Skip to content

Add daily fixer agentic workflow for 'Resource not accessible by integration' across long-term branches #424

New issue
New issue
Closed as not planned
Closed as not planned
Add daily fixer agentic workflow for 'Resource not accessible by integration' across long-term branches#424
Assignees
copilot-swe-agentfr4nc1sc0-r4m0n

Description

@fr4nc1sc0-r4m0n
fr4nc1sc0-r4m0n
opened on Feb 26, 2026

Daily fixer for “Resource not accessible by integration” across long-term branches

Analysis

  • The repository already has reusable patterns for failed-run analysis and remediation in ./.github/workflows/gh-aw-pr-actions-detective.md, ./.github/workflows/gh-aw-pr-actions-fixer.md, and scheduled fixer scaffolding in ./.github/workflows/gh-aw-scheduled-fix.md.
  • The requested workflow must run every 24 hours, scan failed workflow executions from the last 24h, detect the exact error text Resource not accessible by integration, and open remediation PRs.
  • PR granularity is defined: one PR per failing workflow.
  • Scope is defined: default branch plus all long-term branches (release branches included).
  • Remediation instructions must be loaded from the external source at runtime: https://github.com/elastic/observability-cicd/blob/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt.
  • Review process is defined: generated PRs must request review from the elastic/observablt-ci team and remain pending until approval (no auto-merge behavior).

Implementation Plan

  1. Create specialized workflow source (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

    • Add a new gh-aw workflow with workflow_call inputs, safe PR output, and Actions read + PR write permissions.
    • Base structure on existing detective/fixer workflows so behavior is consistent with current repo conventions.
    • Why: this is the canonical source that compiles into the distributable lock workflow.

  2. Implement 24h scan and branch coverage logic (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

    • Instruct the agent to query failed runs created in the last 24 hours and include all long-term branches (default + configured release branches).
    • Add explicit input for long-term branch patterns/names so consumers can define their branch set without code changes.
    • Why: ensures deterministic daily coverage for default and release maintenance lines.

  3. Implement error detection and per-workflow PR fan-out (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

    • Parse run/job logs and match exact error text Resource not accessible by integration.
    • Group findings by failing workflow and create exactly one PR per failing workflow (branch-aware to avoid collisions).
    • Skip PR creation when no matching failures are found.
    • Why: aligns with requested PR granularity and avoids mixed, hard-to-review remediation PRs.

  4. Load and apply external remediation instructions (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

    • Require runtime fetch of the remediation prompt from the provided observability-cicd URL via web-fetch.
    • Require the agent to follow those instructions as the primary fix policy when patching workflow permissions/config.
    • Why: guarantees fixes follow the mandated centralized guidance.

  5. Enforce PR description and review assignment requirements (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

    • Require each generated PR body to include: affected workflow/run links, exact failure evidence, root cause, and remediation approach applied.
    • Require reviewer request for team elastic/observablt-ci and keep PR unmerged/pending approval.
    • Why: satisfies governance and traceability requirements for automated changes.

  6. Add consumer trigger with 24h cadence (./gh-agent-workflows/resource-not-accessible-by-integration-fixer/example.yml):

    • Add schedule trigger to run once every 24 hours plus workflow_dispatch for manual execution.
    • Wire required secrets/permissions and pass branch-scope input defaults.
    • Why: provides installable, ready-to-use workflow entrypoint for target repositories.

  7. Document usage and operational behavior (./gh-agent-workflows/resource-not-accessible-by-integration-fixer/README.md):

    • Document cadence, 24h scan window, branch scope configuration, per-workflow PR behavior, and required review team assignment.
    • Document dependency on external instructions URL and failure/noop behavior.
    • Why: makes rollout and operations predictable for adopters.

  8. Register in workflow catalogs and setup automation (./gh-agent-workflows/README.md, ./docs/workflows/gh-agent-workflows.md, ./scripts/quick-setup.sh):

    • Add the new workflow to workflow listings/docs.
    • Add it to continuous_improvement_workflows in quick-setup.
    • Why: ensures discoverability and inclusion in the continuous-improvement install set.

  9. Compile and validate repository artifacts (./Makefile):

    • Run make compile to generate lock workflow and dogfood trigger artifacts.
    • Run make lint to validate workflows/actions.
    • Perform a smoke test in a test repo: (a) no matching error -> no PR, (b) matching error -> one PR per failing workflow with required body and team review request.
    • Why: confirms generated artifacts and runtime behavior before merge.

Activity

  1. fr4nc1sc0-r4m0n
    changed the title [-]Add daily fixer workflow for 'Resource not accessible by integration' across long-term branches[/-] [+]Add daily fixer agentic workflow for 'Resource not accessible by integration' across long-term branches[/+] on Feb 26, 2026
  2. fr4nc1sc0-r4m0n
    assigned
    Copilot
    and
    fr4nc1sc0-r4m0n
    on Feb 26, 2026

  3. github-actions commented on Feb 26, 2026

    @github-actions
    github-actionsBot
    on Feb 26, 2026 – with GitHub Actions
    Contributor

    Recommendation: implement a new specialized scheduled fixer workflow for this use case instead of extending existing workflows, because current patterns are constrained to issue-driven single-PR runs or default-branch/single-run analysis and cannot directly satisfy the requested 24h multi-branch one-PR-per-failing-workflow behavior.

    Recommendation

    Create gh-aw-resource-not-accessible-by-integration-fixer as a dedicated workflow that runs every 24h, scans failed runs from the last 24h across default + configured long-term branches, exact-matches Resource not accessible by integration, and opens one PR per failing workflow with required review requests.

