From b57c1ef49029612fad48ffa6a6cf644597663002 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Nov 2025 16:43:26 +0000 Subject: [PATCH 1/7] Initial plan From 076a22b1b7683b9f0bbfbdc12035e4c71da0fd40 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Nov 2025 16:49:18 +0000 Subject: [PATCH 2/7] Initial exploration - understanding smoke test workflows Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/glossary-maintainer.lock.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml index 5cfcc987454..be90b9c0717 100644 --- a/.github/workflows/glossary-maintainer.lock.yml +++ b/.github/workflows/glossary-maintainer.lock.yml @@ -75,6 +75,9 @@ jobs: runs-on: ubuntu-slim permissions: contents: read + outputs: + comment_id: ${{ '' }} + comment_repo: ${{ '' }} steps: - name: Check workflow file timestamps uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 From e9fdd451624226c93235da0d3311190697ce7d82 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Nov 2025 16:55:30 +0000 Subject: [PATCH 3/7] Update smoke test workflows to use add-comment instead of create-issue - Changed smoke-claude.md, smoke-codex.md, and smoke-copilot.md - Replaced create-issue with add-comment in safe-outputs - Updated workflow prompts to add comments to PRs instead of creating issues - Kept staged mode enabled for all workflows - Compiled all workflows successfully Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-claude.lock.yml | 788 ++++++++++++----------- .github/workflows/smoke-claude.md | 4 +- .github/workflows/smoke-codex.lock.yml | 788 ++++++++++++----------- .github/workflows/smoke-codex.md | 4 +- .github/workflows/smoke-copilot.lock.yml | 788 ++++++++++++----------- .github/workflows/smoke-copilot.md | 4 +- 6 files changed, 1272 insertions(+), 1104 deletions(-) diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 32ae4207b4c..c43d530f31c 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -13,20 +13,20 @@ # ```mermaid # graph LR # activation["activation"] +# add_comment["add_comment"] # agent["agent"] # conclusion["conclusion"] -# create_issue["create_issue"] # detection["detection"] # missing_tool["missing_tool"] # pre_activation["pre_activation"] # pre_activation --> activation +# agent --> add_comment +# detection --> add_comment # activation --> agent # agent --> conclusion # activation --> conclusion -# create_issue --> conclusion +# add_comment --> conclusion # missing_tool --> conclusion -# agent --> create_issue -# detection --> create_issue # agent --> detection # agent --> missing_tool # detection --> missing_tool @@ -167,6 +167,416 @@ jobs: core.setFailed(error instanceof Error ? error.message : String(error)); }); + add_comment: + needs: + - agent + - detection + if: > + ((((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'add_comment'))) && + (((github.event.issue.number) || (github.event.pull_request.number)) || (github.event.discussion.number))) && + (needs.detection.outputs.success == 'true') + runs-on: ubuntu-slim + permissions: + contents: read + discussions: write + issues: write + pull-requests: write + timeout-minutes: 10 + outputs: + comment_id: ${{ steps.add_comment.outputs.comment_id }} + comment_url: ${{ steps.add_comment.outputs.comment_url }} + steps: + - name: Debug agent outputs + env: + AGENT_OUTPUT: ${{ needs.agent.outputs.output }} + AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }} + run: | + echo "Output: $AGENT_OUTPUT" + echo "Output types: $AGENT_OUTPUT_TYPES" + - name: Download agent output artifact + continue-on-error: true + uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6 + with: + name: agent_output.json + path: /tmp/gh-aw/safeoutputs/ + - name: Setup agent output environment variable + run: | + mkdir -p /tmp/gh-aw/safeoutputs/ + find "/tmp/gh-aw/safeoutputs/" -type f -print + echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" + - name: Add Issue Comment + id: add_comment + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 + env: + GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} + GH_AW_WORKFLOW_NAME: "Smoke Claude" + GH_AW_SAFE_OUTPUTS_STAGED: "true" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const fs = require("fs"); + function loadAgentOutput() { + const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT; + if (!agentOutputFile) { + core.info("No GH_AW_AGENT_OUTPUT environment variable found"); + return { success: false }; + } + let outputContent; + try { + outputContent = fs.readFileSync(agentOutputFile, "utf8"); + } catch (error) { + const errorMessage = `Error reading agent output file: ${error instanceof Error ? error.message : String(error)}`; + core.error(errorMessage); + return { success: false, error: errorMessage }; + } + if (outputContent.trim() === "") { + core.info("Agent output content is empty"); + return { success: false }; + } + core.info(`Agent output content length: ${outputContent.length}`); + let validatedOutput; + try { + validatedOutput = JSON.parse(outputContent); + } catch (error) { + const errorMessage = `Error parsing agent output JSON: ${error instanceof Error ? error.message : String(error)}`; + core.error(errorMessage); + return { success: false, error: errorMessage }; + } + if (!validatedOutput.items || !Array.isArray(validatedOutput.items)) { + core.info("No valid items found in agent output"); + return { success: false }; + } + return { success: true, items: validatedOutput.items }; + } + function generateFooter( + workflowName, + runUrl, + workflowSource, + workflowSourceURL, + triggeringIssueNumber, + triggeringPRNumber, + triggeringDiscussionNumber + ) { + let footer = `\n\n> AI generated by [${workflowName}](${runUrl})`; + if (triggeringIssueNumber) { + footer += ` for #${triggeringIssueNumber}`; + } else if (triggeringPRNumber) { + footer += ` for #${triggeringPRNumber}`; + } else if (triggeringDiscussionNumber) { + footer += ` for discussion #${triggeringDiscussionNumber}`; + } + if (workflowSource && workflowSourceURL) { + footer += `\n>\n> To add this workflow in your repository, run \`gh aw add ${workflowSource}\`. See [usage guide](https://githubnext.github.io/gh-aw/tools/cli/).`; + } + footer += "\n"; + return footer; + } + function getCampaign(format) { + const campaign = process.env.GH_AW_CAMPAIGN || ""; + if (campaign) { + core.info(`Campaign: ${campaign}`); + return format === "markdown" ? `\n\n` : campaign; + } + return ""; + } + function getRepositoryUrl() { + const targetRepoSlug = process.env.GH_AW_TARGET_REPO_SLUG; + if (targetRepoSlug) { + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + return `${githubServer}/${targetRepoSlug}`; + } else if (context.payload.repository?.html_url) { + return context.payload.repository.html_url; + } else { + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + return `${githubServer}/${context.repo.owner}/${context.repo.repo}`; + } + } + async function commentOnDiscussion(github, owner, repo, discussionNumber, message, replyToId) { + const { repository } = await github.graphql( + ` + query($owner: String!, $repo: String!, $num: Int!) { + repository(owner: $owner, name: $repo) { + discussion(number: $num) { + id + url + } + } + }`, + { owner, repo, num: discussionNumber } + ); + if (!repository || !repository.discussion) { + throw new Error(`Discussion #${discussionNumber} not found in ${owner}/${repo}`); + } + const discussionId = repository.discussion.id; + const discussionUrl = repository.discussion.url; + let result; + if (replyToId) { + result = await github.graphql( + ` + mutation($dId: ID!, $body: String!, $replyToId: ID!) { + addDiscussionComment(input: { discussionId: $dId, body: $body, replyToId: $replyToId }) { + comment { + id + body + createdAt + url + } + } + }`, + { dId: discussionId, body: message, replyToId } + ); + } else { + result = await github.graphql( + ` + mutation($dId: ID!, $body: String!) { + addDiscussionComment(input: { discussionId: $dId, body: $body }) { + comment { + id + body + createdAt + url + } + } + }`, + { dId: discussionId, body: message } + ); + } + const comment = result.addDiscussionComment.comment; + return { + id: comment.id, + html_url: comment.url, + discussion_url: discussionUrl, + }; + } + async function main() { + const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true"; + const isDiscussionExplicit = process.env.GITHUB_AW_COMMENT_DISCUSSION === "true"; + const result = loadAgentOutput(); + if (!result.success) { + return; + } + const commentItems = result.items.filter( item => item.type === "add_comment"); + if (commentItems.length === 0) { + core.info("No add-comment items found in agent output"); + return; + } + core.info(`Found ${commentItems.length} add-comment item(s)`); + function getTargetNumber(item) { + return item.item_number; + } + const commentTarget = process.env.GH_AW_COMMENT_TARGET || "triggering"; + core.info(`Comment target configuration: ${commentTarget}`); + const isIssueContext = context.eventName === "issues" || context.eventName === "issue_comment"; + const isPRContext = + context.eventName === "pull_request" || + context.eventName === "pull_request_review" || + context.eventName === "pull_request_review_comment"; + const isDiscussionContext = context.eventName === "discussion" || context.eventName === "discussion_comment"; + const isDiscussion = isDiscussionContext || isDiscussionExplicit; + if (isStaged) { + let summaryContent = "## 🎭 Staged Mode: Add Comments Preview\n\n"; + summaryContent += "The following comments would be added if staged mode was disabled:\n\n"; + const createdIssueUrl = process.env.GH_AW_CREATED_ISSUE_URL; + const createdIssueNumber = process.env.GH_AW_CREATED_ISSUE_NUMBER; + const createdDiscussionUrl = process.env.GH_AW_CREATED_DISCUSSION_URL; + const createdDiscussionNumber = process.env.GH_AW_CREATED_DISCUSSION_NUMBER; + const createdPullRequestUrl = process.env.GH_AW_CREATED_PULL_REQUEST_URL; + const createdPullRequestNumber = process.env.GH_AW_CREATED_PULL_REQUEST_NUMBER; + if (createdIssueUrl || createdDiscussionUrl || createdPullRequestUrl) { + summaryContent += "#### Related Items\n\n"; + if (createdIssueUrl && createdIssueNumber) { + summaryContent += `- Issue: [#${createdIssueNumber}](${createdIssueUrl})\n`; + } + if (createdDiscussionUrl && createdDiscussionNumber) { + summaryContent += `- Discussion: [#${createdDiscussionNumber}](${createdDiscussionUrl})\n`; + } + if (createdPullRequestUrl && createdPullRequestNumber) { + summaryContent += `- Pull Request: [#${createdPullRequestNumber}](${createdPullRequestUrl})\n`; + } + summaryContent += "\n"; + } + for (let i = 0; i < commentItems.length; i++) { + const item = commentItems[i]; + summaryContent += `### Comment ${i + 1}\n`; + const targetNumber = getTargetNumber(item); + if (targetNumber) { + const repoUrl = getRepositoryUrl(); + if (isDiscussion) { + const discussionUrl = `${repoUrl}/discussions/${targetNumber}`; + summaryContent += `**Target Discussion:** [#${targetNumber}](${discussionUrl})\n\n`; + } else { + const issueUrl = `${repoUrl}/issues/${targetNumber}`; + summaryContent += `**Target Issue:** [#${targetNumber}](${issueUrl})\n\n`; + } + } else { + if (isDiscussion) { + summaryContent += `**Target:** Current discussion\n\n`; + } else { + summaryContent += `**Target:** Current issue/PR\n\n`; + } + } + summaryContent += `**Body:**\n${item.body || "No content provided"}\n\n`; + summaryContent += "---\n\n"; + } + await core.summary.addRaw(summaryContent).write(); + core.info("📝 Comment creation preview written to step summary"); + return; + } + if (commentTarget === "triggering" && !isIssueContext && !isPRContext && !isDiscussionContext) { + core.info('Target is "triggering" but not running in issue, pull request, or discussion context, skipping comment creation'); + return; + } + const triggeringIssueNumber = + context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined; + const triggeringPRNumber = + context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined); + const triggeringDiscussionNumber = context.payload?.discussion?.number; + const createdComments = []; + for (let i = 0; i < commentItems.length; i++) { + const commentItem = commentItems[i]; + core.info(`Processing add-comment item ${i + 1}/${commentItems.length}: bodyLength=${commentItem.body.length}`); + let itemNumber; + let commentEndpoint; + if (commentTarget === "*") { + const targetNumber = getTargetNumber(commentItem); + if (targetNumber) { + itemNumber = parseInt(targetNumber, 10); + if (isNaN(itemNumber) || itemNumber <= 0) { + core.info(`Invalid target number specified: ${targetNumber}`); + continue; + } + commentEndpoint = isDiscussion ? "discussions" : "issues"; + } else { + core.info(`Target is "*" but no number specified in comment item`); + continue; + } + } else if (commentTarget && commentTarget !== "triggering") { + itemNumber = parseInt(commentTarget, 10); + if (isNaN(itemNumber) || itemNumber <= 0) { + core.info(`Invalid target number in target configuration: ${commentTarget}`); + continue; + } + commentEndpoint = isDiscussion ? "discussions" : "issues"; + } else { + if (isIssueContext) { + itemNumber = context.payload.issue?.number || context.payload.pull_request?.number || context.payload.discussion?.number; + if (context.payload.issue) { + commentEndpoint = "issues"; + } else { + core.info("Issue context detected but no issue found in payload"); + continue; + } + } else if (isPRContext) { + itemNumber = context.payload.pull_request?.number || context.payload.issue?.number || context.payload.discussion?.number; + if (context.payload.pull_request) { + commentEndpoint = "issues"; + } else { + core.info("Pull request context detected but no pull request found in payload"); + continue; + } + } else if (isDiscussionContext) { + itemNumber = context.payload.discussion?.number || context.payload.issue?.number || context.payload.pull_request?.number; + if (context.payload.discussion) { + commentEndpoint = "discussions"; + } else { + core.info("Discussion context detected but no discussion found in payload"); + continue; + } + } + } + if (!itemNumber) { + core.info("Could not determine issue, pull request, or discussion number"); + continue; + } + let body = commentItem.body.trim(); + const createdIssueUrl = process.env.GH_AW_CREATED_ISSUE_URL; + const createdIssueNumber = process.env.GH_AW_CREATED_ISSUE_NUMBER; + const createdDiscussionUrl = process.env.GH_AW_CREATED_DISCUSSION_URL; + const createdDiscussionNumber = process.env.GH_AW_CREATED_DISCUSSION_NUMBER; + const createdPullRequestUrl = process.env.GH_AW_CREATED_PULL_REQUEST_URL; + const createdPullRequestNumber = process.env.GH_AW_CREATED_PULL_REQUEST_NUMBER; + let hasReferences = false; + let referencesSection = "\n\n#### Related Items\n\n"; + if (createdIssueUrl && createdIssueNumber) { + referencesSection += `- Issue: [#${createdIssueNumber}](${createdIssueUrl})\n`; + hasReferences = true; + } + if (createdDiscussionUrl && createdDiscussionNumber) { + referencesSection += `- Discussion: [#${createdDiscussionNumber}](${createdDiscussionUrl})\n`; + hasReferences = true; + } + if (createdPullRequestUrl && createdPullRequestNumber) { + referencesSection += `- Pull Request: [#${createdPullRequestNumber}](${createdPullRequestUrl})\n`; + hasReferences = true; + } + if (hasReferences) { + body += referencesSection; + } + const workflowName = process.env.GH_AW_WORKFLOW_NAME || "Workflow"; + const workflowSource = process.env.GH_AW_WORKFLOW_SOURCE || ""; + const workflowSourceURL = process.env.GH_AW_WORKFLOW_SOURCE_URL || ""; + const runId = context.runId; + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + const runUrl = context.payload.repository + ? `${context.payload.repository.html_url}/actions/runs/${runId}` + : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`; + body += getCampaign("markdown"); + body += generateFooter( + workflowName, + runUrl, + workflowSource, + workflowSourceURL, + triggeringIssueNumber, + triggeringPRNumber, + triggeringDiscussionNumber + ); + try { + let comment; + if (commentEndpoint === "discussions") { + core.info(`Creating comment on discussion #${itemNumber}`); + core.info(`Comment content length: ${body.length}`); + let replyToId; + if (context.eventName === "discussion_comment" && context.payload?.comment?.node_id) { + replyToId = context.payload.comment.node_id; + core.info(`Creating threaded reply to comment ${replyToId}`); + } + comment = await commentOnDiscussion(github, context.repo.owner, context.repo.repo, itemNumber, body, replyToId); + core.info("Created discussion comment #" + comment.id + ": " + comment.html_url); + comment.discussion_url = comment.discussion_url; + } else { + core.info(`Creating comment on ${commentEndpoint} #${itemNumber}`); + core.info(`Comment content length: ${body.length}`); + const { data: restComment } = await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: itemNumber, + body: body, + }); + comment = restComment; + core.info("Created comment #" + comment.id + ": " + comment.html_url); + } + createdComments.push(comment); + if (i === commentItems.length - 1) { + core.setOutput("comment_id", comment.id); + core.setOutput("comment_url", comment.html_url); + } + } catch (error) { + core.error(`✗ Failed to create comment: ${error instanceof Error ? error.message : String(error)}`); + throw error; + } + } + if (createdComments.length > 0) { + let summaryContent = "\n\n## GitHub Comments\n"; + for (const comment of createdComments) { + summaryContent += `- Comment #${comment.id}: [View Comment](${comment.html_url})\n`; + } + await core.summary.addRaw(summaryContent).write(); + } + core.info(`Successfully created ${createdComments.length} comment(s)`); + return createdComments; + } + await main(); + agent: needs: activation runs-on: ubuntu-latest @@ -377,10 +787,10 @@ jobs: run: | mkdir -p /tmp/gh-aw/safeoutputs cat > /tmp/gh-aw/safeoutputs/config.json << 'EOF' - {"create_issue":{"max":1},"missing_tool":{},"noop":{"max":1}} + {"add_comment":{"max":1},"missing_tool":{},"noop":{"max":1}} EOF