Skip to content

Commit 89c371f

Browse files
lpcoxCopilotCopilot
authored
ci: disable threat detection in all workflows (#1892)
* ci: disable threat detection in all workflows Add threat-detection: enabled: false under safe-outputs in all 24 workflows that use safe-outputs. This removes the AI-powered threat detection phase that runs before each agent job. The lock files shrink by ~5K lines total as the compiled threat detection job and its setup are removed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: upgrade all workflows to gh-aw v0.68.1 Upgrade from v0.68.0 to v0.68.1 and recompile all lock files with post-processing applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update .github/workflows/agentics-maintenance.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 28db5ac commit 89c371f

54 files changed

Lines changed: 2190 additions & 6472 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/agents/agentic-workflows.agent.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Workflows may optionally include:
3030
- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
3131
- Workflow lock files: `.github/workflows/*.lock.yml`
3232
- Shared components: `.github/workflows/shared/*.md`
33-
- Configuration: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/github-agentic-workflows.md
33+
- Configuration: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/github-agentic-workflows.md
3434

3535
## Problems This Solves
3636

@@ -52,7 +52,7 @@ When you interact with this agent, it will:
5252
### Create New Workflow
5353
**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
5454

55-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/create-agentic-workflow.md
55+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/create-agentic-workflow.md
5656

5757
**Use cases**:
5858
- "Create a workflow that triages issues"
@@ -62,7 +62,7 @@ When you interact with this agent, it will:
6262
### Update Existing Workflow
6363
**Load when**: User wants to modify, improve, or refactor an existing workflow
6464

65-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/update-agentic-workflow.md
65+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/update-agentic-workflow.md
6666

6767
**Use cases**:
6868
- "Add web-fetch tool to the issue-classifier workflow"
@@ -72,7 +72,7 @@ When you interact with this agent, it will:
7272
### Debug Workflow
7373
**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
7474

75-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/debug-agentic-workflow.md
75+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/debug-agentic-workflow.md
7676

7777
**Use cases**:
7878
- "Why is this workflow failing?"
@@ -82,7 +82,7 @@ When you interact with this agent, it will:
8282
### Upgrade Agentic Workflows
8383
**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
8484

85-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/upgrade-agentic-workflows.md
85+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/upgrade-agentic-workflows.md
8686

8787
**Use cases**:
8888
- "Upgrade all workflows to the latest version"
@@ -92,7 +92,7 @@ When you interact with this agent, it will:
9292
### Create a Report-Generating Workflow
9393
**Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
9494

95-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/report.md
95+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/report.md
9696

9797
**Use cases**:
9898
- "Create a weekly CI health report"
@@ -102,7 +102,7 @@ When you interact with this agent, it will:
102102
### Create Shared Agentic Workflow
103103
**Load when**: User wants to create a reusable workflow component or wrap an MCP server
104104

105-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/create-shared-agentic-workflow.md
105+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/create-shared-agentic-workflow.md
106106

107107
**Use cases**:
108108
- "Create a shared component for Notion integration"
@@ -112,7 +112,7 @@ When you interact with this agent, it will:
112112
### Fix Dependabot PRs
113113
**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
114114

115-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/dependabot.md
115+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/dependabot.md
116116

117117
**Use cases**:
118118
- "Fix the open Dependabot PRs for npm dependencies"
@@ -122,7 +122,7 @@ When you interact with this agent, it will:
122122
### Analyze Test Coverage
123123
**Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
124124

125-
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/test-coverage.md
125+
**Prompt file**: https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/test-coverage.md
126126

127127
**Use cases**:
128128
- "Create a workflow that comments coverage on PRs"
@@ -169,10 +169,10 @@ gh aw compile --validate
169169

170170
## Important Notes
171171

172-
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/github-agentic-workflows.md for complete documentation
172+
- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/github-agentic-workflows.md for complete documentation
173173
- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
174174
- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
175175
- **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
176176
- Follow security best practices: minimal permissions, explicit network access, no template injection
177-
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See https://github.com/github/gh-aw/blob/v0.68.0/.github/aw/network.md for the full list of valid ecosystem identifiers and domain patterns.
177+
- **Network configuration**: Use ecosystem identifiers (`node`, `python`, `go`, etc.) or explicit FQDNs in `network.allowed`. Bare shorthands like `npm` or `pypi` are **not** valid. See https://github.com/github/gh-aw/blob/v0.68.1/.github/aw/network.md for the full list of valid ecosystem identifiers and domain patterns.
178178
- **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.

