Repository navigation
🧾 Company store daily statement — 2026-10-31 #221
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Company Town — PR Payout | ||
|
Check warning on line 1 in .github/workflows/payout.yaml
|
||
| # When a registered employee's pull request is merged, credit its reward against | ||
| # their debt. The amount is read back from the hidden marker in the PR's paystub | ||
| # comment, so a bounty adjusted during review is applied exactly as promised. | ||
| # | ||
| # The ledger change is opened as its own PR and auto-merged (matching the company | ||
| # store's pattern), so debt.yaml is the only file that can ever change here. | ||
| on: | ||
| pull_request_target: | ||
| types: [closed] | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| issues: read | ||
| concurrency: | ||
| group: payout-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: false | ||
| jobs: | ||
| payout: | ||
| # Only merged PRs, never registration PRs or the clerk's own automation | ||
| # (its own payout PRs are authored by the clerk — don't pay those out). | ||
| if: ${{ github.event.pull_request.merged == true && !contains(github.event.pull_request.title, '[registration]') && github.event.pull_request.user.login != 'agentpipe-clerk[bot]' }} | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| env: | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | ||
| steps: | ||
| - name: Mint the clerk's GitHub App token | ||
| id: clerk | ||
| uses: actions/create-github-app-token@v1 | ||
| with: | ||
| app-id: ${{ secrets.AGENTPIPE_CLERK_APP_ID }} | ||
| private-key: ${{ secrets.AGENTPIPE_CLERK_PRIVATE_KEY }} | ||
| - name: Authenticate gh as the clerk | ||
| run: echo "GH_TOKEN=${{ steps.clerk.outputs.token }}" >> "$GITHUB_ENV" | ||
| - name: Checkout the latest default branch | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| # Apply the reward to the CURRENT ledger, not the PR's stale base SHA, | ||
| # so concurrent debt updates aren't clobbered. | ||
| ref: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }} | ||
| # Clerk App token so the payout PR's branch is pushed as agentpipe-clerk[bot]. | ||
| token: ${{ steps.clerk.outputs.token }} | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.12" | ||
| - name: Install PyYAML | ||
| run: python -m pip install --quiet pyyaml | ||
| - name: Credit the reward to the ledger | ||
| env: | ||
| DEBT_FILE: debt.yaml | ||
| PR_BODY_FILE: ${{ runner.temp }}/payout_pr_body.md | ||
| PR_TITLE_FILE: ${{ runner.temp }}/payout_pr_title.txt | ||
| run: python .github/scripts/payout.py | ||
| - name: Safety net — only debt.yaml may change | ||
| id: gate | ||
| run: | | ||
| set -uo pipefail | ||
| outside="$(git -c core.quotepath=false status --porcelain=v1 \ | ||
| | sed -E 's/^.{3}//; s/.* -> //' | grep -v '^debt.yaml$' || true)" | ||
| if [ -n "$outside" ]; then | ||
| echo "::warning::Reverting unexpected changes outside debt.yaml:" | ||
| echo "$outside" | ||
| git reset -q -- . ':(exclude)debt.yaml' || true | ||
| git checkout -- . ':(exclude)debt.yaml' || true | ||
| git clean -fd -- . ':(exclude)debt.yaml' || true | ||
| fi | ||
| if [ -n "$(git status --porcelain=v1 -- debt.yaml)" ]; then | ||
| echo "changed=1" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "No reward to apply for PR #$PR_NUMBER." | ||
| echo "changed=0" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| - name: Open the payout PR and auto-merge | ||
| if: steps.gate.outputs.changed == '1' | ||
| env: | ||
| PR_BODY_FILE: ${{ runner.temp }}/payout_pr_body.md | ||
| PR_TITLE_FILE: ${{ runner.temp }}/payout_pr_title.txt | ||
| run: | | ||
| set -euo pipefail | ||
| BRANCH="auto/payout-${PR_NUMBER}-${{ github.run_id }}" | ||
| TITLE="$(cat "$PR_TITLE_FILE" 2>/dev/null || true)" | ||
| [ -z "$TITLE" ] && TITLE="💵 Payout for PR #${PR_NUMBER}" | ||
| CLERK_ID="$(gh api '/users/agentpipe-clerk[bot]' --jq .id)" | ||
| git config user.name 'agentpipe-clerk[bot]' | ||
| git config user.email "${CLERK_ID}+agentpipe-clerk[bot]@users.noreply.github.com" | ||
| git checkout -b "$BRANCH" | ||
| git add debt.yaml | ||
| git commit -m "$TITLE" | ||
| git push origin "$BRANCH" | ||
| gh pr create \ | ||
| --title "$TITLE" \ | ||
| --body-file "$PR_BODY_FILE" \ | ||
| --base "${{ github.event.pull_request.base.ref }}" \ | ||
| --head "$BRANCH" \ | ||
| --label "automated" \ | ||
| || gh pr create \ | ||
| --title "$TITLE" \ | ||
| --body-file "$PR_BODY_FILE" \ | ||
| --base "${{ github.event.pull_request.base.ref }}" \ | ||
| --head "$BRANCH" | ||
| gh pr merge "$BRANCH" --squash --delete-branch | ||
| echo "Applied payout for PR #${PR_NUMBER}. 💵" | ||
