agentics-maintenance.yml

# This file was automatically generated by pkg/workflow/maintenance_workflow.go. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
#
#    ___                   _   _
#   / _ \                 | | (_)
#  | |_| | __ _  ___ _ __ | |_ _  ___
#  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
#  | | | | (_| |  __/ | | | |_| | (__
#  \_| |_/\__, |\___|_| |_|\__|_|\___|
#          __/ |
#  _    _ |___/
# | |  | |                / _| |
# | |  | | ___ _ __ _  __| |_| | _____      ____
# | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
# \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
#  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
#
#
# To regenerate this workflow, run:
#   gh aw compile
# Not all edits will cause changes to this file.
#
# For more information: https://github.github.com/gh-aw/introduction/overview/
#
# This file defines the generated agentic maintenance workflow for this repository.
# It runs scheduled cleanup for expiring safe outputs and supports manual maintenance operations.
#
# This workflow is generated automatically when workflows use expiring safe outputs,
# when workflows enable steering (safe-outputs.steer), declare compaction-enabled
# ledgers (tools.ledger) or work queues, or when repository maintenance features are
# enabled in .github/workflows/aw.json.
#
# To disable maintenance workflow generation, set in .github/workflows/aw.json:
# {"maintenance": false}
#
# Agentic maintenance docs:
# https://github.github.com/gh-aw/reference/ephemerals/#manual-maintenance-operations
#
name: Agentic Maintenance

on:
  schedule:
    - cron: "37 */2 * * *"  # Every 2 hours (based on minimum expires: 1 days)
  push:
    branches:
      - main
    paths:
      - '.github/workflows/*.md'
  issues:
    types: [labeled]
  workflow_dispatch:
    inputs:
      operation:
        description: 'Optional maintenance operation to run'
        required: false
        type: choice
        default: 'none'
        options:
          - 'none'
          - 'disable'
          - 'enable'
          - 'update'
          - 'upgrade'
          - 'safe_outputs'
          - 'create_labels'
          - 'activity_report'
          - 'close_agentic_workflows_issues'
          - 'clean_cache_memories'
          - 'update_pull_request_branches'
          - 'validate'
          - 'forecast'
          - 'compact_ledger'
      run_url:
        description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
        required: false
        type: string
        default: ''
      ledger:
        description: 'Ledger name to compact when operation is compact_ledger (empty compacts every due ledger).'
        required: false
        type: string
        default: ''
  workflow_call:
    inputs:
      operation:
        description: 'Optional maintenance operation to run (disable, enable, update, upgrade, safe_outputs, create_labels, activity_report, close_agentic_workflows_issues, clean_cache_memories, update_pull_request_branches, validate, forecast, compact_ledger)'
        required: false
        type: string
        default: ''
      run_url:
        description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
        required: false
        type: string
        default: ''
      ledger:
        description: 'Ledger name to compact when operation is compact_ledger (empty compacts every due ledger).'
        required: false
        type: string
        default: ''
    outputs:
      operation_completed:
        description: 'The maintenance operation that was completed (empty when none ran or a scheduled job ran)'
        value: ${{ jobs.run_operation.outputs.operation || (inputs.operation == 'safe_outputs' || inputs.operation == 'create_labels' || inputs.operation == 'activity_report' || inputs.operation == 'close_agentic_workflows_issues' || inputs.operation == 'update_pull_request_branches' || inputs.operation == 'validate' || inputs.operation == 'forecast' || inputs.operation == 'clean_cache_memories' || inputs.operation == 'compact_ledger') && inputs.operation || '' }}
      applied_run_url:
        description: 'The run URL that safe outputs were applied from'
        value: ${{ jobs.apply_safe_outputs.outputs.run_url }}

# Jobs request only the permissions needed for their individual maintenance operations.
permissions: {}

# Serialize maintenance runs to avoid overlapping writes to repository resources.
concurrency:
  group: ${{ github.workflow }}-${{ github.repository }}
  cancel-in-progress: false

jobs:
  close-expired-discussions:
    name: Close expired discussions
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
    runs-on: ubuntu-slim
    # Closing expired resources requires write access to this resource type only.
    permissions:
      discussions: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Close expired discussions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'close_expired_discussions.cjs'));
            await main();
  close-expired-issues:
    name: Close expired issues
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
    runs-on: ubuntu-slim
    # Closing expired resources requires write access to this resource type only.
    permissions:
      issues: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Close expired issues
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'close_expired_issues.cjs'));
            await main();
  close-expired-pull-requests:
    name: Close expired pull requests
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
    runs-on: ubuntu-slim
    # Closing expired resources requires write access to this resource type only.
    permissions:
      pull-requests: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Close expired pull requests
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'close_expired_pull_requests.cjs'));
            await main();

