chore: upgrade bug-fix and bug-test to gh-aw v0.88.7 - #4604
Merged
KSchlobohm merged 4 commits intoSep 16, 2026
Merged
Conversation
Regenerate bug-fix and bug-test with Copilot 1.0.80. Preserve the 1 MB patch limit and editable Python test extras through the local-package validation workaround. Add focused workflow contract regressions. Accept the v0.88.7 Copilot-specific protected-file set: CLAUDE.md and GEMINI.md are no longer hard-blocked. This exception was approved by the user. Assisted-by: GitHub Copilot (model: GPT-6 Astra, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Remove the 1 MB compatibility override and its regression assertions. Let gh-aw v0.88.7 supply its default 4 MB patch limit without adding a repository-specific restriction. Regenerate the lock with the approved compiler. Assisted-by: GitHub Copilot (model: GPT-6 Astra, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Allow github.com for origin Git access. Require successful discovery before using the current-checkout fallback, report discovery or checkout errors as setup failures, and require original exit codes before output filtering. Include focused regressions without a standalone shell recipe. These instructions do not guarantee agent compliance. Fork tests demonstrated Git access and exact-head handoff; inconsistent exit capture and other observed runtime limitations remain documented in the review evidence. Assisted-by: GitHub Copilot (model: GPT-6 Astra, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The intentional 4 MB patch limit is not protected by the new regression tests.
Get a fresh assessment by requesting another Copilot review.
Review tier: Balanced
Findings: 1
Open (1)
What changed in this PR
Upgrades the bug-fix and bug-test automation to gh-aw v0.88.7 and Copilot 1.0.80 while preserving workflow contracts.
Changes:
- Regenerates both workflow locks.
- Hardens bug-test checkout and exit-code handling.
- Adds regression coverage for workflow contracts and installation failures.
| File | Description |
|---|---|
.github/workflows/bug-fix.lock.yml |
Regenerates bug-fix with upgraded runtime. |
.github/workflows/bug-test.md |
Updates networking, installation, and failure guidance. |
.github/workflows/bug-test.lock.yml |
Regenerates bug-test with upgraded runtime. |
tests/test_github_workflows.py |
Adds workflow contract and regression tests. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Add assertion for maximum patch size in PR creation Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The large generated workflow changes affect privileged automation and warrant final human review despite strong regression and fork coverage.
Review tier: Balanced
Findings: None
Resolved since last review (1)
mnriem
added
the
triage-nice-to-have
mnriem
added a commit
to gyanu2507/spec-kit
that referenced
this pull request
Sep 16, 2026
main advanced past this PR: github#4604 upgraded the bug-fix workflow to gh-aw v0.88.7 (new container digests, setup-action pin, engine copilot 1.0.80), which conflicted with the v0.79.8 lock this branch had generated. Merged origin/main and regenerated bug-fix.lock.yml from source with the now-current pinned compiler v0.88.7 so the artifact GitHub Actions runs reflects @gyanu2507's frontmatter. Net delta vs main is only the intended change: agent maxAiCredits 1000->2000 and the harness allowlist gains shell(python) alongside shell(python3). The manifest (action SHAs, container digests), firewall allowDomains, permissions, isolation, models, detection cap (400) and daily cap (5000) are byte-identical to main. The .gitattributes churn the compiler emits is reverted to match main. Focused tests (tests/test_bug_fix_workflow.py) assert the compiled lock, not just the Markdown, and pass; the workflow-validation suite passes. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
mnriem
added a commit
to gyanu2507/spec-kit
that referenced
this pull request
Sep 16, 2026
main advanced past this PR: github#4604 upgraded the bug-fix workflow to gh-aw v0.88.7 (new container digests, setup-action pin, engine copilot 1.0.80), which conflicted with the v0.79.8 lock this branch had generated. Merged origin/main and regenerated bug-fix.lock.yml from source with the now-current pinned compiler v0.88.7 so the artifact GitHub Actions runs reflects @gyanu2507's frontmatter. Net delta vs main is only the intended change: agent maxAiCredits 1000->2000 and the harness allowlist gains shell(python) alongside shell(python3). The manifest (action SHAs, container digests), firewall allowDomains, permissions, isolation, models, detection cap (400) and daily cap (5000) are byte-identical to main. The .gitattributes churn the compiler emits is reverted to match main. Focused tests (tests/test_bug_fix_workflow.py) assert the compiled lock, not just the Markdown, and pass; the workflow-validation suite passes. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
3 tasks
5 tasks
mnriem
added a commit
that referenced
this pull request
Sep 17, 2026
* Raise bug-fix workflow credit cap and run pytest from PATH The agentic bug-fix run hit the 1K default and then failed trying ./.venv/bin/python (Permission denied). Give the workflow 2K credits, allow `python` as well as python3, and tell the agent to use PATH. Fixes #4472 * Recompile bug-fix.lock.yml so credit cap and python allowlist take effect PR #4508 raised max-ai-credits to 2000 and added `python` to the bash allowlist in bug-fix.md, but never regenerated the compiled bug-fix.lock.yml — the artifact GitHub Actions actually runs. Both frontmatter-derived settings were therefore inert: the lock still pinned maxAiCredits to the 1000 default and allowed shell(python3) but not shell(python). (The prompt guidance was already live via {{#runtime-import}}.) Recompile with gh-aw v0.79.8 (the pinned compiler) to apply exactly: - agent + summary jobs' effective maxAiCredits: 1000 -> 2000 - harness allowlist: + shell(python) Dependabot's action SHA pins in the committed lock (actions/checkout v7.0.1, actions/setup-node v7.0.0) are preserved rather than reverted to the compiler's older baked-in defaults. No container digest, firewall domain, permission, or detection-job (400) change. Rework tests/test_bug_fix_workflow.py to assert the compiled lock (the real running artifact) for the cap and allowlist, and the runtime-imported Markdown for the pytest-PATH guidance, replacing the prior .md-only string checks that passed even while the running workflow was unchanged. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Recompile bug-fix.lock.yml with pinned gh-aw v0.88.7 after merging main main advanced past this PR: #4604 upgraded the bug-fix workflow to gh-aw v0.88.7 (new container digests, setup-action pin, engine copilot 1.0.80), which conflicted with the v0.79.8 lock this branch had generated. Merged origin/main and regenerated bug-fix.lock.yml from source with the now-current pinned compiler v0.88.7 so the artifact GitHub Actions runs reflects @gyanu2507's frontmatter. Net delta vs main is only the intended change: agent maxAiCredits 1000->2000 and the harness allowlist gains shell(python) alongside shell(python3). The manifest (action SHAs, container digests), firewall allowDomains, permissions, isolation, models, detection cap (400) and daily cap (5000) are byte-identical to main. The .gitattributes churn the compiler emits is reverted to match main. Focused tests (tests/test_bug_fix_workflow.py) assert the compiled lock, not just the Markdown, and pass; the workflow-validation suite passes. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Strengthen bug-fix workflow tests to catch dropped allowlist and reversed prohibition Addresses two regression-test gaps from review of #4508: 1. The shell-allowlist test matched bare shell(python) substrings, which also appear in the lock's commented tool inventory, so it passed even if compilation dropped the real --allow-tool arguments. It now isolates the executable harness command line (the sole copilot_harness.cjs reference) and asserts the full escaped --allow-tool 'shell(python)'/'shell(python3)'/ 'shell(pytest)' arguments. 2. The pytest-PATH test checked three independent substrings, so wording that recommended .venv/bin/python would still pass. It now asserts the normalized prohibition ("Do not invoke ... Permission denied.") as one contiguous unit, so reversing the guidance or splitting the permission-denied explanation away fails the test. Source and compiled lock are unchanged; this is test-only strengthening. Mutation checks confirm the old assertions passed while the new ones fail when the executable allow-tool args are dropped, the prohibition is reversed, or the permission-denied explanation is separated. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Manfred Riem <manfred.riem@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Upgrade
bug-fixandbug-testtogether from gh-aw v0.79.8 / Copilot 1.0.60 to gh-aw v0.88.7 / Copilot 1.0.80, following #4546.--strict --validate.github.comexplicitly for origin fetches. Clarify that failed discovery or checkout is a setup failure, not evidence that no fix exists, and require original exit codes before output filtering.Source-level label gates, bot exclusions, permissions, allowed outputs, and output limits are preserved. This intentionally accepts the new compiler defaults: a 4 MB patch limit instead of 1 MB, and protected-file checks that retain Copilot instruction files but no longer include
CLAUDE.mdorGEMINI.md.The diff contains only both generated locks,
bug-test.md, andtests/test_github_workflows.py. No community workflows, shared action pins, test fixtures, or generated product fixes are included.Testing
uv run specify --helpLocal validation:
git diff --checkpassed.Applicable CI passed on the final fork upgrade and reliability PRs, including Linux, Windows, and macOS with Python 3.13 and 3.14.
Fork testing provided evidence that the upgraded workflows work together in practice—not just that they compile—and that test results reflect the proposed fix rather than the wrong checkout. The end-to-end run supports that conclusion, but also exposed instruction-following deviations; it does not establish complete workflow-contract compliance. Three broader-suite failures also reproduced on the base checkout.
AI Disclosure
GitHub Copilot (GPT-6 Astra) prepared the workflow changes, regression tests, validation, and this description on behalf of @KSchlobohm. The human contributor directed scope and approved fork publication and controlled test runs. Agent-authored commits include attribution. Fork runtime behavior was checked against logs and GitHub state.