feat: optimize config-consistency-auditor — early exit, trimmed toolset, leaner prompt

[Copilot]

config-consistency-auditor was running at ~125.7 AIC/run regardless of whether any config-touching PRs were merged, making it the costliest workflow in the fleet. On most weekdays no relevant PRs exist, so the entire agent session was wasted.

Changes

Early exit before agent launch (~96% savings on no-PR days)

Added a fetch_prs pre-check job that filters merged PRs via jq against config-relevant paths. The agent job is gated with if: needs.fetch_prs.outputs.pr_count != '0' — skipping the full agent run entirely when nothing needs auditing.

if: needs.fetch_prs.outputs.pr_count != '0'
jobs:
  fetch_prs:
    outputs:
      pr_count: ${{ steps.filter.outputs.pr_count }}
    steps:
      - name: Filter config-touching merged PRs
        id: filter
        run: |
          gh pr list --state merged --limit 50 --json number,title,mergedAt,files > /tmp/all-prs.json
          PR_COUNT=$(jq --arg cutoff "$CUTOFF" '[.[] | select(.mergedAt >= $cutoff) | select(
            (.files // []) | map(.path) | any(test("src/config-file\\.ts|src/types/|..."))
          )] | length' /tmp/all-prs.json)
          echo "pr_count=$PR_COUNT" >> "$GITHUB_OUTPUT"

DataOps pre-step (reduces agent context on active days)

Added a steps: block in the agent job that pre-fetches the filtered PR list to /tmp/gh-aw/relevant-prs.json. Agent reads compact JSON instead of fetching and filtering via tool calls.

Network and toolset trimming (~13–22K AIC/run on active days)

• Removed node from network.allowed — not used by this workflow
• toolsets: [default, pull_requests] → toolsets: [pull_requests] — removes ~15 unused tool schemas (~7.5–10.5K tokens/turn)

Prompt reduction (~36% smaller, ~4.3 KB from 6.7 KB)

• Security classification condensed from 8 lines to 3
• Step 2 now references pre-fetched file; removed redundant path filter list
• Removed embedded 17-line example PR body template from Step 6
• Step 5 cross-references the classification section instead of duplicating it

[Copilot]

Pull request overview

This PR updates the config-consistency-auditor agentic workflow to reduce unnecessary runs and token/context usage by skipping the agent session when no relevant PRs were merged and by trimming the toolset and prompt.

Changes:

• Add a fetch_prs pre-check job and gate the agent job on pr_count != '0' to early-exit on no-PR days.
• Pre-fetch and persist a filtered “relevant merged PRs” list for the agent to read, reducing tool calls/context on active days.
• Trim workflow toolsets and reduce prompt verbosity to lower AIC/tokens per run.

Show a summary per file

File	Description
.github/workflows/config-consistency-auditor.md	Adds pre-check job + gating, pre-fetch step, and prompt/toolset/network trimming.
.github/workflows/config-consistency-auditor.lock.yml	Regenerated lock workflow reflecting the updated spec (but currently includes unintended toolchain/template regressions vs repo norms).
.github/aw/actions-lock.json	Updates action pin set used by agentic workflow compilation/locking.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 4
• Review effort level: Low

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[lpcox]

@copilot discard all updates except those to the .md file

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	99.17%	99.21%	📈 +0.04%
Statements	99.13%	99.17%	📈 +0.04%
Functions	99.45%	99.45%	➡️ +0.00%
Branches	95.75%	95.75%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

@copilot discard all updates except those to the .md file

Done. Reverted .github/workflows/config-consistency-auditor.lock.yml and .github/aw/actions-lock.json to their pre-PR state. Only the .md changes remain (commit revert: discard lock.yml and actions-lock.json changes, keep .md edits only).