Bind Ops workflows to separate App identities

.github/workflows/action-pin-sweep.yml

@@ -39,18 +39,35 @@ on:
       - '.github/workflows/action-pin-sweep.yml'
 
 concurrency:
-  group: action-pin-sweep-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
 
 permissions:
   contents: read
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          EVENT_NAME: ${{ github.event_name }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          if [ "$EVENT_NAME" = 'pull_request' ]; then
+            exit 0
+          fi
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   self-test:
     # A detector nobody has seen fire is a detector nobody should trust. These
     # tests prove it fires on the exact reference that stranded openadapt-evals
     # 0.91.0 on PyPI, and stays quiet on an accepted backlog entry.
     name: Prove the detector fires and stays quiet
+    needs: reject-lifecycle-app
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
@@ -66,7 +83,11 @@ jobs:
 
   sweep:
     name: Sweep every repository we own for an unpinned action
-    if: github.event_name != 'pull_request'
+    needs: reject-lifecycle-app
+    if: >-
+      github.event_name != 'pull_request' &&
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/azure-cost-guard.yml

@@ -9,11 +9,27 @@ permissions:
   contents: read
 
 concurrency:
-  group: azure-cost-guard
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   report:
+    needs: reject-lifecycle-app
+    if: >-
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/db-backup-freshness.yml

@@ -13,11 +13,27 @@ permissions:
   contents: read
 
 concurrency:
-  group: production-db-backup-freshness
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   verify:
+    needs: reject-lifecycle-app
+    if: >-
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     environment: production-backup-monitor
@@ -110,8 +126,11 @@ jobs:
 
   record-alert:
     name: Keep one durable backup freshness alert
-    needs: verify
-    if: ${{ always() }}
+    needs: [reject-lifecycle-app, verify]
+    if: >-
+      always() &&
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/db-backup.yml

@@ -17,11 +17,27 @@ permissions:
   contents: read
 
 concurrency:
-  group: production-db-backup
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   dump:
+    needs: reject-lifecycle-app
+    if: >-
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     # The complete production database is plaintext until the local age step.
     # Route this job only to the workflow-restricted production backup group.
     # GitHub-hosted runners and the default self-hosted group are not permitted.
@@ -244,8 +260,11 @@ jobs:
 
   record-alert:
     name: Keep one durable backup alert
-    needs: dump
-    if: ${{ always() }}
+    needs: [reject-lifecycle-app, dump]
+    if: >-
+      always() &&
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/default-branch-sweep.yml

@@ -33,18 +33,35 @@ on:
       - '.github/workflows/default-branch-sweep.yml'
 
 concurrency:
-  group: default-branch-sweep-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
 
 permissions:
   contents: read
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          EVENT_NAME: ${{ github.event_name }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          if [ "$EVENT_NAME" = 'pull_request' ]; then
+            exit 0
+          fi
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   self-test:
     # A detector nobody has seen fire is a detector nobody should trust. The
     # offline classification tests also run in Docs CI; running them here keeps
     # a change to the detector self-contained.
     name: Prove the classifier fires and stays quiet
+    needs: reject-lifecycle-app
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
@@ -60,7 +77,11 @@ jobs:
 
   sweep:
     name: Sweep every default branch we own
-    if: github.event_name != 'pull_request'
+    needs: reject-lifecycle-app
+    if: >-
+      github.event_name != 'pull_request' &&
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/prod-health-alert.yml

@@ -31,11 +31,27 @@ permissions:
   contents: read
 
 concurrency:
-  group: prod-health
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   probe:
+    needs: reject-lifecycle-app
+    if: >-
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -88,8 +104,11 @@ jobs:
 
   record-alert:
     name: Keep one durable production health alert
-    needs: probe
-    if: ${{ always() }}
+    needs: [reject-lifecycle-app, probe]
+    if: >-
+      always() &&
+      github.actor != 'openadapt-lifecycle[bot]' &&
+      github.triggering_actor != 'openadapt-lifecycle[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/production-lifecycle-policy.yml

@@ -5,36 +5,36 @@ on:
     - cron: "37 8 * * *"
   workflow_dispatch:
   pull_request:
-    paths:
-      - ".github/workflows/production-lifecycle-policy.yml"
-      - "docs/production-lifecycle.json"
-      - "docs/reference/production-lifecycle.md"
-      - "docs/schemas/production-lifecycle-public.schema.json"
-      - "mkdocs.yml"
-      - "production-lifecycle-source.json"
-      - "scripts/render_production_lifecycle.py"
-      - "tests/test_production_lifecycle_policy.py"
   push:
     branches: [main]
-    paths:
-      - ".github/workflows/production-lifecycle-policy.yml"
-      - "docs/production-lifecycle.json"
-      - "docs/reference/production-lifecycle.md"
-      - "docs/schemas/production-lifecycle-public.schema.json"
-      - "mkdocs.yml"
-      - "production-lifecycle-source.json"
-      - "scripts/render_production_lifecycle.py"
-      - "tests/test_production_lifecycle_policy.py"
 
 permissions:
   contents: read
 
 concurrency:
-  group: production-lifecycle-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
+  reject-lifecycle-app:
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject the lifecycle App
+        env:
+          ACTOR: ${{ github.actor }}
+          EVENT_NAME: ${{ github.event_name }}
+          TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+        run: |
+          if [ "$EVENT_NAME" = 'pull_request' ] || [ "$EVENT_NAME" = 'push' ]; then
+            exit 0
+          fi
+          test "$ACTOR" != 'openadapt-lifecycle[bot]'
+          test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]'
+
   validate:
+    name: Validate Production lifecycle
+    needs: reject-lifecycle-app
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -51,10 +51,12 @@ jobs:
         run: python3 -m unittest tests.test_production_lifecycle_policy
 
   report-failure:
-    needs: validate
+    needs: [reject-lifecycle-app, validate]
     if: >-
       ${{ always() && needs.validate.result == 'failure' &&
-          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+          (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') &&
+          github.actor != 'openadapt-lifecycle[bot]' &&
+          github.triggering_actor != 'openadapt-lifecycle[bot]' }}
     runs-on: ubuntu-latest
     permissions:
       issues: write