[detection-analysis] Detection Analysis Report — 2026-07-22 (last 24h)

[github-actions[bot]]

Summary

• Window evaluated: last 24 full hours (UTC) — 2026-07-21T23:37:52Z → 2026-07-22T23:37:52Z
• Total runs analyzed: 280 (across 103 distinct workflows)
• Detection-enabled runs: 83 (29.6%)
• Regular runs (detection false/absent): 197 (70.4%)
• Misconfigured workflows found: 3

Warning

3 workflows whose names imply an audit/analysis role are running without gh-aw-detection: true. See the Misconfigured Workflows section for the recommended fixes.

Metric	Regular	Detection
Runs	197	83
Success rate	95.4%	92.8%
Failures	9	6
Avg tokens	36,931	40,696

Comparison Chart

Misconfigured Workflows

Rule 2 — workflow name contains an audit/analysis keyword (audit, analyzer, report, detector, monitor, inspector) but no run in the window had gh-aw-detection: true. The documented opt-out (Daily Agentic Workflow AIC Usage Audit, mirrored from githubnext/agentic-ops) was excluded.

Workflow	Misconfiguration	Runs	Example run	Recommended fix
Deep Report	rule 2 — name matches report, detection absent	1	§29932509927	Add gh-aw-detection: true to the engine config and recompile the .lock.yml
Daily Security Observability Report	rule 2 — name matches report, detection absent	1	§29937379516	Add gh-aw-detection: true to the engine config and recompile the .lock.yml
Daily Regulatory Report Generator	rule 2 — name matches report, detection absent	1	§29959595122	Add gh-aw-detection: true to the engine config and recompile the .lock.yml

Rules that did not flag anything this window:

• Rule 1 (detection false on a workflow with >3 runs): no detection-disabled workflow exceeded 3 runs in the fetched data. Caveat: only 24h of logs were downloaded, so the full 7-day count could not be computed.
• Rule 3 (detection true but detection steps failed): 6 detection-enabled runs failed, but every failure was in the agent-execution step (Execute GitHub Copilot CLI / Execute Claude Code CLI). Their threat-detection steps were skipped and the Conclude threat detection step succeeded, so none qualify.
• Rule 4 (alternates detection on/off within 24h): every workflow was internally consistent — no workflow mixed enabled and disabled runs.

Recommendations

1. Enable detection on the 3 report workflows above. Add gh-aw-detection: true to each workflow's engine block and recompile so the threat-detection stage runs on their outputs.
2. Triage the 6 detection-enabled agent failures (CI Optimization Coach, Daily Max Ai Credits Test, GitHub MCP Structural Analysis, Daily Agent of the Day Blog Writer, Daily Issues Report Generator, Daily BYOK Ollama Test). These are agent/CLI execution failures, unrelated to detection, but drag the detection cohort's success rate to 92.8% vs. 95.4% for regular runs.
3. Re-run this analysis with a full 7-day log window to properly evaluate Rule 1 — the current run's agenticworkflows logs download hit the 300s timeout, yielding a partial dataset (280 in-window runs with complete aw_info.json).

View All Run Metrics

Detection column: ✅ on = every run had gh-aw-detection: true; ❌ off/absent = no run enabled detection; ⚠️ mixed = varied within window.

