fix: github workflows

[Dani Akash (DaniAkash)]

This pull request restructures and updates GitHub Actions workflows for the browseros-agent package. The main changes include moving and consolidating workflow files, improving workflow configuration for clarity and maintainability, and removing redundant files. The updates ensure that all workflows consistently use the correct working directory, streamline permissions, and clarify job and step naming.

Workflow configuration and structure improvements:

• All workflow files for browseros-agent (audit.yml, code-quality.yml, claude.yml, pr-title.yml, release-agent-sdk.yml, test.yml) have been moved from packages/browseros-agent/.github/workflows/ to the repository root .github/workflows/ for better visibility and centralized management. The internal configuration was updated to reflect the new structure and working directories. [1] [2] [3] [4] [5] [6] [7] [8] [9]

• Workflow jobs now explicitly set the working-directory to packages/browseros-agent (or subdirectories as appropriate) using the defaults.run.working-directory key, ensuring commands run in the correct context. [1] [2] [3] [4] [5] [6]

Permissions and job configuration:

• Permissions blocks in workflows have been simplified for readability, removing redundant comments and ensuring only necessary permissions are granted. [1] [2]

• Job and step names in workflow files have been standardized for clarity (e.g., removing emojis, using consistent naming).

Cleanup and removal:

• The old dependabot.yml configuration in packages/browseros-agent/.github/ has been deleted, indicating that dependency management configuration has been centralized or is no longer needed in this location.

• The duplicate or outdated cla.yml workflow in packages/browseros-agent/.github/workflows/ has been removed, consolidating CLA checks into the root workflow.

These changes collectively improve workflow maintainability, reduce duplication, and ensure CI/CD processes run reliably in the intended context.

[greptile-apps]

Greptile Summary

This PR centralizes all browseros-agent GitHub Actions workflows from packages/browseros-agent/.github/workflows/ into the repository-root .github/workflows/ directory, adds defaults.run.working-directory to keep commands scoped to the correct package, and refreshes the CLA workflow to store signatures in a dedicated remote repository. The structural move is the right direction for a monorepo, but there is one critical bug and one likely path issue.

Key changes:

• All 6 agent workflows moved to repo root and given explicit working-directory: packages/browseros-agent defaults
• cla.yml migrated to a remote signatures repository (browseros-ai/cla-signatures) with an improved bot allowlist and cleaner UX messaging
• dependabot.yml and the duplicate sub-package cla.yml removed

Issues found:

• test.yml uses on: [] (empty trigger list), meaning the test workflow is never triggered by any GitHub event — automated tests are effectively disabled
• code-quality.yml typecheck job runs bun run --cwd apps/agent codegen; with the new defaults.run.working-directory: packages/browseros-agent, the path resolves to packages/browseros-agent/apps/agent rather than the repo-root apps/agent — verify this is the intended target
• cla.yml allowlist now includes bot* which broadly matches any username starting with "bot", not just bot accounts; tightening this to *[bot] is safer

Confidence Score: 2/5

• Not safe to merge as-is — the test workflow is fully disabled and a path ambiguity in code-quality checks needs verification.
• The critical on: [] bug in test.yml means no tests will ever run after this merges. The --cwd apps/agent path in code-quality.yml may silently resolve to the wrong directory. These are functional regressions that should be resolved before merging.
• .github/workflows/test.yml (disabled triggers) and .github/workflows/code-quality.yml (ambiguous --cwd path in typecheck job)

Important Files Changed

Filename	Overview
.github/workflows/test.yml	Critical issue: on: [] means this workflow has no triggers and tests will never run automatically.
.github/workflows/release-agent-sdk.yml	Working directory corrected from packages/agent-sdk to packages/browseros-agent/packages/agent-sdk; install step overrides the default — asymmetry should be documented.
.github/workflows/code-quality.yml	Added path filter and defaults.run.working-directory; the --cwd apps/agent in the typecheck job may resolve to the wrong directory relative to the new default working directory.
.github/workflows/cla.yml	Migrated CLA signatures to a dedicated remote repository; lock-pullrequest-aftermerge changed to false and bot allowlist broadened with bot* pattern.
.github/workflows/audit.yml	Moved to repo root with working-directory: packages/browseros-agent default; no functional changes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[GitHub Event] --> B{Workflow Trigger}

    B -->|push/PR to main| C[code-quality.yml\npaths: packages/browseros-agent/**]
    B -->|schedule / workflow_dispatch| D[audit.yml]
    B -->|workflow_dispatch| E[release-agent-sdk.yml]
    B -->|PR opened/sync/issue comment| F[cla.yml]
    B -->|PR opened/comment/@claude| G[claude.yml]
    B -->|PR opened/sync/edit| H[pr-title.yml]
    B -->|on: empty list ⚠️| I[test.yml\nNEVER TRIGGERS]

    C --> C1[biome job\nwd: packages/browseros-agent]
    C --> C2[typecheck job\nwd: packages/browseros-agent\n--cwd apps/agent ⚠️]

    D --> D1[security-audit\nwd: packages/browseros-agent\nbun audit → Slack]

