ci: bootstrap sample-catalog sync workflow#398
Merged
Conversation
Copy the sync-sample-catalog pipeline from microsoft-foundry-for-vscode so the foundry-toolkit repo can publish samples/hosted-agent/sample-catalog.json from upstream microsoft-foundry/foundry-samples. - .github/workflows/sync-sample-catalog.yml: workflow_dispatch-triggered job that runs the generator and opens a draft PR with the regenerated catalog. - .github/scripts/generate_sample_catalog.mjs: walks the upstream tree, derives displayName/protocol/requiresModel from each agent.yaml + manifest, applies sample-overrides.json, and LLM-generates descriptions. - samples/hosted-agent/sample-overrides.json: PM-managed per-path framework/requiresModel overrides. The workflow has only a workflow_dispatch trigger and requires repo secrets (SYNC_APP_ID, SYNC_APP_PRIVATE_KEY, AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_API_KEY, AZURE_OPENAI_DEPLOYMENT) to run; secrets are intentionally not configured yet, so the workflow stays dormant until they are added.
Org-level GitHub App creation requires admin permission this repo's maintainer does not have. Since foundry-toolkit has no PR checks today, the anti-recursion limitation of GITHUB_TOKEN (auto-PRs don't trigger downstream workflows) is acceptable. Drop the create-github-app-token step and the SYNC_APP_ID / SYNC_APP_PRIVATE_KEY secret requirements; comment in the workflow records the trade-off so a future switch back to a GitHub App is obvious.
workflow_dispatch requires the workflow file to exist on the default branch before dispatch is allowed (404 otherwise). Temporarily add a push trigger scoped to this feature branch and a hardcoded DEFAULT_COMMIT_SHA fallback so committing alone runs the pipeline end-to-end. To be reverted before merge.
Org policy blocks GITHUB_TOKEN from creating PRs (see https://github.com/microsoft/foundry-toolkit/actions/runs/26492230324). Switch back to the App-token approach: a personal GitHub App was created and installed on this repo, with App ID + private key stored in SYNC_APP_ID / SYNC_APP_PRIVATE_KEY secrets. This reverts the GITHUB_TOKEN simplification commit; the temporary push trigger + DEFAULT_COMMIT_SHA are still in place for one more smoke test before final cleanup.
…ync-catalog-bootstrap-20260527
This reverts commit 6225353.
Contributor
There was a problem hiding this comment.
Pull request overview
Bootstraps a GitHub Actions–driven pipeline to regenerate samples/hosted-agent/sample-catalog.json from the upstream microsoft-foundry/foundry-samples repo, including a Node.js generator script and a small overrides file to correct per-template metadata.
Changes:
- Adds a
workflow_dispatchworkflow that generates the catalog and opens/updates a draft PR with the refreshed JSON. - Introduces a Node.js generator script that scans upstream templates, derives metadata from
agent.yaml/agent.manifest.yaml, applies overrides, and optionally generates descriptions via Azure OpenAI. - Adds a checked-in initial
sample-catalog.jsonplussample-overrides.jsonfor per-path metadata corrections.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/sync-sample-catalog.yml |
Adds the manual workflow to generate the catalog and open a draft PR via a GitHub App token. |
.github/scripts/generate_sample_catalog.mjs |
Implements the upstream scan + catalog generation logic, including overrides and optional LLM description generation. |
samples/hosted-agent/sample-overrides.json |
Adds PM-managed per-path overrides used during generation. |
samples/hosted-agent/sample-catalog.json |
Adds the initially generated catalog output committed into the repo. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
All write operations (branch push, PR create) go through the GitHub App token, so the default GITHUB_TOKEN only needs read access for actions/checkout. Addresses PR #398 review feedback.
huimiu
approved these changes
May 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bootstrap the sample-catalog sync pipeline in this repo, mirroring what was
just landed in microsoft-foundry-for-vscode
(PRs #643
and #646).
What this adds
.github/workflows/sync-sample-catalog.ymlworkflow_dispatchjob that runs the generator, opens a draft PR with the refreshed catalog, and labels it..github/scripts/generate_sample_catalog.mjsmicrosoft-foundry/foundry-samplesrepo, extracts metadata fromagent.yaml/agent.manifest.yaml, merges overrides, and writessamples/hosted-agent/sample-catalog.json.samples/hosted-agent/sample-overrides.jsonsamples/hosted-agent/sample-catalog.jsonHow the workflow authenticates
PR creation goes through a dedicated GitHub App (see
Generate GitHub App tokenstep). This matches the source workflow inmicrosoft-foundry-for-vscodeand is required because themicrosoftorgblocks the built-in
GITHUB_TOKENfrom creating or approving pull requests.The default
GITHUB_TOKENis scoped tocontents: read(only whatactions/checkoutneeds); all write operations use the App token.Required secrets (must be configured before triggering the workflow)
SYNC_APP_IDSYNC_APP_PRIVATE_KEYAZURE_OPENAI_ENDPOINTdescriptionfields when an entry has none.AZURE_OPENAI_API_KEYAZURE_OPENAI_DEPLOYMENTgpt-4o-mini).The App must be installed on this repo with
Contents: writeandPull requests: writepermissions.Reviewer checks
workflow_dispatchtrigger (won't auto-run on push/PR).GITHUB_TOKENis scoped tocontents: read; writes go via the App token.