Add daily fixer agentic workflow for 'Resource not accessible by integration' across long-term branches

[fr4nc1sc0-r4m0n]

Daily fixer for “Resource not accessible by integration” across long-term branches

Analysis

• The repository already has reusable patterns for failed-run analysis and remediation in ./.github/workflows/gh-aw-pr-actions-detective.md, ./.github/workflows/gh-aw-pr-actions-fixer.md, and scheduled fixer scaffolding in ./.github/workflows/gh-aw-scheduled-fix.md.
• The requested workflow must run every 24 hours, scan failed workflow executions from the last 24h, detect the exact error text Resource not accessible by integration, and open remediation PRs.
• PR granularity is defined: one PR per failing workflow.
• Scope is defined: default branch plus all long-term branches (release branches included).
• Remediation instructions must be loaded from the external source at runtime: https://github.com/elastic/observability-cicd/blob/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt.
• Review process is defined: generated PRs must request review from the elastic/observablt-ci team and remain pending until approval (no auto-merge behavior).

Implementation Plan

1. Create specialized workflow source (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

   • Add a new gh-aw workflow with workflow_call inputs, safe PR output, and Actions read + PR write permissions.
   • Base structure on existing detective/fixer workflows so behavior is consistent with current repo conventions.
   • Why: this is the canonical source that compiles into the distributable lock workflow.

2. Implement 24h scan and branch coverage logic (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

   • Instruct the agent to query failed runs created in the last 24 hours and include all long-term branches (default + configured release branches).
   • Add explicit input for long-term branch patterns/names so consumers can define their branch set without code changes.
   • Why: ensures deterministic daily coverage for default and release maintenance lines.

3. Implement error detection and per-workflow PR fan-out (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

   • Parse run/job logs and match exact error text Resource not accessible by integration.
   • Group findings by failing workflow and create exactly one PR per failing workflow (branch-aware to avoid collisions).
   • Skip PR creation when no matching failures are found.
   • Why: aligns with requested PR granularity and avoids mixed, hard-to-review remediation PRs.

4. Load and apply external remediation instructions (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

   • Require runtime fetch of the remediation prompt from the provided observability-cicd URL via web-fetch.
   • Require the agent to follow those instructions as the primary fix policy when patching workflow permissions/config.
   • Why: guarantees fixes follow the mandated centralized guidance.

5. Enforce PR description and review assignment requirements (./.github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md):

   • Require each generated PR body to include: affected workflow/run links, exact failure evidence, root cause, and remediation approach applied.
   • Require reviewer request for team elastic/observablt-ci and keep PR unmerged/pending approval.
   • Why: satisfies governance and traceability requirements for automated changes.

6. Add consumer trigger with 24h cadence (./gh-agent-workflows/resource-not-accessible-by-integration-fixer/example.yml):

   • Add schedule trigger to run once every 24 hours plus workflow_dispatch for manual execution.
   • Wire required secrets/permissions and pass branch-scope input defaults.
   • Why: provides installable, ready-to-use workflow entrypoint for target repositories.

7. Document usage and operational behavior (./gh-agent-workflows/resource-not-accessible-by-integration-fixer/README.md):

   • Document cadence, 24h scan window, branch scope configuration, per-workflow PR behavior, and required review team assignment.
   • Document dependency on external instructions URL and failure/noop behavior.
   • Why: makes rollout and operations predictable for adopters.

8. Register in workflow catalogs and setup automation (./gh-agent-workflows/README.md, ./docs/workflows/gh-agent-workflows.md, ./scripts/quick-setup.sh):

   • Add the new workflow to workflow listings/docs.
   • Add it to continuous_improvement_workflows in quick-setup.
   • Why: ensures discoverability and inclusion in the continuous-improvement install set.

9. Compile and validate repository artifacts (./Makefile):

   • Run make compile to generate lock workflow and dogfood trigger artifacts.
   • Run make lint to validate workflows/actions.
   • Perform a smoke test in a test repo: (a) no matching error -> no PR, (b) matching error -> one PR per failing workflow with required body and team review request.
   • Why: confirms generated artifacts and runtime behavior before merge.

[github-actions]

Recommendation: implement a new specialized scheduled fixer workflow for this use case instead of extending existing workflows, because current patterns are constrained to issue-driven single-PR runs or default-branch/single-run analysis and cannot directly satisfy the requested 24h multi-branch one-PR-per-failing-workflow behavior.

Recommendation

Create gh-aw-resource-not-accessible-by-integration-fixer as a dedicated workflow that runs every 24h, scans failed runs from the last 24h across default + configured long-term branches, exact-matches Resource not accessible by integration, and opens one PR per failing workflow with required review requests.

