perf: optimize firewall-issue-dispatcher token usage#1904
Conversation
- Switch toolsets from [default] to [issues] (~16 fewer MCP tools) - Use cli-proxy with GraphQL batch fetch instead of sequential MCP calls - Trim prompt: remove architecture details, streamline instructions - Add explicit batch-fetch-then-filter workflow to minimize agent turns Closes #1901 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
Optimizes the Firewall Issue Dispatcher agentic workflow prompt and GitHub tool configuration to reduce token usage by shrinking the MCP tool context and shifting issue discovery into a single batched fetch.
Changes:
- Restricts GitHub MCP toolset from
defaulttoissues. - Reworks the prompt to do a single batched GraphQL fetch (via
gh api graphql) and local filtering, instead of iterative MCP discovery. - Regenerates the compiled lock workflow to reflect the updated frontmatter/prompt.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/firewall-issue-dispatcher.md | Switches GitHub toolset and rewrites discovery instructions around a single GraphQL batch fetch + local filtering. |
| .github/workflows/firewall-issue-dispatcher.lock.yml | Recompiled lock file reflecting updated prompt/frontmatter hashes and embedded prompt blocks. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 2
| tools: | ||
| github: | ||
| toolsets: [default] | ||
| toolsets: [issues] | ||
| allowed-repos: ["github/gh-aw", "github/gh-aw-firewall"] | ||
| min-integrity: none | ||
| github-token: ${{ secrets.GH_AW_CROSS_REPO_PAT }} |
There was a problem hiding this comment.
The prompt now requires running gh api graphql, but this workflow does not enable a shell/gh execution tool (no tools: bash and no imported safe-input for gh). As-is, the agent likely cannot execute the batch fetch step. Enable a constrained bash tool (ideally allowlisted to gh api graphql only) or switch the batch fetch back to GitHub MCP tools.
| gh api graphql -f query=' | ||
| query { | ||
| repository(owner: "github", name: "gh-aw") { | ||
| issues(labels: ["awf"], states: [OPEN], first: 50) { | ||
| nodes { | ||
| number | ||
| title | ||
| body | ||
| url | ||
| labels(first: 10) { nodes { name } } | ||
| comments(first: 100) { | ||
| nodes { author { login } body } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
The GraphQL query fetches only first: 50 issues and comments(first: 100) with no pagination, so it will silently miss additional awf issues or comments (which can lead to skipped audits or duplicate tracking issues if the audit link is beyond the first 100 comments). Add cursor pagination (pageInfo/endCursor) and use gh api graphql --paginate (and/or explicitly document/enforce the limits).
|
Smoke Test Results ✅ GitHub MCP: #1894 perf: optimize secret-digger-claude token usage, #1892 ci: disable threat detection in all workflows Overall: PASS
|
🤖 Smoke Test Results
Overall: PASS PR: perf: optimize firewall-issue-dispatcher token usage by @lpcox (no assignees)
|
|
Smoke test (Codex) results:
|
Smoke Test: GitHub Actions Services Connectivity ✅All connectivity checks passed:
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Summary
Optimizes the firewall-issue-dispatcher workflow to reduce token usage and improve reliability.
Changes
[default]→[issues]— removes ~16 unused MCP tools from agent contextgh api graphqlcall fetches all issues + comments at once, replacing sequential MCPlist_issues+get_issue_commentscalls that consumed multiple agent turnsAGENTS.mdif needed), streamlined instructions from ~80 lines to ~50 linesExpected Impact
The workflow had a 75% failure rate with $12.81 wasted on failed runs (issue #1901). These changes reduce per-run token consumption and minimize the number of turns needed for the discovery phase, which is where most failures occurred.
Closes #1901