[scanner] v6 readiness live exercise: GitHub triggers (@-mention + Actions workflow_dispatch)

Live-exercise rows: @-mention of the App on a fresh issue/PR (kick, 👀 ack, audit entry; avoid #9164/#9165), and one hive-action-smoke workflow_dispatch against a real issue with kick source=action (use dashboard URL per #9172). Acceptance: linked kick, ack and audit evidence for both. Runbook: src/docs/v6-readiness-runbook.md on v6. Post evidence (links to audit entries/screenshots) as a comment on #7563 and tick the matching row in the v6 readiness bar. Known blockers are tracked in existing issues (see Danathar's 2026-09-27 status pass on #7563); do not re-file them. Part of #7563

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.88

Claimed: running the live exercise for these rows now; evidence will be posted on #7563.

Status: both rows BLOCKED. Nothing was changed on any hive, no test issue was created, and no rows on #7563 were ticked.

Hive checked: the v6 placeholder hosted-available-oke-08-placeholder-xf07. It runs :edge at d5d7e1c, which is v6 HEAD. Its App is id 3568013, with bot login hivecommons-hive[bot].

Row 1: GitHub @-mention (BLOCKED)

The placeholder hive has no github.mentions block in its running config (hive.yaml.runtime and hive.yaml.dashboard). That means enabled is false. There is no default_agent, and no agent has a mention channel. audit.jsonl has 0 agent_mention_* events, ever. The console hive is the same: no mentions config and 0 mention audits.
The only repo this hive manages is hivecommons/spektacular, which is Nic Jackson's project. nicholasjackson is an owner on that hive. The runbook does not designate that repo for smoke tests, and a throwaway issue there would notify a third party.
Needed to run it:
1. A v6 hive that manages an operator-owned sandbox repo, or explicit OK from the Spektacular owner to use hivecommons/spektacular.
2. On that hive: github.mentions.enabled: true, github.mentions.default_agent: <agent>, and summoners: [clubanderson] (or min_role). The chosen agent must be enabled, hold Converse, have a mention channel, and be governor-kickable.
Known bugs 🐛 [v6] mention: per-thread cap counts every App-authored comment on the whole issue/PR against review_bots.max_attempts_per_thread (default 1) — every follow-up @hive mention is silently declined after the hive's own reply #9164 and 🐛 [v6] mention: poller head-of-line blocking — one persistently failing Handle (ack 403, agent not kickable, provider backoff) stalls every later mention in the repo and burns the summoner's hourly budget until the 👀-acked mention is dropped as rate-limited #9165 are both closed as fixed on v6 (🐛 fix(mention): count only mention replies against a dedicated per-thread cap #9315, 🐛 fix: stop one failing mention from stalling the repo's mention poller #9305), so they no longer shape this row.

Row 2: GitHub Actions hive-action-smoke (BLOCKED)

The workflow is at .github/workflows/hive-action-smoke.yml on v6 only. Its inputs are issue (required), prompt, transport (comment|oidc), hive_url and audience. It needs no secrets: it uses github.token, and the id-token: write permission for oidc. The hub_url issue Danathar cited is actually 📝 [v6] github-actions trigger: docs and the composite action point OIDC dispatch at the **hub** (hub_url), but /api/contribute/actions/dispatch is served only by the spoke dashboard — hive-hub returns 404 #9173, not 🐛 [v6] dashboard: Extensions → Spektacular / hub-executor toggles save config but take no effect until restart, with no UI hint; runner, executor and status are boot-time snapshots; saveConfig failure still returns 200 #9172, and it is fixed: the input is now hive_url, the spoke dashboard.
The workflow can't be dispatched. hivecommons/hive's default branch is v5, and the file is not on v5. It is absent from GET /repos/hivecommons/hive/actions/workflows (63 workflows, none of them this one), so workflow_dispatch is unavailable.
The comment transport posts on an issue in the repo the workflow runs in (hivecommons/hive). The placeholder hive does not manage that repo.
The relay body is @hive status .... findMention only matches @hivecommons-hive[bot] or @hivecommons-hive, so the relay comment would not be parsed as a mention for this App. The runbook states this precondition: the App bot login must be hive[bot].
The hive also needs github.actions.enabled: true with status in allowed_commands, and the Row 1 mention config.
Needed to run it:
1. Register the workflow: land hive-action-smoke.yml plus .github/actions/hive/ on the default branch, or copy both into the managed test repo.
2. Run it from a repo the hive manages.
3. Either an App whose bot login is hive[bot], or change the relay body to @<app-login> (for example a mention_login input on the composite action).

Leaving #9700 open.

