feat(automation): route trusted review-agent mentions

.github/workflows/agent-mention-noema-dispatch.yml

@@ -0,0 +1,196 @@
+name: Agent Mention Noema Dispatch
+run-name: >-
+  Agent Mention Noema ${{ github.event.client_payload.target_repository }}#${{
+  github.event.client_payload.pr_number }} [cwl-agent-invocation:${{
+  github.event.client_payload.agent_invocation_key }}]
+
+on:
+  repository_dispatch:
+    types: [agent-mention-noema]
+
+concurrency:
+  group: agent-mention-noema-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
+permissions:
+  contents: read
+
+jobs:
+  validate-and-forward:
+    if: github.repository == 'ContextualWisdomLab/.github'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      actions: read
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REQUESTED_AGENT: "cwl-noema-review"
+      PAYLOAD_AGENT: ${{ github.event.client_payload.requested_agent || '' }}
+      INVOCATION_KEY: ${{ github.event.client_payload.agent_invocation_key || '' }}
+      TARGET_REPOSITORY: ${{ github.event.client_payload.target_repository || '' }}
+      PR_NUMBER: ${{ github.event.client_payload.pr_number || '' }}
+      PR_HEAD_SHA: ${{ github.event.client_payload.pr_head_sha || '' }}
+      PR_BASE_SHA: ${{ github.event.client_payload.pr_base_sha || '' }}
+      BASE_BRANCH: ${{ github.event.client_payload.base_branch || '' }}
+      REQUESTED_BY: ${{ github.event.client_payload.requested_by || '' }}
+      SOURCE_COMMENT_ID: ${{ github.event.client_payload.source_comment_id || '' }}
+    steps:
+      - name: Validate exact invocation payload
+        run: |
+          set -euo pipefail
+          if [ "$PAYLOAD_AGENT" != "$REQUESTED_AGENT" ] ||
+            ! [[ "$INVOCATION_KEY" =~ ^[0-9a-f]{64}$ ]] ||
+            ! [[ "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]] ||
+            ! [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] ||
+            ! [[ "$PR_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]] ||
+            ! [[ "$PR_BASE_SHA" =~ ^[0-9a-f]{40}$ ]] ||
+            ! [[ "$BASE_BRANCH" =~ ^[A-Za-z0-9._/-]+$ ]] ||
+            [[ "$BASE_BRANCH" == -* ]] ||
+            ! [[ "$SOURCE_COMMENT_ID" =~ ^[1-9][0-9]*$ ]] ||
+            ! [[ "$REQUESTED_BY" =~ ^[A-Za-z0-9-]+$ ]]; then
+            echo "::error::Rejected malformed or mismatched Noema agent invocation payload."
+            exit 1
+          fi
+
+          python3 - <<'PYTHON'
+          import hashlib
+          import hmac
+          import json
+          import os
+
+          canonical = json.dumps(
+              {
+                  "actor": os.environ["REQUESTED_BY"],
+                  "agent": os.environ["REQUESTED_AGENT"],
+                  "base_branch": os.environ["BASE_BRANCH"],
+                  "base_sha": os.environ["PR_BASE_SHA"],
+                  "comment_id": int(os.environ["SOURCE_COMMENT_ID"]),
+                  "head_sha": os.environ["PR_HEAD_SHA"],
+                  "pr_number": int(os.environ["PR_NUMBER"]),
+                  "repository": os.environ["TARGET_REPOSITORY"],
+              },
+              ensure_ascii=True,
+              separators=(",", ":"),
+              sort_keys=True,
+          ).encode("utf-8")
+          expected = hashlib.sha256(canonical).hexdigest()
+          if not hmac.compare_digest(expected, os.environ["INVOCATION_KEY"]):
+              raise SystemExit("invocation key does not match canonical payload")
+          PYTHON
+
+      - name: Inspect exact-name Actions artifact ledger
+        id: ledger
+        run: |
+          set -euo pipefail
+          LEDGER_ARTIFACT_NAME="cwl-agent-invocation-${INVOCATION_KEY}"
+          export LEDGER_ARTIFACT_NAME
+          echo "LEDGER_ARTIFACT_NAME=$LEDGER_ARTIFACT_NAME" >>"$GITHUB_ENV"
+          response_file="${RUNNER_TEMP}/agent-mention-artifacts.json"
+          gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts" \
+            -X GET \
+            -f "name=${LEDGER_ARTIFACT_NAME}" \
+            -f "per_page=100" >"$response_file"
+          python3 - "$response_file" <<'PYTHON'
+          import json
+          import os
+          from pathlib import Path
+          import sys
+
+          response_path = Path(sys.argv[1])
+          payload = json.loads(response_path.read_text(encoding="utf-8"))
+          expected_name = os.environ["LEDGER_ARTIFACT_NAME"]
+          if not isinstance(payload, dict):