    E --> E1[install deps\nwd: packages/browseros-agent]
    E1 --> E2[build / test / publish\nwd: packages/browseros-agent/packages/agent-sdk]

    F --> F1[contributor-assistant/github-action\nsignatures → remote: browseros-ai/cla-signatures]

    I:::critical

    classDef critical fill:#ffcccc,stroke:#cc0000,color:#000

Loading

Comments Outside Diff (2)

1. .github/workflows/test.yml, line 3 (link)

   Test workflow has no triggers — tests will never run

   on: [] is an empty trigger list, which means this workflow is never triggered by any GitHub event. As a result, automated tests are completely disabled. This needs real event triggers such as push/pull_request to run.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: .github/workflows/test.yml
   Line: 3
   
   Comment:
   **Test workflow has no triggers — tests will never run**
   
   `on: []` is an empty trigger list, which means this workflow is never triggered by any GitHub event. As a result, automated tests are completely disabled. This needs real event triggers such as `push`/`pull_request` to run.
   
   
   
   How can I resolve this? If you propose a fix, please make it concise.

2. .github/workflows/code-quality.yml, line 54 (link)

   --cwd apps/agent is relative to the default working directory, not the repo root

   Because defaults.run.working-directory is packages/browseros-agent, the --cwd apps/agent argument in bun run --cwd apps/agent codegen will resolve to packages/browseros-agent/apps/agent — not apps/agent at the repo root. If apps/agent is a top-level directory in the repo (not nested under packages/browseros-agent), this step will fail with a path not found error. Verify that packages/browseros-agent/apps/agent is the intended target, or use an absolute path (e.g. $GITHUB_WORKSPACE/apps/agent) to make the intent unambiguous.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: .github/workflows/code-quality.yml
   Line: 54
   
   Comment:
   **`--cwd apps/agent` is relative to the default working directory, not the repo root**
   
   Because `defaults.run.working-directory` is `packages/browseros-agent`, the `--cwd apps/agent` argument in `bun run --cwd apps/agent codegen` will resolve to `packages/browseros-agent/apps/agent` — not `apps/agent` at the repo root. If `apps/agent` is a top-level directory in the repo (not nested under `packages/browseros-agent`), this step will fail with a path not found error. Verify that `packages/browseros-agent/apps/agent` is the intended target, or use an absolute path (e.g. `$GITHUB_WORKSPACE/apps/agent`) to make the intent unambiguous.
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: .github/workflows/test.yml
Line: 3

Comment:
**Test workflow has no triggers — tests will never run**

`on: []` is an empty trigger list, which means this workflow is never triggered by any GitHub event. As a result, automated tests are completely disabled. This needs real event triggers such as `push`/`pull_request` to run.

```suggestion
on:
  push:
    branches:
      - main
    paths:
      - 'packages/browseros-agent/**'
  pull_request:
    branches:
      - main
    paths:
      - 'packages/browseros-agent/**'
  workflow_dispatch:
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/release-agent-sdk.yml
Line: 24-26

Comment:
**Step-level `working-directory` conflicts with `defaults.run.working-directory`**

The job's `defaults.run.working-directory` is set to `packages/browseros-agent/packages/agent-sdk` (line 12), but the "Install dependencies" step overrides it with a step-level `working-directory: packages/browseros-agent`. While this does work (step-level `working-directory` overrides the default), it creates an asymmetry that is easy to miss: the install step runs one directory up from all the other steps. Consider adding a comment to make this explicit, or restructuring so the dependency install is a separate, clearly scoped step.

```suggestion
      - name: Install dependencies
        run: bun ci
        working-directory: packages/browseros-agent  # installs root deps; subsequent steps use packages/browseros-agent/packages/agent-sdk
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/cla.yml
Line: 35

Comment:
**Broad bot allowlist pattern may match real contributor usernames**

The pattern `bot*` will match any username that starts with "bot" — including legitimate human contributors with usernames like `botond`, `botmark`, etc. The previous allowlist was more specific (`dependabot[bot]`, `renovate[bot]`, `github-actions[bot]`). Consider whether this breadth is intentional or whether it should be tightened.

```suggestion
          allowlist: 'shadowfax92,felarof99,*[bot],dependabot,renovate,github-actions,snyk-bot,imgbot,greenkeeper,semantic-release-bot,allcontributors'
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/code-quality.yml
Line: 54

Comment:
**`--cwd apps/agent` is relative to the default working directory, not the repo root**

Because `defaults.run.working-directory` is `packages/browseros-agent`, the `--cwd apps/agent` argument in `bun run --cwd apps/agent codegen` will resolve to `packages/browseros-agent/apps/agent` — not `apps/agent` at the repo root. If `apps/agent` is a top-level directory in the repo (not nested under `packages/browseros-agent`), this step will fail with a path not found error. Verify that `packages/browseros-agent/apps/agent` is the intended target, or use an absolute path (e.g. `$GITHUB_WORKSPACE/apps/agent`) to make the intent unambiguous.

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 9188abe}

[Dani Akash (DaniAkash)]

Claude (@claude)