cat > /tmp/gh-aw/safeoutputs/tools.json << 'EOF' - [{"description":"Create a new GitHub issue","inputSchema":{"additionalProperties":false,"properties":{"body":{"description":"Issue body/description","type":"string"},"labels":{"description":"Issue labels","items":{"type":"string"},"type":"array"},"parent":{"description":"Parent issue number to create this issue as a sub-issue of","type":"number"},"title":{"description":"Issue title","type":"string"}},"required":["title","body"],"type":"object"},"name":"create_issue"},{"description":"Report a missing tool or functionality needed to complete tasks","inputSchema":{"additionalProperties":false,"properties":{"alternatives":{"description":"Possible alternatives or workarounds (max 256 characters)","type":"string"},"reason":{"description":"Why this tool is needed (max 256 characters)","type":"string"},"tool":{"description":"Name of the missing tool (max 128 characters)","type":"string"}},"required":["tool","reason"],"type":"object"},"name":"missing_tool"},{"description":"Log a message for transparency when no significant actions are needed. Use this to ensure workflows produce human-visible artifacts even when no other actions are taken (e.g., 'Analysis complete - no issues found').","inputSchema":{"additionalProperties":false,"properties":{"message":{"description":"Message to log for transparency","type":"string"}},"required":["message"],"type":"object"},"name":"noop"}] + [{"description":"Add a comment to a GitHub issue, pull request, or discussion","inputSchema":{"additionalProperties":false,"properties":{"body":{"description":"Comment body/content","type":"string"},"item_number":{"description":"Issue, pull request or discussion number","type":"number"}},"required":["body","item_number"],"type":"object"},"name":"add_comment"},{"description":"Report a missing tool or functionality needed to complete tasks","inputSchema":{"additionalProperties":false,"properties":{"alternatives":{"description":"Possible alternatives or workarounds (max 256 characters)","type":"string"},"reason":{"description":"Why this tool is needed (max 256 characters)","type":"string"},"tool":{"description":"Name of the missing tool (max 128 characters)","type":"string"}},"required":["tool","reason"],"type":"object"},"name":"missing_tool"},{"description":"Log a message for transparency when no significant actions are needed. Use this to ensure workflows produce human-visible artifacts even when no other actions are taken (e.g., 'Analysis complete - no issues found').","inputSchema":{"additionalProperties":false,"properties":{"message":{"description":"Message to log for transparency","type":"string"}},"required":["message"],"type":"object"},"name":"noop"}] EOF cat > /tmp/gh-aw/safeoutputs/mcp-server.cjs << 'EOF' const fs = require("fs"); @@ -1104,7 +1514,7 @@ jobs: This proactive approach eliminates retry loops and reduces token consumption. - Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and post summary in an issue. + Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and add a comment to the current pull request with a summary. PROMPT_EOF - name: Append XPIA security instructions to prompt @@ -1163,13 +1573,13 @@ jobs: --- - ## Creating an Issue, Reporting Missing Tools or Functionality + ## Adding a Comment to an Issue or Pull Request, Reporting Missing Tools or Functionality **IMPORTANT**: To do the actions mentioned in the header of this section, use the **safeoutputs** tools, do NOT attempt to use `gh`, do NOT attempt to use the GitHub API. You don't have write access to the GitHub repo. - **Creating an Issue** + **Adding a Comment to an Issue or Pull Request** - To create an issue, use the create-issue tool from safeoutputs + To add a comment to an issue or pull request, use the add-comments tool from safeoutputs **Reporting Missing Tools or Functionality** @@ -3204,9 +3614,9 @@ jobs: needs: - agent - activation - - create_issue + - add_comment - missing_tool - if: (always()) && (needs.agent.result != 'skipped') + if: ((always()) && (needs.agent.result != 'skipped')) && (!(needs.add_comment.outputs.comment_id)) runs-on: ubuntu-slim permissions: contents: read @@ -3483,360 +3893,6 @@ jobs: core.setFailed(error instanceof Error ? error.message : String(error)); }); - create_issue: - needs: - - agent - - detection - if: > - (((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_issue'))) && - (needs.detection.outputs.success == 'true') - runs-on: ubuntu-slim - permissions: - contents: read - issues: write - timeout-minutes: 10 - outputs: - issue_number: ${{ steps.create_issue.outputs.issue_number }} - issue_url: ${{ steps.create_issue.outputs.issue_url }} - steps: - - name: Download agent output artifact - continue-on-error: true - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6 - with: - name: agent_output.json - path: /tmp/gh-aw/safeoutputs/ - - name: Setup agent output environment variable - run: | - mkdir -p /tmp/gh-aw/safeoutputs/ - find "/tmp/gh-aw/safeoutputs/" -type f -print - echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Create Output Issue - id: create_issue - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 - env: - GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} - GH_AW_WORKFLOW_NAME: "Smoke Claude" - GH_AW_SAFE_OUTPUTS_STAGED: "true" - with: - github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - script: | - function sanitizeLabelContent(content) { - if (!content || typeof content !== "string") { - return ""; - } - let sanitized = content.trim(); - sanitized = sanitized.replace(/\x1b\[[0-9;]*[mGKH]/g, ""); - sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, ""); - sanitized = sanitized.replace( - /(^|[^\w`])@([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\/[A-Za-z0-9._-]+)?)/g, - (_m, p1, p2) => `${p1}\`@${p2}\`` - ); - sanitized = sanitized.replace(/[<>&'"]/g, ""); - return sanitized.trim(); - } - const fs = require("fs"); - function loadAgentOutput() { - const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT; - if (!agentOutputFile) { - core.info("No GH_AW_AGENT_OUTPUT environment variable found"); - return { success: false }; - } - let outputContent; - try { - outputContent = fs.readFileSync(agentOutputFile, "utf8"); - } catch (error) { - const errorMessage = `Error reading agent output file: ${error instanceof Error ? error.message : String(error)}`; - core.error(errorMessage); - return { success: false, error: errorMessage }; - } - if (outputContent.trim() === "") { - core.info("Agent output content is empty"); - return { success: false }; - } - core.info(`Agent output content length: ${outputContent.length}`); - let validatedOutput; - try { - validatedOutput = JSON.parse(outputContent); - } catch (error) { - const errorMessage = `Error parsing agent output JSON: ${error instanceof Error ? error.message : String(error)}`; - core.error(errorMessage); - return { success: false, error: errorMessage }; - } - if (!validatedOutput.items || !Array.isArray(validatedOutput.items)) { - core.info("No valid items found in agent output"); - return { success: false }; - } - return { success: true, items: validatedOutput.items }; - } - async function generateStagedPreview(options) { - const { title, description, items, renderItem } = options; - let summaryContent = `## 🎭 Staged Mode: ${title} Preview\n\n`; - summaryContent += `${description}\n\n`; - for (let i = 0; i < items.length; i++) { - const item = items[i]; - summaryContent += renderItem(item, i); - summaryContent += "---\n\n"; - } - try { - await core.summary.addRaw(summaryContent).write(); - core.info(summaryContent); - core.info(`📝 ${title} preview written to step summary`); - } catch (error) { - core.setFailed(error instanceof Error ? error : String(error)); - } - } - function generateFooter( - workflowName, - runUrl, - workflowSource, - workflowSourceURL, - triggeringIssueNumber, - triggeringPRNumber, - triggeringDiscussionNumber - ) { - let footer = `\n\n> AI generated by [${workflowName}](${runUrl})`; - if (triggeringIssueNumber) { - footer += ` for #${triggeringIssueNumber}`; - } else if (triggeringPRNumber) { - footer += ` for #${triggeringPRNumber}`; - } else if (triggeringDiscussionNumber) { - footer += ` for discussion #${triggeringDiscussionNumber}`; - } - if (workflowSource && workflowSourceURL) { - footer += `\n>\n> To add this workflow in your repository, run \`gh aw add ${workflowSource}\`. See [usage guide](https://githubnext.github.io/gh-aw/tools/cli/).`; - } - footer += "\n"; - return footer; - } - function getCampaign(format) { - const campaign = process.env.GH_AW_CAMPAIGN || ""; - if (campaign) { - core.info(`Campaign: ${campaign}`); - return format === "markdown" ? `\n\n` : campaign; - } - return ""; - } - async function main() { - core.setOutput("issue_number", ""); - core.setOutput("issue_url", ""); - const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true"; - const result = loadAgentOutput(); - if (!result.success) { - return; - } - const createIssueItems = result.items.filter(item => item.type === "create_issue"); - if (createIssueItems.length === 0) { - core.info("No create-issue items found in agent output"); - return; - } - core.info(`Found ${createIssueItems.length} create-issue item(s)`); - if (isStaged) { - await generateStagedPreview({ - title: "Create Issues", - description: "The following issues would be created if staged mode was disabled:", - items: createIssueItems, - renderItem: (item, index) => { - let content = `### Issue ${index + 1}\n`; - content += `**Title:** ${item.title || "No title provided"}\n\n`; - if (item.body) { - content += `**Body:**\n${item.body}\n\n`; - } - if (item.labels && item.labels.length > 0) { - content += `**Labels:** ${item.labels.join(", ")}\n\n`; - } - return content; - }, - }); - return; - } - const parentIssueNumber = context.payload?.issue?.number; - const triggeringIssueNumber = - context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined; - const triggeringPRNumber = - context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined); - const triggeringDiscussionNumber = context.payload?.discussion?.number; - const labelsEnv = process.env.GH_AW_ISSUE_LABELS; - let envLabels = labelsEnv - ? labelsEnv - .split(",") - .map(label => label.trim()) - .filter(label => label) - : []; - const createdIssues = []; - for (let i = 0; i < createIssueItems.length; i++) { - const createIssueItem = createIssueItems[i]; - core.info( - `Processing create-issue item ${i + 1}/${createIssueItems.length}: title=${createIssueItem.title}, bodyLength=${createIssueItem.body.length}` - ); - core.info(`Debug: createIssueItem.parent = ${JSON.stringify(createIssueItem.parent)}`); - core.info(`Debug: parentIssueNumber from context = ${JSON.stringify(parentIssueNumber)}`); - const effectiveParentIssueNumber = createIssueItem.parent !== undefined ? createIssueItem.parent : parentIssueNumber; - core.info(`Debug: effectiveParentIssueNumber = ${JSON.stringify(effectiveParentIssueNumber)}`); - if (effectiveParentIssueNumber && createIssueItem.parent !== undefined) { - core.info(`Using explicit parent issue number from item: #${effectiveParentIssueNumber}`); - } - let labels = [...envLabels]; - if (createIssueItem.labels && Array.isArray(createIssueItem.labels)) { - labels = [...labels, ...createIssueItem.labels]; - } - labels = labels - .filter(label => !!label) - .map(label => String(label).trim()) - .filter(label => label) - .map(label => sanitizeLabelContent(label)) - .filter(label => label) - .map(label => (label.length > 64 ? label.substring(0, 64) : label)) - .filter((label, index, arr) => arr.indexOf(label) === index); - let title = createIssueItem.title ? createIssueItem.title.trim() : ""; - let bodyLines = createIssueItem.body.split("\n"); - if (!title) { - title = createIssueItem.body || "Agent Output"; - } - const titlePrefix = process.env.GH_AW_ISSUE_TITLE_PREFIX; - if (titlePrefix && !title.startsWith(titlePrefix)) { - title = titlePrefix + title; - } - if (effectiveParentIssueNumber) { - core.info("Detected issue context, parent issue #" + effectiveParentIssueNumber); - bodyLines.push(`Related to #${effectiveParentIssueNumber}`); - } - const workflowName = process.env.GH_AW_WORKFLOW_NAME || "Workflow"; - const workflowSource = process.env.GH_AW_WORKFLOW_SOURCE || ""; - const workflowSourceURL = process.env.GH_AW_WORKFLOW_SOURCE_URL || ""; - const runId = context.runId; - const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; - const runUrl = context.payload.repository - ? `${context.payload.repository.html_url}/actions/runs/${runId}` - : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`; - const fingerprintComment = getCampaign("markdown"); - if (fingerprintComment) { - bodyLines.push(fingerprintComment); - } - bodyLines.push( - ``, - ``, - generateFooter( - workflowName, - runUrl, - workflowSource, - workflowSourceURL, - triggeringIssueNumber, - triggeringPRNumber, - triggeringDiscussionNumber - ).trimEnd(), - "" - ); - const body = bodyLines.join("\n").trim(); - core.info(`Creating issue with title: ${title}`); - core.info(`Labels: ${labels}`); - core.info(`Body length: ${body.length}`); - try { - const { data: issue } = await github.rest.issues.create({ - owner: context.repo.owner, - repo: context.repo.repo, - title: title, - body: body, - labels: labels, - }); - core.info("Created issue #" + issue.number + ": " + issue.html_url); - createdIssues.push(issue); - core.info(`Debug: About to check if sub-issue linking is needed. effectiveParentIssueNumber = ${effectiveParentIssueNumber}`); - if (effectiveParentIssueNumber) { - core.info(`Attempting to link issue #${issue.number} as sub-issue of #${effectiveParentIssueNumber}`); - try { - core.info(`Fetching node ID for parent issue #${effectiveParentIssueNumber}...`); - const getIssueNodeIdQuery = ` - query($owner: String!, $repo: String!, $issueNumber: Int!) { - repository(owner: $owner, name: $repo) { - issue(number: $issueNumber) { - id - } - } - } - `; - const parentResult = await github.graphql(getIssueNodeIdQuery, { - owner: context.repo.owner, - repo: context.repo.repo, - issueNumber: effectiveParentIssueNumber, - }); - const parentNodeId = parentResult.repository.issue.id; - core.info(`Parent issue node ID: ${parentNodeId}`); - core.info(`Fetching node ID for child issue #${issue.number}...`); - const childResult = await github.graphql(getIssueNodeIdQuery, { - owner: context.repo.owner, - repo: context.repo.repo, - issueNumber: issue.number, - }); - const childNodeId = childResult.repository.issue.id; - core.info(`Child issue node ID: ${childNodeId}`); - core.info(`Executing addSubIssue mutation...`); - const addSubIssueMutation = ` - mutation($issueId: ID!, $subIssueId: ID!) { - addSubIssue(input: { - issueId: $issueId, - subIssueId: $subIssueId - }) { - subIssue { - id - number - } - } - } - `; - await github.graphql(addSubIssueMutation, { - issueId: parentNodeId, - subIssueId: childNodeId, - }); - core.info("✓ Successfully linked issue #" + issue.number + " as sub-issue of #" + effectiveParentIssueNumber); - } catch (error) { - core.info(`Warning: Could not link sub-issue to parent: ${error instanceof Error ? error.message : String(error)}`); - core.info(`Error details: ${error instanceof Error ? error.stack : String(error)}`); - try { - core.info(`Attempting fallback: adding comment to parent issue #${effectiveParentIssueNumber}...