  cleanup-stale-steering-issues:
    name: Cleanup stale steering issues
    if: ${{ (!(github.event.repository.fork)) && github.event_name == 'schedule' }}
    runs-on: ubuntu-slim
    # Reading workflow runs and closing issues requires these permissions.
    permissions:
      actions: read
      issues: write
      contents: read
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Close stale steering issues
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'cleanup_stale_steering_issues.cjs'));
            await main();

  cleanup-cache-memory:
    name: Cleanup cache memory
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none' || inputs.operation == 'clean_cache_memories') }}
    runs-on: ubuntu-slim
    # Removing obsolete Actions caches requires actions: write.
    permissions:
      actions: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Cleanup outdated cache-memory entries
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'cleanup_cache_memory.cjs'));
            await main();

  run_operation:
    name: Run maintenance operation
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation != '' && inputs.operation != 'none' && inputs.operation != 'safe_outputs' && inputs.operation != 'create_labels' && inputs.operation != 'activity_report' && inputs.operation != 'close_agentic_workflows_issues' && inputs.operation != 'clean_cache_memories' && inputs.operation != 'update_pull_request_branches' && inputs.operation != 'validate' && inputs.operation != 'forecast' && inputs.operation != 'compact_ledger' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    # Updates, upgrades, and workflow enable/disable operations need repository write access.
    permissions:
      actions: write
      contents: write
      pull-requests: write
    outputs:
      operation: ${{ steps.record.outputs.operation }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build gh-aw
        run: make build

      - name: Run operation
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_OPERATION: ${{ inputs.operation }}
          GH_AW_CMD_PREFIX: ./gh-aw
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'run_operation_update_upgrade.cjs'));
            await main();

      - name: Record outputs
        id: record
        env:
          GH_AW_OPERATION: ${{ inputs.operation }}
        run: echo "operation=$GH_AW_OPERATION" >> "$GITHUB_OUTPUT"

  update_pull_request_branches:
    name: Update pull request branches
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'update_pull_request_branches' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    # Branch updates may write commits and update pull requests.
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Update pull request branches
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'update_pull_request_branches.cjs'));
            await main();

  apply_safe_outputs:
    name: Apply safe outputs
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'safe_outputs' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    # Replay can create or update any supported safe-output resource.
    permissions:
      actions: read
      contents: write
      discussions: write
      issues: write
      pull-requests: write
    outputs:
      run_url: ${{ steps.record.outputs.run_url }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Apply Safe Outputs
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_JOB_CHECK_RUN_ID: ${{ job.check_run_id }}
          GH_AW_WORKFLOW_ID: "agentics-maintenance"
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_RUN_URL: ${{ inputs.run_url }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'apply_safe_outputs_replay.cjs'));
            await main();

      - name: Record outputs
        id: record
        env:
          GH_AW_RUN_URL: ${{ inputs.run_url }}
        run: echo "run_url=$GH_AW_RUN_URL" >> "$GITHUB_OUTPUT"

  create_labels:
    name: Create labels
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'create_labels' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    # Creating repository labels uses the issues API.
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build gh-aw
        run: make build

      - name: Create missing labels
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_CMD_PREFIX: ./gh-aw
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'create_labels.cjs'));
            await main();

  activity_report:
    name: activity report
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'activity_report' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    timeout-minutes: 120
    # Read workflow logs and create the resulting report issue.
    permissions:
      actions: read
      contents: read
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build gh-aw
        run: make build

      - name: Restore activity report logs cache
        id: activity_report_logs_cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ./.cache/gh-aw/activity-report-logs
          key: ${{ runner.os }}-activity-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-activity-report-logs-${{ github.repository }}-
            ${{ runner.os }}-activity-report-logs-
      - name: Download activity report logs
        timeout-minutes: 20
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_CMD_PREFIX: ./gh-aw
        run: |
          ${GH_AW_CMD_PREFIX} logs \
            --repo "$GITHUB_REPOSITORY" \
            --start-date -1w \
            --count 500 \
            --output ./.cache/gh-aw/activity-report-logs \
            --format markdown \
            --report-file ./.cache/gh-aw/activity-report-logs/report.md

