Add agentic workflow flock-action

[zircote]

Add agentic workflow flock-action

[github-actions]

Benchmark Results

No benchmarks configured. Add benchmarks to benches/ directory.

Full results available in CI artifacts.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.83%. Comparing base (0c1c941) to head (c39151b).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #37   +/-   ##
=======================================
  Coverage   95.83%   95.83%           
=======================================
  Files           9        9           
  Lines        6499     6499           
=======================================
  Hits         6228     6228           
  Misses        271      271           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Code Coverage Report

Overall Coverage: 0%

Summary

Filename                      Regions    Missed Regions     Cover   Functions  Missed Functions  Executed       Lines      Missed Lines     Cover    Branches   Missed Branches     Cover
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
client.rs                        1444                67    95.36%         118                13    88.98%         923                35    96.21%           0                 0         -
format.rs                        2172                 3    99.86%         132                 1    99.24%        1292                 1    99.92%           0                 0         -
main.rs                           326               241    26.07%          14                 8    42.86%         225               168    25.33%           0                 0         -
mcp/analytics.rs                  408                 2    99.51%          24                 0   100.00%         331                 0   100.00%           0                 0         -
mcp/mod.rs                        144                55    61.81%          23                15    34.78%         128                65    49.22%           0                 0         -
mcp/prompts.rs                   1908                33    98.27%         126                 6    95.24%        1043                12    98.85%           0                 0         -
mcp/resources.rs                 1317                20    98.48%          93                 1    98.92%         865                 6    99.31%           0                 0         -
mcp/tools.rs                     2146                90    95.81%         116                18    84.48%        1333                47    96.47%           0                 0         -
models.rs                        1079                31    97.13%          78                10    87.18%         762                14    98.16%           0                 0         -
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
TOTAL                           10944               542    95.05%         724                72    90.06%        6902               348    94.96%           0                 0         -

Full HTML report available in CI artifacts.

[Copilot]

Pull request overview

This PR adds a new agentic workflow called "Flock Action" that provides automated NSIP (National Sheep Improvement Program) flock analysis capabilities directly through GitHub Issues. The workflow leverages the nsip MCP server to process breeding analysis requests and generate comprehensive reports.

Changes:

• Adds flock-action.md source file defining workflow behavior and MCP tool integrations
• Adds flock-action.lock.yml generated lockfile implementing the workflow in GitHub Actions
• Integrates with the nsip MCP server via Docker to access 13 breeding analysis tools

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/flock-action.md	Source definition for the Flock Action workflow, specifying MCP server configuration, safe outputs, network policies, and agent instructions for processing six types of breeding analyses (mating recommendations, flock evaluation, animal comparisons, ranking, inbreeding matrices, and flock profiles)
.github/workflows/flock-action.lock.yml	Generated GitHub Actions workflow file (1236 lines) implementing the Flock Action agent with full CI/CD pipeline including activation controls, MCP gateway setup, safe outputs processing, threat detection, and pull request creation

[Copilot]

The workflow triggers on all opened issues (without label filtering) but relies on the agent prompt to check for the flock-action label. This means the workflow will execute and consume resources for every opened issue, even those not intended for flock analysis.

Consider adding a conditional at the GitHub Actions level to filter by label. For example, you could use if: contains(github.event.issue.labels.*.name, 'flock-action') in the activation job, or use a label-based trigger similar to other agentic workflows that use reaction: eyes or other activation mechanisms.

This will prevent unnecessary workflow runs and reduce CI resource consumption, especially on repositories with high issue activity.

[Copilot]

The nsip tool invokes docker run on the external image ghcr.io/zircote/nsip without pinning it to an immutable version tag or digest, meaning a mutated or compromised image could be pulled and executed in this automation context. Because this container runs automatically with access to repository contents and limited network egress (including nsip.org), an attacker controlling that image could exfiltrate data or influence generated reports/PRs. Pin this Docker image to a specific, trusted tag or digest and periodically review/update it to reduce the risk of a supply chain compromise.