`); - await github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: effectiveParentIssueNumber, - body: `Created related issue: #${issue.number}`, - }); - core.info("✓ Added comment to parent issue #" + effectiveParentIssueNumber + " (sub-issue linking not available)"); - } catch (commentError) { - core.info( - `Warning: Could not add comment to parent issue: ${commentError instanceof Error ? commentError.message : String(commentError)}` - ); - } - } - } else { - core.info(`Debug: No parent issue number set, skipping sub-issue linking`); - } - if (i === createIssueItems.length - 1) { - core.setOutput("issue_number", issue.number); - core.setOutput("issue_url", issue.html_url); - } - } catch (error) { - const errorMessage = error instanceof Error ? error.message : String(error); - if (errorMessage.includes("Issues has been disabled in this repository")) { - core.info(`⚠ Cannot create issue "${title}": Issues are disabled for this repository`); - core.info("Consider enabling issues in repository settings if you want to create issues automatically"); - continue; - } - core.error(`✗ Failed to create issue "${title}": ${errorMessage}`); - throw error; - } - } - if (createdIssues.length > 0) { - let summaryContent = "\n\n## GitHub Issues\n"; - for (const issue of createdIssues) { - summaryContent += `- Issue #${issue.number}: [${issue.title}](${issue.html_url})\n`; - } - await core.summary.addRaw(summaryContent).write(); - } - core.info(`Successfully created ${createdIssues.length} issue(s)`); - } - (async () => { - await main(); - })(); - detection: needs: agent if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true' diff --git a/.github/workflows/smoke-claude.md b/.github/workflows/smoke-claude.md index 01bce2f480a..bc6c429272b 100644 --- a/.github/workflows/smoke-claude.md +++ b/.github/workflows/smoke-claude.md @@ -23,9 +23,9 @@ tools: toolsets: [repos, pull_requests] safe-outputs: staged: true - create-issue: + add-comment: timeout-minutes: 10 strict: true --- -Review the last 2 merged pull requests in the ${{ github.repository }} repository and post summary in an issue. \ No newline at end of file +Review the last 2 merged pull requests in the ${{ github.repository }} repository and add a comment to the current pull request with a summary. \ No newline at end of file diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 18699402e2d..a6dfea1ee28 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -9,20 +9,20 @@ # ```mermaid # graph LR # activation["activation"] +# add_comment["add_comment"] # agent["agent"] # conclusion["conclusion"] -# create_issue["create_issue"] # detection["detection"] # missing_tool["missing_tool"] # pre_activation["pre_activation"] # pre_activation --> activation +# agent --> add_comment +# detection --> add_comment # activation --> agent # agent --> conclusion # activation --> conclusion -# create_issue --> conclusion +# add_comment --> conclusion # missing_tool --> conclusion -# agent --> create_issue -# detection --> create_issue # agent --> detection # agent --> missing_tool # detection --> missing_tool @@ -163,6 +163,416 @@ jobs: core.setFailed(error instanceof Error ? error.message : String(error)); }); + add_comment: + needs: + - agent + - detection + if: > + ((((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'add_comment'))) && + (((github.event.issue.number) || (github.event.pull_request.number)) || (github.event.discussion.number))) && + (needs.detection.outputs.success == 'true') + runs-on: ubuntu-slim + permissions: + contents: read + discussions: write + issues: write + pull-requests: write + timeout-minutes: 10 + outputs: + comment_id: ${{ steps.add_comment.outputs.comment_id }} + comment_url: ${{ steps.add_comment.outputs.comment_url }} + steps: + - name: Debug agent outputs + env: + AGENT_OUTPUT: ${{ needs.agent.outputs.output }} + AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }} + run: | + echo "Output: $AGENT_OUTPUT" + echo "Output types: $AGENT_OUTPUT_TYPES" + - name: Download agent output artifact + continue-on-error: true + uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6 + with: + name: agent_output.json + path: /tmp/gh-aw/safeoutputs/ + - name: Setup agent output environment variable + run: | + mkdir -p /tmp/gh-aw/safeoutputs/ + find "/tmp/gh-aw/safeoutputs/" -type f -print + echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" + - name: Add Issue Comment + id: add_comment + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 + env: + GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} + GH_AW_WORKFLOW_NAME: "Smoke Codex" + GH_AW_SAFE_OUTPUTS_STAGED: "true" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const fs = require("fs"); + function loadAgentOutput() { + const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT; + if (!agentOutputFile) { + core.info("No GH_AW_AGENT_OUTPUT environment variable found"); + return { success: false }; + } + let outputContent; + try { + outputContent = fs.readFileSync(agentOutputFile, "utf8"); + } catch (error) { + const errorMessage = `Error reading agent output file: ${error instanceof Error ? error.message : String(error)}`; + core.error(errorMessage); + return { success: false, error: errorMessage }; + } + if (outputContent.trim() === "") { + core.info("Agent output content is empty"); + return { success: false }; + } + core.info(`Agent output content length: ${outputContent.length}`); + let validatedOutput; + try { + validatedOutput = JSON.parse(outputContent); + } catch (error) { + const errorMessage = `Error parsing agent output JSON: ${error instanceof Error ? error.message : String(error)}`; + core.error(errorMessage); + return { success: false, error: errorMessage }; + } + if (!validatedOutput.items || !Array.isArray(validatedOutput.items)) { + core.info("No valid items found in agent output"); + return { success: false }; + } + return { success: true, items: validatedOutput.items }; + } + function generateFooter( + workflowName, + runUrl, + workflowSource, + workflowSourceURL, + triggeringIssueNumber, + triggeringPRNumber, + triggeringDiscussionNumber + ) { + let footer = `\n\n> AI generated by [${workflowName}](${runUrl})`; + if (triggeringIssueNumber) { + footer += ` for #${triggeringIssueNumber}`; + } else if (triggeringPRNumber) { + footer += ` for #${triggeringPRNumber}`; + } else if (triggeringDiscussionNumber) { + footer += ` for discussion #${triggeringDiscussionNumber}`; + } + if (workflowSource && workflowSourceURL) { + footer += `\n>\n> To add this workflow in your repository, run \`gh aw add ${workflowSource}\`. See [usage guide](https://githubnext.github.io/gh-aw/tools/cli/).`; + } + footer += "\n"; + return footer; + } + function getCampaign(format) { + const campaign = process.env.GH_AW_CAMPAIGN || ""; + if (campaign) { + core.info(`Campaign: ${campaign}`); + return format === "markdown" ? `\n\n` : campaign; + } + return ""; + } + function getRepositoryUrl() { + const targetRepoSlug = process.env.GH_AW_TARGET_REPO_SLUG; + if (targetRepoSlug) { + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + return `${githubServer}/${targetRepoSlug}`; + } else if (context.payload.repository?.html_url) { + return context.payload.repository.html_url; + } else { + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + return `${githubServer}/${context.repo.owner}/${context.repo.repo}`; + } + } + async function commentOnDiscussion(github, owner, repo, discussionNumber, message, replyToId) { + const { repository } = await github.graphql( + ` + query($owner: String!, $repo: String!, $num: Int!) { + repository(owner: $owner, name: $repo) { + discussion(number: $num) { + id + url + } + } + }`, + { owner, repo, num: discussionNumber } + ); + if (!repository || !repository.discussion) { + throw new Error(`Discussion #${discussionNumber} not found in ${owner}/${repo}`); + } + const discussionId = repository.discussion.id; + const discussionUrl = repository.discussion.url; + let result; + if (replyToId) { + result = await github.graphql( + ` + mutation($dId: ID!, $body: String!, $replyToId: ID!) { + addDiscussionComment(input: { discussionId: $dId, body: $body, replyToId: $replyToId }) { + comment { + id + body + createdAt + url + } + } + }`, + { dId: discussionId, body: message, replyToId } + ); + } else { + result = await github.graphql( + ` + mutation($dId: ID!, $body: String!) { + addDiscussionComment(input: { discussionId: $dId, body: $body }) { + comment { + id + body + createdAt + url + } + } + }`, + { dId: discussionId, body: message } + ); + } + const comment = result.addDiscussionComment.comment; + return { + id: comment.id, + html_url: comment.url, + discussion_url: discussionUrl, + }; + } + async function main() { + const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true"; + const isDiscussionExplicit = process.env.GITHUB_AW_COMMENT_DISCUSSION === "true"; + const result = loadAgentOutput(); + if (!result.success) { + return; + } + const commentItems = result.items.filter( item => item.type === "add_comment"); + if (commentItems.length === 0) { + core.info("No add-comment items found in agent output"); + return; + } + core.info(`Found ${commentItems.length} add-comment item(s)`); + function getTargetNumber(item) { + return item.item_number; + } + const commentTarget = process.env.GH_AW_COMMENT_TARGET || "triggering"; + core.info(`Comment target configuration: ${commentTarget}`); + const isIssueContext = context.eventName === "issues" || context.eventName === "issue_comment"; + const isPRContext = + context.eventName === "pull_request" || + context.eventName === "pull_request_review" || + context.eventName === "pull_request_review_comment"; + const isDiscussionContext = context.eventName === "discussion" || context.eventName === "discussion_comment"; + const isDiscussion = isDiscussionContext || isDiscussionExplicit; + if (isStaged) { + let summaryContent = "## 🎭 Staged Mode: Add Comments Preview\n\n"; + summaryContent += "The following comments would be added if staged mode was disabled:\n\n"; + const createdIssueUrl = process.env.GH_AW_CREATED_ISSUE_URL; + const createdIssueNumber = process.env.GH_AW_CREATED_ISSUE_NUMBER; + const createdDiscussionUrl = process.env.GH_AW_CREATED_DISCUSSION_URL; + const createdDiscussionNumber = process.env.GH_AW_CREATED_DISCUSSION_NUMBER; + const createdPullRequestUrl = process.env.GH_AW_CREATED_PULL_REQUEST_URL; + const createdPullRequestNumber = process.env.GH_AW_CREATED_PULL_REQUEST_NUMBER; + if (createdIssueUrl || createdDiscussionUrl || createdPullRequestUrl) { + summaryContent += "#### Related Items\n\n"; + if (createdIssueUrl && createdIssueNumber) { + summaryContent += `- Issue: [#${createdIssueNumber}](${createdIssueUrl})\n`; + } + if (createdDiscussionUrl && createdDiscussionNumber) { + summaryContent += `- Discussion: [#${createdDiscussionNumber}](${createdDiscussionUrl})\n`; + } + if (createdPullRequestUrl && createdPullRequestNumber) { + summaryContent += `- Pull Request: [#${createdPullRequestNumber}](${createdPullRequestUrl})\n`; + } + summaryContent += "\n"; + } + for (let i = 0; i < commentItems.length; i++) { + const item = commentItems[i]; + summaryContent += `### Comment ${i + 1}\n`; + const targetNumber = getTargetNumber(item); + if (targetNumber) { + const repoUrl = getRepositoryUrl(); + if (isDiscussion) { + const discussionUrl = `${repoUrl}/discussions/${targetNumber}`; + summaryContent += `**Target Discussion:** [#${targetNumber}](${discussionUrl})\n\n`; + } else { + const issueUrl = `${repoUrl}/issues/${targetNumber}`; + summaryContent += `**Target Issue:** [#${targetNumber}](${issueUrl})\n\n`; + } + } else { + if (isDiscussion) { + summaryContent += `**Target:** Current discussion\n\n`; + } else { + summaryContent += `**Target:** Current issue/PR\n\n`; + } + } + summaryContent += `**Body:**\n${item.body || "No content provided"}\n\n`; + summaryContent += "---\n\n"; + } + await core.summary.addRaw(summaryContent).write(); + core.info("📝 Comment creation preview written to step summary"); + return; + } + if (commentTarget === "triggering" && !isIssueContext && !isPRContext && !isDiscussionContext) { + core.info('Target is "triggering" but not running in issue, pull request, or discussion context, skipping comment creation'); + return; + } + const triggeringIssueNumber = + context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined; + const triggeringPRNumber = + context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined); + const triggeringDiscussionNumber = context.payload?.discussion?.number; + const createdComments = []; + for (let i = 0; i < commentItems.length; i++) { + const commentItem = commentItems[i]; + core.info(`Processing add-comment item ${i + 1}/${commentItems.length}: bodyLength=${commentItem.body.length}`); + let itemNumber; + let commentEndpoint; + if (commentTarget === "*") { + const targetNumber = getTargetNumber(commentItem); + if (targetNumber) { + itemNumber = parseInt(targetNumber, 10); + if (isNaN(itemNumber) || itemNumber <= 0) { + core.info(`Invalid target number specified: ${targetNumber}`); + continue; + } + commentEndpoint = isDiscussion ? "discussions" : "issues"; + } else { + core.info(`Target is "*" but no number specified in comment item`); + continue; + } + } else if (commentTarget && commentTarget !== "triggering") { + itemNumber = parseInt(commentTarget, 10); + if (isNaN(itemNumber) || itemNumber <= 0) { + core.info(`Invalid target number in target configuration: ${commentTarget}`); + continue; + } + commentEndpoint = isDiscussion ? "discussions" : "issues"; + } else { + if (isIssueContext) { + itemNumber = context.payload.issue?.number || context.payload.pull_request?.number || context.payload.discussion?.number; + if (context.payload.issue) { + commentEndpoint = "issues"; + } else { + core.info("Issue context detected but no issue found in payload"); + continue; + } + } else if (isPRContext) { + itemNumber = context.payload.pull_request?.number || context.payload.issue?.number || context.payload.discussion?.number; + if (context.payload.pull_request) { + commentEndpoint = "issues"; + } else { + core.info("Pull request context detected but no pull request found in payload"); + continue; + } + } else if (isDiscussionContext) { + itemNumber = context.payload.discussion?.number || context.payload.issue?.number || context.payload.pull_request?.number; + if (context.payload.discussion) { + commentEndpoint = "discussions"; + } else { + core.info("Discussion context detected but no discussion found in payload"); + continue; + } + } + } + if (!itemNumber) { + core.info("Could not determine issue, pull request, or discussion number"); + continue; + } + let body = commentItem.body.trim(); + const createdIssueUrl = process.env.GH_AW_CREATED_ISSUE_URL; + const createdIssueNumber = process.env.GH_AW_CREATED_ISSUE_NUMBER; + const createdDiscussionUrl = process.env.GH_AW_CREATED_DISCUSSION_URL; + const createdDiscussionNumber = process.env.GH_AW_CREATED_DISCUSSION_NUMBER; + const createdPullRequestUrl = process.env.GH_AW_CREATED_PULL_REQUEST_URL; + const createdPullRequestNumber = process.env.GH_AW_CREATED_PULL_REQUEST_NUMBER; + let hasReferences = false; + let referencesSection = "\n\n#### Related Items\n\n"; + if (createdIssueUrl && createdIssueNumber) { + referencesSection += `- Issue: [#${createdIssueNumber}](${createdIssueUrl})\n`; + hasReferences = true; + } + if (createdDiscussionUrl && createdDiscussionNumber) { + referencesSection += `- Discussion: [#${createdDiscussionNumber}](${createdDiscussionUrl})\n`; + hasReferences = true; + } + if (createdPullRequestUrl && createdPullRequestNumber) { + referencesSection += `- Pull Request: [#${createdPullRequestNumber}](${createdPullRequestUrl})\n`; + hasReferences = true; + } + if (hasReferences) { + body += referencesSection; + } + const workflowName = process.env.GH_AW_WORKFLOW_NAME || "Workflow"; + const workflowSource = process.env.GH_AW_WORKFLOW_SOURCE || ""; + const workflowSourceURL = process.env.GH_AW_WORKFLOW_SOURCE_URL || ""; + const runId = context.runId; + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + const runUrl = context.payload.repository + ? `${context.payload.repository.html_url}/actions/runs/${runId}` + : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`; + body += getCampaign("markdown"); + body += generateFooter( + workflowName, + runUrl, + workflowSource, + workflowSourceURL, + triggeringIssueNumber, + triggeringPRNumber, + triggeringDiscussionNumber + ); + try { + let comment; + if (commentEndpoint === "discussions") { + core.info(`Creating comment on discussion #${itemNumber}`); + core.info(`Comment content length: ${body.length}`); + let replyToId; + if (context.eventName === "discussion_comment" && context.payload?.comment?.node_id) { + replyToId = context.payload.comment.node_id; + core.info(`Creating threaded reply to comment ${replyToId}`); + } + comment = await commentOnDiscussion(github, context.repo.owner, context.repo.repo, itemNumber, body, replyToId); + core.info("Created discussion comment #" + comment.id + ": " + comment.html_url); + comment.discussion_url = comment.discussion_url; + } else { + core.info(`Creating comment on ${commentEndpoint} #${itemNumber}`); + core.info(`Comment content length: ${body.length}`); + const { data: restComment } = await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: itemNumber, + body: body, + }); + comment = restComment; + core.info("Created comment #" + comment.id + ": " + comment.html_url); + } + createdComments.push(comment); + if (i === commentItems.length - 1) { + core.setOutput("comment_id", comment.id); + core.setOutput("comment_url", comment.html_url); + } + } catch (error) { + core.error(`✗ Failed to create comment: ${error instanceof Error ? error.message : String(error)}`); + throw error; + } + } + if (createdComments.length > 0) { + let summaryContent = "\n\n## GitHub Comments\n"; + for (const comment of createdComments) { + summaryContent += `- Comment #${comment.id}: [View Comment](${comment.html_url})\n`; + } + await core.summary.addRaw(summaryContent).write(); + } + core.info(`Successfully created ${createdComments.length} comment(s)`); + return createdComments; + } + await main(); + agent: needs: activation runs-on: ubuntu-latest @@ -264,10 +674,10 @@ jobs: run: | mkdir -p /tmp/gh-aw/safeoutputs cat > /tmp/gh-aw/safeoutputs/config.json << 'EOF' - {"create_issue":{"max":1},"missing_tool":{},"noop":{"max":1}} + {"add_comment":{"max":1},"missing_tool":{},"noop":{"max":1}} EOF cat > /tmp/gh-aw/safeoutputs/tools.json << 'EOF' - [{"description":"Create a new GitHub issue","inputSchema":{"additionalProperties":false,"properties":{"body":{"description":"Issue body/description","type":"string"},"labels":{"description":"Issue labels","items":{"type":"string"},"type":"array"},"parent":{"description":"Parent issue number to create this issue as a sub-issue of","type":"number"},"title":{"description":"Issue title","type":"string"}},"required":["title","body"],"type":"object"},"name":"create_issue"},{"description":"Report a missing tool or functionality needed to complete tasks","inputSchema":{"additionalProperties":false,"properties":{"alternatives":{"description":"Possible alternatives or workarounds (max 256 characters)","type":"string"},"reason":{"description":"Why this tool is needed (max 256 characters)","type":"string"},"tool":{"description":"Name of the missing tool (max 128 characters)","type":"string"}},"required":["tool","reason"],"type":"object"},"name":"missing_tool"},{"description":"Log a message for transparency when no significant actions are needed. Use this to ensure workflows produce human-visible artifacts even when no other actions are taken (e.g., 'Analysis complete - no issues found').","inputSchema":{"additionalProperties":false,"properties":{"message":{"description":"Message to log for transparency","type":"string"}},"required":["message"],"type":"object"},"name":"noop"}] + [{"description":"Add a comment to a GitHub issue, pull request, or discussion","inputSchema":{"additionalProperties":false,"properties":{"body":{"description":"Comment body/content","type":"string"},"item_number":{"description":"Issue, pull request or discussion number","type":"number"}},"required":["body","item_number"],"type":"object"},"name":"add_comment"},{"description":"Report a missing tool or functionality needed to complete tasks","inputSchema":{"additionalProperties":false,"properties":{"alternatives":{"description":"Possible alternatives or workarounds (max 256 characters)","type":"string"},"reason":{"description":"Why this tool is needed (max 256 characters)","type":"string"},"tool":{"description":"Name of the missing tool (max 128 characters)","type":"string"}},"required":["tool","reason"],"type":"object"},"name":"missing_tool"},{"description":"Log a message for transparency when no significant actions are needed. Use this to ensure workflows produce human-visible artifacts even when no other actions are taken (e.g., 'Analysis complete - no issues found').","inputSchema":{"additionalProperties":false,"properties":{"message":{"description":"Message to log for transparency","type":"string"}},"required":["message"],"type":"object"},"name":"noop"}] EOF cat > /tmp/gh-aw/safeoutputs/mcp-server.cjs << 'EOF' const fs = require("fs"); @@ -878,7 +1288,7 @@ jobs: mkdir -p "$PROMPT_DIR" # shellcheck disable=SC2006,SC2287 cat > "$GH_AW_PROMPT" << 'PROMPT_EOF' - Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and post summary in an issue. + Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and add a comment to the current pull request with a summary. PROMPT_EOF - name: Append XPIA security instructions to prompt @@ -937,13 +1347,13 @@ jobs: --- - ## Creating an Issue, Reporting Missing Tools or Functionality + ## Adding a Comment to an Issue or Pull Request, Reporting Missing Tools or Functionality **IMPORTANT**: To do the actions mentioned in the header of this section, use the **safeoutputs** tools, do NOT attempt to use `gh`, do NOT attempt to use the GitHub API. You don't have write access to the GitHub repo. - **Creating an Issue** + **Adding a Comment to an Issue or Pull Request** - To create an issue, use the create-issue tool from safeoutputs + To add a comment to an issue or pull request, use the add-comments tool from safeoutputs **Reporting Missing Tools or Functionality** @@ -2748,9 +3158,9 @@ jobs: needs: - agent - activation - - create_issue + - add_comment - missing_tool - if: (always()) && (needs.agent.result != 'skipped') + if: ((always()) && (needs.agent.result != 'skipped')) && (!(needs.add_comment.outputs.comment_id)) runs-on: ubuntu-slim permissions: contents: read @@ -3027,360 +3437,6 @@ jobs: core.setFailed(error instanceof Error ? error.message : String(error)); }); - create_issue: - needs: - - agent - - detection - if: > - (((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_issue'))) && - (needs.detection.outputs.success == 'true') - runs-on: ubuntu-slim - permissions: - contents: read - issues: write - timeout-minutes: 10 - outputs: - issue_number: ${{ steps.create_issue.outputs.issue_number }} - issue_url: ${{ steps.create_issue.outputs.issue_url }} - steps: - - name: Download agent output artifact - continue-on-error: true - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6 - with: - name: agent_output.json - path: /tmp/gh-aw/safeoutputs/ - - name: Setup agent output environment variable - run: | - mkdir -p /tmp/gh-aw/safeoutputs/ - find "/tmp/gh-aw/safeoutputs/" -type f -print - echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Create Output Issue - id: create_issue - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 - env: - GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} - GH_AW_WORKFLOW_NAME: "Smoke Codex" - GH_AW_SAFE_OUTPUTS_STAGED: "true" - with: - github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - script: | - function sanitizeLabelContent(content) { - if (!content || typeof content !== "string") { - return ""; - } - let sanitized = content.trim(); - sanitized = sanitized.replace(/\x1b\[[0-9;]*[mGKH]/g, ""); - sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, ""); - sanitized = sanitized.replace( - /(^|[^\w`])@([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\/[A-Za-z0-9._-]+)?)/g, - (_m, p1, p2) => `${p1}\`@${p2}\`` - ); - sanitized = sanitized.replace(/[<>&'"]/g, ""); - return sanitized.trim(); - } - const fs = require("fs"); - function loadAgentOutput() { - const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT; - if (!agentOutputFile) { - core.info("No GH_AW_AGENT_OUTPUT environment variable found"); - return { success: false }; - } - let outputContent; - try { - outputContent = fs.readFileSync(agentOutputFile, "utf8"); - } catch (error) { - const errorMessage = `Error reading agent output file: ${error instanceof Error ? error.message : String(error)}`; - core.error(errorMessage); - return { success: false, error: errorMessage }; - } - if (outputContent.trim() === "") { - core.info("Agent output content is empty"); - return { success: false }; - } - core.info(`Agent output content length: ${outputContent.length}`); - let validatedOutput; - try { - validatedOutput = JSON.parse(outputContent); - } catch (error) { - const errorMessage = `Error parsing agent output JSON: ${error instanceof Error ? error.message : String(error)}`; - core.error(errorMessage); - return { success: false, error: errorMessage }; - } - if (!validatedOutput.items || !Array.isArray(validatedOutput.items)) { - core.info("No valid items found in agent output"); - return { success: false }; - } - return { success: true, items: validatedOutput.items }; - } - async function generateStagedPreview(options) { - const { title, description, items, renderItem } = options; - let summaryContent = `## 🎭 Staged Mode: ${title} Preview\n\n`; - summaryContent += `${description}\n\n`; - for (let i = 0; i < items.length; i++) { - const item = items[i]; - summaryContent += renderItem(item, i); - summaryContent += "---\n\n"; - } - try { - await core.summary.addRaw(summaryContent).write(); - core.info(summaryContent); - core.info(`📝 ${title} preview written to step summary`); - } catch (error) { - core.setFailed(error instanceof Error ? error : String(error)); - } - } - function generateFooter( - workflowName, - runUrl, - workflowSource, - workflowSourceURL, - triggeringIssueNumber, - triggeringPRNumber, - triggeringDiscussionNumber - ) { - let footer = `\n\n> AI generated by [${workflowName}](${runUrl})`; - if (triggeringIssueNumber) { - footer += ` for #${triggeringIssueNumber}`; - } else if (triggeringPRNumber) { - footer += ` for #${triggeringPRNumber}`; - } else if (triggeringDiscussionNumber) { - footer += ` for discussion #${triggeringDiscussionNumber}`; - } - if (workflowSource && workflowSourceURL) { - footer += `\n>\n> To add this workflow in your repository, run \`gh aw add ${workflowSource}\`. See [usage guide](https://githubnext.github.io/gh-aw/tools/cli/).`; - } - footer += "\n"; - return footer; - } - function getCampaign(format) { - const campaign = process.env.GH_AW_CAMPAIGN || ""; - if (campaign) { - core.info(`Campaign: ${campaign}`); - return format === "markdown" ? `\n\n` : campaign; - } - return ""; - } - async function main() { - core.setOutput("issue_number", ""); - core.setOutput("issue_url", ""); - const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true"; - const result = loadAgentOutput(); - if (!result.success) { - return; - } - const createIssueItems = result.items.filter(item => item.type === "create_issue"); - if (createIssueItems.length === 0) { - core.info("No create-issue items found in agent output"); - return; - } - core.info(`Found ${createIssueItems.length} create-issue item(s)`); - if (isStaged) { - await generateStagedPreview({ - title: "Create Issues", - description: "The following issues would be created if staged mode was disabled:", - items: createIssueItems, - renderItem: (item, index) => { - let content = `### Issue ${index + 1}\n`; - content += `**Title:** ${item.title || "No title provided"}\n\n`; - if (item.body) { - content += `**Body:**\n${item.body}\n\n`; - } - if (item.labels && item.labels.length > 0) { - content += `**Labels:** ${item.labels.join(", ")}\n\n`; - } - return content; - }, - }); - return; - } - const parentIssueNumber = context.payload?.issue?.number; - const triggeringIssueNumber = - context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined; - const triggeringPRNumber = - context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined); - const triggeringDiscussionNumber = context.payload?.discussion?.number; - const labelsEnv = process.env.GH_AW_ISSUE_LABELS; - let envLabels = labelsEnv - ? labelsEnv - .split(",") - .map(label => label.trim()) - .filter(label => label) - : []; - const createdIssues = []; - for (let i = 0; i < createIssueItems.length; i++) { - const createIssueItem = createIssueItems[i]; - core.info( - `Processing create-issue item ${i + 1}/${createIssueItems.length}: title=${createIssueItem.title}, bodyLength=${createIssueItem.body.length}` - ); - core.info(`Debug: createIssueItem.parent = ${JSON.stringify(createIssueItem.parent)}`); - core.info(`Debug: parentIssueNumber from context = ${JSON.stringify(parentIssueNumber)}`); - const effectiveParentIssueNumber = createIssueItem.parent !== undefined ? createIssueItem.parent : parentIssueNumber; - core.info(`Debug: effectiveParentIssueNumber = ${JSON.stringify(effectiveParentIssueNumber)}`); - if (effectiveParentIssueNumber && createIssueItem.parent !== undefined) { - core.info(`Using explicit parent issue number from item: #${effectiveParentIssueNumber}`); - } - let labels = [...envLabels]; - if (createIssueItem.labels && Array.isArray(createIssueItem.labels)) { - labels = [...labels, ...createIssueItem.labels]; - } - labels = labels - .filter(label => !!label) - .map(label => String(label).trim()) - .filter(label => label) - .map(label => sanitizeLabelContent(label)) - .filter(label => label) - .map(label => (label.length > 64 ? label.substring(0, 64) : label)) - .filter((label, index, arr) => arr.indexOf(label) === index); - let title = createIssueItem.title ? createIssueItem.title.trim() : ""; - let bodyLines = createIssueItem.body.split("\n"); - if (!title) { - title = createIssueItem.body || "Agent Output"; - } - const titlePrefix = process.env.GH_AW_ISSUE_TITLE_PREFIX; - if (titlePrefix && !title.startsWith(titlePrefix)) { - title = titlePrefix + title; - } - if (effectiveParentIssueNumber) { - core.info("Detected issue context, parent issue #" + effectiveParentIssueNumber); - bodyLines.push(`Related to #${effectiveParentIssueNumber}`); - } - const workflowName = process.env.GH_AW_WORKFLOW_NAME || "Workflow"; - const workflowSource = process.env.GH_AW_WORKFLOW_SOURCE || ""; - const workflowSourceURL = process.env.GH_AW_WORKFLOW_SOURCE_URL || ""; - const runId = context.runId; - const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; - const runUrl = context.payload.repository - ? `${context.payload.repository.html_url}/actions/runs/${runId}` - : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`; - const fingerprintComment = getCampaign("markdown"); - if (fingerprintComment) { - bodyLines.push(fingerprintComment); - } - bodyLines.push( - ``, - ``, - generateFooter( - workflowName, - runUrl, - workflowSource, - workflowSourceURL, - triggeringIssueNumber, - triggeringPRNumber, - triggeringDiscussionNumber - ).trimEnd(), - "" - ); - const body = bodyLines.join("\n").trim(); - core.info(`Creating issue with title: ${title}`); - core.info(`Labels: ${labels}`); - core.info(`Body length: ${body.length}`); - try { - const { data: issue } = await github.rest.issues.create({ - owner: context.repo.owner, - repo: context.repo.repo, - title: title, - body: body, - labels: labels, - }); - core.info("Created issue #" + issue.number + ": " + issue.html_url); - createdIssues.push(issue); - core.info(`Debug: About to check if sub-issue linking is needed. effectiveParentIssueNumber = ${effectiveParentIssueNumber}`); - if (effectiveParentIssueNumber) { - core.info(`Attempting to link issue #${issue.number} as sub-issue of #${effectiveParentIssueNumber}`); - try { - core.info(`Fetching node ID for parent issue #${effectiveParentIssueNumber}...`); - const getIssueNodeIdQuery = ` - query($owner: String!, $repo: String!, $issueNumber: Int!) { - repository(owner: $owner, name: $repo) { - issue(number: $issueNumber) { - id - } - } - } - `; - const parentResult = await github.graphql(getIssueNodeIdQuery, { - owner: context.repo.owner, - repo: context.repo.repo, - issueNumber: effectiveParentIssueNumber, - }); - const parentNodeId = parentResult.repository.issue.id; - core.info(`Parent issue node ID: ${parentNodeId}`); - core.info(`Fetching node ID for child issue #${issue.number}...`); - const childResult = await github.graphql(getIssueNodeIdQuery, { - owner: context.repo.owner, - repo: context.repo.repo, - issueNumber: issue.number, - }); - const childNodeId = childResult.repository.issue.id; - core.info(`Child issue node ID: ${childNodeId}`); - core.info(`Executing addSubIssue mutation...`); - const addSubIssueMutation = ` - mutation($issueId: ID!, $subIssueId: ID!) { - addSubIssue(input: { - issueId: $issueId, - subIssueId: $subIssueId - }) { - subIssue { - id - number - } - } - } - `; - await github.graphql(addSubIssueMutation, { - issueId: parentNodeId, - subIssueId: childNodeId, - }); - core.info("✓ Successfully linked issue #" + issue.number + " as sub-issue of #" + effectiveParentIssueNumber); - } catch (error) { - core.info(`Warning: Could not link sub-issue to parent: ${error instanceof Error ? error.message : String(error)}`); - core.info(`Error details: ${error instanceof Error ? error.stack : String(error)}`); - try { - core.info(`Attempting fallback: adding comment to parent issue #${effectiveParentIssueNumber}...`); - await github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: effectiveParentIssueNumber, - body: `Created related issue: #${issue.number}`, - }); - core.info("✓ Added comment to parent issue #" + effectiveParentIssueNumber + " (sub-issue linking not available)"); - } catch (commentError) { - core.info( - `Warning: Could not add comment to parent issue: ${commentError instanceof Error ? commentError.message : String(commentError)}` - ); - } - } - } else { - core.info(`Debug: No parent issue number set, skipping sub-issue linking`); - } - if (i === createIssueItems.length - 1) { - core.setOutput("issue_number", issue.number); - core.setOutput("issue_url", issue.html_url); - } - } catch (error) { - const errorMessage = error instanceof Error ? error.message : String(error); - if (errorMessage.includes("Issues has been disabled in this repository")) { - core.info(`⚠ Cannot create issue "${title}": Issues are disabled for this repository`); - core.info("Consider enabling issues in repository settings if you want to create issues automatically"); - continue; - } - core.error(`✗ Failed to create issue "${title}": ${errorMessage}`); - throw error; - } - } - if (createdIssues.length > 0) { - let summaryContent = "\n\n## GitHub Issues\n"; - for (const issue of createdIssues) { - summaryContent += `- Issue #${issue.number}: [${issue.title}](${issue.html_url})\n`; - } - await core.summary.addRaw(summaryContent).write(); - } - core.info(`Successfully created ${createdIssues.length} issue(s)`); - } - (async () => { - await main(); - })(); - detection: needs: agent if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true' diff --git a/.github/workflows/smoke-codex.md b/.github/workflows/smoke-codex.md index fc18cc9fef2..4f0ddfb7903 100644 --- a/.github/workflows/smoke-codex.md +++ b/.github/workflows/smoke-codex.md @@ -17,9 +17,9 @@ tools: github: safe-outputs: staged: true - create-issue: + add-comment: timeout-minutes: 10 strict: true --- -Review the last 2 merged pull requests in the ${{ github.repository }} repository and post summary in an issue. \ No newline at end of file +Review the last 2 merged pull requests in the ${{ github.repository }} repository and add a comment to the current pull request with a summary. \ No newline at end of file diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 81d82d84e16..1dbe760cb76 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -9,20 +9,20 @@ # ```mermaid # graph LR # activation["activation"] +# add_comment["add_comment"] # agent["agent"] # conclusion["conclusion"] -# create_issue["create_issue"] # detection["detection"] # missing_tool["missing_tool"] # pre_activation["pre_activation"] # pre_activation --> activation +# agent --> add_comment +# detection --> add_comment # activation --> agent # agent --> conclusion # activation --> conclusion -# create_issue --> conclusion +# add_comment --> conclusion # missing_tool --> conclusion -# agent --> create_issue -# detection --> create_issue # agent --> detection # agent --> missing_tool # detection --> missing_tool @@ -163,6 +163,416 @@ jobs: core.setFailed(error instanceof Error ? error.message : String(error)); }); + add_comment: + needs: + - agent + - detection + if: > + ((((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'add_comment'))) && + (((github.event.issue.number) || (github.event.pull_request.number)) || (github.event.discussion.number))) && + (needs.detection.outputs.success == 'true') + runs-on: ubuntu-slim + permissions: + contents: read + discussions: write + issues: write + pull-requests: write + timeout-minutes: 10 + outputs: + comment_id: ${{ steps.add_comment.outputs.comment_id }} + comment_url: ${{ steps.add_comment.outputs.comment_url }} + steps: + - name: Debug agent outputs + env: + AGENT_OUTPUT: ${{ needs.agent.outputs.output }} + AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }} + run: | + echo "Output: $AGENT_OUTPUT" + echo "Output types: $AGENT_OUTPUT_TYPES" + - name: Download agent output artifact + continue-on-error: true + uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6 + with: + name: agent_output.json + path: /tmp/gh-aw/safeoutputs/ + - name: Setup agent output environment variable + run: | + mkdir -p /tmp/gh-aw/safeoutputs/ + find "/tmp/gh-aw/safeoutputs/" -type f -print + echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" + - name: Add Issue Comment + id: add_comment + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 + env: + GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} + GH_AW_WORKFLOW_NAME: "Smoke Copilot" + GH_AW_SAFE_OUTPUTS_STAGED: "true" + with: + github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} + script: | + const fs = require("fs"); + function loadAgentOutput() { + const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT; + if (!agentOutputFile) { + core.info("No GH_AW_AGENT_OUTPUT environment variable found"); + return { success: false }; + } + let outputContent; + try { + outputContent = fs.readFileSync(agentOutputFile, "utf8"); + } catch (error) { + const errorMessage = `Error reading agent output file: ${error instanceof Error ? error.message : String(error)}`; + core.error(errorMessage); + return { success: false, error: errorMessage }; + } + if (outputContent.trim() === "") { + core.info("Agent output content is empty"); + return { success: false }; + } + core.info(`Agent output content length: ${outputContent.length}`); + let validatedOutput; + try { + validatedOutput = JSON.parse(outputContent); + } catch (error) { + const errorMessage = `Error parsing agent output JSON: ${error instanceof Error ? error.message : String(error)}`; + core.error(errorMessage); + return { success: false, error: errorMessage }; + } + if (!validatedOutput.items || !Array.isArray(validatedOutput.items)) { + core.info("No valid items found in agent output"); + return { success: false }; + } + return { success: true, items: validatedOutput.items }; + } + function generateFooter( + workflowName, + runUrl, + workflowSource, + workflowSourceURL, + triggeringIssueNumber, + triggeringPRNumber, + triggeringDiscussionNumber + ) { + let footer = `\n\n> AI generated by [${workflowName}](${runUrl})`; + if (triggeringIssueNumber) { + footer += ` for #${triggeringIssueNumber}`; + } else if (triggeringPRNumber) { + footer += ` for #${triggeringPRNumber}`; + } else if (triggeringDiscussionNumber) { + footer += ` for discussion #${triggeringDiscussionNumber}`; + } + if (workflowSource && workflowSourceURL) { + footer += `\n>\n> To add this workflow in your repository, run \`gh aw add ${workflowSource}\`. See [usage guide](https://githubnext.github.io/gh-aw/tools/cli/).