      - name: Save activity report logs cache
        if: ${{ always() }}
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ./.cache/gh-aw/activity-report-logs
          key: ${{ steps.activity_report_logs_cache.outputs.cache-primary-key }}

      - name: Generate activity report issue
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('node:fs');
            const reportPath = './.cache/gh-aw/activity-report-logs/report.md';
            if (!fs.existsSync(reportPath)) {
              core.warning('Activity report markdown not found at ' + reportPath + '; skipping issue creation.');
              return;
            }
            let reportBody = '';
            try {
              reportBody = fs.readFileSync(reportPath, 'utf8').trim();
            } catch (error) {
              core.warning('Failed to read activity report markdown at ' + reportPath + ': ' + error.message);
              return;
            }
            if (!reportBody) {
              core.warning('Activity report markdown is empty at ' + reportPath + '; skipping issue creation.');
              return;
            }
            const repoSlug = context.repo.owner + '/' + context.repo.repo;
            const body = [
              '### Agentic workflow activity report',
              '',
              'Repository: ' + repoSlug,
              'Generated at: ' + new Date().toISOString(),
              '',
              reportBody,
            ].join('\n');
            const createdIssue = await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: '[aw] agentic status report',
              body,
              labels: ['agentic-workflows'],
            });
            core.info('Created issue #' + createdIssue.data.number + ': ' + createdIssue.data.html_url);

  forecast_report:
    name: forecast report
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'forecast' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    timeout-minutes: 60
    # Read workflow logs and create the resulting report issue.
    permissions:
      actions: read
      contents: read
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build gh-aw
        run: make build

      - name: Restore forecast report logs cache
        id: forecast_report_logs_cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ./.github/aw/logs
          key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-
            ${{ runner.os }}-forecast-report-logs-

      - name: Generate forecast report
        id: generate_forecast_report
        timeout-minutes: 30
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_CMD_PREFIX: ./gh-aw
        run: |
          mkdir -p ./.cache/gh-aw/forecast
          set +e
          ${GH_AW_CMD_PREFIX} forecast --repo "$GITHUB_REPOSITORY" --timeout 30 --verbose --json > ./.cache/gh-aw/forecast/report.json
          forecast_exit_code=$?
          set -e
          if [ "${forecast_exit_code}" -eq 124 ]; then
            echo '{"outcome":"timeout","message":"Forecast computation timed out after 30 minutes."}' > ./.cache/gh-aw/forecast/error.json
            echo "::error::Forecast computation timed out after 30 minutes."
            exit 1
          fi
          if [ "${forecast_exit_code}" -ne 0 ]; then
            echo '{"outcome":"error","message":"Forecast computation failed before producing a report."}' > ./.cache/gh-aw/forecast/error.json
            echo "::error::Forecast computation failed with exit code ${forecast_exit_code}."
            exit 1
          fi

      - name: Debug forecast logs folder
        if: ${{ always() }}
        shell: bash
        run: |
          if [ ! -d ./.github/aw/logs ]; then
            echo "Logs directory not found: ./.github/aw/logs"
            exit 0
          fi
          echo "Files under ./.github/aw/logs:"
          find ./.github/aw/logs -type f | sort

      - name: Save forecast report logs cache
        if: ${{ always() }}
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ./.github/aw/logs
          key: ${{ runner.os }}-forecast-report-logs-${{ github.repository }}-${{ github.ref_name }}-${{ github.run_id }}

      - name: Generate forecast issue
        if: ${{ always() }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          FORECAST_STEP_OUTCOME: ${{ steps.generate_forecast_report.outcome }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'create_forecast_issue.cjs'));
            await main();

  close_agentic_workflows_issues:
    name: Close agentic workflows issues
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'close_agentic_workflows_issues' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-slim
    # Closing no-repro issues requires issues: write.
    permissions:
      issues: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Close no-repro agentic-workflows issues
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'close_agentic_workflows_issues.cjs'));
            await main();

  validate_workflows:
    name: Validate workflows
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call') && inputs.operation == 'validate' && (!(github.event.repository.fork)) }}
    runs-on: ubuntu-latest
    # Read workflow sources and file issues for validation findings.
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build gh-aw
        run: make build