Workflow	Detection	Runs	Success	Avg tokens
Matt Pocock Skills Reviewer	❌ off/absent	26	100%	14,038
Test Quality Sentinel	✅ on	25	100%	9,960
Design Decision Gate 🏗️	❌ off/absent	24	96%	10,810
PR Code Quality Reviewer	❌ off/absent	24	92%	21,371
Impeccable Skills Reviewer	❌ off/absent	23	100%	8,649
PR Sous Chef	❌ off/absent	22	95%	29,812
Issue Monster	❌ off/absent	15	100%	19,790
Tidy	❌ off/absent	11	100%	5,613
PR Description Updater	❌ off/absent	4	100%	11,072
AI Moderator	✅ on	3	100%	486,742
Avenger	✅ on	3	100%	9,075
Contribution Check	✅ on	3	100%	21,382
Auto-Triage Issues	✅ on	2	100%	16,000
Code Scanning Fixer	✅ on	2	100%	4,937
Discussion Task Miner - Code Quality Improvement Agent	❌ off/absent	2	100%	19,236
PR Triage Agent	❌ off/absent	2	100%	10,921
[aw] Failure Investigator (6h)	✅ on	2	100%	26,424
Agent Container Smoke Test	❌ off/absent	1	100%	4,123
Agent Performance Analyzer - Meta-Orchestrator	✅ on	1	100%	20,385
Agent Persona Explorer	✅ on	1	100%	59,142
Agentic Workflow AIC Usage Optimizer	❌ off/absent	1	100%	18,351
Agentic Workflow Audit Agent	✅ on	1	100%	44,765
Architecture Guardian	✅ on	1	100%	4,146
Blog Auditor	✅ on	1	100%	24,093
CI Optimization Coach	✅ on	1	0%	0
CLI Consistency Checker	✅ on	1	100%	62,516
Changeset Generator	✅ on	1	100%	78,668
Claude Code User Documentation Review	✅ on	1	100%	41,886
Constraint Solving — Problem of the Day	✅ on	1	100%	10,078
Copilot Agent PR Analysis	✅ on	1	100%	24,363
Copilot Agent Prompt Clustering Analysis	✅ on	1	100%	31,307
Copilot PR Conversation NLP Analysis	✅ on	1	100%	45,534
Copilot PR Prompt Pattern Analysis	✅ on	1	100%	11,657
Daily A/B Testing Advisor	✅ on	1	100%	45,542
Daily AIC Consumption Report (Sentry + Grafana OTel)	✅ on	1	100%	35,720
Daily AWF Spec Compiler Surfacing Review	✅ on	1	100%	79,704
Daily Agent of the Day Blog Writer	✅ on	1	0%	58,016
Daily Agentic Workflow AIC Usage Audit (documented opt-out)	❌ off/absent	1	100%	10,772
Daily Ambient Context Optimizer	✅ on	1	100%	32,685
Daily BYOK Ollama Test	✅ on	1	0%	0
Daily CLI Performance Agent	✅ on	1	100%	17,872
Daily Cache Strategy Analyzer	✅ on	1	100%	345,599
Daily Caveman Optimizer	✅ on	1	100%	16,723
Daily Choice Type Test	✅ on	1	100%	4,396
Daily Code Metrics and Trend Tracking Agent	✅ on	1	100%	40,345
Daily Container Image Security Scan	❌ off/absent	1	0%	3,254
Daily Copilot PR Merged Report	✅ on	1	100%	11,047
Daily Documentation Updater	✅ on	1	100%	62,559
Daily Fact	✅ on	1	100%	44,820
Daily Formal Spec Verifier	✅ on	1	100%	59,664
Daily Go Function Namer	✅ on	1	100%	17,642
Daily Issues Report Generator	✅ on	1	0%	12,059
Daily MCP Tool Concurrency Analysis	✅ on	1	100%	10,640
Daily Malicious Code Scan Agent	✅ on	1	100%	8,480
Daily Max Ai Credits Test	✅ on	1	0%	3,010
Daily Project Performance Summary Generator (Using MCP Scripts)	✅ on	1	100%	20,521
Daily Regulatory Report Generator	❌ off/absent	1	100%	19,970
Daily Reliability Review	✅ on	1	100%	26,919
Daily SPDD Spec Planner	❌ off/absent	1	0%	5,240
Daily Safe Output Integrator	❌ off/absent	1	100%	18,406
Daily Secrets Analysis Agent	❌ off/absent	1	100%	14,711
Daily Security Observability Report	❌ off/absent	1	100%	16,489
Daily Team Evolution Insights	❌ off/absent	1	100%	19,546
Daily Testify Uber Super Expert	✅ on	1	100%	10,655
Daily VulnHunter Scan	❌ off/absent	1	100%	89,663
Dead Code Removal Agent	❌ off/absent	1	100%	0
Deep Report	❌ off/absent	1	100%	30,143
Delight	❌ off/absent	1	100%	22,687
Dependabot Dependency Checker	❌ off/absent	1	100%	71,423
Draft PR Cleanup	❌ off/absent	1	100%	5,306
Duplicate Code Detector	✅ on	1	100%	207,025
ESLint Monster	❌ off/absent	1	100%	76,277
GEO Optimizer Daily Audit	✅ on	1	100%	8,681
GitHub API Consumption Report Agent	✅ on	1	100%	36,761
GitHub MCP Structural Analysis	✅ on	1	0%	61,603
Glossary Maintainer	❌ off/absent	1	100%	13,516
Issue Triage Agent	❌ off/absent	1	100%	4,731
Linter Miner	❌ off/absent	1	100%	16,193
Lockfile Statistics Analysis Agent	❌ off/absent	1	100%	14,105
Package Specification Enforcer	❌ off/absent	1	100%	39,376
Package Specification Extractor	❌ off/absent	1	100%	13,015
Release	❌ off/absent	1	100%	9,594
Repository Quality Improvement Agent	❌ off/absent	1	100%	35,201
Scout	❌ off/absent	1	100%	14,011
Slide Deck Maintainer	❌ off/absent	1	100%	8,406
Smoke Antigravity	❌ off/absent	1	100%	0
Smoke Claude	❌ off/absent	1	100%	26,324
Smoke Claude on Copilot	❌ off/absent	1	0%	0
Smoke Codex	❌ off/absent	1	100%	121,561
Smoke Copilot	❌ off/absent	1	100%	1,627,603
Smoke Copilot - AOAI (Entra)	❌ off/absent	1	100%	382,262
Smoke Copilot - AOAI (apikey)	❌ off/absent	1	100%	1,518,613
Smoke Copilot MAI	❌ off/absent	1	100%	103,301
Smoke Copilot Small	❌ off/absent	1	100%	3,273
Smoke Copilot Sub Agents	❌ off/absent	1	0%	64,473
Smoke Gemini	❌ off/absent	1	100%	153,712
Smoke OTEL	❌ off/absent	1	100%	25,164
Smoke Pi	❌ off/absent	1	100%	20,217
Team Status	❌ off/absent	1	100%	4,881
The Daily Repository Chronicle	✅ on	1	100%	12,105
Typist - Go Type Analysis	✅ on	1	100%	66,184
UK AI Operational Resilience	❌ off/absent	1	100%	17,882
Workflow Normalizer	❌ off/absent	1	100%	8,656

View Historical Trend

24 days of history (last 30-day window). Detection adoption and both cohorts' run volume are trending up; detection success rate holds in the mid-to-high 80s/90s.

References:

• §29932509927 — Deep Report
• §29937379516 — Daily Security Observability Report
• §29959595122 — Daily Regulatory Report Generator

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔎 Detection Analysis Report · age00 227.7 AIC · ⌖ 32.5 AIC · ⊞ 6.8K · ◷

• expires on Jul 25, 2026, 3:46 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Detection Analysis Report.

A newer discussion is available at Discussion #47671.