fix(smoke-copilot): revert agent job to read-only perms to unblock CI - #6369
Merged
Conversation
PR #6366 changed the smoke-copilot agent job to issues:write / pull-requests:write, but the gh-aw compiler (v0.82.13) forbids write permissions on the agent job — writes must flow through safe-outputs' scoped app token. As a result the lock file's frontmatter_hash could not be regenerated and stayed at the read-perm value (008d5a5c), while the .md advertised write perms. This mismatch made the 'Check workflow lock file' activation step fail on every open PR (CI builds the branch merged with main), e.g. #6362, even for PRs that never touched smoke-copilot. Revert issues/pull-requests to read (safe-outputs already handles the comment/label writes) and recompile so .md and lock are consistent. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23717692-af7a-4e03-a156-5b696c3f01bd
Contributor
There was a problem hiding this comment.
Pull request overview
Restores compiler-compatible read permissions for the Smoke Copilot agent job and synchronizes its generated workflow lock.
Changes:
- Reverts agent issue and pull-request permissions to read-only.
- Updates the compiled lock workflow accordingly.
- Preserves write permissions for safe-output jobs.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/smoke-copilot.md |
Restores read-only agent permissions. |
.github/workflows/smoke-copilot.lock.yml |
Synchronizes compiled agent permissions and metadata. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Medium
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
This was referenced Jul 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Smoke Copilotactivation check (Check workflow lock file) is failing on every open PR — including unrelated ones like #6362 that never touch smoke-copilot — with:Root cause
PR #6366 changed the smoke-copilot agent job permissions to
issues: write/pull-requests: write. However, the gh-aw compiler (v0.82.13) forbids write permissions on the agent job — writes must go throughsafe-outputs, which uses a scoped GitHub App token.Because the write-perm
.mdcannot be compiled, its lock file'sfrontmatter_hashwas never regenerated and stayed at the read-perm value (008d5a5c…), while the.mdadvertised write perms (hash81338ace…). Since PR CI builds the branch merged withmain, every PR inherits main's write-perm.mdagainst the read-perm lock hash and fails the activation check.Fix
Revert
issues/pull-requeststoread(safe-outputs already handles the comment/label writes via its scoped token) and recompile so.mdand.lock.ymlare consistent again (frontmatter_hash: 008d5a5c…).This unblocks CI across all open PRs.
Verification
gh aw compile smoke-copilot→ 0 errors (v0.82.13).mdfrontmatter hash now matches the committed lock (008d5a5c…)npm test→ 244 suites / 3851 tests passScope
Only two files change:
smoke-copilot.mdandsmoke-copilot.lock.yml.