+              raise SystemExit("artifact response must be an object")
+          total_count = payload.get("total_count")
+          artifacts = payload.get("artifacts")
+          if type(total_count) is not int or total_count < 0:
+              raise SystemExit("artifact response has an invalid total_count")
+          if not isinstance(artifacts, list):
+              raise SystemExit("artifact response has an invalid artifacts collection")
+          if total_count != len(artifacts):
+              raise SystemExit("artifact response is truncated or inconsistent")
+          live = False
+          for artifact in artifacts:
+              if not isinstance(artifact, dict):
+                  raise SystemExit("artifact response contains a non-object record")
+              artifact_id = artifact.get("id")
+              name = artifact.get("name")
+              expired = artifact.get("expired")
+              if type(artifact_id) is not int or artifact_id < 1:
+                  raise SystemExit("artifact response contains an invalid artifact id")
+              if not isinstance(name, str) or name != expected_name:
+                  raise SystemExit("artifact response contains a mismatched artifact name")
+              if type(expired) is not bool:
+                  raise SystemExit("artifact response contains an invalid expired flag")
+              live = live or not expired
+
+          output_path = Path(os.environ["GITHUB_OUTPUT"])
+          if live:
+              with output_path.open("a", encoding="utf-8") as handle:
+                  handle.write("claim=false\n")
+              raise SystemExit(0)
+
+          claim_dir = Path(os.environ["RUNNER_TEMP"]) / "cwl-agent-invocation-ledger"
+          claim_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+          claim = {
+              "actor": os.environ["REQUESTED_BY"],
+              "agent": os.environ["REQUESTED_AGENT"],
+              "base_branch": os.environ["BASE_BRANCH"],
+              "base_sha": os.environ["PR_BASE_SHA"],
+              "comment_id": int(os.environ["SOURCE_COMMENT_ID"]),
+              "head_sha": os.environ["PR_HEAD_SHA"],
+              "invocation_key": os.environ["INVOCATION_KEY"],
+              "pr_number": int(os.environ["PR_NUMBER"]),
+              "repository": os.environ["TARGET_REPOSITORY"],
+          }
+          (claim_dir / "claim.json").write_text(
+              json.dumps(claim, ensure_ascii=True, indent=2, sort_keys=True) + "\n",
+              encoding="utf-8",
+          )
+          with output_path.open("a", encoding="utf-8") as handle:
+              handle.write("claim=true\n")
+          PYTHON
+
+      - name: Claim exact invocation in the durable artifact ledger
+        if: steps.ledger.outputs.claim == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: cwl-agent-invocation-${{ env.INVOCATION_KEY }}
+          path: ${{ runner.temp }}/cwl-agent-invocation-ledger/claim.json
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
+          overwrite: false
+          include-hidden-files: false
+
+      - name: Forward once to the authoritative Noema workflow
+        if: steps.ledger.outputs.claim == 'true'
+        run: |
+          set -euo pipefail
+          jq -n \
+            --arg target_repository "$TARGET_REPOSITORY" \
+            --argjson pr_number "$PR_NUMBER" \
+            --arg pr_head_sha "$PR_HEAD_SHA" \
+            --arg pr_base_sha "$PR_BASE_SHA" \
+            --arg base_branch "$BASE_BRANCH" \
+            --arg requested_agent "$REQUESTED_AGENT" \
+            --arg agent_invocation_key "$INVOCATION_KEY" \
+            --arg requested_by "$REQUESTED_BY" \
+            --argjson source_comment_id "$SOURCE_COMMENT_ID" \
+            '{
+              event_type: "noema-review",
+              client_payload: {
+                target_repository: $target_repository,
+                pr_number: $pr_number,
+                pr_head_sha: $pr_head_sha,
+                pr_base_sha: $pr_base_sha,
+                base_branch: $base_branch,
+                requested_agent: $requested_agent,
+                agent_invocation_key: $agent_invocation_key,
+                requested_by: $requested_by,
+                source_comment_id: $source_comment_id
+              }
+            }' \
+            | gh api "repos/${GITHUB_REPOSITORY}/dispatches" -X POST --input -