.github/aw/actions-lock.json

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@
1010
"version": "v8",
1111
"sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
1212
},
13+
"actions/github-script@v9": {
14+
"repo": "actions/github-script",
15+
"version": "v9",
16+
"sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
17+
},
1318
"actions/github-script@v9.0.0": {
1419
"repo": "actions/github-script",
1520
"version": "v9.0.0",
@@ -20,15 +25,15 @@
2025
"version": "v6.3.0",
2126
"sha": "53b83947a5a98c8d113130e565377fae1a50d02f"
2227
},
23-
"actions/upload-artifact@v7.0.0": {
28+
"actions/upload-artifact@v7.0.1": {
2429
"repo": "actions/upload-artifact",
25-
"version": "v7.0.0",
26-
"sha": "bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"
30+
"version": "v7.0.1",
31+
"sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
2732
},
28-
"docker/build-push-action@v7.0.0": {
33+
"docker/build-push-action@v7.1.0": {
2934
"repo": "docker/build-push-action",
30-
"version": "v7.0.0",
31-
"sha": "d08e5c354a6adb9ed34480a06d141179aa583294"
35+
"version": "v7.1.0",
36+
"sha": "bcafcacb16a39f128d818304e6c9c0c18556b85f"
3237
},
3338
"docker/login-action@v4.1.0": {
3439
"repo": "docker/login-action",
@@ -40,15 +45,20 @@
4045
"version": "v4.0.0",
4146
"sha": "4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd"
4247
},
43-
"github/gh-aw-actions/setup@v0.68.0": {
48+
"github/gh-aw-actions/setup-cli@v0.68.1": {
49+
"repo": "github/gh-aw-actions/setup-cli",
50+
"version": "v0.68.1",
51+
"sha": "2fe53acc038ba01c3bbdc767d4b25df31ca5bdfc"
52+
},
53+
"github/gh-aw-actions/setup@v0.68.1": {
4454
"repo": "github/gh-aw-actions/setup",
45-
"version": "v0.68.0",
46-
"sha": "0acfb4a691fe207cd8bc982ea5cb9d750d57a702"
55+
"version": "v0.68.1",
56+
"sha": "2fe53acc038ba01c3bbdc767d4b25df31ca5bdfc"
4757
},
48-
"github/gh-aw/actions/setup@v0.68.0": {
58+
"github/gh-aw/actions/setup@v0.68.1": {
4959
"repo": "github/gh-aw/actions/setup",
50-
"version": "v0.68.0",
51-
"sha": "f3d301231ec6de850c2b3320f3ba896ab1e8a8ff"
60+
"version": "v0.68.1",
61+
"sha": "5a06d310cf45161bde77d070065a1e1489fc411c"
5262
},
5363
"softprops/action-gh-release@v2.6.1": {
5464
"repo": "softprops/action-gh-release",

.github/workflows/agentics-maintenance.yml

Lines changed: 157 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
#
21
# ___ _ _
32
# / _ \ | | (_)
43
# | |_| | __ _ ___ _ __ | |_ _ ___
@@ -13,7 +12,7 @@
1312
# \ /\ / (_) | | | | ( | | | | (_) \ V V /\__ \
1413
# \/ \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
1514
#
16-
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.47.0). DO NOT EDIT.
15+
# This file was automatically generated by pkg/workflow/maintenance_workflow.go (v0.68.0). DO NOT EDIT.
1716
#
1817
# To regenerate this workflow, run:
1918
# gh aw compile
@@ -37,45 +36,193 @@ on:
3736
schedule:
3837
- cron: "37 */2 * * *" # Every 2 hours (based on minimum expires: 1 days)
3938
workflow_dispatch:
39+
inputs:
40+
operation:
41+
description: 'Optional maintenance operation to run'
42+
required: false
43+
type: string
44+
default: ''
45+
run_url:
46+
description: 'Run URL or run ID to replay safe outputs from (e.g. https://github.com/owner/repo/actions/runs/12345 or 12345). Required when operation is safe_outputs.'
47+
required: false
48+
type: string
49+
default: ''
4050

4151
permissions: {}
4252

4353
jobs:
4454
close-expired-entities:
55+
if: ${{ !github.event.repository.fork && (github.event_name != 'workflow_dispatch' || github.event.inputs.operation == '') }}
4556
runs-on: ubuntu-slim
4657
permissions:
4758
discussions: write
4859
issues: write
4960
pull-requests: write
5061
steps:
5162
- name: Setup Scripts
52-
uses: github/gh-aw/actions/setup@v0.47.0
63+
uses: github/gh-aw-actions/setup@0acfb4a691fe207cd8bc982ea5cb9d750d57a702 # v0.68.0
5364
with:
54-
destination: /opt/gh-aw/actions
65+
destination: ${{ runner.temp }}/gh-aw/actions
5566

