feat: Add retro workflow for retrospective analysis - #74

Review Complete: Looks Good to Merge

I've reviewed this PR and it looks excellent. Here's what I checked:

✅ Correctness

• Workflow configuration: Valid gh-aw syntax, properly structured frontmatter
• Schedule: Every 6 hours at :17 past the hour (good - avoids the :00/:30 stampede)
• Permissions: Read-only (contents, actions, issues, pull-requests) - appropriate for analysis
• Safe-outputs: Correctly configured with max: 5 for create-issue, auto-labels with agent/retro
• Pre-fetch step: Well-written defensive bash with set -euo pipefail, portable date command
• Concurrency: Uses run_id (allows parallel runs) - intentional per comments, race condition on duplicate issues is benign

✅ Code Quality

• Clear documentation in both YAML comments and prompt
• Follows patterns from existing workflows (ci-triage.md, queue-triage.md)
• Good design decisions explained in comments (e.g., concurrency strategy, cron timing)
• Duplicate prevention built into the agent prompt
• Actionable prompt with clear constraints and success criteria

✅ Safety

• Read-only GitHub access via MCP tools
• Reasonable limits (5 issues per run, 20 minute timeout)
• Safe bash tools only (cat, head, tail, grep, wc, ls, jq, date, sort, uniq)
• No destructive operations

✅ Functionality

Correctly implements all requirements from issue #73:

• ✅ Analyzes repos where deployed (default: bootc-dev/bcvk, configurable)
• ✅ Identifies patterns (recurring failures, performance issues, flaky tests)
• ✅ Files improvement issues
• ✅ Prevents duplicates
• ✅ Scheduled every 6 hours

✅ Repository Conventions

• No Signed-off-by (correct per CLAUDE.md for AI-generated code)
• Lockfile auto-generated correctly with proper metadata
• Resolves #73
• Follows same structure as other standalone workflows

Notes

• Default target repo "bootc-dev/bcvk" is documented as "Adopter-specific" - intentional for this demo repo
• PR is currently in draft status - ready to mark as ready for review when you're comfortable

This is high-quality work that's ready to merge.

Review: retro.md workflow

I've reviewed the new retrospective analysis workflow. The overall design is solid and follows the established patterns from ci-triage.md and queue-triage.md. However, there's a critical portability bug that needs to be fixed.

Critical Issue: Hardcoded Repository Name

Location: .github/workflows/retro.md:95

The pre-fetch step hardcodes the repository name instead of using the dynamic github.repository context:

# Current (line 95):
REPOS="bootc-dev/gh-agentic-workflows"

Problem: This breaks the workflow if:

• The repository is forked
• The repository is renamed
• The workflow is copied to another deployment

Required Fix: Follow the same pattern as ci-triage.md and queue-triage.md:

1. Add REPO to the env block (after line 82):

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  INPUT_REPOS: ${{ github.event.inputs.target_repos }}
  LOOKBACK_DAYS: ${{ github.event.inputs.lookback_days || '7' }}
  REPO: ${{ github.repository }}

2. Change line 95 to use the env var:

# Default: analyze this repository's workflow runs.
REPOS="$REPO"

This follows the documented pattern from ci-triage.md (lines 167-170) where env vars are used instead of inlining ${{ github.* }} expressions in run blocks (due to a compiler bug that silently drops the rest of the env block).

What I Checked

✅ Structure: Follows the same pattern as existing workflows
✅ Concurrency: Correctly uses run_id to avoid the single-slot trap
✅ Permissions: Appropriate read-only permissions
✅ Safe-outputs: Correctly configured with create-issue, noop, and missing-data
✅ Pre-fetch logic: Well-designed with proper error handling and BSD/GNU date compatibility
✅ Prompt: Clear, well-structured, and follows repository patterns
✅ Cron schedule: Uses :17 to avoid load spikes (good)
✅ Bash allowlist: Reasonable tool selection for the task

Once the hardcoded repository name is fixed, this will be ready to merge.

Review Complete

The code implementation is solid and follows all repository conventions. However, the PR description contains stale information that needs correction before merge.

What I Checked

• ✅ Shell script length and error handling
• ✅ Workflow configuration and permissions
• ✅ Safe-outputs setup
• ✅ Follows existing workflow patterns (ci-triage.md, queue-triage.md)
• ✅ Agent prompt is clear and has proper constraints
• ✅ Commit messages are well-formatted

Required Fix

Update the PR description to accurately reflect that the workflow analyzes this repository by default, not bootc-dev/bcvk.

The "Multi-repo analysis" section currently says:

currently bootc-dev/bcvk, configurable via workflow_dispatch

But the code (retro.md:96) actually defaults to ${{ github.repository }} (this repo).

Suggested replacement:

Repository analysis: Analyzes workflow runs in this repository (bootc-dev/gh-agentic-workflows) by default, with support for analyzing other repositories via the target_repos workflow_dispatch input.

This matters because the PR description will become the squash commit message in main's history—it must accurately describe what the workflow does.

Reviewed the retro workflow addition. The implementation is solid:

• Pre-fetch script properly validates inputs and handles edge cases
• Agent prompt is clear with well-defined constraints
• Security controls are appropriate (read-only + safe-outputs)
• Integration is complete (CI, justfile, labels, docs)
• Correctly excluded from aw.yml for host-only deployment
• Follows established patterns from ci-triage and queue-triage

Ready to merge.