ci: pin GitHub Actions by SHA instead of mutable tags (staging sync) #276

Merged
core-devops merged 4 commits from ci/staging-sha-pinning into staging 2026-05-10 14:03:06 +00:00

4 Commits

Author SHA1 Message Date
bea89ce4e9 fix(a2a): handle string-form errors in delegate_task
Some checks failed
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 14s
sop-tier-check / tier-check (pull_request) Failing after 7s
audit-force-merge / audit (pull_request) Failing after 5s
The A2A proxy can return three error shapes:
  {"error": "plain string"}
  {"error": {"message": "...", "code": ...}}
  {"error": {"message": {"nested": "object"}}}   ← value at .message is a string

builtin_tools/a2a_tools.py:72 called data["error"].get("message")
without guarding against error being a string, which raised:
  AttributeError: 'str' object has no attribute 'get'

This broke every delegation attempt through the legacy a2a_tools path
(the LangChain-wrapped version used by adapter templates). The
SSOT parser a2a_response.py already handled string errors; the
legacy inline sniffer in a2a_tools.py did not.

Fix: branch on isinstance(err, dict/str/other) before calling .get().

Also update both publish-workflow files to remove the dead
`staging` branch trigger — trunk-based migration (PR #109,
2026-05-08) removed the staging branch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 11:39:32 +00:00
14f05b5a64 chore: restore manifest.json after trigger test 2026-05-10 11:38:34 +00:00
7caee806df chore: trigger publish workflow [Integration Tester 2026-05-10T08:45Z] 2026-05-10 11:38:34 +00:00
a914f675a4 chore: staging trigger commit from Integration Tester 2026-05-10 11:38:34 +00:00