refactor: migrate Deequ Bot to the shared Shadow engine - #756
Merged
Conversation
Replace the vendored copy of the bot (src/scripts/issue_bot/) with consuming the shared engine sudsali/shadow via its reusable workflow, SHA-pinned to 3a057597420d7123df162bfe4686aaafb5f7eccd (v1.2). One engine, maintained once upstream, instead of a per-repo fork. Zero intended behavior change: - Deequ's language-tuned prompts stay in Secrets Manager (deequ-bot/* namespace) and are selected via prompt_sm_prefix: deequ-bot — the engine fetches all eight (pr-investigator/critic/reporter + 2 commit nudges + issue-classify/ issue-respond/followup) in place of its bundled language-agnostic defaults. - .shadow.yml sets bot.name: deequ-bot so the clean-review marker stays <!-- deequ-bot:clean --> (auto-approve.yml keys on it) and the Scala codebase config (src/main/scala, .scala) matches the vendored setup. - All four surfaces (PR review, issue triage, issue-respond, follow-up), all four triggers, and the job-level trigger guard are preserved. Workflow name stays "Deequ Bot" (auto-approve.yml keys on it too). BOT_AGENT_PIPELINE=1 is already the live path, so the dropped legacy file-review prompts are dead code. generate_kb.py stays (update-kb.yml still runs it); its stale paths-ignore entries for the removed dirs are cleaned up. Requires a one-time OIDC trust update on the bot's IAM role (job_workflow_ref → shadow's reusable workflow), applied out-of-band with an @* version wildcard so future engine bumps need no IAM change.
The caller works on the current sub-only IAM trust with no change (its OIDC sub is still repo:awslabs/deequ:*). The job_workflow_ref pin is optional defense-in-depth to be applied only after this PR merges — applying it while the base branch still runs the vendored bot denies AssumeRole. Comment-only.
A reusable-workflow caller must grant, at the top level, the union of
permissions its nested jobs request — GitHub caps nested jobs at the caller's
token and otherwise fails at startup ('is requesting ... but is only allowed
none'). The reusable workflow's analyze (id-token:write, pull-requests:read)
and act (issues:write, pull-requests:write) jobs need this union; the vendored
workflow declared these per-job, which doesn't carry across the workflow_call
boundary. Fixes the workflow_dispatch startup_failure.
Drop WHAT-narration and multi-paragraph explanations; keep only comments that prevent a concrete mistake (name coupling, dual-SHA pin, pull_request_target no-ref, permissions ceiling, marker, if-guard).
Surface the Shadow product to the OSS community. Renames the user-facing identity in lockstep across the three coupled points: .shadow.yml bot.name (the clean-review marker), the workflow name, and auto-approve.yml (both the workflows[] trigger and the CLEAN_MARKER it greps). prompt_sm_prefix stays deequ-bot (private Secrets Manager namespace).
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| on: | ||
| workflow_run: | ||
| workflows: ["Java CI with Maven", "Deequ Bot"] | ||
| workflows: ["Java CI with Maven", "Shadow"] |
Contributor
There was a problem hiding this comment.
DESIGN: The PR description no longer matches the diff — it claims the workflow name and marker are preserved as Deequ Bot/deequ-bot:clean, but the diff renames both to Shadow/shadow:clean. Reviewers relying on the description will miss that this is now a rename PR (not a pure infra swap). Update the description to reflect that (a) workflow name changed to "Shadow", (b) marker changed to <!-- shadow:clean -->, and (c) auto-approve.yml did need changes.
PR body: "Marker unchanged." and "
auto-approve.ymlneeds no change". Incremental diff auto-approve.yml line 5:workflows: ["Java CI with Maven", "Shadow"]. Line 75:const CLEAN_MARKER = '<!-- shadow:clean -->';. .shadow.yml line 10:name: shadow.
Bumps the shared-engine SHA to v1.3 (adds bot.attribution) and sets the footer attribution so posted comments surface the Shadow product to the OSS community.
sudsali
changed the title
sudsali
marked this pull request as ready for review
July 2, 2026 15:29
This was referenced Jul 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the Deequ Bot from a vendored copy of the engine (
src/scripts/issue_bot/) to consuming the shared Shadow engine (sudsali/shadow) via its reusable workflow, SHA-pinned to0ff3d75(v1.3). Same behavior, one engine maintained upstream instead of a per-repo fork. Net diff removes ~8k lines of vendored code + tests.What Changes
issue-bot.ymlwith a thin caller ofsudsali/shadow/.github/workflows/shadow-review.yml(all four triggers preserved: issues, issue_comment, pull_request_target, workflow_dispatch).shadow.yml— engine config (Scala codebase,bot.name: shadow, attribution footer)src/scripts/issue_bot/) and its tests (src/scripts/tests/); keepsgenerate_kb.pydeequ-bottoshadowBehavior Preserved
deequ-bot/*), selected viaprompt_sm_prefix: deequ-bot; the engine fetches all eight (PR investigator/critic/reporter + 2 commit nudges + issue-classify/respond/followup) in place of its bundled defaults. No new secrets.<!-- shadow:clean -->;auto-approve.ymlupdated in lockstep (workflow name + marker)BOT_AGENT_PIPELINE=1was already the live path, so the dropped legacy file-review prompts were dead codeArchitecture
Security
substaysrepo:awslabs/deequ:*); an optionaljob_workflow_reftrust narrowing may be applied after merge (applying it before breaks the base-branch vendored bot)uses:andshadow_refboth pin the exact commit; a moved upstream tag can't change what runs@/#auto-link neutralized, marker-spoof-proof)Files
.github/workflows/issue-bot.yml.shadow.yml.github/workflows/auto-approve.ymldeequ-bot→shadow.github/workflows/update-kb.ymlpaths-ignorefor removed dirssrc/scripts/issue_bot/src/scripts/tests/Testing
All four surfaces exercised against the pinned engine (
v1.3) with real Bedrock and deequ's realdeequ-bot/*Secrets Manager prompts:workflow_dispatchdry_run: trueon GitHub Actions against PR Fix NPE: encode bin edges in BinnedFrequencies state instead of mutab… #722:analyze+actsucceed; all 8 prompts resolve fromsm:deequ-bot/*; 3-agent pipeline (Investigator → Critic → Reporter, Opus) produces inline findings; review pinned to the analyzed commit (commit_id)RESPONDon Haiku,issue-classify+issue-respondfromsm:deequ-bot/*, substantive answer,buglabel appliedissue_comment) — reply thread:followupprompt fromsm:deequ-bot/*, coherent response, escalates when knowledge base is insufficientRollback
Revert this PR — the vendored
src/scripts/issue_bot/returns and runs as before. No data or state migration; secrets and repo variables are untouched.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.