[jessegoodier]

What changed and why

Adds the kc-pr-agent composite action and the scaffolding for this public actions repository.

• kc-pr-agent action: runs the published PR-Agent image, pinned by tag and digest. Only an allowlist of the step env is forwarded into the container: the GitHub context, artifact and PR-Agent settings, model provider credentials, CA bundles and SECTION__KEY settings. The runner's OIDC request token is never forwarded. An empty input falls back to the matching variable in the step env, then to the built-in default.
• Docs: usage-focused READMEs and a sanitized example workflow. The root README explains that the actions are built for Kubecost's repositories and published for transparency. The MIT license intentionally matches upstream PR-Agent.
• Release workflow: tags each action separately. The version must be higher than the action's latest release, the version tag and floating major tag are pushed together in one atomic push, release notes start from the action's previous release, and only one release runs at a time.
• Tooling: CI (pre-commit and action validation), weekly image-pin update PRs, Dependabot, and pre-commit hooks including ruff check and ruff format.

Checklist

• just lint and just check pass
• Third-party actions are pinned to a commit SHA with a # vX.Y.Z comment; images to tag@sha256:digest
• No secrets, account IDs, role ARNs, internal hostnames or internal repository names (this repository is public)
• The action's README documents any new input, output, permission or behavior change

🤖 Generated with Claude Code