Report blocked gh-aw compiler versions during activation - #59747
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
✅ Ponytail Reviewer completed successfully! Cannot perform ponytail review: /tmp/gh-aw/agent/pr-diff.patch is empty (0 bytes), so there are no changed lines to review. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "github.com"See Network Configuration for more information.
|
|
✅ PR Code Quality Reviewer completed the code quality review. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "github.com"See Network Configuration for more information.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch PR file list
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.
|
There was a problem hiding this comment.
🟡 Changes recommended
Runtime reporting expressions are ignored, concurrent activations can create duplicate issues, and unrelated generated workflow drift is included.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds activation-stage issue reporting for blocked compiler versions, preventing silent repository-wide workflow outages.
Changes:
- Creates or updates blocked-version issues while preserving hard failure behavior.
- Wires reporting policy, workflow name, and conditional issue permissions.
- Adds tests and refactors activation helpers.
File summaries
| File | Description |
|---|---|
pkg/workflow/compiler_activation_steps.go |
Wires reporting and refactors skill steps. |
pkg/workflow/compiler_activation_steps_test.go |
Tests reporting configuration and permissions. |
pkg/workflow/compiler_activation_permissions.go |
Adds conditional issue permissions. |
actions/setup/js/check_version_updates.cjs |
Implements blocked-version issue reporting. |
actions/setup/js/check_version_updates.test.cjs |
Tests issue creation, updating, and failures. |
.github/workflows/windows.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/windows-grower.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/notion-issue-summary.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/hippo-embed.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/firewall.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/example-permissions-warning.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/daily-max-ai-credits-test.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/daily-harness-experiment-proposer.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/daily-credit-limit-test.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/codex-github-remote-mcp-test.lock.yml |
Adds generated gpt-6 aliases. |
.github/workflows/agentic-token-optimizer.lock.yml |
Modifies an upstream-managed generated workflow. |
Review details
- Files reviewed: 30/302 changed files
- Comments generated: 2
- Review effort level: Balanced
|
🏗️ ADR Required This PR required ADR enforcement because it adds more than 100 new lines in default business-logic directories ( Evidence used
I generated and committed a draft ADR at What the draft records
Next action
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "github.com"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Request changes
The activation-stage fallback is headed in the right direction, but the new notification path is still too fragile to trust during the exact repo-wide outage it is meant to surface.
Blocking theme
- The new blocked-version reporter relies on the Search API without retry or backoff, so concurrent activation failures can self-rate-limit the lookup and silently drop the only alert.
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
api.github.comgithub.com
[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:
tools:
github:
mode: gh-proxySee GitHub Tools for more information on gh-proxy mode.
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
allowed:
- defaults
- "api.github.com"
- "github.com"See Network Configuration for more information.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 72.1 AIC · ⌖ 5.59 AIC · ⊞ 22.9K
Comment /review to run again
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /codebase-design and /diagnosing-bugs (fallback triage heuristic — pr-triage agent not invoked directly by this reviewer session; classification based on file types: JS action script + Go compiler wiring + tests = feature/refactor mix). Requesting changes on one design-consistency gap; two additional suggestions for robustness/test coverage.
📋 Key Themes & Highlights
Key Themes
- Category-filter bypass: The new activation-stage blocked-version issue reuses
conclusionReportFailureAsIssueEnabled, which only understands the literalfalseopt-out, not the category-list filtering form (report-failure-as-issue: ["!some_category"]). Workflows that use category filtering to silence certain failure types still getissues: writeand a blocked-version issue created, which isn't obviously intended given the shared config knob. - Search-index race: Deduplication depends on
github.rest.search.issuesAndPullRequests, which is eventually consistent — concurrent activation runs could create duplicate issues. Acceptable for a best-effort path, but worth a comment/test acknowledging the limitation. - Missing negative-path test: The
typeof github === "undefined" ...guard inreportBlockedVersionIssuehas no direct test coverage.
Positive Highlights
- ✅ Clean refactor of
compiler_activation_steps.go's skill-install logic into focused helper functions (addActivationSkillUpgradeStep,addActivationSingleSkillInstallStep,resolveFrontmatterSkillToken) — improves readability without changing behavior. - ✅ Good test coverage for the create/update/disable/failure paths of the new blocked-version issue flow in
check_version_updates.test.cjs. - ✅ Failure reporting is correctly wired as best-effort (wrapped in try/catch, doesn't mask the primary
setFailedcall) — matches the PR's stated goal. - ✅ Permission wiring (
issues: writeonly granted whenactivationBlockedVersionIssueEnabled) keeps the principle of least privilege in mind.
@copilot please address the review comments above.
Warning
Firewall blocked 2 domains
The following domains were blocked by the firewall during workflow execution:
api.github.comgithub.com
[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:
tools:
github:
mode: gh-proxySee GitHub Tools for more information on gh-proxy mode.
To allow these domains, add them to the network.allowed list in your workflow frontmatter:
network:
allowed:
- defaults
- "api.github.com"
- "github.com"See Network Configuration for more information.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 167.3 AIC · ⌖ 15.3 AIC · ⊞ 10.4K
Comment /matt to run again
|
@copilot please address the outstanding review feedback and then run the Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
…ft, harden Search API usage Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
|
@copilot ensure that the 'on' front matter element has a field to turn off this behavior. Similar to turning off reporting missing secrets. |
…notification Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Added in 0487226: |
|
@copilot please address the remaining unresolved review feedback before running the Outstanding unresolved review threads:
Please also refresh the branch if needed and then run the
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
All four threads are already resolved with fixes in commit 2d79b05: Search API calls ( |
|
@copilot please address the remaining review feedback, refresh the branch if needed, and then run the Outstanding review feedback:
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
| const workflowName = process.env.GH_AW_WORKFLOW_NAME || (typeof context !== "undefined" ? context.workflow : "") || "unknown"; | ||
| const runUrl = getRunUrl(); | ||
| const lines = [ | ||
| `<!-- gh-aw-blocked-compiler-version: ${compiledVersion} -->`, |
There was a problem hiding this comment.
@copilot refactor text to template in actions/setup/md and use render file template to render.
There was a problem hiding this comment.
Done in 86f6d51: extracted the issue body into actions/setup/md/blocked_compiler_version_issue.md and refactored buildBlockedVersionIssueBody to call renderTemplateFromFile(getPromptPath(...), {...}), matching the pattern used in handle_agent_failure.cjs.
|
Category: bug | Risk: high | Score: 70/100 (impact 36/50, urgency 22/30, quality 12/20) | Action: fast_track | Reason: activation-path reliability fix with clear tests and broad operational value.
|
Both points are already addressed:
No further code changes needed for these items. |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Blocked compiler versions currently fail in
activation, before downstream failure reporting can run. That makes a repo-wide workflow outage easy to miss because the job that would normally open a failure issue is skipped.Activation-stage notification
check_version_updates.cjsbefore failing the blocked-version check.Compiler wiring
issues: writetoactivationonly when blocked-version issue reporting can run.Failure behavior