This issue is ready for live exercise; the remaining blocker is a maintainer/App environment, not more scanner direction.

Local evidence:

cd src && go test ./pkg/github ./pkg/dashboard -run 'Test.*(Mention|Workflow|Trigger|Action|Dashboard)'
ok github.com/hivecommons/hive/pkg/github 41.345s
ok github.com/hivecommons/hive/pkg/dashboard 19.668s

Remaining human/live runbook:

Configure github.mentions.* for the v6 hive and an allowlisted maintainer.
On a managed issue/PR, comment @<app-handle> ask <agent> v6 readiness live exercise: please acknowledge this thread; save the comment URL, 👀 ack/reaction, kick/run evidence, and agent_mention_kicked audit/log line.
Dispatch hive-action-smoke with transport=comment against a managed issue; save run URL, relay comment, 👀 ack, source=action audit/kick evidence, and rerun-dedupe evidence.
If OIDC is configured, dispatch with transport=oidc, hive_url, and matching audience; save accepted/receipt audit lines and green receipt assertion.
Post the evidence on 📝 v6 epic + readiness bar: dashboard-optional operation — meet humans where they are #7563 and tick/link the GitHub @-mention and workflow_dispatch rows.

Replacing hold with needs-human.

What to reply

/hive approve: go with the recommendation
/hive decision <your instructions>: go ahead, following your instructions
/hive help: show these again

If this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply /fixed instead.

Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.

Decision brief — GitHub triggers live exercise (2026-10-16)

Re-checked today against console's hive (hive-hosted-hosted-kubestellar-console-4vkt, v6 edge 97e4922, manages the operator-owned kubestellar/console) and the hivecommons/hive default branch:

Row 1 (@-mention): still no github.mentions block on any v6 hive. Both earlier blockers are gone — 🐛 [v6] mention: per-thread cap counts every App-authored comment on the whole issue/PR against review_bots.max_attempts_per_thread (default 1) — every follow-up @hive mention is silently declined after the hive's own reply #9164/🐛 [v6] mention: poller head-of-line blocking — one persistently failing Handle (ack 403, agent not kickable, provider backoff) stalls every later mention in the repo and burns the summoner's hourly budget until the 👀-acked mention is dropped as rate-limited #9165 are fixed on v6, and the v6 readiness: provision a dedicated test hive + sandbox repo so the live exercises (#9699/#9700/#9701) can run #9708 decision names console's hive as the exercise environment, whose managed repo is operator-owned, so no third party gets paged. The only remaining step is a config change on a production hive plus one mention comment. Not done unilaterally; see options.
Row 2 (hive-action-smoke workflow_dispatch): still not dispatchable: .github/workflows/hive-action-smoke.yml exists only on v6; the repo default branch is v5 and GET /repos/hivecommons/hive/actions/workflows lists no such workflow, so GitHub offers no workflow_dispatch for it. Also the relay body is @hive status … while the App's bot login is hivecommons-hive[bot] (findMention only matches that login), and the hive that would receive it must manage the repo the workflow runs in. Two code/branch changes are needed before any human can click "Run workflow".

Options

Row 1 now, row 2 via PR — recommended
- Row 1: I add to console's hive hive.yaml (all three layers, backed up): github.mentions: {enabled: true, default_agent: <mention-capable, Converse-holding agent — e.g. scanner>, summoners: [clubanderson]}, wait for "config reloaded", then post @hivecommons-hive ask scanner v6 readiness live exercise: please acknowledge this thread on a fresh kubestellar/console issue, capture 👀 ack + agent_mention_kicked audit + kick, post evidence on 📝 v6 epic + readiness bar: dashboard-optional operation — meet humans where they are #7563 and tick the row; then revert the block. Cost: ~30 min; reversible; one agent kick on console's hive.
- Row 2: a v6 PR adding a mention_login input to .github/actions/hive (default hivecommons-hive) and a v5-side copy of hive-action-smoke.yml so the workflow registers on the default branch (the composite action pinned to v6). I can open both PRs today; dispatch after merge. Cost: 2 small PRs + one dispatch.
Row 1 only, defer row 2 until v6 becomes the default branch (then the workflow registers by itself). Leaves the Actions row on 📝 v6 epic + readiness bar: dashboard-optional operation — meet humans where they are #7563 red.
Defer both until a dedicated sandbox repo is attached to a v6 hive (none planned per v6 readiness: provision a dedicated test hive + sandbox repo so the live exercises (#9699/#9700/#9701) can run #9708).

The /hive approve path is not useful here: the open decision is "may I change production hive config and open the two PRs", not "which direction".