      - name: Validate workflows and file issue on findings
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_CMD_PREFIX: ./gh-aw
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'run_validate_workflows.cjs'));
            await main();

  label_disable_agentic_workflow:
    name: Disable agentic workflow by label
    if: ${{ (!(github.event.repository.fork)) && github.event_name == 'issues' && github.event.label.name == 'agentic-workflows:disable' }}
    runs-on: ubuntu-slim
    # Label requests disable workflow runs and update the requesting issue.
    permissions:
      actions: write
      contents: read
      issues: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        id: check_permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Disable agentic workflow
        if: ${{ steps.check_permissions.outcome == 'success' }}
        uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'disable_agentic_workflow.cjs'));
            await main();

  label_apply_safe_outputs:
    name: Apply safe outputs by label
    if: ${{ (!(github.event.repository.fork)) && github.event_name == 'issues' && github.event.label.name == 'agentic-workflows:apply-safe-outputs' }}
    runs-on: ubuntu-slim
    # Applying safe outputs can update each supported repository resource.
    permissions:
      actions: read
      contents: write
      discussions: write
      issues: write
      pull-requests: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check admin/maintainer permissions
        id: check_permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_team_member.cjs'));
            await main();

      - name: Apply safe outputs from referenced run
        if: ${{ steps.check_permissions.outcome == 'success' }}
        uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' # v9.0.0
        env:
          GH_AW_JOB_CHECK_RUN_ID: ${{ job.check_run_id }}
          GH_AW_WORKFLOW_ID: "agentics-maintenance"
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'label_apply_safe_outputs.cjs'));
            await main();

  compile-workflows:
    name: Compile workflows
    if: ${{ (!(github.event.repository.fork)) && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
    runs-on: ubuntu-slim
    concurrency:
      group: ${{ github.workflow }}-compile-workflows-${{ github.repository }}
      cancel-in-progress: true
    # Detect drift by reading sources and open a tracking issue when necessary.
    permissions:
      contents: read
      issues: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build gh-aw
        run: make build

      - name: Pre-compile validation
        run: |
          ./gh-aw compile --validate --no-emit --verbose
          echo "✓ Pre-compile validation passed"

      - name: Compile workflows
        run: |
          ./gh-aw compile --validate --verbose
          echo "✓ All workflows compiled successfully"

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Check for out-of-sync workflows and create issue or pull request if needed
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'check_workflow_recompile_needed.cjs'));
            await main();

  secret-validation:
    name: Validate secrets
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
    runs-on: ubuntu-slim
    # Read repository scripts to check configured integration secrets without write access.
    permissions:
      contents: read
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '22'

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Validate Secrets
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          # GitHub tokens
          GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
          GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
          GH_AW_PROJECT_GITHUB_TOKEN: ${{ secrets.GH_AW_PROJECT_GITHUB_TOKEN }}
          GH_AW_COPILOT_TOKEN: ${{ secrets.GH_AW_COPILOT_TOKEN }}
          # AI Engine API keys
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          BRAVE_API_KEY: ${{ secrets.BRAVE_API_KEY }}
          # Integration tokens
          NOTION_API_TOKEN: ${{ secrets.NOTION_API_TOKEN }}
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'validate_secrets.cjs'));
            await main();

      - name: Upload secret validation report
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: secret-validation-report
          path: secret-validation-report.md
          retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '30' }}
          if-no-files-found: warn

  ledger_compaction_plan:
    name: Plan ledger compaction
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none' || inputs.operation == 'compact_ledger') }}
    runs-on: ubuntu-slim
    # Planning treats ledger content as untrusted and must remain read-only.
    permissions:
      contents: read
    outputs:
      plan_created: ${{ steps.plan_0.outputs.plan_created == 'true' || steps.plan_1.outputs.plan_created == 'true' || steps.plan_2.outputs.plan_created == 'true' || steps.plan_3.outputs.plan_created == 'true' || steps.plan_4.outputs.plan_created == 'true' || steps.plan_5.outputs.plan_created == 'true' || steps.plan_6.outputs.plan_created == 'true' }}
      plans_uploaded: ${{ steps.upload_plans.outcome == 'success' }}
      plan_0_created: ${{ steps.plan_0.outputs.plan_created }}
      plan_1_created: ${{ steps.plan_1.outputs.plan_created }}
      plan_2_created: ${{ steps.plan_2.outputs.plan_created }}
      plan_3_created: ${{ steps.plan_3.outputs.plan_created }}
      plan_4_created: ${{ steps.plan_4.outputs.plan_created }}
      plan_5_created: ${{ steps.plan_5.outputs.plan_created }}
      plan_6_created: ${{ steps.plan_6.outputs.plan_created }}
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Plan ledger compaction (arxiv-papers, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'arxiv-papers' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_0
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/arxiv-papers",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "id",
              "max_patch_kb": 50,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "arxiv-papers",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "analyzed_at": {
                    "type": "string"
                  },
                  "area": {
                    "type": "string"
                  },
                  "categories": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "id": {
                    "type": "string"
                  },
                  "opportunity": {
                    "type": "string"
                  },
                  "published": {
                    "type": "string"
                  },
                  "relevant": {
                    "type": "boolean"
                  },
                  "title": {
                    "type": "string"
                  },
                  "url": {
                    "type": "string"
                  }
                },
                "required": [
                  "id",
                  "title",
                  "url",
                  "published",
                  "categories",
                  "relevant",
                  "analyzed_at"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-0.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Plan ledger compaction (audit-history, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'audit-history' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_1
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/audit-history",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "run_id",
              "max_patch_kb": 10,
              "max_record_kb": 16,
              "max_segment_kb": 100,
              "name": "audit-history",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "aggregate_metrics": {
                    "type": "object"
                  },
                  "anomaly_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "audit_window": {
                    "additionalProperties": false,
                    "properties": {
                      "end": {
                        "type": "string"
                      },
                      "start": {
                        "type": "string"
                      }
                    },
                    "type": "object"
                  },
                  "audited_at": {
                    "type": "string"
                  },
                  "finding_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "outcome": {
                    "enum": [
                      "findings_reported",
                      "noop"
                    ]
                  },
                  "recommendation_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "record_type": {
                    "enum": [
                      "workflow_run_audit"
                    ]
                  },
                  "recurring_finding_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "run_id": {
                    "type": "string"
                  },
                  "runs_reviewed": {
                    "minimum": 0,
                    "type": "integer"
                  }
                },
                "required": [
                  "record_type",
                  "run_id",
                  "audited_at",
                  "audit_window",
                  "runs_reviewed",
                  "aggregate_metrics",
                  "finding_ids",
                  "recommendation_ids",
                  "anomaly_ids",
                  "recurring_finding_ids",
                  "outcome"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-1.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Plan ledger compaction (awf-feature-reviews, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'awf-feature-reviews' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_2
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/awf-feature-reviews",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "max_patch_kb": 10,
              "max_record_kb": 8,
              "max_segment_kb": 100,
              "name": "awf-feature-reviews"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-2.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Plan ledger compaction (caveman-run-history, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'caveman-run-history' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_3
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/caveman-run-history",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "run_id",
              "max_patch_kb": 10,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "caveman-run-history",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "date": {
                    "type": "string"
                  },
                  "files_optimized": {
                    "minimum": 0,
                    "type": "integer"
                  },
                  "files_processed": {
                    "minimum": 0,
                    "type": "integer"
                  },
                  "planned_outcome": {
                    "enum": [
                      "pull_request_requested",
                      "noop"
                    ]
                  },
                  "record_type": {
                    "enum": [
                      "caveman_run"
                    ]
                  },
                  "run_id": {
                    "type": "string"
                  }
                },
                "required": [
                  "record_type",
                  "run_id",
                  "date",
                  "files_processed",
                  "files_optimized",
                  "planned_outcome"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-3.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Plan ledger compaction (centralization, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'centralization' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_4
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/centralization",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "run_id",
              "max_patch_kb": 10,
              "max_record_kb": 8,
              "max_segment_kb": 100,
              "name": "centralization",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "generated_at": {
                    "type": "string"
                  },
                  "intent_buckets": {
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "avg_sessions": {
                          "minimum": 0,
                          "type": "number"
                        },
                        "distinct_users": {
                          "minimum": 0,
                          "type": "integer"
                        },
                        "fallback_rate": {
                          "minimum": 0,
                          "type": "number"
                        },
                        "intent_bucket": {
                          "type": "string"
                        },
                        "task_count": {
                          "minimum": 0,
                          "type": "integer"
                        }
                      },
                      "required": [
                        "intent_bucket",
                        "task_count",
                        "distinct_users",
                        "avg_sessions",
                        "fallback_rate"
                      ],
                      "type": "object"
                    },
                    "maxItems": 10,
                    "type": "array"
                  },
                  "overall_stats": {
                    "type": "object"
                  },
                  "record_type": {
                    "enum": [
                      "centralization_snapshot"
                    ]
                  },
                  "repository": {
                    "type": "string"
                  },
                  "run_id": {
                    "type": "string"
                  },
                  "workflow_opportunities": {
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "artifact_types": {
                          "items": {
                            "type": "string"
                          },
                          "type": "array"
                        },
                        "centralization_score": {
                          "minimum": 0,
                          "type": "number"
                        },
                        "distinct_users": {
                          "minimum": 0,
                          "type": "integer"
                        },
                        "intent_bucket": {
                          "type": "string"
                        },
                        "recommendation_kind": {
                          "type": "string"
                        },
                        "start_context_guess": {
                          "type": "string"
                        },
                        "task_count": {
                          "minimum": 0,
                          "type": "integer"
                        }
                      },
                      "required": [
                        "intent_bucket",
                        "artifact_types",
                        "start_context_guess",
                        "task_count",
                        "distinct_users",
                        "centralization_score",
                        "recommendation_kind"
                      ],
                      "type": "object"
                    },
                    "maxItems": 10,
                    "type": "array"
                  }
                },
                "required": [
                  "record_type",
                  "run_id",
                  "generated_at",
                  "repository",
                  "overall_stats",
                  "intent_buckets",
                  "workflow_opportunities"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-4.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Plan ledger compaction (concurrency-audits, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'concurrency-audits' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_5
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/concurrency-audits",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "max_patch_kb": 10,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "concurrency-audits"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-5.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Plan ledger compaction (smoke, untrusted, read-only)
        if: ${{ inputs.operation != 'compact_ledger' || inputs.ledger == '' || inputs.ledger == 'smoke' }}
        continue-on-error: true
        timeout-minutes: 15
        id: plan_6
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ github.token }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/smoke",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "workflow_run_id",
              "max_patch_kb": 10,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "smoke",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "record_type": {
                    "enum": [
                      "repo_memory_ledger_smoke"
                    ]
                  },
                  "result": {
                    "enum": [
                      "passed"
                    ]
                  },
                  "workflow_run_id": {
                    "type": "string"
                  }
                },
                "required": [
                  "record_type",
                  "workflow_run_id",
                  "result"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-6.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_plan.cjs'));
            await main();