`; + } + footer += "\n"; + return footer; + } + function getCampaign(format) { + const campaign = process.env.GH_AW_CAMPAIGN || ""; + if (campaign) { + core.info(`Campaign: ${campaign}`); + return format === "markdown" ? `\n\n` : campaign; + } + return ""; + } + function getRepositoryUrl() { + const targetRepoSlug = process.env.GH_AW_TARGET_REPO_SLUG; + if (targetRepoSlug) { + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + return `${githubServer}/${targetRepoSlug}`; + } else if (context.payload.repository?.html_url) { + return context.payload.repository.html_url; + } else { + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + return `${githubServer}/${context.repo.owner}/${context.repo.repo}`; + } + } + async function commentOnDiscussion(github, owner, repo, discussionNumber, message, replyToId) { + const { repository } = await github.graphql( + ` + query($owner: String!, $repo: String!, $num: Int!) { + repository(owner: $owner, name: $repo) { + discussion(number: $num) { + id + url + } + } + }`, + { owner, repo, num: discussionNumber } + ); + if (!repository || !repository.discussion) { + throw new Error(`Discussion #${discussionNumber} not found in ${owner}/${repo}`); + } + const discussionId = repository.discussion.id; + const discussionUrl = repository.discussion.url; + let result; + if (replyToId) { + result = await github.graphql( + ` + mutation($dId: ID!, $body: String!, $replyToId: ID!) { + addDiscussionComment(input: { discussionId: $dId, body: $body, replyToId: $replyToId }) { + comment { + id + body + createdAt + url + } + } + }`, + { dId: discussionId, body: message, replyToId } + ); + } else { + result = await github.graphql( + ` + mutation($dId: ID!, $body: String!) { + addDiscussionComment(input: { discussionId: $dId, body: $body }) { + comment { + id + body + createdAt + url + } + } + }`, + { dId: discussionId, body: message } + ); + } + const comment = result.addDiscussionComment.comment; + return { + id: comment.id, + html_url: comment.url, + discussion_url: discussionUrl, + }; + } + async function main() { + const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true"; + const isDiscussionExplicit = process.env.GITHUB_AW_COMMENT_DISCUSSION === "true"; + const result = loadAgentOutput(); + if (!result.success) { + return; + } + const commentItems = result.items.filter( item => item.type === "add_comment"); + if (commentItems.length === 0) { + core.info("No add-comment items found in agent output"); + return; + } + core.info(`Found ${commentItems.length} add-comment item(s)`); + function getTargetNumber(item) { + return item.item_number; + } + const commentTarget = process.env.GH_AW_COMMENT_TARGET || "triggering"; + core.info(`Comment target configuration: ${commentTarget}`); + const isIssueContext = context.eventName === "issues" || context.eventName === "issue_comment"; + const isPRContext = + context.eventName === "pull_request" || + context.eventName === "pull_request_review" || + context.eventName === "pull_request_review_comment"; + const isDiscussionContext = context.eventName === "discussion" || context.eventName === "discussion_comment"; + const isDiscussion = isDiscussionContext || isDiscussionExplicit; + if (isStaged) { + let summaryContent = "## 🎭 Staged Mode: Add Comments Preview\n\n"; + summaryContent += "The following comments would be added if staged mode was disabled:\n\n"; + const createdIssueUrl = process.env.GH_AW_CREATED_ISSUE_URL; + const createdIssueNumber = process.env.GH_AW_CREATED_ISSUE_NUMBER; + const createdDiscussionUrl = process.env.GH_AW_CREATED_DISCUSSION_URL; + const createdDiscussionNumber = process.env.GH_AW_CREATED_DISCUSSION_NUMBER; + const createdPullRequestUrl = process.env.GH_AW_CREATED_PULL_REQUEST_URL; + const createdPullRequestNumber = process.env.GH_AW_CREATED_PULL_REQUEST_NUMBER; + if (createdIssueUrl || createdDiscussionUrl || createdPullRequestUrl) { + summaryContent += "#### Related Items\n\n"; + if (createdIssueUrl && createdIssueNumber) { + summaryContent += `- Issue: [#${createdIssueNumber}](${createdIssueUrl})\n`; + } + if (createdDiscussionUrl && createdDiscussionNumber) { + summaryContent += `- Discussion: [#${createdDiscussionNumber}](${createdDiscussionUrl})\n`; + } + if (createdPullRequestUrl && createdPullRequestNumber) { + summaryContent += `- Pull Request: [#${createdPullRequestNumber}](${createdPullRequestUrl})\n`; + } + summaryContent += "\n"; + } + for (let i = 0; i < commentItems.length; i++) { + const item = commentItems[i]; + summaryContent += `### Comment ${i + 1}\n`; + const targetNumber = getTargetNumber(item); + if (targetNumber) { + const repoUrl = getRepositoryUrl(); + if (isDiscussion) { + const discussionUrl = `${repoUrl}/discussions/${targetNumber}`; + summaryContent += `**Target Discussion:** [#${targetNumber}](${discussionUrl})\n\n`; + } else { + const issueUrl = `${repoUrl}/issues/${targetNumber}`; + summaryContent += `**Target Issue:** [#${targetNumber}](${issueUrl})\n\n`; + } + } else { + if (isDiscussion) { + summaryContent += `**Target:** Current discussion\n\n`; + } else { + summaryContent += `**Target:** Current issue/PR\n\n`; + } + } + summaryContent += `**Body:**\n${item.body || "No content provided"}\n\n`; + summaryContent += "---\n\n"; + } + await core.summary.addRaw(summaryContent).write(); + core.info("📝 Comment creation preview written to step summary"); + return; + } + if (commentTarget === "triggering" && !isIssueContext && !isPRContext && !isDiscussionContext) { + core.info('Target is "triggering" but not running in issue, pull request, or discussion context, skipping comment creation'); + return; + } + const triggeringIssueNumber = + context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined; + const triggeringPRNumber = + context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined); + const triggeringDiscussionNumber = context.payload?.discussion?.number; + const createdComments = []; + for (let i = 0; i < commentItems.length; i++) { + const commentItem = commentItems[i]; + core.info(`Processing add-comment item ${i + 1}/${commentItems.length}: bodyLength=${commentItem.body.length}`); + let itemNumber; + let commentEndpoint; + if (commentTarget === "*") { + const targetNumber = getTargetNumber(commentItem); + if (targetNumber) { + itemNumber = parseInt(targetNumber, 10); + if (isNaN(itemNumber) || itemNumber <= 0) { + core.info(`Invalid target number specified: ${targetNumber}`); + continue; + } + commentEndpoint = isDiscussion ? "discussions" : "issues"; + } else { + core.info(`Target is "*" but no number specified in comment item`); + continue; + } + } else if (commentTarget && commentTarget !== "triggering") { + itemNumber = parseInt(commentTarget, 10); + if (isNaN(itemNumber) || itemNumber <= 0) { + core.info(`Invalid target number in target configuration: ${commentTarget}`); + continue; + } + commentEndpoint = isDiscussion ? "discussions" : "issues"; + } else { + if (isIssueContext) { + itemNumber = context.payload.issue?.number || context.payload.pull_request?.number || context.payload.discussion?.number; + if (context.payload.issue) { + commentEndpoint = "issues"; + } else { + core.info("Issue context detected but no issue found in payload"); + continue; + } + } else if (isPRContext) { + itemNumber = context.payload.pull_request?.number || context.payload.issue?.number || context.payload.discussion?.number; + if (context.payload.pull_request) { + commentEndpoint = "issues"; + } else { + core.info("Pull request context detected but no pull request found in payload"); + continue; + } + } else if (isDiscussionContext) { + itemNumber = context.payload.discussion?.number || context.payload.issue?.number || context.payload.pull_request?.number; + if (context.payload.discussion) { + commentEndpoint = "discussions"; + } else { + core.info("Discussion context detected but no discussion found in payload"); + continue; + } + } + } + if (!itemNumber) { + core.info("Could not determine issue, pull request, or discussion number"); + continue; + } + let body = commentItem.body.trim(); + const createdIssueUrl = process.env.GH_AW_CREATED_ISSUE_URL; + const createdIssueNumber = process.env.GH_AW_CREATED_ISSUE_NUMBER; + const createdDiscussionUrl = process.env.GH_AW_CREATED_DISCUSSION_URL; + const createdDiscussionNumber = process.env.GH_AW_CREATED_DISCUSSION_NUMBER; + const createdPullRequestUrl = process.env.GH_AW_CREATED_PULL_REQUEST_URL; + const createdPullRequestNumber = process.env.GH_AW_CREATED_PULL_REQUEST_NUMBER; + let hasReferences = false; + let referencesSection = "\n\n#### Related Items\n\n"; + if (createdIssueUrl && createdIssueNumber) { + referencesSection += `- Issue: [#${createdIssueNumber}](${createdIssueUrl})\n`; + hasReferences = true; + } + if (createdDiscussionUrl && createdDiscussionNumber) { + referencesSection += `- Discussion: [#${createdDiscussionNumber}](${createdDiscussionUrl})\n`; + hasReferences = true; + } + if (createdPullRequestUrl && createdPullRequestNumber) { + referencesSection += `- Pull Request: [#${createdPullRequestNumber}](${createdPullRequestUrl})\n`; + hasReferences = true; + } + if (hasReferences) { + body += referencesSection; + } + const workflowName = process.env.GH_AW_WORKFLOW_NAME || "Workflow"; + const workflowSource = process.env.GH_AW_WORKFLOW_SOURCE || ""; + const workflowSourceURL = process.env.GH_AW_WORKFLOW_SOURCE_URL || ""; + const runId = context.runId; + const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; + const runUrl = context.payload.repository + ? `${context.payload.repository.html_url}/actions/runs/${runId}` + : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`; + body += getCampaign("markdown"); + body += generateFooter( + workflowName, + runUrl, + workflowSource, + workflowSourceURL, + triggeringIssueNumber, + triggeringPRNumber, + triggeringDiscussionNumber + ); + try { + let comment; + if (commentEndpoint === "discussions") { + core.info(`Creating comment on discussion #${itemNumber}`); + core.info(`Comment content length: ${body.length}`); + let replyToId; + if (context.eventName === "discussion_comment" && context.payload?.comment?.node_id) { + replyToId = context.payload.comment.node_id; + core.info(`Creating threaded reply to comment ${replyToId}`); + } + comment = await commentOnDiscussion(github, context.repo.owner, context.repo.repo, itemNumber, body, replyToId); + core.info("Created discussion comment #" + comment.id + ": " + comment.html_url); + comment.discussion_url = comment.discussion_url; + } else { + core.info(`Creating comment on ${commentEndpoint} #${itemNumber}`); + core.info(`Comment content length: ${body.length}`); + const { data: restComment } = await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: itemNumber, + body: body, + }); + comment = restComment; + core.info("Created comment #" + comment.id + ": " + comment.html_url); + } + createdComments.push(comment); + if (i === commentItems.length - 1) { + core.setOutput("comment_id", comment.id); + core.setOutput("comment_url", comment.html_url); + } + } catch (error) { + core.error(`✗ Failed to create comment: ${error instanceof Error ? error.message : String(error)}`); + throw error; + } + } + if (createdComments.length > 0) { + let summaryContent = "\n\n## GitHub Comments\n"; + for (const comment of createdComments) { + summaryContent += `- Comment #${comment.id}: [View Comment](${comment.html_url})\n`; + } + await core.summary.addRaw(summaryContent).write(); + } + core.info(`Successfully created ${createdComments.length} comment(s)`); + return createdComments; + } + await main(); + agent: needs: activation runs-on: ubuntu-latest @@ -272,10 +682,10 @@ jobs: run: | mkdir -p /tmp/gh-aw/safeoutputs cat > /tmp/gh-aw/safeoutputs/config.json << 'EOF' - {"create_issue":{"max":1},"missing_tool":{},"noop":{"max":1}} + {"add_comment":{"max":1},"missing_tool":{},"noop":{"max":1}} EOF cat > /tmp/gh-aw/safeoutputs/tools.json << 'EOF' - [{"description":"Create a new GitHub issue","inputSchema":{"additionalProperties":false,"properties":{"body":{"description":"Issue body/description","type":"string"},"labels":{"description":"Issue labels","items":{"type":"string"},"type":"array"},"parent":{"description":"Parent issue number to create this issue as a sub-issue of","type":"number"},"title":{"description":"Issue title","type":"string"}},"required":["title","body"],"type":"object"},"name":"create_issue"},{"description":"Report a missing tool or functionality needed to complete tasks","inputSchema":{"additionalProperties":false,"properties":{"alternatives":{"description":"Possible alternatives or workarounds (max 256 characters)","type":"string"},"reason":{"description":"Why this tool is needed (max 256 characters)","type":"string"},"tool":{"description":"Name of the missing tool (max 128 characters)","type":"string"}},"required":["tool","reason"],"type":"object"},"name":"missing_tool"},{"description":"Log a message for transparency when no significant actions are needed. Use this to ensure workflows produce human-visible artifacts even when no other actions are taken (e.g., 'Analysis complete - no issues found').","inputSchema":{"additionalProperties":false,"properties":{"message":{"description":"Message to log for transparency","type":"string"}},"required":["message"],"type":"object"},"name":"noop"}] + [{"description":"Add a comment to a GitHub issue, pull request, or discussion","inputSchema":{"additionalProperties":false,"properties":{"body":{"description":"Comment body/content","type":"string"},"item_number":{"description":"Issue, pull request or discussion number","type":"number"}},"required":["body","item_number"],"type":"object"},"name":"add_comment"},{"description":"Report a missing tool or functionality needed to complete tasks","inputSchema":{"additionalProperties":false,"properties":{"alternatives":{"description":"Possible alternatives or workarounds (max 256 characters)","type":"string"},"reason":{"description":"Why this tool is needed (max 256 characters)","type":"string"},"tool":{"description":"Name of the missing tool (max 128 characters)","type":"string"}},"required":["tool","reason"],"type":"object"},"name":"missing_tool"},{"description":"Log a message for transparency when no significant actions are needed. Use this to ensure workflows produce human-visible artifacts even when no other actions are taken (e.g., 'Analysis complete - no issues found').","inputSchema":{"additionalProperties":false,"properties":{"message":{"description":"Message to log for transparency","type":"string"}},"required":["message"],"type":"object"},"name":"noop"}] EOF cat > /tmp/gh-aw/safeoutputs/mcp-server.cjs << 'EOF' const fs = require("fs"); @@ -900,7 +1310,7 @@ jobs: mkdir -p "$PROMPT_DIR" # shellcheck disable=SC2006,SC2287 cat > "$GH_AW_PROMPT" << 'PROMPT_EOF' - Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and post summary in an issue. + Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and add a comment to the current pull request with a summary. PROMPT_EOF - name: Append XPIA security instructions to prompt @@ -979,13 +1389,13 @@ jobs: --- - ## Creating an Issue, Reporting Missing Tools or Functionality + ## Adding a Comment to an Issue or Pull Request, Reporting Missing Tools or Functionality **IMPORTANT**: To do the actions mentioned in the header of this section, use the **safeoutputs** tools, do NOT attempt to use `gh`, do NOT attempt to use the GitHub API. You don't have write access to the GitHub repo. - **Creating an Issue** + **Adding a Comment to an Issue or Pull Request** - To create an issue, use the create-issue tool from safeoutputs + To add a comment to an issue or pull request, use the add-comments tool from safeoutputs **Reporting Missing Tools or Functionality** @@ -3776,9 +4186,9 @@ jobs: needs: - agent - activation - - create_issue + - add_comment - missing_tool - if: (always()) && (needs.agent.result != 'skipped') + if: ((always()) && (needs.agent.result != 'skipped')) && (!