Leaving needs-human; adding needs-decision. Reply with the option number (option 1 → I execute both halves).

🌱 ci: add hive-action-smoke workflow_dispatch for hive v6 readiness e…

Live exercise executed against console's hive (v6, ghcr.io/hivecommons/hive:057d344, ns hive-hosted-hosted-kubestellar-console-4vkt). Evidence: #7563 (comment)

Acceptance status:

Row 1 (@-mention): already DONE (Danathar); supplementary re-run on console's hive also PASS (👀 + agent_mention_kicked).
Row 2 (hive-action-smoke workflow_dispatch): checklist items (a)–(c) completed — workflow in kubestellar/console via 🌱 ci: add hive-action-smoke workflow_dispatch for hive v6 readiness exercise kubestellar/console#24484, github.actions/github.mentions configured, dispatched run https://github.com/kubestellar/console/actions/runs/39281968583 — but the hive declined with guard=repo (bare-name repos: vs owner/name event repo). Root cause + fix suggestion in 🐛 mention: Actions trigger always declines with guard=repo when project repos are bare names (owner/name event vs bare config) #12981. Item (d) (dedupe re-run) not attempted since no kick happened.

So #9700 acceptance is not yet met — Row 2 is blocked on #12981. Once that merges to v6 and the console spoke is rolled, the retry is a single gh workflow run hive-action-smoke.yml --repo kubestellar/console --ref main -f issue=<n> -f transport=comment plus one gh run rerun; everything else is already in place. Side findings filed as #12982 (deferred mention kick dropped during startup) and #12983 (run loop stalled on slow-start pacing while holding cfgReloadMu). No labels changed here.

@Danathar

/hive decision split — agent-verifiable parts done (Row 1 @-mention: done by @Danathar + re-run on console's hive, ticked on #7563 — struck. Row 2 code half: #12964 → PR #12967 is open on v5 (hive-authored, role/trusted, DCO ok), reviewed: it registers hive-action-smoke.yml on the default branch, pins the composite action to a v6 SHA that already carries the app_handle input (verified 5a12935 is on v6), and ships an offline test script .github/scripts/test-hive-action-smoke.sh; CI still running, the hive sweep auto-merges on green. The guard=repo decline from the 2026-10-19 dispatch (#12981) is fixed on v6 by #12985 (merged 16:44Z). go test ./pkg/mention ok, 80 tests. github.actions/github.mentions keys are documented in github-actions-trigger.md + operator-reference.md — no doc gap, no PR from this pass); remaining live steps need Andy:

Andy waits for two merges: 🐛 fix: register hive-action-smoke on v5 and parameterise the relay mention login #12967 (v5, registers the workflow) and a console-spoke roll that includes 🐛 fix(mention): normalise repo guard so bare repos entries match owner/name Actions events #12985 (ghcr.io/hivecommons/hive built from v6 ≥ d57def4). Check: gh pr view 12967 -R hivecommons/hive --json state and the spoke's /api/version.
Andy re-dispatches (everything else — workflow in kubestellar/console via 🌱 ci: add hive-action-smoke workflow_dispatch for hive v6 readiness exercise kubestellar/console#24484, github.actions.enabled: true, allowed_commands: [status], github.mentions — is already in place): gh workflow run hive-action-smoke.yml --repo kubestellar/console --ref main -f issue=<n> -f transport=comment, then gh run rerun <run-id> once for the dedupe evidence.
Paste back here: the two run URLs, the relay comment URL, the agent_mention_kicked … source=action audit line and the dedupe/skip line. An agent formats the 📝 v6 epic + readiness bar: dashboard-optional operation — meet humans where they are #7563 block and ticks the row. OIDC transport optional; skip.

Update: #12967 merged to v5 (tide, 2026-10-19) — hive-action-smoke.yml is now registered on the default branch with the app_handle relay input; the #12964 code half of row 2 is done. Andy's checklist above now only waits on the console spoke rolling a v6 image ≥ d57def4 (#12985) before the re-dispatch.

@clubanderson

Un-parked by @clubanderson. Decision: split — agent-verifiable parts done (Row 1 @-mention: done by @Danathar + re-run on console's hive, ticked on #7563 — struck. Row 2 code half: #12964 → PR #12967 is open on v5 (hive-authored, role/trusted, DCO ok), reviewed: it registers hive-action-smoke.yml on the default branch, pins the composite action to a v6 SHA that already carries the app_handle input (verified 5a12935 is on v6), and ships an offline test script .github/scripts/test-hive-action-smoke.sh; CI still running, the hive sweep auto-merges on green. The guard=repo decline from the 2026-10-19 dispatch (#12981) is fixed on v6 by #12985 (merged 16:44Z). go test ./pkg/mention ok, 80 tests. github.actions/github.mentions keys are documented in github-actions-trigger.md + operator-reference.md — no doc gap, no PR from this pass); remaining live steps need Andy:

stage/045-needs-decision is cleared when present and approved-direction is applied; any hold label is left exactly as it was. needs-human stays: this issue is held for a person and remains out of the agent queue until a person removes that label.