      - name: Upload ledger compaction plans
        if: ${{ steps.plan_0.outputs.plan_created == 'true' || steps.plan_1.outputs.plan_created == 'true' || steps.plan_2.outputs.plan_created == 'true' || steps.plan_3.outputs.plan_created == 'true' || steps.plan_4.outputs.plan_created == 'true' || steps.plan_5.outputs.plan_created == 'true' || steps.plan_6.outputs.plan_created == 'true' }}
        id: upload_plans
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ledger-compaction-plans
          path: ${{ runner.temp }}/gh-aw/ledger-compaction
          retention-days: ${{ vars.GH_AW_DEFAULT_ARTIFACT_RETENTION_DAYS || '1' }}
          if-no-files-found: error
      - name: Report ledger compaction planning failures
        if: ${{ steps.plan_0.outcome == 'failure' || steps.plan_1.outcome == 'failure' || steps.plan_2.outcome == 'failure' || steps.plan_3.outcome == 'failure' || steps.plan_4.outcome == 'failure' || steps.plan_5.outcome == 'failure' || steps.plan_6.outcome == 'failure' }}
        run: exit 1

  ledger_compaction_apply:
    name: Apply ledger compaction
    needs: ledger_compaction_plan
    if: ${{ !cancelled() && needs.ledger_compaction_plan.outputs.plans_uploaded == 'true' && needs.ledger_compaction_plan.outputs.plan_created == 'true' }}
    runs-on: ubuntu-slim
    # Applying a validated plan commits updated ledger content.
    permissions:
      contents: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Download ledger compaction plans
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ledger-compaction-plans
          path: ${{ runner.temp }}/gh-aw/ledger-compaction

      - name: Validate and apply ledger compaction (arxiv-papers, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_0_created == 'true' }}
        id: apply_0
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/arxiv-papers",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "id",
              "max_patch_kb": 50,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "arxiv-papers",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "analyzed_at": {
                    "type": "string"
                  },
                  "area": {
                    "type": "string"
                  },
                  "categories": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "id": {
                    "type": "string"
                  },
                  "opportunity": {
                    "type": "string"
                  },
                  "published": {
                    "type": "string"
                  },
                  "relevant": {
                    "type": "boolean"
                  },
                  "title": {
                    "type": "string"
                  },
                  "url": {
                    "type": "string"
                  }
                },
                "required": [
                  "id",
                  "title",
                  "url",
                  "published",
                  "categories",
                  "relevant",
                  "analyzed_at"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-0.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();

      - name: Validate and apply ledger compaction (audit-history, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_1_created == 'true' }}
        id: apply_1
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/audit-history",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "run_id",
              "max_patch_kb": 10,
              "max_record_kb": 16,
              "max_segment_kb": 100,
              "name": "audit-history",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "aggregate_metrics": {
                    "type": "object"
                  },
                  "anomaly_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "audit_window": {
                    "additionalProperties": false,
                    "properties": {
                      "end": {
                        "type": "string"
                      },
                      "start": {
                        "type": "string"
                      }
                    },
                    "type": "object"
                  },
                  "audited_at": {
                    "type": "string"
                  },
                  "finding_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "outcome": {
                    "enum": [
                      "findings_reported",
                      "noop"
                    ]
                  },
                  "recommendation_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "record_type": {
                    "enum": [
                      "workflow_run_audit"
                    ]
                  },
                  "recurring_finding_ids": {
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "run_id": {
                    "type": "string"
                  },
                  "runs_reviewed": {
                    "minimum": 0,
                    "type": "integer"
                  }
                },
                "required": [
                  "record_type",
                  "run_id",
                  "audited_at",
                  "audit_window",
                  "runs_reviewed",
                  "aggregate_metrics",
                  "finding_ids",
                  "recommendation_ids",
                  "anomaly_ids",
                  "recurring_finding_ids",
                  "outcome"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-1.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();

      - name: Validate and apply ledger compaction (awf-feature-reviews, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_2_created == 'true' }}
        id: apply_2
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/awf-feature-reviews",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "max_patch_kb": 10,
              "max_record_kb": 8,
              "max_segment_kb": 100,
              "name": "awf-feature-reviews"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-2.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();

      - name: Validate and apply ledger compaction (caveman-run-history, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_3_created == 'true' }}
        id: apply_3
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/caveman-run-history",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "run_id",
              "max_patch_kb": 10,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "caveman-run-history",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "date": {
                    "type": "string"
                  },
                  "files_optimized": {
                    "minimum": 0,
                    "type": "integer"
                  },
                  "files_processed": {
                    "minimum": 0,
                    "type": "integer"
                  },
                  "planned_outcome": {
                    "enum": [
                      "pull_request_requested",
                      "noop"
                    ]
                  },
                  "record_type": {
                    "enum": [
                      "caveman_run"
                    ]
                  },
                  "run_id": {
                    "type": "string"
                  }
                },
                "required": [
                  "record_type",
                  "run_id",
                  "date",
                  "files_processed",
                  "files_optimized",
                  "planned_outcome"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-3.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();

      - name: Validate and apply ledger compaction (centralization, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_4_created == 'true' }}
        id: apply_4
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/centralization",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "run_id",
              "max_patch_kb": 10,
              "max_record_kb": 8,
              "max_segment_kb": 100,
              "name": "centralization",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "generated_at": {
                    "type": "string"
                  },
                  "intent_buckets": {
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "avg_sessions": {
                          "minimum": 0,
                          "type": "number"
                        },
                        "distinct_users": {
                          "minimum": 0,
                          "type": "integer"
                        },
                        "fallback_rate": {
                          "minimum": 0,
                          "type": "number"
                        },
                        "intent_bucket": {
                          "type": "string"
                        },
                        "task_count": {
                          "minimum": 0,
                          "type": "integer"
                        }
                      },
                      "required": [
                        "intent_bucket",
                        "task_count",
                        "distinct_users",
                        "avg_sessions",
                        "fallback_rate"
                      ],
                      "type": "object"
                    },
                    "maxItems": 10,
                    "type": "array"
                  },
                  "overall_stats": {
                    "type": "object"
                  },
                  "record_type": {
                    "enum": [
                      "centralization_snapshot"
                    ]
                  },
                  "repository": {
                    "type": "string"
                  },
                  "run_id": {
                    "type": "string"
                  },
                  "workflow_opportunities": {
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "artifact_types": {
                          "items": {
                            "type": "string"
                          },
                          "type": "array"
                        },
                        "centralization_score": {
                          "minimum": 0,
                          "type": "number"
                        },
                        "distinct_users": {
                          "minimum": 0,
                          "type": "integer"
                        },
                        "intent_bucket": {
                          "type": "string"
                        },
                        "recommendation_kind": {
                          "type": "string"
                        },
                        "start_context_guess": {
                          "type": "string"
                        },
                        "task_count": {
                          "minimum": 0,
                          "type": "integer"
                        }
                      },
                      "required": [
                        "intent_bucket",
                        "artifact_types",
                        "start_context_guess",
                        "task_count",
                        "distinct_users",
                        "centralization_score",
                        "recommendation_kind"
                      ],
                      "type": "object"
                    },
                    "maxItems": 10,
                    "type": "array"
                  }
                },
                "required": [
                  "record_type",
                  "run_id",
                  "generated_at",
                  "repository",
                  "overall_stats",
                  "intent_buckets",
                  "workflow_opportunities"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-4.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();