(needs.add_comment.outputs.comment_id)) runs-on: ubuntu-slim permissions: contents: read @@ -4055,360 +4465,6 @@ jobs: core.setFailed(error instanceof Error ? error.message : String(error)); }); - create_issue: - needs: - - agent - - detection - if: > - (((!cancelled()) && (needs.agent.result != 'skipped')) && (contains(needs.agent.outputs.output_types, 'create_issue'))) && - (needs.detection.outputs.success == 'true') - runs-on: ubuntu-slim - permissions: - contents: read - issues: write - timeout-minutes: 10 - outputs: - issue_number: ${{ steps.create_issue.outputs.issue_number }} - issue_url: ${{ steps.create_issue.outputs.issue_url }} - steps: - - name: Download agent output artifact - continue-on-error: true - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6 - with: - name: agent_output.json - path: /tmp/gh-aw/safeoutputs/ - - name: Setup agent output environment variable - run: | - mkdir -p /tmp/gh-aw/safeoutputs/ - find "/tmp/gh-aw/safeoutputs/" -type f -print - echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV" - - name: Create Output Issue - id: create_issue - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 - env: - GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }} - GH_AW_WORKFLOW_NAME: "Smoke Copilot" - GH_AW_SAFE_OUTPUTS_STAGED: "true" - with: - github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }} - script: | - function sanitizeLabelContent(content) { - if (!content || typeof content !== "string") { - return ""; - } - let sanitized = content.trim(); - sanitized = sanitized.replace(/\x1b\[[0-9;]*[mGKH]/g, ""); - sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, ""); - sanitized = sanitized.replace( - /(^|[^\w`])@([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\/[A-Za-z0-9._-]+)?)/g, - (_m, p1, p2) => `${p1}\`@${p2}\`` - ); - sanitized = sanitized.replace(/[<>&'"]/g, ""); - return sanitized.trim(); - } - const fs = require("fs"); - function loadAgentOutput() { - const agentOutputFile = process.env.GH_AW_AGENT_OUTPUT; - if (!agentOutputFile) { - core.info("No GH_AW_AGENT_OUTPUT environment variable found"); - return { success: false }; - } - let outputContent; - try { - outputContent = fs.readFileSync(agentOutputFile, "utf8"); - } catch (error) { - const errorMessage = `Error reading agent output file: ${error instanceof Error ? error.message : String(error)}`; - core.error(errorMessage); - return { success: false, error: errorMessage }; - } - if (outputContent.trim() === "") { - core.info("Agent output content is empty"); - return { success: false }; - } - core.info(`Agent output content length: ${outputContent.length}`); - let validatedOutput; - try { - validatedOutput = JSON.parse(outputContent); - } catch (error) { - const errorMessage = `Error parsing agent output JSON: ${error instanceof Error ? error.message : String(error)}`; - core.error(errorMessage); - return { success: false, error: errorMessage }; - } - if (!validatedOutput.items || !Array.isArray(validatedOutput.items)) { - core.info("No valid items found in agent output"); - return { success: false }; - } - return { success: true, items: validatedOutput.items }; - } - async function generateStagedPreview(options) { - const { title, description, items, renderItem } = options; - let summaryContent = `## 🎭 Staged Mode: ${title} Preview\n\n`; - summaryContent += `${description}\n\n`; - for (let i = 0; i < items.length; i++) { - const item = items[i]; - summaryContent += renderItem(item, i); - summaryContent += "---\n\n"; - } - try { - await core.summary.addRaw(summaryContent).write(); - core.info(summaryContent); - core.info(`📝 ${title} preview written to step summary`); - } catch (error) { - core.setFailed(error instanceof Error ? error : String(error)); - } - } - function generateFooter( - workflowName, - runUrl, - workflowSource, - workflowSourceURL, - triggeringIssueNumber, - triggeringPRNumber, - triggeringDiscussionNumber - ) { - let footer = `\n\n> AI generated by [${workflowName}](${runUrl})`; - if (triggeringIssueNumber) { - footer += ` for #${triggeringIssueNumber}`; - } else if (triggeringPRNumber) { - footer += ` for #${triggeringPRNumber}`; - } else if (triggeringDiscussionNumber) { - footer += ` for discussion #${triggeringDiscussionNumber}`; - } - if (workflowSource && workflowSourceURL) { - footer += `\n>\n> To add this workflow in your repository, run \`gh aw add ${workflowSource}\`. See [usage guide](https://githubnext.github.io/gh-aw/tools/cli/).`; - } - footer += "\n"; - return footer; - } - function getCampaign(format) { - const campaign = process.env.GH_AW_CAMPAIGN || ""; - if (campaign) { - core.info(`Campaign: ${campaign}`); - return format === "markdown" ? `\n\n` : campaign; - } - return ""; - } - async function main() { - core.setOutput("issue_number", ""); - core.setOutput("issue_url", ""); - const isStaged = process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true"; - const result = loadAgentOutput(); - if (!result.success) { - return; - } - const createIssueItems = result.items.filter(item => item.type === "create_issue"); - if (createIssueItems.length === 0) { - core.info("No create-issue items found in agent output"); - return; - } - core.info(`Found ${createIssueItems.length} create-issue item(s)`); - if (isStaged) { - await generateStagedPreview({ - title: "Create Issues", - description: "The following issues would be created if staged mode was disabled:", - items: createIssueItems, - renderItem: (item, index) => { - let content = `### Issue ${index + 1}\n`; - content += `**Title:** ${item.title || "No title provided"}\n\n`; - if (item.body) { - content += `**Body:**\n${item.body}\n\n`; - } - if (item.labels && item.labels.length > 0) { - content += `**Labels:** ${item.labels.join(", ")}\n\n`; - } - return content; - }, - }); - return; - } - const parentIssueNumber = context.payload?.issue?.number; - const triggeringIssueNumber = - context.payload?.issue?.number && !context.payload?.issue?.pull_request ? context.payload.issue.number : undefined; - const triggeringPRNumber = - context.payload?.pull_request?.number || (context.payload?.issue?.pull_request ? context.payload.issue.number : undefined); - const triggeringDiscussionNumber = context.payload?.discussion?.number; - const labelsEnv = process.env.GH_AW_ISSUE_LABELS; - let envLabels = labelsEnv - ? labelsEnv - .split(",") - .map(label => label.trim()) - .filter(label => label) - : []; - const createdIssues = []; - for (let i = 0; i < createIssueItems.length; i++) { - const createIssueItem = createIssueItems[i]; - core.info( - `Processing create-issue item ${i + 1}/${createIssueItems.length}: title=${createIssueItem.title}, bodyLength=${createIssueItem.body.length}` - ); - core.info(`Debug: createIssueItem.parent = ${JSON.stringify(createIssueItem.parent)}`); - core.info(`Debug: parentIssueNumber from context = ${JSON.stringify(parentIssueNumber)}`); - const effectiveParentIssueNumber = createIssueItem.parent !== undefined ? createIssueItem.parent : parentIssueNumber; - core.info(`Debug: effectiveParentIssueNumber = ${JSON.stringify(effectiveParentIssueNumber)}`); - if (effectiveParentIssueNumber && createIssueItem.parent !== undefined) { - core.info(`Using explicit parent issue number from item: #${effectiveParentIssueNumber}`); - } - let labels = [...envLabels]; - if (createIssueItem.labels && Array.isArray(createIssueItem.labels)) { - labels = [...labels, ...createIssueItem.labels]; - } - labels = labels - .filter(label => !!label) - .map(label => String(label).trim()) - .filter(label => label) - .map(label => sanitizeLabelContent(label)) - .filter(label => label) - .map(label => (label.length > 64 ? label.substring(0, 64) : label)) - .filter((label, index, arr) => arr.indexOf(label) === index); - let title = createIssueItem.title ? createIssueItem.title.trim() : ""; - let bodyLines = createIssueItem.body.split("\n"); - if (!title) { - title = createIssueItem.body || "Agent Output"; - } - const titlePrefix = process.env.GH_AW_ISSUE_TITLE_PREFIX; - if (titlePrefix && !title.startsWith(titlePrefix)) { - title = titlePrefix + title; - } - if (effectiveParentIssueNumber) { - core.info("Detected issue context, parent issue #" + effectiveParentIssueNumber); - bodyLines.push(`Related to #${effectiveParentIssueNumber}`); - } - const workflowName = process.env.GH_AW_WORKFLOW_NAME || "Workflow"; - const workflowSource = process.env.GH_AW_WORKFLOW_SOURCE || ""; - const workflowSourceURL = process.env.GH_AW_WORKFLOW_SOURCE_URL || ""; - const runId = context.runId; - const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com"; - const runUrl = context.payload.repository - ? `${context.payload.repository.html_url}/actions/runs/${runId}` - : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`; - const fingerprintComment = getCampaign("markdown"); - if (fingerprintComment) { - bodyLines.push(fingerprintComment); - } - bodyLines.push( - ``, - ``, - generateFooter( - workflowName, - runUrl, - workflowSource, - workflowSourceURL, - triggeringIssueNumber, - triggeringPRNumber, - triggeringDiscussionNumber - ).trimEnd(), - "" - ); - const body = bodyLines.join("\n").trim(); - core.info(`Creating issue with title: ${title}`); - core.info(`Labels: ${labels}`); - core.info(`Body length: ${body.length}`); - try { - const { data: issue } = await github.rest.issues.create({ - owner: context.repo.owner, - repo: context.repo.repo, - title: title, - body: body, - labels: labels, - }); - core.info("Created issue #" + issue.number + ": " + issue.html_url); - createdIssues.push(issue); - core.info(`Debug: About to check if sub-issue linking is needed. effectiveParentIssueNumber = ${effectiveParentIssueNumber}`); - if (effectiveParentIssueNumber) { - core.info(`Attempting to link issue #${issue.number} as sub-issue of #${effectiveParentIssueNumber}`); - try { - core.info(`Fetching node ID for parent issue #${effectiveParentIssueNumber}...`); - const getIssueNodeIdQuery = ` - query($owner: String!, $repo: String!, $issueNumber: Int!) { - repository(owner: $owner, name: $repo) { - issue(number: $issueNumber) { - id - } - } - } - `; - const parentResult = await github.graphql(getIssueNodeIdQuery, { - owner: context.repo.owner, - repo: context.repo.repo, - issueNumber: effectiveParentIssueNumber, - }); - const parentNodeId = parentResult.repository.issue.id; - core.info(`Parent issue node ID: ${parentNodeId}`); - core.info(`Fetching node ID for child issue #${issue.number}...`); - const childResult = await github.graphql(getIssueNodeIdQuery, { - owner: context.repo.owner, - repo: context.repo.repo, - issueNumber: issue.number, - }); - const childNodeId = childResult.repository.issue.id; - core.info(`Child issue node ID: ${childNodeId}`); - core.info(`Executing addSubIssue mutation...`); - const addSubIssueMutation = ` - mutation($issueId: ID!, $subIssueId: ID!) { - addSubIssue(input: { - issueId: $issueId, - subIssueId: $subIssueId - }) { - subIssue { - id - number - } - } - } - `; - await github.graphql(addSubIssueMutation, { - issueId: parentNodeId, - subIssueId: childNodeId, - }); - core.info("✓ Successfully linked issue #" + issue.number + " as sub-issue of #" + effectiveParentIssueNumber); - } catch (error) { - core.info(`Warning: Could not link sub-issue to parent: ${error instanceof Error ? error.message : String(error)}`); - core.info(`Error details: ${error instanceof Error ? error.stack : String(error)}`); - try { - core.info(`Attempting fallback: adding comment to parent issue #${effectiveParentIssueNumber}...`); - await github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: effectiveParentIssueNumber, - body: `Created related issue: #${issue.number}`, - }); - core.info("✓ Added comment to parent issue #" + effectiveParentIssueNumber + " (sub-issue linking not available)"); - } catch (commentError) { - core.info( - `Warning: Could not add comment to parent issue: ${commentError instanceof Error ? commentError.message : String(commentError)}` - ); - } - } - } else { - core.info(`Debug: No parent issue number set, skipping sub-issue linking`); - } - if (i === createIssueItems.length - 1) { - core.setOutput("issue_number", issue.number); - core.setOutput("issue_url", issue.html_url); - } - } catch (error) { - const errorMessage = error instanceof Error ? error.message : String(error); - if (errorMessage.includes("Issues has been disabled in this repository")) { - core.info(`⚠ Cannot create issue "${title}": Issues are disabled for this repository`); - core.info("Consider enabling issues in repository settings if you want to create issues automatically"); - continue; - } - core.error(`✗ Failed to create issue "${title}": ${errorMessage}`); - throw error; - } - } - if (createdIssues.length > 0) { - let summaryContent = "\n\n## GitHub Issues\n"; - for (const issue of createdIssues) { - summaryContent += `- Issue #${issue.number}: [${issue.title}](${issue.html_url})\n`; - } - await core.summary.addRaw(summaryContent).write(); - } - core.info(`Successfully created ${createdIssues.length} issue(s)`); - } - (async () => { - await main(); - })(); - detection: needs: agent if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true' diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md index 54ca1a7fbb2..b5601d08ebd 100644 --- a/.github/workflows/smoke-copilot.md +++ b/.github/workflows/smoke-copilot.md @@ -24,9 +24,9 @@ tools: github: safe-outputs: staged: true - create-issue: + add-comment: timeout-minutes: 10 strict: true --- -Review the last 2 merged pull requests in the ${{ github.repository }} repository and post summary in an issue. \ No newline at end of file +Review the last 2 merged pull requests in the ${{ github.repository }} repository and add a comment to the current pull request with a summary. \ No newline at end of file From c6ff072531ce76bd497830a2efa9d586bb536c6b Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Nov 2025 17:05:56 +0000 Subject: [PATCH 4/7] Add comprehensive capability testing to smoke workflows - Added GitHub MCP testing (review last 2 merged PRs) - Added Playwright MCP testing (navigate to example.com) - Added file writing capability testing (create test file) - Added bash tool testing (verify file creation) - Updated frontmatter with network permissions and tool configurations - Set strict=false for Claude and Codex (firewall not supported) - All workflows compile successfully with appropriate warnings Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-claude.lock.yml | 98 +++++++++++++++++++++++- .github/workflows/smoke-claude.md | 32 +++++++- .github/workflows/smoke-codex.lock.yml | 67 +++++++++++++++- .github/workflows/smoke-codex.md | 32 +++++++- .github/workflows/smoke-copilot.lock.yml | 62 ++++++++++----- .github/workflows/smoke-copilot.md | 25 +++++- 6 files changed, 286 insertions(+), 30 deletions(-) diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index c43d530f31c..1799b16acb9 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -707,7 +707,7 @@ jobs: # Domain allow-list (populated during generation) # JSON array safely embedded as Python list literal - ALLOWED_DOMAINS = ["crl3.digicert.com","crl4.digicert.com","ocsp.digicert.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","crl.geotrust.com","ocsp.geotrust.com","crl.thawte.com","ocsp.thawte.com","crl.verisign.com","ocsp.verisign.com","crl.globalsign.com","ocsp.globalsign.com","crls.ssl.com","ocsp.ssl.com","crl.identrust.com","ocsp.identrust.com","crl.sectigo.com","ocsp.sectigo.com","crl.usertrust.com","ocsp.usertrust.com","s.symcb.com","s.symcd.com","json-schema.org","json.schemastore.org","archive.ubuntu.com","security.ubuntu.com","ppa.launchpad.net","keyserver.ubuntu.com","azure.archive.ubuntu.com","api.snapcraft.io","packagecloud.io","packages.cloud.google.com","packages.microsoft.com"] + ALLOWED_DOMAINS = ["crl3.digicert.com","crl4.digicert.com","ocsp.digicert.