Findings

• Existing Scheduled Fix is issue-driven and explicitly constrained to single-PR behavior (.github/workflows/gh-aw-fragments/scheduled-fix.md:7, .github/workflows/gh-aw-scheduled-fix.md:114-124, .github/workflows/gh-aw-fragments/safe-output-create-pr.md:32).
• Existing PR Actions Fixer is manual + single-run (workflow-run-id) and PR-associated; it noops without a PR (.github/workflows/gh-aw-pr-actions-fixer.md:35-38, :101-107).
• Existing Branch Actions Detective trigger is default-branch-only and issue-oriented (gh-agent-workflows/branch-actions-detective/example.yml:15-18, .github/workflows/gh-aw-branch-actions-detective.md:72-75).
• Existing run-mining pattern in agent-efficiency is reusable for log scanning, but currently 7-day issue reporting (.github/workflows/agent-efficiency.md:59, :69, :79, :117).
• Registration surfaces for new workflow are clear: gh-agent-workflows/README.md (catalog + quick-setup list, lines 21-39 and 66-79), docs/workflows/gh-agent-workflows.md (workflow catalog, lines 67-102), and scripts/quick-setup.sh (continuous_improvement_workflows, lines 128-142).
• Related completed work confirms pattern/history: base scheduled audit/fix introduction in PR switch to upstream compiler, rename workflows, update fragments #312; dedup/title-prefix improvements in issue Do not repeat previous findings #405 and PR Update to 0.50.4 and improve workflows #406.

Verification

I ran targeted commands to verify current constraints and reusable logic:

grep -n "Only one PR per run\|If no suitable issue is found" .github/workflows/gh-aw-fragments/scheduled-fix.md
grep -n "max: 1\|create-pull-request" .github/workflows/gh-aw-fragments/safe-output-create-pr.md
grep -n "workflow_dispatch\|workflow-run-id\|No pull request associated" .github/workflows/gh-aw-pr-actions-fixer.md
grep -n "head_branch == github.event.repository.default_branch\|workflow_run" gh-agent-workflows/branch-actions-detective/example.yml
grep -n "7 days ago\|Failed runs found\|actions/runs" .github/workflows/agent-efficiency.md

Observed output (key lines):

.github/workflows/gh-aw-fragments/scheduled-fix.md:7:- **Only one PR per run.**
.github/workflows/gh-aw-pr-actions-fixer.md:35:      workflow-run-id:
.github/workflows/gh-aw-pr-actions-fixer.md:106:...If there are none, call `noop`...
gh-agent-workflows/branch-actions-detective/example.yml:16:...head_branch == github.event.repository.default_branch...
.github/workflows/agent-efficiency.md:59:      SINCE=$(date -u -d '7 days ago' ...)

Detailed Action Plan

1. Add workflow source: .github/workflows/gh-aw-resource-not-accessible-by-integration-fixer.md.
   • Inputs: lookback-hours (default 24), long-term-branches (CSV/pattern), remediation-instructions-url, review-team (default requested value), plus standard model/setup inputs.
   • Permissions: at minimum actions: read, contents: read, pull-requests: write (and any additional required by final PR path).
2. Implement runtime scan + grouping logic.
   • Reuse actions-run and log-download approach from .github/workflows/agent-efficiency.md:59-90.
   • Filter failed runs in window and branch scope.
   • Parse logs for exact text Resource not accessible by integration.
   • Group findings by workflow identity (and branch if needed to avoid collisions), then emit one candidate fix per group.
3. Fetch external remediation instructions at runtime from:
   • https://github.com/elastic/observability-cicd/blob/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt
   • Apply as primary fix policy for generated changes.
4. PR behavior and governance.
   • Create one PR per failing workflow group.
   • PR body should include workflow/run links, exact evidence snippet, root cause, and remediation summary.
   • Request review from team elastic/observablt-ci; keep PR pending approval (no auto-merge path).
5. Add installer docs/surfaces.
   • gh-agent-workflows/resource-not-accessible-by-integration-fixer/example.yml (daily schedule + workflow_dispatch).
   • gh-agent-workflows/resource-not-accessible-by-integration-fixer/README.md.
   • Register in gh-agent-workflows/README.md, docs/workflows/gh-agent-workflows.md, and (if part of CI add-ons) scripts/quick-setup.sh list.
6. Validate.
   • Run make compile and make lint.
   • Smoke scenarios: (a) no matching failures => no PR; (b) N failing workflows => N PRs; (c) reviewer request attached; (d) PR body contains required evidence.

Related Items

Type	Link	Relevance
Issue	#424	Current request
Issue	#405	Recent dedup pattern improvements affecting scheduled workflows
PR	#312	Introduced/renamed scheduled workflow base architecture
PR	#406	Added previous-findings and title-prefix improvements
File	.github/workflows/gh-aw-scheduled-fix.md	Current scheduled fixer base behavior
File	.github/workflows/gh-aw-fragments/scheduled-fix.md	Explicit one-PR-per-run process constraints
File	.github/workflows/gh-aw-pr-actions-fixer.md	Single-run, PR-associated fixer pattern
File	gh-agent-workflows/branch-actions-detective/example.yml	Default-branch-only failure trigger pattern
File	.github/workflows/agent-efficiency.md	Reusable failed-run scanning/log parsing approach
File	scripts/quick-setup.sh	Workflow registration surface for install automation
Web	https://github.com/elastic/observability-cicd/blob/main/github-actions/actionable/alerts/app/prompts/accessible-by-integration.txt	Required external remediation instruction source

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.