ci(detection-only): re-point detection job at standalone smoke sibling#589
Merged
Conversation
Mirror the smoke-copilot-standalone detection job body in detection-only.yml: install the released threat-detect binary via install_threat_detect_binary.sh, run `threat-detect --engine copilot --output detection_result.json` under AWF, and conclude from the structured detection_result.json via conclude_threat_detection.sh. This removes the dangling coupling to the deprecated *-container smoke siblings. The GH_AW_THREAT_DETECTION_VERSION override is preserved, and the activation/agent fixture-upload stubs are unchanged. Update the README detection-only note to describe the standalone mechanism. Closes #582 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Re-points the manual detection workflow to the supported standalone Copilot detection mechanism.
Changes:
- Installs and runs the released detector under AWF.
- Uses file-based detection conclusion handling.
- Updates the related README documentation.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/detection-only.yml |
Mirrors the standalone detection job flow. |
README.md |
Documents the updated workflow mechanism. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Medium
Retain the numeric guard for GH_AW_DEFAULT_DETECTION_MAX_AI_CREDITS so a free-form or malformed repository variable cannot produce invalid awf-config.json JSON and block the manual detection workflow. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: David Slater <12449447+davidslater@users.noreply.github.com>
…into ace/01KY35MNBK3V3CAK5MWGEZCYP8 # Conflicts: # .github/workflows/detection-only.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-points
.github/workflows/detection-only.ymlso its detection job body mirrors thesmoke-copilot-standalonedetection job instead of the removed*-containerCopilot smoke sibling, resolving the dangling coupling described in #582.Changes
.github/workflows/detection-only.yml— thedetectionjob now follows the standalone mechanism:threat-detectbinary viainstall_threat_detect_binary.sh(honoringGH_AW_THREAT_DETECTION_VERSION, defaulting to the pinnedv0.2.2).threat-detect --engine copilot --output detection_result.json /tmp/gh-aw/threat-detectionunder AWF (v0.27.37images, api-proxy token steering,COPILOT_GITHUB_TOKEN: ${{ github.token }}+copilot-requests: write).detection_result.jsonviaconclude_threat_detection.sh(replacing the oldthreat-detect concludesubcommand path).v0.82.14; workflow-name/ref env aligned tosmoke-copilot-standalone.README.md— the detection-only note now describes the standalone mechanism (install released binary → run under AWF → file-basedconclude).Preserved
workflow_dispatchtrigger and theactivation/agentstub jobs are unchanged; theagentjob still stages and uploadstestdata/detection-only/<fixture>/(prompt,agent_output.json,aw-*.patch) as theagentartifact.GH_AW_THREAT_DETECTION_VERSIONoverride for detection-only is retained.Validation
actionlintpasses except for thecopilot-requestspermission scope, which is a valid newer GitHub Actions scope used identically bysmoke-copilot-standalone.lock.yml; actionlint's bundled scope list is simply outdated.Closes #582