv/bin/pip install -e ".[dev]"
 
-      - name: Diagnose producer access (TEMPORARY - remove after debug)
-        env:
-          GH_TOKEN: ${{ secrets.DRAFTS_REPO_TOKEN }}
-          DRAFTS_REPO: ${{ vars.DRAFTS_REPO }}
-        run: |
-          set +e
-          echo "::group::1. Token + user identity (gh auth status + gh api user)"
-          gh auth status 2>&1
-          echo "---"
-          gh api user --jq '{login,type}' 2>&1
-          USER_EXIT=$?
-          echo "gh api user exit: ${USER_EXIT}"
-          echo "::endgroup::"
-
-          echo "::group::2. Repo accessibility via REST API"
-          gh api "repos/${DRAFTS_REPO}" 2>&1 | head -30
-          API_EXIT=${PIPESTATUS[0]}
-          echo "gh api repos exit: ${API_EXIT}"
-          echo "::endgroup::"
-
-          echo "::group::3. Raw git clone (bypassing gh, verbose)"
-          GIT_TRACE=1 GIT_CURL_VERBOSE=1 git clone \
-            --depth=1 \
-            "https://x-access-token:${GH_TOKEN}@github.com/${DRAFTS_REPO}.git" \
-            /tmp/raw-clone-test 2>&1 | tail -60
-          GIT_EXIT=${PIPESTATUS[0]}
-          echo "git clone exit: ${GIT_EXIT}"
-          rm -rf /tmp/raw-clone-test
-          echo "::endgroup::"
-
-          echo "::group::4. gh repo clone (the actual failing command)"
-          GH_DEBUG=api gh repo clone "${DRAFTS_REPO}" /tmp/gh-clone-test -- --depth=1 2>&1 | tail -40
-          GH_CLONE_EXIT=${PIPESTATUS[0]}
-          echo "gh repo clone exit: ${GH_CLONE_EXIT}"
-          rm -rf /tmp/gh-clone-test
-          echo "::endgroup::"
-
-          set -e
-          echo "Diagnostic complete. Continuing to actual clone step (which will likely fail too)."
-
       - name: Clone producer repo
         env:
           GH_TOKEN: ${{ secrets.DRAFTS_REPO_TOKEN }}
@@ -142,14 +108,24 @@ jobs:
             echo "::error::DRAFTS_REPO variable not set (Settings -> Secrets and variables -> Actions -> Variables)."
             exit 1
           fi
-          gh repo clone "${DRAFTS_REPO}" /tmp/drafts-clone -- --depth=1
+          # Raw `git clone` with token-in-URL auth. We tried
+          # `gh repo clone` but it exhibited non-deterministic exit 1
+          # behavior under bash -e with no stderr surfacing. Going
+          # direct to git is the layer gh wraps anyway.
+          git clone --depth=1 \
+            "https://x-access-token:${GH_TOKEN}@github.com/${DRAFTS_REPO}.git" \
+            /tmp/drafts-clone
           # Auto-detect the staging directory inside the clone. We look for
           # the deepest folder that contains <tool>/manifest.py files. This
           # avoids hardcoding the producer's internal subfolder name in
           # this committed YAML file.
-          FIRST_MANIFEST=$(find /tmp/drafts-clone -mindepth 3 -maxdepth 3 -name 'manifest.py' -type f 2>/dev/null | head -1)
+          # `|| true` neutralizes SIGPIPE-induced exit 141 from
+          # `find` when `head -1` closes the pipe early. Without
+          # this, `set -eo pipefail` kills the script with no
+          # visible error, masking a successful clone as a failure.
+          FIRST_MANIFEST=$(find /tmp/drafts-clone -mindepth 3 -maxdepth 3 -name 'manifest.py' -type f 2>/dev/null | head -1 || true)
           if [ -z "${FIRST_MANIFEST}" ]; then
-            FIRST_MANIFEST=$(find /tmp/drafts-clone -mindepth 2 -maxdepth 2 -name 'manifest.py' -type f 2>/dev/null | head -1)
+            FIRST_MANIFEST=$(find /tmp/drafts-clone -mindepth 2 -maxdepth 2 -name 'manifest.py' -type f 2>/dev/null | head -1 || true)
           fi
           if [ -z "${FIRST_MANIFEST}" ]; then
             echo "::error::Cloned drafts repo has no <tool>/manifest.py files at depth 2 or 3. Repo layout unrecognized."
@@ -192,6 +168,14 @@ jobs:
         with:
           use_bedrock: 'true'
           github_token: ${{ secrets.GITHUB_TOKEN }}
+          # Allow github-actions bot as trigger actor. Default
+          # behavior rejects bot-initiated runs as prompt-injection
+          # protection. Our self-dispatch chain (last step) uses
+          # GITHUB_TOKEN and surfaces as "github-actions" actor,
+          # which would otherwise fail with "non-human actor"
+          # error. Safe here because the only bot that can trigger
+          # this workflow is our own self-dispatch.
+          allowed_bots: 'github-actions'
           claude_args: --dangerously-skip-permissions
           show_full_output: 'true'
           prompt: |
@@ -229,6 +213,7 @@ jobs:
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
+          allowed_bots: 'github-actions'  # see primary step for rationale
           claude_args: --dangerously-skip-permissions
           show_full_output: 'true'
           prompt: |
@@ -411,3 +396,20 @@ jobs:
               echo "**Outcome:** Unknown - pipeline did not emit a tool name."
             fi
           } >> "${GITHUB_STEP_SUMMARY}"
+
+      # ---- Self-dispatch chain ---------------------------------------------
+      # If this run integrated a tool, immediately trigger the next run to
+      # drain the producer queue as fast as possible. If the producer queue
+      # is empty (skipped) or this run failed, the chain breaks and we fall
+      # back to the 5-minute cron failsafe.
+      #
+      # Concurrency group (`auto-integrate`) ensures self-dispatched runs
+      # never overlap with cron-triggered runs — they queue serially.
+      - name: Self-dispatch next run (chain on success)
+        if: steps.run.outputs.skipped != 'true' && steps.run.outputs.failed != 'true' && steps.run.outputs.tool_name != '' && github.event.inputs.dry_run != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TOOL_NAME: ${{ steps.run.outputs.tool_name }}
+        run: |
+          echo "Integrated ${TOOL_NAME}. Chaining next run to drain queue."
+          gh workflow run auto-integrate.yml --ref staging