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","crl.geotrust.com","ocsp.geotrust.com","crl.thawte.com","ocsp.thawte.com","crl.verisign.com","ocsp.verisign.com","crl.globalsign.com","ocsp.globalsign.com","crls.ssl.com","ocsp.ssl.com","crl.identrust.com","ocsp.identrust.com","crl.sectigo.com","ocsp.sectigo.com","crl.usertrust.com","ocsp.usertrust.com","s.symcb.com","s.symcd.com","json-schema.org","json.schemastore.org","archive.ubuntu.com","security.ubuntu.com","ppa.launchpad.net","keyserver.ubuntu.com","azure.archive.ubuntu.com","api.snapcraft.io","packagecloud.io","packages.cloud.google.com","packages.microsoft.com","example.com"] def extract_domain(url_or_query): """Extract domain from URL or search query.""" @@ -1379,6 +1379,16 @@ jobs: "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_MCP_SERVER_TOKEN" } }, + "playwright": { + "command": "npx", + "args": [ + "@playwright/mcp@0.0.47", + "--output-dir", + "/tmp/gh-aw/mcp-logs/playwright", + "--allowed-origins", + "localhost;localhost:*;127.0.0.1;127.0.0.1:*;example.com" + ] + }, "safeoutputs": { "command": "node", "args": ["/tmp/gh-aw/safeoutputs/mcp-server.cjs"], @@ -1514,7 +1524,25 @@ jobs: This proactive approach eliminates retry loops and reduces token consumption. - Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and add a comment to the current pull request with a summary. + # Smoke Test: Claude Engine Validation + + This smoke test validates Claude engine functionality by testing core capabilities: + + ## Test Requirements + + 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${GH_AW_EXPR_D892F163} + 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-claude-${GH_AW_EXPR_B50B6E9C}.txt` with content "Smoke test passed for Claude at $(date)" + 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) + 4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + + ## Output + + Add a comment to the current pull request with: + - Summary of the 2 merged PRs + - File writing test result (success/failure) + - Bash tool test result (file content verification) + - Playwright test result (page title verification) + - Overall smoke test status for **Claude engine** PROMPT_EOF - name: Append XPIA security instructions to prompt @@ -1563,6 +1591,40 @@ jobs: **IMPORTANT**: When you need to create temporary files or directories during your work, **always use the `/tmp/gh-aw/agent/` directory** that has been pre-created for you. Do NOT use the root `/tmp/` directory directly. + PROMPT_EOF + - name: Append playwright output directory instructions to prompt + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + run: | + # shellcheck disable=SC2006,SC2287 + cat >> "$GH_AW_PROMPT" << PROMPT_EOF + + --- + + ## Playwright Output Directory + + **IMPORTANT**: When using Playwright tools to take screenshots or generate files, **all output files are automatically saved to `/tmp/gh-aw/mcp-logs/playwright/`**. This is the Playwright --output-dir and you can find any screenshots, traces, or other files generated by Playwright in this directory. + + PROMPT_EOF + - name: Append edit tool accessibility instructions to prompt + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + run: | + # shellcheck disable=SC2006,SC2287 + cat >> "$GH_AW_PROMPT" << PROMPT_EOF + + + --- + + ## File Editing Access + + **IMPORTANT**: The edit tool provides file editing capabilities. You have write access to files in the following directories: + + - **Current workspace**: `$GITHUB_WORKSPACE` - The repository you're working on + - **Temporary directory**: `/tmp/gh-aw/` - For temporary files and agent work + + **Do NOT** attempt to edit files outside these directories as you do not have the necessary permissions. + PROMPT_EOF - name: Append safe outputs instructions to prompt env: @@ -1626,6 +1688,7 @@ jobs: env: GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt GH_AW_EXPR_D892F163: ${{ github.repository }} + GH_AW_EXPR_B50B6E9C: ${{ github.run_id }} with: script: | const fs = require("fs"); @@ -1751,10 +1814,16 @@ jobs: - name: Execute Claude Code CLI id: agentic_execution # Allowed tools (sorted): + # - Bash + # - BashOutput + # - Edit # - ExitPlanMode # - Glob # - Grep + # - KillBash # - LS + # - MultiEdit + # - NotebookEdit # - NotebookRead # - Read # - Task @@ -1812,11 +1881,32 @@ jobs: # - mcp__github__search_pull_requests # - mcp__github__search_repositories # - mcp__github__search_users + # - mcp__playwright__browser_click + # - mcp__playwright__browser_close + # - mcp__playwright__browser_console_messages + # - mcp__playwright__browser_drag + # - mcp__playwright__browser_evaluate + # - mcp__playwright__browser_file_upload + # - mcp__playwright__browser_fill_form + # - mcp__playwright__browser_handle_dialog + # - mcp__playwright__browser_hover + # - mcp__playwright__browser_install + # - mcp__playwright__browser_navigate + # - mcp__playwright__browser_navigate_back + # - mcp__playwright__browser_network_requests + # - mcp__playwright__browser_press_key + # - mcp__playwright__browser_resize + # - mcp__playwright__browser_select_option + # - mcp__playwright__browser_snapshot + # - mcp__playwright__browser_tabs + # - mcp__playwright__browser_take_screenshot + # - mcp__playwright__browser_type + # - mcp__playwright__browser_wait_for timeout-minutes: 10 run: | set -o pipefail # Execute Claude Code CLI with prompt from file - claude --print --max-turns 15 --mcp-config /tmp/gh-aw/mcp-config/mcp-servers.json --allowed-tools ExitPlanMode,Glob,Grep,LS,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users --debug --verbose --permission-mode bypassPermissions --output-format stream-json --settings /tmp/gh-aw/.claude/settings.json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee /tmp/gh-aw/agent-stdio.log + claude --print --max-turns 15 --mcp-config /tmp/gh-aw/mcp-config/mcp-servers.json --allowed-tools Bash,BashOutput,Edit,ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,NotebookEdit,NotebookRead,Read,Task,TodoWrite,Write,mcp__github__download_workflow_run_artifact,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__get_workflow_run,mcp__github__get_workflow_run_logs,mcp__github__get_workflow_run_usage,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__list_workflow_jobs,mcp__github__list_workflow_run_artifacts,mcp__github__list_workflow_runs,mcp__github__list_workflows,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__playwright__browser_click,mcp__playwright__browser_close,mcp__playwright__browser_console_messages,mcp__playwright__browser_drag,mcp__playwright__browser_evaluate,mcp__playwright__browser_file_upload,mcp__playwright__browser_fill_form,mcp__playwright__browser_handle_dialog,mcp__playwright__browser_hover,mcp__playwright__browser_install,mcp__playwright__browser_navigate,mcp__playwright__browser_navigate_back,mcp__playwright__browser_network_requests,mcp__playwright__browser_press_key,mcp__playwright__browser_resize,mcp__playwright__browser_select_option,mcp__playwright__browser_snapshot,mcp__playwright__browser_tabs,mcp__playwright__browser_take_screenshot,mcp__playwright__browser_type,mcp__playwright__browser_wait_for --debug --verbose --permission-mode bypassPermissions --output-format stream-json --settings /tmp/gh-aw/.claude/settings.json "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)" 2>&1 | tee /tmp/gh-aw/agent-stdio.log env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} @@ -1966,7 +2056,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com" + GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,example.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-claude.md b/.github/workflows/smoke-claude.md index bc6c429272b..0b002d4f476 100644 --- a/.github/workflows/smoke-claude.md +++ b/.github/workflows/smoke-claude.md @@ -18,14 +18,42 @@ engine: max-turns: 15 imports: - shared/mcp-pagination.md +network: + allowed: + - defaults + - example.com tools: github: toolsets: [repos, pull_requests] + playwright: + allowed_domains: + - example.com + edit: + bash: + - "*" safe-outputs: staged: true add-comment: timeout-minutes: 10 -strict: true +strict: false --- -Review the last 2 merged pull requests in the ${{ github.repository }} repository and add a comment to the current pull request with a summary. \ No newline at end of file +# Smoke Test: Claude Engine Validation + +This smoke test validates Claude engine functionality by testing core capabilities: + +## Test Requirements + +1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${{ github.repository }} +2. **File Writing Testing**: Create a test file `/tmp/smoke-test-claude-${{ github.run_id }}.txt` with content "Smoke test passed for Claude at $(date)" +3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) +4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + +## Output + +Add a comment to the current pull request with: +- Summary of the 2 merged PRs +- File writing test result (success/failure) +- Bash tool test result (file content verification) +- Playwright test result (page title verification) +- Overall smoke test status for **Claude engine** \ No newline at end of file diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index a6dfea1ee28..c94fc8850a7 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -1272,6 +1272,16 @@ jobs: ] env_vars = ["GITHUB_PERSONAL_ACCESS_TOKEN"] + [mcp_servers.playwright] + command = "npx" + args = [ + "@playwright/mcp@0.0.47", + "--output-dir", + "/tmp/gh-aw/mcp-logs/playwright", + "--allowed-origins", + "localhost;localhost:*;127.0.0.1;127.0.0.1:*;example.com" + ] + [mcp_servers.safeoutputs] command = "node" args = [ @@ -1288,7 +1298,25 @@ jobs: mkdir -p "$PROMPT_DIR" # shellcheck disable=SC2006,SC2287 cat > "$GH_AW_PROMPT" << 'PROMPT_EOF' - Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and add a comment to the current pull request with a summary. + # Smoke Test: Codex Engine Validation + + This smoke test validates Codex engine functionality by testing core capabilities: + + ## Test Requirements + + 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${GH_AW_EXPR_D892F163} + 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-codex-${GH_AW_EXPR_B50B6E9C}.txt` with content "Smoke test passed for Codex at $(date)" + 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) + 4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + + ## Output + + Add a comment to the current pull request with: + - Summary of the 2 merged PRs + - File writing test result (success/failure) + - Bash tool test result (file content verification) + - Playwright test result (page title verification) + - Overall smoke test status for **Codex engine** PROMPT_EOF - name: Append XPIA security instructions to prompt @@ -1337,6 +1365,40 @@ jobs: **IMPORTANT**: When you need to create temporary files or directories during your work, **always use the `/tmp/gh-aw/agent/` directory** that has been pre-created for you. Do NOT use the root `/tmp/` directory directly. + PROMPT_EOF + - name: Append playwright output directory instructions to prompt + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + run: | + # shellcheck disable=SC2006,SC2287 + cat >> "$GH_AW_PROMPT" << PROMPT_EOF + + --- + + ## Playwright Output Directory + + **IMPORTANT**: When using Playwright tools to take screenshots or generate files, **all output files are automatically saved to `/tmp/gh-aw/mcp-logs/playwright/`**. This is the Playwright --output-dir and you can find any screenshots, traces, or other files generated by Playwright in this directory. + + PROMPT_EOF + - name: Append edit tool accessibility instructions to prompt + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + run: | + # shellcheck disable=SC2006,SC2287 + cat >> "$GH_AW_PROMPT" << PROMPT_EOF + + + --- + + ## File Editing Access + + **IMPORTANT**: The edit tool provides file editing capabilities. You have write access to files in the following directories: + + - **Current workspace**: `$GITHUB_WORKSPACE` - The repository you're working on + - **Temporary directory**: `/tmp/gh-aw/` - For temporary files and agent work + + **Do NOT** attempt to edit files outside these directories as you do not have the necessary permissions. + PROMPT_EOF - name: Append safe outputs instructions to prompt env: @@ -1400,6 +1462,7 @@ jobs: env: GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt GH_AW_EXPR_D892F163: ${{ github.repository }} + GH_AW_EXPR_B50B6E9C: ${{ github.run_id }} with: script: | const fs = require("fs"); @@ -1668,7 +1731,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com" + GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,example.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-codex.md b/.github/workflows/smoke-codex.md index 4f0ddfb7903..fa08d0c7787 100644 --- a/.github/workflows/smoke-codex.md +++ b/.github/workflows/smoke-codex.md @@ -13,13 +13,41 @@ permissions: pull-requests: read name: Smoke Codex engine: codex +network: + allowed: + - defaults + - example.com tools: github: + playwright: + allowed_domains: + - example.com + edit: + bash: + - "*" safe-outputs: staged: true add-comment: timeout-minutes: 10 -strict: true +strict: false --- -Review the last 2 merged pull requests in the ${{ github.repository }} repository and add a comment to the current pull request with a summary. \ No newline at end of file +# Smoke Test: Codex Engine Validation + +This smoke test validates Codex engine functionality by testing core capabilities: + +## Test Requirements + +1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${{ github.repository }} +2. **File Writing Testing**: Create a test file `/tmp/smoke-test-codex-${{ github.run_id }}.txt` with content "Smoke test passed for Codex at $(date)" +3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) +4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + +## Output + +Add a comment to the current pull request with: +- Summary of the 2 merged PRs +- File writing test result (success/failure) +- Bash tool test result (file content verification) +- Playwright test result (page title verification) +- Overall smoke test status for **Codex engine** \ No newline at end of file diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 1dbe760cb76..92c1d941b7f 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -1277,6 +1277,12 @@ jobs: "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}" } }, + "playwright": { + "type": "local", + "command": "npx", + "args": ["@playwright/mcp@0.0.47", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", "localhost;localhost:*;127.0.0.1;127.0.0.1:*;example.com"], + "tools": ["*"] + }, "safeoutputs": { "type": "local", "command": "node", @@ -1310,7 +1316,25 @@ jobs: mkdir -p "$PROMPT_DIR" # shellcheck disable=SC2006,SC2287 cat > "$GH_AW_PROMPT" << 'PROMPT_EOF' - Review the last 2 merged pull requests in the ${GH_AW_EXPR_D892F163} repository and add a comment to the current pull request with a summary. + # Smoke Test: Copilot Engine Validation + + This smoke test validates Copilot engine functionality by testing core capabilities: + + ## Test Requirements + + 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${GH_AW_EXPR_D892F163} + 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-copilot-${GH_AW_EXPR_B50B6E9C}.txt` with content "Smoke test passed for Copilot at $(date)" + 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) + 4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + + ## Output + + Add a comment to the current pull request with: + - Summary of the 2 merged PRs + - File writing test result (success/failure) + - Bash tool test result (file content verification) + - Playwright test result (page title verification) + - Overall smoke test status for **Copilot engine** PROMPT_EOF - name: Append XPIA security instructions to prompt @@ -1359,6 +1383,20 @@ jobs: **IMPORTANT**: When you need to create temporary files or directories during your work, **always use the `/tmp/gh-aw/agent/` directory** that has been pre-created for you. Do NOT use the root `/tmp/` directory directly. + PROMPT_EOF + - name: Append playwright output directory instructions to prompt + env: + GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt + run: | + # shellcheck disable=SC2006,SC2287 + cat >> "$GH_AW_PROMPT" << PROMPT_EOF + + --- + + ## Playwright Output Directory + + **IMPORTANT**: When using Playwright tools to take screenshots or generate files, **all output files are automatically saved to `/tmp/gh-aw/mcp-logs/playwright/`**. This is the Playwright --output-dir and you can find any screenshots, traces, or other files generated by Playwright in this directory. + PROMPT_EOF - name: Append edit tool accessibility instructions to prompt env: @@ -1442,6 +1480,7 @@ jobs: env: GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt GH_AW_EXPR_D892F163: ${{ github.repository }} + GH_AW_EXPR_B50B6E9C: ${{ github.run_id }} with: script: | const fs = require("fs"); @@ -1567,26 +1606,11 @@ jobs: - name: Execute GitHub Copilot CLI id: agentic_execution # Copilot CLI tool arguments (sorted): - # --allow-tool github - # --allow-tool safeoutputs - # --allow-tool shell(cat) - # --allow-tool shell(date) - # --allow-tool shell(echo) - # --allow-tool shell(grep) - # --allow-tool shell(head) - # --allow-tool shell(ls) - # --allow-tool shell(pwd) - # --allow-tool shell(sort) - # --allow-tool shell(tail) - # --allow-tool shell(uniq) - # --allow-tool shell(wc) - # --allow-tool shell(yq) - # --allow-tool write timeout-minutes: 10 run: | set -o pipefail - sudo -E awf --env-all --allow-domains api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com --log-level info \ - "npx -y @github/copilot@0.0.358 --add-dir /tmp/gh-aw/ --log-level all --disable-builtin-mcps --allow-tool github --allow-tool safeoutputs --allow-tool 'shell(cat)' --allow-tool 'shell(date)' --allow-tool 'shell(echo)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(ls)' --allow-tool 'shell(pwd)' --allow-tool 'shell(sort)' --allow-tool 'shell(tail)' --allow-tool 'shell(uniq)' --allow-tool 'shell(wc)' --allow-tool 'shell(yq)' --allow-tool write --allow-all-paths --prompt \"\$(cat /tmp/gh-aw/aw-prompts/prompt.txt)\"" \ + sudo -E awf --env-all --allow-domains api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,example.com,get.pnpm.io,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com --log-level info \ + "npx -y @github/copilot@0.0.358 --add-dir /tmp/gh-aw/ --log-level all --disable-builtin-mcps --allow-all-tools --allow-all-paths --prompt \"\$(cat /tmp/gh-aw/aw-prompts/prompt.txt)\"" \ 2>&1 | tee /tmp/gh-aw/agent-stdio.log # Move preserved Copilot logs to expected location @@ -1738,7 +1762,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com" + GH_AW_ALLOWED_DOMAINS: "api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,example.com,get.pnpm.io,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md index b5601d08ebd..296569d625c 100644 --- a/.github/workflows/smoke-copilot.md +++ b/.github/workflows/smoke-copilot.md @@ -17,11 +17,16 @@ network: allowed: - defaults - node + - example.com firewall: true tools: edit: bash: + - "*" github: + playwright: + allowed_domains: + - example.com safe-outputs: staged: true add-comment: @@ -29,4 +34,22 @@ timeout-minutes: 10 strict: true --- -Review the last 2 merged pull requests in the ${{ github.repository }} repository and add a comment to the current pull request with a summary. \ No newline at end of file +# Smoke Test: Copilot Engine Validation + +This smoke test validates Copilot engine functionality by testing core capabilities: + +## Test Requirements + +1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${{ github.repository }} +2. **File Writing Testing**: Create a test file `/tmp/smoke-test-copilot-${{ github.run_id }}.txt` with content "Smoke test passed for Copilot at $(date)" +3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) +4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + +## Output + +Add a comment to the current pull request with: +- Summary of the 2 merged PRs +- File writing test result (success/failure) +- Bash tool test result (file content verification) +- Playwright test result (page title verification) +- Overall smoke test status for **Copilot engine** \ No newline at end of file From 7be9bcc31c7aa13021dbaae117c96cf73df90dde Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Nov 2025 17:23:08 +0000 Subject: [PATCH 5/7] Use github.com for Playwright and strict mode for all engines - Changed example.com to github.com in playwright allowed_domains - Updated test instructions to navigate to github.com - Set strict: true for all three engines (Claude, Codex, Copilot) - Removed network restrictions for Claude and Codex (required for strict mode) - Kept network restrictions with firewall for Copilot (supports firewall) - All workflows compile successfully in strict mode Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-claude.lock.yml | 8 ++++---- .github/workflows/smoke-claude.md | 10 +++------- .github/workflows/smoke-codex.lock.yml | 6 +++--- .github/workflows/smoke-codex.md | 10 +++------- .github/workflows/smoke-copilot.lock.yml | 8 ++++---- .github/workflows/smoke-copilot.md | 6 +++--- 6 files changed, 20 insertions(+), 28 deletions(-) diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 1799b16acb9..0eb824d1f73 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -707,7 +707,7 @@ jobs: # Domain allow-list (populated during generation) # JSON array safely embedded as Python list literal - ALLOWED_DOMAINS = ["crl3.digicert.com","crl4.digicert.com","ocsp.digicert.