[agent-suggestions] Agent suggestions - 2026-05-04

[github-actions]

Agent Suggestions

Date: 2026-05-04

1. Downstream Integration Drift Detector

Trigger: schedule (daily or weekly) + workflow_dispatch

Purpose: Detect downstream workflow integration drift for repos that consume elastic/ai-github-actions (mismatched workflow_run.workflows names, broken/missing auth token wiring, stale workflow references), and produce one actionable consolidated report.

Proposed safe outputs: create-issue (single grouped report), add-comment (optional run-level remediation notes), noop

Evidence:

• Existing internal monitoring already reports repeated downstream runtime/config failures across multiple repos, including repeated authentication/API-key failures and requests for preflight validation/deduplication:
  • [downstream-health] Downstream health report for 2026-04-28 #1040
• Concrete downstream trigger mismatch example that breaks expected automation routing:
  • [bug-hunter] PR Actions Detective listens for non-existent docs-cleanup workflow integrations#18233
• Active downstream adoption footprint discovered via code search:
  • https://github.com/search?q=%22elastic%2Fai-github-actions%2F.github%2Fworkflows%2Fgh-aw-%22+org:elastic+path:.github%2Fworkflows&type=code

Why not covered already:

• internal-downstream-health reports bot activity/silence and recurring failures, but does not continuously validate downstream integration contract drift (trigger-name correctness, wiring correctness, stale references) as a dedicated detector.
• Existing closed [agent-suggestions] items ([agent-suggestions] Agent suggestions - 2026-03-02 #528, [agent-suggestions] Agent suggestions - 2026-03-09 #625, [agent-suggestions] Agent suggestions - 2026-03-16 #713, [agent-suggestions] Agent suggestions - 2026-04-06 #879) covered different scopes (failure clustering, AW failure remediation loop, quickstart guard, workflow-patrol remediator), not downstream contract-drift detection.

Duplicate Checks

• Open issues reviewed: https://github.com/elastic/ai-github-actions/issues?q=is:issue+is:open+%28agent+OR+workflow+OR+automation%29
• Open PRs reviewed: https://github.com/elastic/ai-github-actions/pulls?q=is:pr+is:open+%28agent+OR+workflow%29
• Prior reports reviewed: https://github.com/elastic/ai-github-actions/issues?q=is:issue+in:title+%22%5Bagent-suggestions%5D%22

Downstream Signals

• elastic/elastic-agent, elastic/ai-github-actions-playground: repeated auth/config failures surfaced in downstream health reports
  • [downstream-health] Downstream health report for 2026-04-28 #1040
• elastic/integrations: workflow trigger name mismatch issue
  • [bug-hunter] PR Actions Detective listens for non-existent docs-cleanup workflow integrations#18233

Suggested Next Steps

• Add gh-aw-downstream-integration-drift-detector under gh-agent-workflows/ as a scheduled detector.
• Validate workflow contract checks (trigger name matching, required secret/token wiring, stale reference checks) and group findings per downstream repo.
• Implement dedupe so one open issue is updated instead of creating repeated noise for unchanged drift.

Note

🔒 Integrity filter blocked 94 items

The following items were blocked because they don't meet the GitHub integrity level.

• #392 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #700 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #1025 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #405 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #333 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #357 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #359 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #354 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #301 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #167 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #129 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #937 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #851 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #767 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #705 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #703 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ... and 78 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Trigger Agent Suggestions

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on May 11, 2026, 1:04 PM UTC

[github-actions]

This issue was automatically closed because it expired on 2026-05-11T13:04:07.803Z.

Closed by Workflow