CHANGELOG.md

@@ -8,6 +8,75 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ### Added
 
+- `canvas` integration — 5 actions, auth: custom. Learning management
+  system for course, assignment, and user management via the Canvas REST
+  API (list_accounts, list_assignments, list_courses,
+  search_course_content, update_assignment). Producer-staged by
+  integration-drafts; consumer-side audit applied 2 patches before merge.
+- `product_hunt` integration — 1 action, auth: oauth2. Discover and explore
+  tech products and topics via the Product Hunt GraphQL API
+  (list_topic_options). Producer-staged by integration-drafts; consumer-side
+  audit applied 1 patch before merge.
+- `shopify_partner` integration — 1 action, auth: api_key. Shopify Partner
+  webhook verification via local HMAC-SHA256 signature validation
+  (verify_webhook). Producer-staged by integration-drafts; consumer-side
+  audit applied 1 patch before merge.
+- `browserbase` integration — 3 actions, auth: api_key. Cloud browser
+  infrastructure for running and managing headless browser sessions via
+  the Browserbase REST API (create_context, create_session, list_projects).
+  Producer-staged by integration-drafts; consumer-side audit applied
+  1 patch before merge.
+- `pagerduty` integration — 4 actions, auth: oauth2. Incident management
+  and on-call scheduling platform via the PagerDuty REST API
+  (trigger_incident, acknowledge_incident, resolve_incident,
+  find_oncall_user). Producer-staged by integration-drafts; consumer-side
+  audit applied 5 patches before merge.
+- `netlify` integration — 4 actions, auth: oauth2. Web hosting and
+  automation platform for modern web projects via the Netlify REST API
+  (get_site, list_files, list_site_deploys, rollback_deploy).
+  Producer-staged by integration-drafts; consumer-side audit applied
+  4 patches before merge.
+- `azure_storage` integration — 4 actions, auth: oauth2. Manage blobs and
+  containers in Microsoft Azure Blob Storage via the Azure Blob Storage
+  REST API (create_container, delete_blob, list_containers, upload_blob).
+  Producer-staged by integration-drafts; consumer-side audit applied
+  1 patch before merge.
+- `insightly` integration — 2 actions, auth: api_key. CRM and project
+  management platform for managing contacts and tasks via the Insightly
+  REST API (create_contact, create_task). Producer-staged by
+  integration-drafts; consumer-side audit applied 1 patch before merge.
+- `reflect` integration — 5 actions, auth: oauth2. Note-taking and
+  knowledge management via the Reflect API (append_daily_note, create_link,
+  get_user, list_graph_id_options, list_links). Producer-staged by
+  integration-drafts; consumer-side audit applied 7 patches before merge.
+- `help_scout` integration — 8 actions, auth: oauth2. Customer support
+  helpdesk platform with shared inboxes, knowledge base, and live chat
+  via the Help Scout REST API. Producer-staged by integration-drafts;
+  consumer-side audit applied 3 patches before merge.
+- `luma` integration — 8 actions, auth: api_key. Event management platform
+  for creating, managing, and tracking events and guests via the Luma
+  public API. Producer-staged by integration-drafts; consumer-side audit
+  applied 2 patches before merge.
+- `typeform` integration — 12 actions, auth: oauth2. Online form builder
+  for surveys, quizzes, and interactive forms via the Typeform REST API.
+  Producer-staged by integration-drafts; consumer-side audit applied
+  3 patches before merge.
+- `microsoft_entra_id` integration — 12 actions, auth: oauth2. Identity
+  and access management via Microsoft Graph API for users, groups, and
+  directory objects. Producer-staged by integration-drafts; consumer-side
+  audit applied 4 patches before merge.
+- `datadog` integration — 11 actions, auth: api_key. Infrastructure
+  monitoring, log management, and application performance platform via
+  the Datadog REST API. Producer-staged by integration-drafts;
+  consumer-side audit applied 2 patches before merge.
+- `browser_use` integration — 25 actions, auth: api_key. AI-powered cloud
+  browser automation via the Browser Use API. Producer-staged by
+  integration-drafts; consumer-side audit applied 1 patch before merge.
+- `freshdesk` integration — 45 actions, auth: api_key. Customer support
+  helpdesk platform for managing tickets, contacts, agents, and knowledge
+  base articles via the Freshdesk REST API. Producer-staged by
+  integration-drafts; consumer-side audit applied 1 patch before merge.
+
 - `amazon_selling_partner` integration — 8 actions, auth: oauth2. Amazon
   Selling Partner API for managing orders, inventory, pricing, and reports
   on Amazon marketplaces (check_fba_inventory_levels,