Closing summary — both rows have kick + 👀 ack + audit evidence

Row	Status	Evidence
1. GitHub @-mention	DONE	Danathar, self-hosted v6 edge `708a59d`: #7563 (comment) (ticked 2026-10-17). Supplementary re-run on console's hive 2026-10-19 15:56Z: #7563 (comment)
2. `hive-action-smoke` `workflow_dispatch`, kick `source=action`	DONE	#7563 (comment) — run https://github.com/kubestellar/console/actions/runs/39311779928 against kubestellar/console#24488 · relay kubestellar/console#24488 (comment) · 👀 `hivecommons-hive[bot]` @ 19:32:22Z · audit `agent_mention_kicked … source=action, actor=clubanderson, run_id=39311779928, run_attempt=1, workflow=Hive action smoke, transport=comment, agent=reviewer` · reviewer reply kubestellar/console#24488 (comment) · rerun (attempt 2) kicked once under its own `run_id:run_attempt` key; exactly one kick per relay comment across webhook + poller cycles (seen-set `kubestellar/console:39311779928:1` / `:2`). Row ticked in the #7563 readiness bar.

What unblocked it: the console spoke was still on 057d344 (pre-#12985). I triggered the owner self-upgrade on the spoke (POST /api/self-upgrade → hub heartbeat), it drained its in-flight kick and came back on ghcr.io/hivecommons/hive:6dafe49 (v6 ≥ d57def4) at 19:31Z with the github.actions/github.mentions runtime config intact; the bare-name repos: list now matches the owner/name Actions event, so the guard=repo decline from #12981 is gone. The workflow itself was already registered on hivecommons/hive@v5 by #12967 and copied into kubestellar/console by kubestellar/console#24484.

Not done / out of scope: OIDC transport (optional per the 2026-10-19 decision; hub OIDC is not configured for this spoke). #12982/#12983 did not reproduce on 6dafe49 but remain open as their own issues. Test issue kubestellar/console#24488 is being closed.

Acceptance met — closing.

@clubanderson

@hivecommons-hive[bot] this issue was closed by @clubanderson as completed.

If this was closed by a merged PR, the fix only takes effect once it ships in a tagged release and your deployment updates to it — check your running version against the fix before concluding the fix failed.

If you are still seeing the problem, comment /reopen and it will be reopened for you — you do not need write access. Please add what you are still observing (running version, logs, steps) so it is not closed the same way again.

Owner-requested verification pass done: #7563 (comment) — every evidence link re-opened and checked; Row 1 and Row 2 reproduced live again end-to-end on console's hive 6dafe49; negative paths exercised and audited (action-disabled run 39313595965, action-command run 39313929605, forged human marker → plain source=mention, bot author → guard=loop), config restored and re-confirmed (run 39314195283). Explicitly UNVERIFIED (outside this issue's acceptance): human guard=unauthorized (no second human identity available — unit-covered), action-run/action-author/identity guards (need a bot identity), OIDC transport (not configured). No code change → no PR. Issue stays closed.

Navigation Menu

Repository navigation

[scanner] v6 readiness live exercise: GitHub triggers (@-mention + Actions workflow_dispatch) #9700

Decision brief — GitHub triggers live exercise (2026-10-16)

Options

5 remaining items

Closing summary — both rows have kick + 👀 ack + audit evidence

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[scanner] v6 readiness live exercise: GitHub triggers (@-mention + Actions workflow_dispatch) #9700

Description

Activity

clubanderson commented on Sep 30, 2026

clubanderson commented on Sep 30, 2026

clubanderson commented on Oct 8, 2026

hivecommons-hive commented on Oct 8, 2026

clubanderson commented on Oct 16, 2026

Decision brief — GitHub triggers live exercise (2026-10-16)

Options

5 remaining items

clubanderson commented on Oct 19, 2026

clubanderson commented on Oct 19, 2026

clubanderson commented on Oct 19, 2026

hivecommons-hive commented on Oct 19, 2026

clubanderson commented on Oct 19, 2026

Closing summary — both rows have kick + 👀 ack + audit evidence

github-actions commented on Oct 19, 2026

clubanderson commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions