[agent-suggestions] Agent suggestions - 2026-08-24 #1890

Agent Suggestions

Date: 2026-08-24

1. workflow-contract-preflight

Trigger: pull_request on workflow source paths (.github/workflows/**, gh-agent-workflows/**, docs workflow references) plus weekly schedule backstop.

Purpose: Detect workflow contract drift before merge (source .md ↔ trigger/example ↔ README parity, required workflow_call input wiring, footer wiring, permissions consistency, generated-file boundary checks excluding .lock.yml). This would shift drift detection from post-merge issue filing to pre-merge prevention.

Proposed safe outputs:

• add-comment on PRs (inline actionable drift report)
• create-issue on scheduled runs for unresolved/recurrent drift
• noop when no drift is found

Evidence:

• Existing drift detector is internal-only and scheduled, not a public PR-time guardrail:
  • https://github.com/elastic/ai-github-actions/blob/main/.github/workflows/workflow-patrol.md
• Repeated recent drift issues indicate recurring need:
  • [workflow-patrol] Workflow drift detected: duplicate-issue-detector missing standard workflow_call setup contract #1881
  • [workflow-patrol] Workflow drift detected: update-pr-body missing messages-footer wiring #1857
  • [workflow-patrol] Workflow drift detected: missing pr-conflict-addresser example/README parity #1845
• Current public workflow catalog does not include a dedicated pre-merge workflow-contract parity checker:
  • https://github.com/elastic/ai-github-actions/blob/main/gh-agent-workflows/README.md
• Downstream repos actively consume these workflows, so pre-merge guardrails would reduce propagation of contract drift:
  • https://github.com/elastic/beats/blob/main/.github/workflows/trigger-pr-review.yml
  • https://github.com/elastic/elastic-agent/blob/main/.github/workflows/trigger-pr-review.yml
  • https://github.com/elastic/integrations/blob/main/.github/workflows/trigger-pr-review.yml
  • https://github.com/elastic/logstash/blob/main/.github/workflows/trigger-pr-buildkite-detective.yml

Why not covered already:
Current coverage includes many detectors/reviewers/fixers and an internal scheduled workflow-patrol; it does not provide a published PR-triggered preflight focused on workflow contract parity for maintainers and downstream adopters.

Duplicate Checks

• Open issue/PR scans for agent/workflow automation requests and active workflow changes were reviewed:
  • fix: propagate gh-aw compile failures in make compile #1888
  • fix(pr-review): surface missing named-flag values in pr-comment.sh #1880
  • Fix text-auditor copy drift in triage prompts and scripts #1823
  • Fix missing required permissions in pr-review-fork example #1820
• Previous agent-suggestions history reviewed from local prior-findings set (including [agent-suggestions] Agent suggestions - 2026-08-10 #1793, [agent-suggestions] Agent suggestions - 2026-08-03 #1746, [agent-suggestions] Agent suggestions - 2026-07-27 #1683, [agent-suggestions] Release integrity verifier workflow #1556, [agent-suggestions] Add reusable package ownership drift workflow #1363); no matching suggestion for a pre-merge workflow-contract preflight.

Downstream Signals

• elastic/beats: uses gh-aw-pr-review trigger (link above)
• elastic/elastic-agent: uses gh-aw-pr-review trigger (link above)
• elastic/integrations: uses gh-aw-pr-review trigger (link above)
• elastic/logstash: uses gh-aw-estc-pr-buildkite-detective trigger (link above)

Suggested Next Steps

• Prototype gh-aw-workflow-contract-preflight as a public workflow using pull_request trigger + scheduled backstop.
• Reuse checks and heuristics from workflow-patrol for parity dimensions, but tune outputs for PR-time maintainers.
• Add gh-agent-workflows/workflow-contract-preflight/README.md and example.yml so downstream repos can adopt it directly.

What is this? | From workflow: Trigger Agent Suggestions

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Aug 31, 2026, 12:33 PM UTC