fix: sync-preview pushes directly on clean merge, PRs only on conflict by notgitika · Pull Request #1078 · aws/agentcore-cli

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika · 2026-05-01T01:56:06Z

Summary

Reworks the sync-preview workflow to push directly to preview when the merge is clean (using the agentcore-devx-automation GitHub App to bypass branch protection), and only creates a PR when there are real conflicts.

How it works

Clean merge → merges main, restores preview's package version, pushes directly to preview. No PR.
Only version conflicts (package.json/package-lock.json) → accepts main's content, restores preview's version field, pushes directly. No PR.
Real conflicts in other files → opens a PR with conflict markers for manual resolution.

Key changes

Uses actions/create-github-app-token with the agentcore-devx-automation app to get a token that bypasses branch protection
Instead of ignoring package.json/lock entirely (which discards new deps, scripts, etc. from main), accepts main's full content and surgically restores only the version field
CHANGELOG.md and schema merge normally from main — no special handling
Dedup check prevents multiple conflict PRs

Test plan

Workflow YAML is valid (verified locally)
Push to main triggers sync-preview workflow
Clean merge pushes directly to preview with version restored
Version-only conflicts auto-resolve and push directly
Real conflicts in other files produce a PR with conflict markers
Existing open PR prevents duplicate creation
App token has push access to preview branch

agentcore-cli-automation · 2026-05-01T01:58:06Z

Reviewed the workflow — a few things worth considering before merge:

1. PRs created by `GITHUB_TOKEN` won't trigger `pull_request` workflows

This is a documented GitHub limitation to prevent recursive workflow runs: "When you use the repository's GITHUB_TOKEN to perform tasks, events triggered by the GITHUB_TOKEN will not create a new workflow run."

That means the sync PRs created here will not run build-and-test.yml or lint.yml (both of which trigger on pull_request without branch filters). Looking at the current preview branch ruleset, no status checks are required for merge, so this won't strictly block merging — but reviewers approving these PRs won't see CI signal, which somewhat defeats the purpose of going through a PR.

Options:

Use a PAT (or a GitHub App token via actions/create-github-app-token) stored as a secret in place of ${{ github.token }} for the gh pr create calls, so workflows fire.
Accept the trade-off and document that sync PRs intentionally bypass CI (in which case the PR body should probably call that out).
Add a workflow_dispatch/manual re-run step or trigger checks explicitly.

2. Rapid pushes to `main` while a sync PR is open will pile up silently

With the new logic, if commit A is pushed → sync PR opened → commit B is pushed before the sync PR is merged, the second run sees count != 0 and skips entirely. B only gets synced whenever the next push to main happens after the existing PR merges. In the old flow, clean merges pushed directly, so every main push was reflected immediately.

This is probably acceptable (it eventually catches up), but if sync PRs sit open for a while it could surprise people. Options:

Leave as-is and rely on "the next push will catch up" (worth a comment in the workflow).
Force-push the new merge onto the existing sync branch so the open PR stays current.

3. Orphan `sync-preview/merge-main-*` branches

Each run creates a fresh timestamped branch and nothing deletes them after the PR merges/closes. Over time these will accumulate. GitHub's "Automatically delete head branches" repo setting handles this cleanly if it's on; otherwise consider adding gh pr merge --delete-branch guidance or a cleanup step.

Issue #1 is the one I'd most want resolved (or at least explicitly decided on) before merging.

github-actions · 2026-05-01T01:59:33Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	43.33%	9083 / 20958
🔵	Statements	42.61%	9646 / 22636
🔵	Functions	40.11%	1569 / 3911
🔵	Branches	40.14%	5862 / 14601

Generated in workflow #2840 for commit 7e9f6a1 by the Vitest Coverage Report Action

notgitika · 2026-05-01T02:06:00Z

1/ is a real issue. unfortunately we need a PAT token or github app token to resolve that
2/ acceptable trade-off imo
3/ Automatically delete head branches is enabled in settings so this is not an issue

github-actions · 2026-05-11T20:50:20Z

Package Tarball

aws-agentcore-0.13.1.tgz

How to install

npm install https://github.com/aws/agentcore-cli/releases/download/pr-1078-tarball/aws-agentcore-0.13.1.tgz

Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

- Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving)

Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately.

Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

stale; addressed comments

Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204)

* docs: add telemetry instrumentation guide (#1197) * chore: replace PAT tokens with GitHub App token (#1198) Replace secrets.PAT_TOKEN and secrets.AUTOMATION_ACCOUNT_PAT_TOKEN with short-lived tokens generated by the agentcore-devx-automation GitHub App (ID: 3637953) via actions/create-github-app-token@v1. This improves security by using ephemeral tokens scoped to the installation rather than long-lived personal access tokens. Requires adding repo variable APP_ID=3637953 and repo secret APP_PRIVATE_KEY with the app's RSA private key. * fix: add batch eval, recommendation, and CloudWatch Logs write permissions to docs (#1113) * feat: instrument telemetry for create command (CLI + TUI) (#1202) Add telemetry recording to the create command in both CLI and TUI paths: - CLI: wrap handleCreateCLI with runCliCommand to emit CreateAttrs on success/failure - TUI: wrap useCreateFlow's run() with withCommandRunTelemetry - Add telemetry assertions to existing integration tests (frameworks + edge cases) * chore: replace all github.token/GITHUB_TOKEN with GitHub App token Replaces all occurrences of \${{ github.token }} and \${{ secrets.GITHUB_TOKEN }} across .github/workflows/ with a per-job GitHub App token generated via actions/create-github-app-token@v1 using vars.APP_ID and secrets.APP_PRIVATE_KEY. * fix: bump versions to resolve security audit failure * revert: keep pr-title.yml using GITHUB_TOKEN (read-only access sufficient) * feat(evaluator): add kmsKeyArn support for custom evaluator (#994) * feat(evaluator): Add kmsKeyArn support for custom evaluator * fix: sync package-lock.json with package.json The lock file was out of sync after dependency bumps on main were merged, causing npm ci to fail in CI. * fix: revert unrelated dep bumps and fix formatting Reverts @opentelemetry/exporter-metrics-otlp-http ^0.217.0 back to ^0.214.0 and secretlint ^13.0.0 back to ^12.2.0 — these were accidentally included in the feature commit from unmerged dependabot PRs and introduce high-severity protobufjs vulnerabilities. Restores fast-xml-parser and @aws-sdk/xml-builder overrides that were also inadvertently removed. Fixes Prettier formatting on agentcore-project.ts import lines. * fix: sync package-lock.json with updated dependencies --------- Co-authored-by: notgitika <gitijh@gmail.com> * refactor: unify result types with discriminated Result<T, E> union (#1125) * refactor: unify result types with discriminated Result<T, E> union Introduce a shared Result<T, E> type (inspired by Rust's Result) that replaces ad-hoc { success: boolean; error?: string } patterns across the codebase. Key changes: - Add src/lib/types.ts with Result<T, E> discriminated union type - Add toError() helper in src/cli/errors.ts for catch blocks - Migrate all command, operation, and primitive result types to Result<T> - Error field is now Error (not string) on the failure branch - Data fields only exist on the success branch (proper narrowing) - Update all consumers to narrow before accessing branch-specific fields - Update test assertions to match new Error objects and add narrowing * docs: update AGENTS.md and telemetry README to reflect Result<T, E> type * feat: record command attrs on telemetry failure via fallbackAttrs (#1204) * feat: record command attrs on telemetry failure via fallbackAttrs Add optional fallbackAttrs parameter to client.withCommandRun so command-specific attributes are recorded even when the callback throws. - client.ts: accept fallbackAttrs, use on failure instead of {} - client.ts: run resilientParse on all non-empty attrs (not just success) - cli-command-run.ts: withCommandRunTelemetry passes attrs as fallbackAttrs - cli-command-run.ts: runCliCommand accepts optional knownAttrs param - command.tsx: extract knownAttrs upfront, pass to runCliCommand - client.test.ts: add unit tests for fallbackAttrs behavior - create-edge-cases.test.ts: assert attrs present on failure entry * chore: rebase onto mainline * fix: sync-preview pushes directly on clean merge, PRs only on conflict (#1078) * fix: sync-preview workflow restores version instead of ignoring files Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge. * fix: push directly to preview on clean merge via GitHub App bypass Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files. * chore: use app-slug instead of app-id for token generation * fix: address review feedback on sync-preview workflow - Pass PREVIEW_VERSION via env var instead of string interpolation in node -e scripts (safer against special chars) - Make git add of package-lock.json conditional on file existence to match the earlier -f guard - Replace loose title search for dedup with headRefName prefix filter to avoid false positives from unrelated PRs - Clarify why package.json/package-lock.json are special-cased (preview carries a different version string that needs preserving) * fix: restore preview-owned files after sync merge Adds a step to restore schemas/agentcore.schema.v1.json and CHANGELOG.md to preview's versions after merging main. These files are auto-generated during preview releases — schema-check CI rejects direct modifications to schemas/, and CHANGELOG.md tracks preview releases separately. * fix: use app-id instead of app-slug for GitHub App token Aligns with the pattern in PR #1210 and ci-failure-issue.yml. * feat: instrument telemetry for deploy command (CLI + TUI) (#1206) * chore: sync safe commits from main into preview Cherry-picks non-breaking changes from main: - docs: add telemetry instrumentation guide (#1197) - chore: replace PAT tokens with GitHub App token (#1198) - fix: add batch eval, recommendation, CloudWatch Logs permissions (#1113) - feat(evaluator): add kmsKeyArn support (#994) - chore: replace github.token with GitHub App token (#1210) - fix: sync-preview workflow rewrite (#1078) Skipped (requires dedicated effort due to Result type refactor): - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for create/deploy (#1202, #1206) - feat: record command attrs on failure (#1204) * chore: merge main into preview with Result refactor Brings in all remaining main commits including: - refactor: unify result types with Result<T, E> (#1125) - feat: instrument telemetry for deploy command (#1206) - feat: record command attrs on failure (#1204) - feat: instrument telemetry for create command (#1202) Adapts preview's deploy flow to use OperationResult with string errors for compatibility with the telemetry layer. --------- Co-authored-by: Hweinstock <42325418+Hweinstock@users.noreply.github.com> Co-authored-by: Aidan Daly <99039782+aidandaly24@users.noreply.github.com> Co-authored-by: Gitika <53349492+notgitika@users.noreply.github.com> Co-authored-by: Aidan Daly <aidandal@amazon.com> Co-authored-by: Harrison Weinstock <hkobew@amazon.com> Co-authored-by: aws-aditya21 <saivenki@amazon.com> Co-authored-by: notgitika <gitijh@gmail.com>