    Findings
    • Existing Scheduled Fix is issue-driven and explicitly constrained to single-PR behavior (.github/workflows/gh-aw-fragments/scheduled-fix.md:7, .github/workflows/gh-aw-scheduled-fix.md:114-124, .github/workflows/gh-aw-fragments/safe-output-create-pr.md:32).
    • Existing PR Actions Fixer is manual + single-run (workflow-run-id) and PR-associated; it noops without a PR (.github/workflows/gh-aw-pr-actions-fixer.md:35-38, :101-107).
    • Existing Branch Actions Detective trigger is default-branch-only and issue-oriented (gh-agent-workflows/branch-actions-detective/example.yml:15-18, .github/workflows/gh-aw-branch-actions-detective.md:72-75).
    • Existing run-mining pattern in agent-efficiency is reusable for log scanning, but currently 7-day issue reporting (.github/workflows/agent-efficiency.md:59, :69, :79, :117).
    • Registration surfaces for new workflow are clear: gh-agent-workflows/README.md (catalog + quick-setup list, lines 21-39 and 66-79), docs/workflows/gh-agent-workflows.md (workflow catalog, lines 67-102), and scripts/quick-setup.sh (continuous_improvement_workflows, lines 128-142).
    • Related completed work confirms pattern/history: base scheduled audit/fix introduction in PR switch to upstream compiler, rename workflows, update fragments #312; dedup/title-prefix improvements in issue Do not repeat previous findings #405 and PR Update to 0.50.4 and improve workflows #406.
    Verification

    I ran targeted commands to verify current constraints and reusable logic:

    grep -n "Only one PR per run\|If no suitable issue is found" .github/workflows/gh-aw-fragments/scheduled-fix.md
grep -n "max: 1\|create-pull-request" .github/workflows/gh-aw-fragments/safe-output-create-pr.md
grep -n "workflow_dispatch\|workflow-run-id\|No pull request associated" .github/workflows/gh-aw-pr-actions-fixer.md
grep -n "head_branch == github.event.repository.default_branch\|workflow_run" gh-agent-workflows/branch-actions-detective/example.yml
grep -n "7 days ago\|Failed runs found\|actions/runs" .github/workflows/agent-efficiency.md

    Observed output (key lines):

    .github/workflows/gh-aw-fragments/scheduled-fix.md:7:- **Only one PR per run.**
.github/workflows/gh-aw-pr-actions-fixer.md:35:      workflow-run-id:
.github/workflows/gh-aw-pr-actions-fixer.md:106:...If there are none, call `noop`...
gh-agent-workflows/branch-actions-detective/example.yml:16:...head_branch == github.event.repository.default_branch...
.github/workflows/agent-efficiency.md:59:      SINCE=$(date -u -d '7 days ago' ...)
    Detailed Action Plan
    1. Add workflow source: .github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md.
      • Inputs: lookback-hours (default 24), long-term-branches (CSV/pattern), remediation-instructions-url, review-team (default requested value), plus standard model/setup inputs.
      • Permissions: at minimum actions: read, contents: read, pull-requests: write (and any additional required by final PR path).
    2. Implement runtime scan + grouping logic.
      • Reuse actions-run and log-download approach from .github/workflows/agent-efficiency.md:59-90.
      • Filter failed runs in window and branch scope.
      • Parse logs for exact text Resource not accessible by integration.
      • Group findings by workflow identity (and branch if needed to avoid collisions), then emit one candidate fix per group.
    3. Fetch external remediation instructions at runtime from:
      • https://github.com/elastic/observability-cicd/blob/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt
      • Apply as primary fix policy for generated changes.
    4. PR behavior and governance.
      • Create one PR per failing workflow group.
      • PR body should include workflow/run links, exact evidence snippet, root cause, and remediation summary.
      • Request review from team elastic/observablt-ci; keep PR pending approval (no auto-merge path).
    5. Add installer docs/surfaces.
      • gh-agent-workflows/resource-not-accessible-by-integration-fixer/example.yml (daily schedule + workflow_dispatch).
      • gh-agent-workflows/resource-not-accessible-by-integration-fixer/README.md.
      • Register in gh-agent-workflows/README.md, docs/workflows/gh-agent-workflows.md, and (if part of CI add-ons) scripts/quick-setup.sh list.
    6. Validate.
      • Run make compile and make lint.
      • Smoke scenarios: (a) no matching failures => no PR; (b) N failing workflows => N PRs; (c) reviewer request attached; (d) PR body contains required evidence.
    Related Items
    Type Link Relevance
    Issue #424 Current request
    Issue #405 Recent dedup pattern improvements affecting scheduled workflows
    PR #312 Introduced/renamed scheduled workflow base architecture
    PR #406 Added previous-findings and title-prefix improvements
    File .github/workflows/gh-aw-scheduled-fix.md Current scheduled fixer base behavior
    File .github/workflows/gh-aw-fragments/scheduled-fix.md Explicit one-PR-per-run process constraints
    File .github/workflows/gh-aw-pr-actions-fixer.md Single-run, PR-associated fixer pattern
    File gh-agent-workflows/branch-actions-detective/example.yml Default-branch-only failure trigger pattern
    File .github/workflows/agent-efficiency.md Reusable failed-run scanning/log parsing approach
    File scripts/quick-setup.sh Workflow registration surface for install automation
    Web https://github.com/elastic/observability-cicd/blob/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt Required external remediation instruction source

    What is this? | From workflow: Issue Triage

    Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

  4. strawgate
    closed this as not plannedon Mar 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions