Merge branch 'main' into copilot/fix-daily-issues-report-generator

Author: pelikhan

.github/aw/github-agentic-workflows.md

@@ -49,6 +49,7 @@ on:
           - 'update'
           - 'upgrade'
           - 'safe_outputs'
+          - 'create_labels'
       run_url:
         description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
         required: false
@@ -106,7 +107,7 @@ jobs:
             await main();
 
   run_operation:
-    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation != '' && github.event.inputs.operation != 'safe_outputs' && !github.event.repository.fork }}
+    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation != '' && github.event.inputs.operation != 'safe_outputs' && github.event.inputs.operation != 'create_labels' && !github.event.repository.fork }}
     runs-on: ubuntu-slim
     permissions:
       actions: write
@@ -201,6 +202,54 @@ jobs:
             const { main } = require('${{ runner.temp }}/gh-aw/actions/apply_safe_outputs_replay.cjs');
             await main();
 
+  create_labels:
+    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation == 'create_labels' && !github.event.repository.fork }}
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Scripts
+        uses: ./actions/setup
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+
+      - name: Check admin/maintainer permissions
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
+            await main();
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build gh-aw
+        run: make build
+
+      - name: Create missing labels
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          GH_AW_CMD_PREFIX: ./gh-aw
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/create_labels.cjs');
+            await main();
+
   compile-workflows:
     if: ${{ !github.event.repository.fork && (github.event_name != 'workflow_dispatch' || github.event.inputs.operation == '') }}
     runs-on: ubuntu-slim

.github/workflows/agentics-maintenance.yml

@@ -163,10 +163,11 @@ steps:
         echo "Found workflow source: $WORKFLOW_MD"
         cp "$WORKFLOW_MD" /tmp/token-optimizer-claude/workflow-source.md
       else
-        find .github/workflows -name "*.md" -exec grep -l "^name: $WORKFLOW_NAME" {} \; 2>/dev/null | head -1 | while read -r f; do
-          echo "Found: $f"
-          cp "$f" /tmp/token-optimizer-claude/workflow-source.md
-        done
+        FOUND_MD=$(find .github/workflows -name "*.md" -exec grep -l "^name: $WORKFLOW_NAME" {} \; 2>/dev/null | head -1 || true)
+        if [ -n "$FOUND_MD" ]; then
+          echo "Found: $FOUND_MD"
+          cp "$FOUND_MD" /tmp/token-optimizer-claude/workflow-source.md
+        fi
       fi
 
       # Extract declared tools from workflow source

.github/workflows/claude-token-optimizer.lock.yml

@@ -69,15 +69,16 @@ steps:
       mkdir -p "$ARTIFACT_DIR"
 
       echo "📥 Downloading token-usage.jsonl artifacts..."
-      jq -r '.[].databaseId' /tmp/token-analyzer-claude/claude-runs.json 2>/dev/null | head -50 | while read -r run_id; do
+      jq -r '.[0:50][]?.databaseId' /tmp/token-analyzer-claude/claude-runs.json 2>/dev/null > /tmp/token-analyzer-claude/run-ids.txt || true
+      while read -r run_id; do
         run_dir="$ARTIFACT_DIR/$run_id"
         mkdir -p "$run_dir"
         gh run download "$run_id" \
           --repo "$GITHUB_REPOSITORY" \
           --name "firewall-audit-logs" \
           --dir "$run_dir" \
           2>/dev/null || true
-      done
+      done < /tmp/token-analyzer-claude/run-ids.txt
 
       # Count how many token-usage.jsonl files we got
       JSONL_COUNT=$(find "$ARTIFACT_DIR" -name "token-usage.jsonl" 2>/dev/null | wc -l)
@@ -86,14 +87,15 @@ steps:
       # Merge all token-usage.jsonl files annotated with run_id
       MERGED_FILE="/tmp/token-analyzer-claude/token-usage-merged.jsonl"
       > "$MERGED_FILE"
-      find "$ARTIFACT_DIR" -name "token-usage.jsonl" | while read -r f; do
+      find "$ARTIFACT_DIR" -name "token-usage.jsonl" > /tmp/token-analyzer-claude/jsonl-files.txt 2>/dev/null || true
+      while read -r f; do
         run_id=$(echo "$f" | grep -oP '(?<=/artifacts/)\d+(?=/)' || true)
         while IFS= read -r line; do
           if [ -n "$line" ]; then
             echo "${line}" | jq --arg run_id "$run_id" '. + {run_id: $run_id}' >> "$MERGED_FILE" 2>/dev/null || true
           fi
         done < "$f"
-      done
+      done < /tmp/token-analyzer-claude/jsonl-files.txt
 
       RECORD_COUNT=$(wc -l < "$MERGED_FILE" 2>/dev/null || echo 0)
       echo "✅ Merged ${RECORD_COUNT} token usage records"