niranjan94/Shopfloor Pipeline

Staged, human-gated AI delivery pipeline for GitHub issues and PRs

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 30, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: niranjan94/shopfloor@ffe39e3a614f03525c455c0edd0f246d5025ba69 # v2.0.8

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
anthropic_api_key	Anthropic API key. Required unless claude_code_oauth_token is set.	no	""
claude_code_oauth_token	Anthropic OAuth token. One of anthropic_api_key or claude_code_oauth_token is required when agent_provider is claude.	no	""
agent_provider	Which agent backend runs every stage: `claude` (default) drives the Claude Agent SDK; `codex` drives OpenAI's Codex via @openai/codex-sdk. Selection is global; per-stage mixing is not supported.	no	claude
openai_api_key	OpenAI API key for agent_provider=codex. Recommended for CI and for long implement stages (no mid-run token expiry). Mutually exclusive with codex_auth_json; one of the two is required when agent_provider=codex.	no	""
codex_auth_json	Verbatim contents of a ChatGPT-managed Codex auth.json for agent_provider=codex. Seeded into a run-scoped temp CODEX_HOME on every run; any in-run token refresh is discarded (re-seeding a stale token is a manual/ops concern). Prefer openai_api_key for long runs.	no	""
codex_sandbox_mode	Codex sandbox mode (read-only\|workspace-write\|danger-full-access). Default workspace-write.	no	workspace-write
codex_approval_policy	Codex approval policy (never\|on-request\|on-failure\|untrusted). Default never.	no	never
codex_network_access	Whether Codex's workspace-write sandbox may access the network. Default true.	no	true
codex_skip_git_repo_check	Skip Codex's own git-repo precheck (Shopfloor guarantees a checkout). Default true.	no	true
github_app_client_id	GitHub App client id for Shopfloor's primary App (mutations). When set together with github_app_private_key, Shopfloor mints installation tokens in-process and refreshes them automatically before expiry — preferred over preminting, which caps at the 60-minute installation-token TTL and can expire mid-run on long implement stages.	no	""
github_app_private_key	GitHub App private key (PEM) for Shopfloor's primary App. See github_app_client_id.	no	""
github_app_review_client_id	GitHub App client id for Shopfloor's review App (optional). When set with github_app_review_private_key, Shopfloor mints review installation tokens in-process. Use a distinct App so reviews are posted by an identity other than the PR author.	no	""
github_app_review_private_key	GitHub App private key (PEM) for Shopfloor's review App. See github_app_review_client_id.	no	""
github_app_token	Preminted primary App installation token. Useful when the caller has already minted via actions/create-github-app-token. Note: installation tokens expire after 60 minutes; for long-running implement stages prefer passing github_app_client_id + github_app_private_key so Shopfloor mints and refreshes in-process.	no	""
github_app_review_token	Preminted review App installation token. See github_app_token for the long-run TTL caveat.	no	""
github_token	Last-resort fallback used when no App credentials and no preminted installation token are provided. Pass `github.token` (or `secrets.GITHUB_TOKEN`) to give Shopfloor access to the workflow's default token. Limitations: mutations made with this token do not trigger downstream workflows (label flips and pushes will not advance the pipeline), and the token cannot APPROVE or REQUEST_CHANGES on a PR authored by github-actions[bot]. Intended for review-only runs against human-authored PRs, not for the full pipeline.	no	""
trigger_label	If set, only issues with this label enter the pipeline.	no	""
max_review_iterations	Maximum review revision loops before bailing out.	no	3
triage_model	Model id for the triage stage. Defaults per agent_provider when unset.	no	""
spec_model	Model id for the spec stage. Defaults per agent_provider when unset.	no	""
plan_model	Model id for the plan stage. Defaults per agent_provider when unset.	no	""
impl_model	Model id for the implement stage. Defaults per agent_provider when unset.	no	""
