From a517e382e763a3bfb90504d73d201f8667059123 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Tue, 7 Jul 2026 05:29:30 +0100 Subject: [PATCH] ci: move argus to the aao secretariat app identity Argus now mints its App token from the org-level SECRETARIAT_APP_ID / SECRETARIAT_APP_PRIVATE_KEY secrets and posts reviews as aao-secretariat[bot] instead of the IPR App (aao-ipr-bot[bot]). The reviewer prompt drops the personal-voice identity clause: Argus is the review desk of the AAO Secretariat serving the AdCP Working Group, applies the WG constitution (fetched from adcontextprotocol/adcp@main at review time and appended to the prompt), and cites decision records (DR-NNNN in the spec repo's governance/decisions/) for settled precedent. Mirrors the spec repo migration in adcontextprotocol/adcp#5832. Co-Authored-By: Claude Fable 5 --- .github/ai-review/expert-adcp-reviewer.md | 2 +- .github/workflows/ai-review.yml | 33 +++++++++++++++-------- 2 files changed, 23 insertions(+), 12 deletions(-) diff --git a/.github/ai-review/expert-adcp-reviewer.md b/.github/ai-review/expert-adcp-reviewer.md index a327ca8..6d51db6 100644 --- a/.github/ai-review/expert-adcp-reviewer.md +++ b/.github/ai-review/expert-adcp-reviewer.md @@ -1,6 +1,6 @@ # Argus — Expert PR Reviewer (Java SDK) -You are **Argus**, the expert PR reviewer for `adcontextprotocol/adcp-sdk-java`. You review pull requests **in the voice of Brian O'Kelley** (`bokelley` — primary maintainer of the AdCP protocol). Apply his standing engineering bar. +You are **Argus**, the expert PR reviewer for `adcontextprotocol/adcp-sdk-java`. Argus is the review desk of the AAO Secretariat, serving the AdCP Working Group. Apply the WG constitution appended to this prompt, and cite decision records (`DR-NNNN` in the spec repo's `governance/decisions/`) when a question is settled precedent. This is a real review on a real PR. You will post it directly via `gh pr review`. Do not output the review as preamble — emit it as the body of the `gh pr review` command at the end. diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index 82b95c3..63da091 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -3,16 +3,17 @@ name: AI PR Review (Argus) # Argus is an LLM PR reviewer that posts an `--approve`, `--comment`, or # `--request-changes` review on every non-dependabot PR. It reads the diff, # delegates to subagents when relevant (ad-tech-protocol-expert, -# security-reviewer, code-reviewer, etc.), and writes the review in -# bokelley's voice. +# security-reviewer, code-reviewer, etc.). Argus is the AAO Secretariat's +# review desk: it applies the WG constitution (fetched from +# adcontextprotocol/adcp@main at review time and appended to the prompt). # -# Reviews are posted with the IPR GitHub App installation token so fork PRs can -# be reviewed and the resulting bot review is attributable to the same App that -# owns this repo's IPR workflow. +# Reviews are posted with the AAO Secretariat GitHub App installation token so +# fork PRs can be reviewed and the review is attributable to the Secretariat +# (`aao-secretariat[bot]`). # # Required secrets: -# IPR_APP_ID — already configured for the IPR workflow -# IPR_APP_PRIVATE_KEY — already configured for the IPR workflow +# SECRETARIAT_APP_ID — org-level, AAO Secretariat GitHub App +# SECRETARIAT_APP_PRIVATE_KEY — org-level, AAO Secretariat GitHub App # ANTHROPIC_API_KEY — Anthropic API key for claude-code-action # # Adapted from adcontextprotocol/adcp's Argus workflow. @@ -79,8 +80,8 @@ jobs: id: notice-token uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1 with: - app-id: ${{ secrets.IPR_APP_ID }} - private-key: ${{ secrets.IPR_APP_PRIVATE_KEY }} + app-id: ${{ secrets.SECRETARIAT_APP_ID }} + private-key: ${{ secrets.SECRETARIAT_APP_PRIVATE_KEY }} permission-contents: read permission-issues: write @@ -145,10 +146,20 @@ jobs: PROMPT_BODY="$(git show "${BASE_SHA}:.github/ai-review/expert-adcp-reviewer.md" \ | sed '/^This is a real review on a real PR\./,/^$/d' \ | awk '/^## Picking the action$/ { exit } { print }')" + # The WG constitution is governance owned by the spec repo. Fetch it + # from adcontextprotocol/adcp@main at review time — never from this + # repo or the PR — so Argus always applies the current constitution. + CONSTITUTION="$(curl -sf https://raw.githubusercontent.com/adcontextprotocol/adcp/main/.agents/wg/constitution.md || true)" SENTINEL="ARGUS_$(openssl rand -hex 8)_EOF" { echo "ARGUS_PROMPT<<${SENTINEL}" echo "$PROMPT_BODY" + if [ -n "$CONSTITUTION" ]; then + echo '' + echo '## WG constitution (from adcontextprotocol/adcp@main)' + echo '' + echo "$CONSTITUTION" + fi echo '' echo '---' echo '' @@ -220,8 +231,8 @@ jobs: if: always() && steps.self-mod.outputs.touches != 'true' uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1 with: - app-id: ${{ secrets.IPR_APP_ID }} - private-key: ${{ secrets.IPR_APP_PRIVATE_KEY }} + app-id: ${{ secrets.SECRETARIAT_APP_ID }} + private-key: ${{ secrets.SECRETARIAT_APP_PRIVATE_KEY }} permission-contents: read permission-pull-requests: write permission-issues: write