5667
- name: Close expired discussions
5768
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
5869
with:
5970
script: |
60-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
71+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
6172
setupGlobals(core, github, context, exec, io);
62-
const { main } = require('/opt/gh-aw/actions/close_expired_discussions.cjs');
73+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
6374
await main();
6475
6576
- name: Close expired issues
6677
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
6778
with:
6879
script: |
69-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
80+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
7081
setupGlobals(core, github, context, exec, io);
71-
const { main } = require('/opt/gh-aw/actions/close_expired_issues.cjs');
82+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
7283
await main();
7384
7485
- name: Close expired pull requests
7586
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
7687
with:
7788
script: |
78-
const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
89+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
90+
setupGlobals(core, github, context, exec, io);
91+
const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
92+
await main();
93+
94+
run_operation:
95+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation != '' && github.event.inputs.operation != 'safe_outputs' && github.event.inputs.operation != 'create_labels' && !github.event.repository.fork }}
96+
runs-on: ubuntu-slim
97+
permissions:
98+
actions: write
99+
contents: write
100+
pull-requests: write
101+
steps:
102+
- name: Checkout repository
103+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
104+
with:
105+
persist-credentials: false
106+
107+
- name: Setup Scripts
108+
uses: github/gh-aw-actions/setup@0acfb4a691fe207cd8bc982ea5cb9d750d57a702 # v0.68.0
109+
with:
110+
destination: ${{ runner.temp }}/gh-aw/actions
111+
112+
- name: Check admin/maintainer permissions
113+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
114+
with:
115+
github-token: ${{ secrets.GITHUB_TOKEN }}
116+
script: |
117+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
118+
setupGlobals(core, github, context, exec, io);
119+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
120+
await main();
121+
122+
- name: Install gh-aw
123+
uses: github/gh-aw-actions/setup-cli@0acfb4a691fe207cd8bc982ea5cb9d750d57a702 # v0.68.0
124+
with:
125+
version: v0.68.0
126+
127+
- name: Run operation
128+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
129+
env:
130+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
131+
GH_AW_OPERATION: ${{ github.event.inputs.operation }}
132+
GH_AW_CMD_PREFIX: gh aw
133+
with:
134+
github-token: ${{ secrets.GITHUB_TOKEN }}
135+
script: |
136+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
137+
setupGlobals(core, github, context, exec, io);
138+
const { main } = require('${{ runner.temp }}/gh-aw/actions/run_operation_update_upgrade.cjs');
139+
await main();
140+
141+
apply_safe_outputs:
142+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation == 'safe_outputs' && !github.event.repository.fork }}
143+
runs-on: ubuntu-slim
144+
permissions:
145+
actions: read
146+
contents: write
147+
discussions: write
148+
issues: write
149+
pull-requests: write
150+
steps:
151+
- name: Checkout actions folder
152+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
153+
with:
154+
sparse-checkout: |
155+
actions
156+
persist-credentials: false
157+
158+
- name: Setup Scripts
159+
uses: github/gh-aw-actions/setup@0acfb4a691fe207cd8bc982ea5cb9d750d57a702 # v0.68.0
160+
with:
161+
destination: ${{ runner.temp }}/gh-aw/actions
162+
163+
- name: Check admin/maintainer permissions
164+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
165+
with:
166+
github-token: ${{ secrets.GITHUB_TOKEN }}
167+
script: |
168+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
169+
setupGlobals(core, github, context, exec, io);
170+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
171+
await main();
172+
173+
- name: Apply Safe Outputs
174+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
175+
env:
176+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
177+
GH_AW_RUN_URL: ${{ github.event.inputs.run_url }}
178+
with:
179+
github-token: ${{ secrets.GITHUB_TOKEN }}
180+
script: |
181+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
182+
setupGlobals(core, github, context, exec, io);
183+
const { main } = require('${{ runner.temp }}/gh-aw/actions/apply_safe_outputs_replay.cjs');
184+
await main();
185+
186+
create_labels:
187+
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.operation == 'create_labels' && !github.event.repository.fork }}
188+
runs-on: ubuntu-slim
189+
permissions:
190+
contents: read
191+
issues: write
192+
steps:
193+
- name: Checkout repository
194+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
195+
with:
196+
persist-credentials: false
197+
198+
- name: Setup Scripts
199+
uses: github/gh-aw-actions/setup@0acfb4a691fe207cd8bc982ea5cb9d750d57a702 # v0.68.0
200+
with:
201+
destination: ${{ runner.temp }}/gh-aw/actions
202+
203+
- name: Check admin/maintainer permissions
204+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
205+
with:
206+
github-token: ${{ secrets.GITHUB_TOKEN }}
207+
script: |
208+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
209+
setupGlobals(core, github, context, exec, io);
210+
const { main } = require('${{ runner.temp }}/gh-aw/actions/check_team_member.cjs');
211+
await main();
212+
213+
- name: Install gh-aw
214+
uses: github/gh-aw-actions/setup-cli@0acfb4a691fe207cd8bc982ea5cb9d750d57a702 # v0.68.0
215+
with:
216+
version: v0.68.0
217+
218+
- name: Create missing labels
219+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
220+
env:
221+
GH_AW_CMD_PREFIX: gh aw
222+
with:
223+
github-token: ${{ secrets.GITHUB_TOKEN }}
224+
script: |
225+
const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
79226
setupGlobals(core, github, context, exec, io);
80-
const { main } = require('/opt/gh-aw/actions/close_expired_pull_requests.cjs');
227+
const { main } = require('${{ runner.temp }}/gh-aw/actions/create_labels.cjs');
81228
await main();

0 commit comments

Comments
 (0)