      - name: Validate and apply ledger compaction (concurrency-audits, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_5_created == 'true' }}
        id: apply_5
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/concurrency-audits",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "max_patch_kb": 10,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "concurrency-audits"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-5.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();

      - name: Validate and apply ledger compaction (smoke, trusted)
        if: ${{ needs.ledger_compaction_plan.outputs.plan_6_created == 'true' }}
        id: apply_6
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_AW_LEDGER_COMPACTION_CONFIG: |-
            {
              "branch_name": "ledgers/smoke",
              "compaction": {
                "schedule": "daily",
                "min_segments": 32,
                "max_segments": 128
              },
              "key": "workflow_run_id",
              "max_patch_kb": 10,
              "max_record_kb": 4,
              "max_segment_kb": 100,
              "name": "smoke",
              "schema": {
                "additionalProperties": false,
                "properties": {
                  "record_type": {
                    "enum": [
                      "repo_memory_ledger_smoke"
                    ]
                  },
                  "result": {
                    "enum": [
                      "passed"
                    ]
                  },
                  "workflow_run_id": {
                    "type": "string"
                  }
                },
                "required": [
                  "record_type",
                  "workflow_run_id",
                  "result"
                ],
                "type": "object"
              },
              "type": "table"
            }
          GH_AW_LEDGER_COMPACTION_TRIGGER: ${{ inputs.operation == 'compact_ledger' && 'requested' || 'scheduled' }}
          GH_AW_LEDGER_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/ledger-compaction/plan-6.json
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { main } = require(path.join(actionsDir, 'ledger_compaction_apply.cjs'));
            await main();
      - name: Report ledger compaction application failures
        if: ${{ steps.apply_0.outcome == 'failure' || steps.apply_1.outcome == 'failure' || steps.apply_2.outcome == 'failure' || steps.apply_3.outcome == 'failure' || steps.apply_4.outcome == 'failure' || steps.apply_5.outcome == 'failure' || steps.apply_6.outcome == 'failure' }}
        run: exit 1

  work_queue_compaction:
    name: Reconcile and compact work queue
    if: ${{ (!(github.event.repository.fork)) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'none') }}
    runs-on: ubuntu-slim
    permissions:
      actions: read
      contents: write
      issues: write
    steps:
      - name: Checkout actions folder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: |
            actions
          clean: false
          persist-credentials: false

      - name: Setup Scripts
        uses: ./actions/setup
        with:
          destination: ${{ runner.temp }}/gh-aw/actions

      - name: Reconcile stranded workers and compact work queue
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          GH_AW_WORK_QUEUE_COMPACTION_PLAN_FILE: ${{ runner.temp }}/gh-aw/work-queue-compaction/plan.json
        with:
          script: |
            const path = require('path');
            const actionsDir = path.join(process.env.RUNNER_TEMP, 'gh-aw', 'actions');
            const { setupGlobals } = require(path.join(actionsDir, 'setup_globals.cjs'));
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { maintenance: reconcile } = require(path.join(actionsDir, 'reconcile_work_queue_run.cjs'));
            const reconciliation = await reconcile({ projectIssues: true, deferIssueFailure: true });
            const { main: plan } = require(path.join(actionsDir, 'work_queue_compaction_plan.cjs'));
            const result = await plan();
            if (result.status === 'planned') {
              const { main: apply } = require(path.join(actionsDir, 'work_queue_compaction_apply.cjs'));
              await apply();
            }
            if (reconciliation.issue_sync_pending?.length) core.setFailed('Work queue reconciliation and compaction completed; Issue synchronization remains pending. Recover the exact terminal requests with work-queue sync-issues --request-id.');