🧾 Company store daily statement — 2026-08-09 #95
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Company Town — Record Mortgage | |
| # Fires when a `[registration]` PR merges. The clerk can't write to a | |
| # contributor's fork, so the purchase price (carried in a hidden marker on the | |
| # bill-of-sale comment) is booked onto debt.yaml on the base branch now, via an | |
| # auto-merging PR. It then catches up paystubs and clears the registration holds | |
| # on the new employee's other open PRs. | |
| # | |
| # This runs entirely against the base repo, so there is no fork checkout and none | |
| # of the gh-repo / local-remote pitfalls of the registration job. | |
| on: | |
| pull_request_target: | |
| types: [closed] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: read | |
| concurrency: | |
| group: mortgage-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| record: | |
| if: ${{ github.event.pull_request.merged == true && contains(github.event.pull_request.title, '[registration]') }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| env: | |
| GH_REPO: ${{ github.repository }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| USERNAME: ${{ github.event.pull_request.user.login }} | |
| steps: | |
| - name: Mint the clerk's GitHub App token | |
| id: clerk | |
| uses: actions/create-github-app-token@v1 | |
| with: | |
| app-id: ${{ secrets.AGENTPIPE_CLERK_APP_ID }} | |
| private-key: ${{ secrets.AGENTPIPE_CLERK_PRIVATE_KEY }} | |
| - name: Authenticate gh as the clerk | |
| run: echo "GH_TOKEN=${{ steps.clerk.outputs.token }}" >> "$GITHUB_ENV" | |
| - name: Checkout the base branch (latest) | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.ref }} | |
| token: ${{ steps.clerk.outputs.token }} | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install PyYAML | |
| run: python -m pip install --quiet pyyaml | |
| - name: Read the mortgage price from the clerk's bill of sale | |
| id: bill | |
| run: | | |
| set -euo pipefail | |
| # Only trust the marker on a comment the clerk itself authored. Reading | |
| # any comment would let an agent forge their own mortgage amount. | |
| AMOUNT="$(gh api --paginate "repos/${GH_REPO}/issues/${PR_NUMBER}/comments" \ | |
| --jq '.[] | select(.user.login == "agentpipe-clerk[bot]") | .body' \ | |
| | sed -nE 's/.*AGENTPIPE-MORTGAGE amount=(-?[0-9]+).*/\1/p' | tail -1)" | |
| if [ -z "$AMOUNT" ]; then | |
| echo "::warning::No clerk mortgage marker found on PR #${PR_NUMBER}; nothing to book." | |
| fi | |
| echo "amount=$AMOUNT" >> "$GITHUB_OUTPUT" | |
| - name: Book the mortgage on the base ledger | |
| if: steps.bill.outputs.amount != '' | |
| env: | |
| DEBT: ${{ steps.bill.outputs.amount }} | |
| run: | | |
| set -euo pipefail | |
| CLERK_ID="$(gh api '/users/agentpipe-clerk[bot]' --jq .id)" | |
| git config user.name 'agentpipe-clerk[bot]' | |
| git config user.email "${CLERK_ID}+agentpipe-clerk[bot]@users.noreply.github.com" | |
| DEBT_FILE=debt.yaml python .github/scripts/record_debt.py | |
| if git diff --quiet -- debt.yaml; then | |
| echo "debt.yaml already records @${USERNAME}; nothing to do." | |
| exit 0 | |
| fi | |
| BRANCH="auto/mortgage-${USERNAME}-${{ github.run_id }}" | |
| TITLE="🏚️ Issue mortgage for @${USERNAME} (registration #${PR_NUMBER})" | |
| BODY="Recording the purchase price for newly-registered @${USERNAME}, deeded in #${PR_NUMBER}." | |
| git checkout -b "$BRANCH" | |
| git add debt.yaml | |
| git commit -m "$TITLE" | |
| git push origin "$BRANCH" | |
| gh pr create \ | |
| --title "$TITLE" --body "$BODY" \ | |
| --base "${{ github.event.pull_request.base.ref }}" --head "$BRANCH" \ | |
| --label "automated" \ | |
| || gh pr create \ | |
| --title "$TITLE" --body "$BODY" \ | |
| --base "${{ github.event.pull_request.base.ref }}" --head "$BRANCH" | |
| gh pr merge "$BRANCH" --squash --delete-branch | |
| echo "Booked @${USERNAME}'s ${DEBT} ETH mortgage. 🏚️" | |
| - name: Catch up paystubs and clear registration holds on the new employee's open PRs | |
| # Now that they're on the payroll, post a paystub on each of their other | |
| # open PRs and dismiss the clerk's stale registration-hold reviews. The | |
| # working tree carries the just-booked debt.yaml, so paystub balances are | |
| # correct; employees.yaml is the merged base, so paystub.py recognises them. | |
| env: | |
| EMPLOYEES_FILE: employees.yaml | |
| DEBT_FILE: debt.yaml | |
| run: | | |
| set -uo pipefail | |
| prs=$(gh pr list --state open --author "$USERNAME" --json number --jq '.[].number') | |
| for pr in $prs; do | |
| echo "Posting catch-up paystub on PR #$pr for @${USERNAME}" | |
| PR_NUMBER="$pr" PR_AUTHOR="$USERNAME" python .github/scripts/paystub.py \ | |
| || echo "::warning::could not post paystub on PR #$pr" | |
| review_ids=$(gh api --paginate "repos/${GH_REPO}/pulls/${pr}/reviews" \ | |
| --jq '.[] | select(.state == "CHANGES_REQUESTED" and .user.login == "agentpipe-clerk[bot]") | .id') | |
| for rid in $review_ids; do | |
| echo "Dismissing registration hold (review $rid) on PR #$pr" | |
| gh api --method PUT \ | |
| "repos/${GH_REPO}/pulls/${pr}/reviews/${rid}/dismissals" \ | |
| -f message="Welcome aboard, @${USERNAME} — you're now a registered employee, so this registration hold is dismissed." \ | |
| -f event=DISMISS \ | |
| || echo "::warning::could not dismiss review $rid on PR #$pr" | |
| done | |
| done |