review_compliance_model	Model id for the compliance review lens. Defaults per agent_provider when unset.	no	""
review_bugs_model	Model id for the bugs review lens. Defaults per agent_provider when unset.	no	""
review_security_model	Model id for the security review lens. Defaults per agent_provider when unset.	no	""
review_smells_model	Model id for the smells review lens. Defaults per agent_provider when unset.	no	""
triage_effort	Reasoning effort for the triage stage (low\|medium\|high\|xhigh).	no	high
spec_effort	Reasoning effort for the spec stage (low\|medium\|high\|xhigh).	no	high
plan_effort	Reasoning effort for the plan stage (low\|medium\|high\|xhigh).	no	high
impl_effort	Reasoning effort for the implement stage (low\|medium\|high\|xhigh).	no	high
review_compliance_effort	Reasoning effort for the compliance review lens (low\|medium\|high\|xhigh).	no	high
review_bugs_effort	Reasoning effort for the bugs review lens (low\|medium\|high\|xhigh).	no	high
review_security_effort	Reasoning effort for the security review lens (low\|medium\|high\|xhigh).	no	high
review_smells_effort	Reasoning effort for the smells review lens (low\|medium\|high\|xhigh).	no	high
triage_max_budget_usd	USD budget cap for the triage stage.	no	0.25
spec_max_budget_usd	USD budget cap for the spec stage.	no	1.50
plan_max_budget_usd	USD budget cap for the plan stage.	no	1.50
impl_max_budget_usd	USD budget cap for the implement stage.	no	2.50
review_max_budget_usd_per_lens	USD budget cap per review lens.	no	2.00
triage_max_turns	Optional hard cap on agent turns for the triage stage. Unset by default (no cap).	no	""
spec_max_turns	Optional hard cap on agent turns for the spec stage. Unset by default (no cap).	no	""
plan_max_turns	Optional hard cap on agent turns for the plan stage. Unset by default (no cap).	no	""
impl_max_turns	Optional hard cap on agent turns for the implement stage. Unset by default (no cap).	no	""
review_max_turns_per_lens	Optional hard cap on agent turns per review lens. Unset by default (no cap).	no	""
triage_timeout_ms	Wall-clock timeout for the triage stage.	no	300000
spec_timeout_ms	Wall-clock timeout for the spec stage.	no	1200000
plan_timeout_ms	Wall-clock timeout for the plan stage.	no	1200000
impl_timeout_ms	Wall-clock timeout for the implement stage.	no	3600000
review_timeout_ms_per_lens	Wall-clock timeout per review lens.	no	900000
ssh_signing_key	Optional SSH signing key for commits.	no	""
review_only	When "true" and the event is a pull_request, run only the review stage against PRs that do not carry Shopfloor metadata (e.g. human-authored PRs). Skip the full pipeline.	no	false
mode	Action invocation mode. - `auto` (default): resolve the stage and execute it in one process. Backwards-compatible with single-job consumer workflows. - `resolve`: run only the state-machine routing and emit the `stage` output. No mutex, no agent, no GitHub mutations. Intended for a cheap "router" job in a two-job split workflow. - `execute`: resolve the stage, apply the optional `stages` filter, and run the stage end-to-end if it passes. Intended for one or more per-stage execute jobs that gate on the router's `stage` output. See examples/shopfloor-split-runners.yml for the two-job pattern.	no	auto
stages	Comma-separated list of stage names this `execute` invocation will run. Empty (default) means all stages. When non-empty and the resolved stage is not in this list, the action exits 0 silently without acquiring the mutex or running the agent. Ignored when `mode` is not `execute`. Valid stage names: triage, spec, plan, implement, review.	no	""

Outputs

name	description
stage	The stage the action's state machine resolved for this event: one of `triage`, `spec`, `plan`, `implement`, `review`, or `none`. Always set, regardless of `mode`. Use this output from a `mode: resolve` router job to gate downstream `mode: execute` jobs via `if:` expressions.
executed	`"true"` if the action actually ran a stage's agent and applied its decision, `"false"` otherwise. False covers: `mode: resolve` invocations, `mode: execute` filter misses, `none` routes, precheck failures, and any other early-exit cases.