notgitika requested a review from a teamMay 1, 2026 01:56

github-actionsBot added size/m PR size: M agentcore-harness-reviewing AgentCore Harness review in progress labels May 1, 2026

github-actionsBot removed the agentcore-harness-reviewing AgentCore Harness review in progress label May 1, 2026

notgitika force-pushed the fix/sync-preview-always-pr branch from 1cdd7ec to a36a123Compare May 1, 2026 02:01

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels May 1, 2026

Hweinstock previously approved these changes May 1, 2026
View reviewed changes

notgitika mentioned this pull request May 11, 2026
fix: sync-preview restores version instead of ignoring files #1203
Closed
6 tasks

notgitika dismissed Hweinstock’s stale review via 4377fedMay 11, 2026 20:48

notgitika force-pushed the fix/sync-preview-always-pr branch from a36a123 to 4377fedCompare May 11, 2026 20:48

notgitika changed the title ~~fix: sync-preview workflow always creates PR instead of direct push~~fix: sync-preview restores version instead of ignoring filesMay 11, 2026

notgitika temporarily deployed to e2e-testing May 11, 2026 20:49 — with GitHub Actions Inactive

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels May 11, 2026

avi-alpert previously approved these changes May 11, 2026
View reviewed changes

notgitika requested a review from Hweinstock May 11, 2026 21:01

notgitika dismissed avi-alpert’s stale review via 77c490aMay 11, 2026 21:31

notgitika changed the title ~~fix: sync-preview restores version instead of ignoring files~~fix: sync-preview pushes directly on clean merge, PRs only on conflictMay 11, 2026

notgitika temporarily deployed to e2e-testing May 11, 2026 21:31 — with GitHub Actions Inactive

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels May 11, 2026

notgitika temporarily deployed to e2e-testing May 11, 2026 21:40 — with GitHub Actions Inactive

github-actionsBot added size/m PR size: M agentcore-harness-reviewing AgentCore Harness review in progress and removed size/m PR size: M labels May 11, 2026

notgitika temporarily deployed to e2e-testing May 12, 2026 17:20 — with GitHub Actions Inactive

notgitika dismissed Hweinstock’s stale review via cceae68May 12, 2026 17:37

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels May 12, 2026

notgitika temporarily deployed to e2e-testing May 12, 2026 17:38 — with GitHub Actions Inactive

notgitika force-pushed the fix/sync-preview-always-pr branch from cceae68 to 664aff9Compare May 12, 2026 17:56

notgitika temporarily deployed to e2e-testing May 12, 2026 17:58 — with GitHub Actions Inactive

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels May 12, 2026

notgitika temporarily deployed to e2e-testing May 12, 2026 18:18 — with GitHub Actions Inactive

github-actionsBot added the size/m PR size: M label May 12, 2026

notgitika added 6 commits May 12, 2026 15:26

fix: sync-preview workflow restores version instead of ignoring files
5a78a81
Instead of keeping preview's entire package.json/package-lock.json (which discards new deps, scripts, etc. from main), accept main's content and surgically restore only the version field to preview's value after merge.

fix: push directly to preview on clean merge via GitHub App bypass
25c2084
Use agentcore-devx-automation app token to bypass branch protection and push directly when the merge is clean (or only version conflicts). Only creates a PR when there are real conflicts in other files.

chore: use app-slug instead of app-id for token generation
41595ab

fix: use app-id instead of app-slug for GitHub App token
7e9f6a1
Aligns with the pattern in PR #1210 and ci-failure-issue.yml.

notgitika force-pushed the fix/sync-preview-always-pr branch from 64b3783 to 7e9f6a1Compare May 12, 2026 19:26

github-actionsBot added size/m PR size: M and removed size/m PR size: M labels May 12, 2026

notgitika temporarily deployed to e2e-testing May 12, 2026 19:39 — with GitHub Actions Inactive

Hweinstock approved these changes May 12, 2026
View reviewed changes

notgitika merged commit 0153694 into mainMay 12, 2026
25 of 26 checks passed

notgitika deleted the fix/sync-preview-always-pr branch May 12, 2026 21:47