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","crl.geotrust.com","ocsp.geotrust.com","crl.thawte.com","ocsp.thawte.com","crl.verisign.com","ocsp.verisign.com","crl.globalsign.com","ocsp.globalsign.com","crls.ssl.com","ocsp.ssl.com","crl.identrust.com","ocsp.identrust.com","crl.sectigo.com","ocsp.sectigo.com","crl.usertrust.com","ocsp.usertrust.com","s.symcb.com","s.symcd.com","json-schema.org","json.schemastore.org","archive.ubuntu.com","security.ubuntu.com","ppa.launchpad.net","keyserver.ubuntu.com","azure.archive.ubuntu.com","api.snapcraft.io","packagecloud.io","packages.cloud.google.com","packages.microsoft.com","example.com"] + ALLOWED_DOMAINS = ["crl3.digicert.com","crl4.digicert.com","ocsp.digicert.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","crl.geotrust.com","ocsp.geotrust.com","crl.thawte.com","ocsp.thawte.com","crl.verisign.com","ocsp.verisign.com","crl.globalsign.com","ocsp.globalsign.com","crls.ssl.com","ocsp.ssl.com","crl.identrust.com","ocsp.identrust.com","crl.sectigo.com","ocsp.sectigo.com","crl.usertrust.com","ocsp.usertrust.com","s.symcb.com","s.symcd.com","json-schema.org","json.schemastore.org","archive.ubuntu.com","security.ubuntu.com","ppa.launchpad.net","keyserver.ubuntu.com","azure.archive.ubuntu.com","api.snapcraft.io","packagecloud.io","packages.cloud.google.com","packages.microsoft.com"] def extract_domain(url_or_query): """Extract domain from URL or search query.""" @@ -1386,7 +1386,7 @@ jobs: "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", - "localhost;localhost:*;127.0.0.1;127.0.0.1:*;example.com" + "localhost;localhost:*;127.0.0.1;127.0.0.1:*;github.com" ] }, "safeoutputs": { @@ -1533,7 +1533,7 @@ jobs: 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${GH_AW_EXPR_D892F163} 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-claude-${GH_AW_EXPR_B50B6E9C}.txt` with content "Smoke test passed for Claude at $(date)" 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) - 4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + 4. **Playwright MCP Testing**: Use playwright to navigate to https://github.com and verify the page title contains "GitHub" ## Output @@ -2056,7 +2056,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,example.com" + GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-claude.md b/.github/workflows/smoke-claude.md index 0b002d4f476..7050a175ac5 100644 --- a/.github/workflows/smoke-claude.md +++ b/.github/workflows/smoke-claude.md @@ -18,16 +18,12 @@ engine: max-turns: 15 imports: - shared/mcp-pagination.md -network: - allowed: - - defaults - - example.com tools: github: toolsets: [repos, pull_requests] playwright: allowed_domains: - - example.com + - github.com edit: bash: - "*" @@ -35,7 +31,7 @@ safe-outputs: staged: true add-comment: timeout-minutes: 10 -strict: false +strict: true --- # Smoke Test: Claude Engine Validation @@ -47,7 +43,7 @@ This smoke test validates Claude engine functionality by testing core capabiliti 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${{ github.repository }} 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-claude-${{ github.run_id }}.txt` with content "Smoke test passed for Claude at $(date)" 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) -4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" +4. **Playwright MCP Testing**: Use playwright to navigate to https://github.com and verify the page title contains "GitHub" ## Output diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index c94fc8850a7..8bfd5469315 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -1279,7 +1279,7 @@ jobs: "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", - "localhost;localhost:*;127.0.0.1;127.0.0.1:*;example.com" + "localhost;localhost:*;127.0.0.1;127.0.0.1:*;github.com" ] [mcp_servers.safeoutputs] @@ -1307,7 +1307,7 @@ jobs: 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${GH_AW_EXPR_D892F163} 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-codex-${GH_AW_EXPR_B50B6E9C}.txt` with content "Smoke test passed for Codex at $(date)" 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) - 4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + 4. **Playwright MCP Testing**: Use playwright to navigate to https://github.com and verify the page title contains "GitHub" ## Output @@ -1731,7 +1731,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,example.com" + GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-codex.md b/.github/workflows/smoke-codex.md index fa08d0c7787..6ae48f7955f 100644 --- a/.github/workflows/smoke-codex.md +++ b/.github/workflows/smoke-codex.md @@ -13,15 +13,11 @@ permissions: pull-requests: read name: Smoke Codex engine: codex -network: - allowed: - - defaults - - example.com tools: github: playwright: allowed_domains: - - example.com + - github.com edit: bash: - "*" @@ -29,7 +25,7 @@ safe-outputs: staged: true add-comment: timeout-minutes: 10 -strict: false +strict: true --- # Smoke Test: Codex Engine Validation @@ -41,7 +37,7 @@ This smoke test validates Codex engine functionality by testing core capabilitie 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${{ github.repository }} 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-codex-${{ github.run_id }}.txt` with content "Smoke test passed for Codex at $(date)" 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) -4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" +4. **Playwright MCP Testing**: Use playwright to navigate to https://github.com and verify the page title contains "GitHub" ## Output diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 92c1d941b7f..7cc950ca01c 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -1280,7 +1280,7 @@ jobs: "playwright": { "type": "local", "command": "npx", - "args": ["@playwright/mcp@0.0.47", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", "localhost;localhost:*;127.0.0.1;127.0.0.1:*;example.com"], + "args": ["@playwright/mcp@0.0.47", "--output-dir", "/tmp/gh-aw/mcp-logs/playwright", "--allowed-origins", "localhost;localhost:*;127.0.0.1;127.0.0.1:*;github.com"], "tools": ["*"] }, "safeoutputs": { @@ -1325,7 +1325,7 @@ jobs: 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${GH_AW_EXPR_D892F163} 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-copilot-${GH_AW_EXPR_B50B6E9C}.txt` with content "Smoke test passed for Copilot at $(date)" 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) - 4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" + 4. **Playwright MCP Testing**: Use playwright to navigate to https://github.com and verify the page title contains "GitHub" ## Output @@ -1609,7 +1609,7 @@ jobs: timeout-minutes: 10 run: | set -o pipefail - sudo -E awf --env-all --allow-domains api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,example.com,get.pnpm.io,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com --log-level info \ + sudo -E awf --env-all --allow-domains '*.githubusercontent.com,api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info \ "npx -y @github/copilot@0.0.358 --add-dir /tmp/gh-aw/ --log-level all --disable-builtin-mcps --allow-all-tools --allow-all-paths --prompt \"\$(cat /tmp/gh-aw/aw-prompts/prompt.txt)\"" \ 2>&1 | tee /tmp/gh-aw/agent-stdio.log @@ -1762,7 +1762,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,example.com,get.pnpm.io,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com" + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md index 296569d625c..5cceb64a579 100644 --- a/.github/workflows/smoke-copilot.md +++ b/.github/workflows/smoke-copilot.md @@ -17,7 +17,7 @@ network: allowed: - defaults - node - - example.com + - github firewall: true tools: edit: @@ -26,7 +26,7 @@ tools: github: playwright: allowed_domains: - - example.com + - github.com safe-outputs: staged: true add-comment: @@ -43,7 +43,7 @@ This smoke test validates Copilot engine functionality by testing core capabilit 1. **GitHub MCP Testing**: Review the last 2 merged pull requests in ${{ github.repository }} 2. **File Writing Testing**: Create a test file `/tmp/smoke-test-copilot-${{ github.run_id }}.txt` with content "Smoke test passed for Copilot at $(date)" 3. **Bash Tool Testing**: Execute bash commands to verify file creation was successful (use `cat` to read the file back) -4. **Playwright MCP Testing**: Use playwright to navigate to https://example.com and verify the page title contains "Example" +4. **Playwright MCP Testing**: Use playwright to navigate to https://github.com and verify the page title contains "GitHub" ## Output From c097a9718d7b6817e3f9b84ebe2af674b877b638 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 19 Nov 2025 17:29:32 +0000 Subject: [PATCH 6/7] Add changeset [skip-ci] --- .changeset/patch-update-smoke-test-workflows.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/patch-update-smoke-test-workflows.md diff --git a/.changeset/patch-update-smoke-test-workflows.md b/.changeset/patch-update-smoke-test-workflows.md new file mode 100644 index 00000000000..9863cd5987b --- /dev/null +++ b/.changeset/patch-update-smoke-test-workflows.md @@ -0,0 +1,5 @@ +--- +"gh-aw": patch +--- + +Update smoke test workflows to use add-comment and add comprehensive capability testing From 92420d878f6efaab5d831732fb7fbb8b8d17a025 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Nov 2025 19:22:01 +0000 Subject: [PATCH 7/7] Add playwright ecosystem to network allowed for MCP support - Added playwright ecosystem to network.allowed for Claude and Codex - Set strict: false for Claude and Codex (required for network restrictions) - Copilot maintains strict: true with playwright ecosystem - Fixes playwright MCP loading issue in smoke tests - All workflows compile successfully with appropriate warnings Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-claude.lock.yml | 4 ++-- .github/workflows/smoke-claude.md | 7 ++++++- .github/workflows/smoke-codex.lock.yml | 2 +- .github/workflows/smoke-codex.md | 7 ++++++- .github/workflows/smoke-copilot.lock.yml | 4 ++-- .github/workflows/smoke-copilot.md | 1 + 6 files changed, 18 insertions(+), 7 deletions(-) diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 0eb824d1f73..788aa92b29f 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -707,7 +707,7 @@ jobs: # Domain allow-list (populated during generation) # JSON array safely embedded as Python list literal - ALLOWED_DOMAINS = ["crl3.digicert.com","crl4.digicert.com","ocsp.digicert.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","crl.geotrust.com","ocsp.geotrust.com","crl.thawte.com","ocsp.thawte.com","crl.verisign.com","ocsp.verisign.com","crl.globalsign.com","ocsp.globalsign.com","crls.ssl.com","ocsp.ssl.com","crl.identrust.com","ocsp.identrust.com","crl.sectigo.com","ocsp.sectigo.com","crl.usertrust.com","ocsp.usertrust.com","s.symcb.com","s.symcd.com","json-schema.org","json.schemastore.org","archive.ubuntu.com","security.ubuntu.com","ppa.launchpad.net","keyserver.ubuntu.com","azure.archive.ubuntu.com","api.snapcraft.io","packagecloud.io","packages.cloud.google.com","packages.microsoft.com"] + ALLOWED_DOMAINS = ["crl3.digicert.com","crl4.digicert.com","ocsp.digicert.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","crl.geotrust.com","ocsp.geotrust.com","crl.thawte.com","ocsp.thawte.com","crl.verisign.com","ocsp.verisign.com","crl.globalsign.com","ocsp.globalsign.com","crls.ssl.com","ocsp.ssl.com","crl.identrust.com","ocsp.identrust.com","crl.sectigo.com","ocsp.sectigo.com","crl.usertrust.com","ocsp.usertrust.com","s.symcb.com","s.symcd.com","json-schema.org","json.schemastore.org","archive.ubuntu.com","security.ubuntu.com","ppa.launchpad.net","keyserver.ubuntu.com","azure.archive.ubuntu.com","api.snapcraft.io","packagecloud.io","packages.cloud.google.com","packages.microsoft.com","*.githubusercontent.com","raw.githubusercontent.com","objects.githubusercontent.com","lfs.github.com","github-cloud.githubusercontent.com","github-cloud.s3.amazonaws.com","codeload.github.com","playwright.download.prss.microsoft.com","cdn.playwright.dev"] def extract_domain(url_or_query): """Extract domain from URL or search query.""" @@ -2056,7 +2056,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com" + GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,*.githubusercontent.com,raw.githubusercontent.com,objects.githubusercontent.com,lfs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,codeload.github.com,playwright.download.prss.microsoft.com,cdn.playwright.dev" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-claude.md b/.github/workflows/smoke-claude.md index 7050a175ac5..cfa4ca651cc 100644 --- a/.github/workflows/smoke-claude.md +++ b/.github/workflows/smoke-claude.md @@ -18,6 +18,11 @@ engine: max-turns: 15 imports: - shared/mcp-pagination.md +network: + allowed: + - defaults + - github + - playwright tools: github: toolsets: [repos, pull_requests] @@ -31,7 +36,7 @@ safe-outputs: staged: true add-comment: timeout-minutes: 10 -strict: true +strict: false --- # Smoke Test: Claude Engine Validation diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 8bfd5469315..48fce6f2431 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -1731,7 +1731,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com" + GH_AW_ALLOWED_DOMAINS: "crl3.digicert.com,crl4.digicert.com,ocsp.digicert.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,crl.geotrust.com,ocsp.geotrust.com,crl.thawte.com,ocsp.thawte.com,crl.verisign.com,ocsp.verisign.com,crl.globalsign.com,ocsp.globalsign.com,crls.ssl.com,ocsp.ssl.com,crl.identrust.com,ocsp.identrust.com,crl.sectigo.com,ocsp.sectigo.com,crl.usertrust.com,ocsp.usertrust.com,s.symcb.com,s.symcd.com,json-schema.org,json.schemastore.org,archive.ubuntu.com,security.ubuntu.com,ppa.launchpad.net,keyserver.ubuntu.com,azure.archive.ubuntu.com,api.snapcraft.io,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,*.githubusercontent.com,raw.githubusercontent.com,objects.githubusercontent.com,lfs.github.com,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,codeload.github.com,playwright.download.prss.microsoft.com,cdn.playwright.dev" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-codex.md b/.github/workflows/smoke-codex.md index 6ae48f7955f..a9d86cf7c46 100644 --- a/.github/workflows/smoke-codex.md +++ b/.github/workflows/smoke-codex.md @@ -13,6 +13,11 @@ permissions: pull-requests: read name: Smoke Codex engine: codex +network: + allowed: + - defaults + - github + - playwright tools: github: playwright: @@ -25,7 +30,7 @@ safe-outputs: staged: true add-comment: timeout-minutes: 10 -strict: true +strict: false --- # Smoke Test: Codex Engine Validation diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index 7cc950ca01c..eaf56b480c3 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -1609,7 +1609,7 @@ jobs: timeout-minutes: 10 run: | set -o pipefail - sudo -E awf --env-all --allow-domains '*.githubusercontent.com,api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info \ + sudo -E awf --env-all --allow-domains '*.githubusercontent.com,api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,playwright.download.prss.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info \ "npx -y @github/copilot@0.0.358 --add-dir /tmp/gh-aw/ --log-level all --disable-builtin-mcps --allow-all-tools --allow-all-paths --prompt \"\$(cat /tmp/gh-aw/aw-prompts/prompt.txt)\"" \ 2>&1 | tee /tmp/gh-aw/agent-stdio.log @@ -1762,7 +1762,7 @@ jobs: uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }} - GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com" + GH_AW_ALLOWED_DOMAINS: "*.githubusercontent.com,api.enterprise.githubcopilot.com,api.github.com,api.npms.io,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,bun.sh,cdn.playwright.dev,codeload.github.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,deb.nodesource.com,deno.land,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,lfs.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,playwright.download.prss.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.yarnpkg.com,s.symcb.com,s.symcd.com,security.ubuntu.com,skimdb.npmjs.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.npmjs.com,www.npmjs.org,yarnpkg.com" GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_API_URL: ${{ github.api_url }} with: diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md index 5cceb64a579..a91ab58f996 100644 --- a/.github/workflows/smoke-copilot.md +++ b/.github/workflows/smoke-copilot.md @@ -18,6 +18,7 @@ network: - defaults - node - github + - playwright firewall: true tools: edit: