[evoskill] skills: refine debugging-workflows for cascading safe-output credential failures

[github-actions]

Caution

Protected files were modified in this change.
This pull request is in request_review mode and requires explicit human scrutiny before merge.

Protected files: .github/skills/debugging-workflows/SKILL.md

EvoSkill Evolver: refined .github/skills/debugging-workflows/SKILL.md

Capability gap diagnosed: The skill's existing "Safe-Output Errors" subsection only covered configuration-time issues (safe-outputs not enabled). It had no guidance for a runtime failure mode where the Process Safe Outputs step reports multiple message failures in one job run, mixing two distinct error classes that are easy to conflate when triaging logs.

Training evidence (last few days, github/gh-aw):

• PR Sous Chef run: https://github.com/github/gh-aw/actions/runs/30397888190 (2026-07-28T20:47:39Z) — 3 of 6 safe-output messages failed. Non-fatal 403 refusing to allow a GitHub App to create or update workflow ... without \workflows` permissionwarnings onupdate_pull_request(branch-update) messages were immediately followed by unrelatedadd_commentmessages failing withBad credentials` (401-style auth failure), repeated 3 times in the same job.
• PR Sous Chef run: https://github.com/github/gh-aw/actions/runs/30395881970 (2026-07-28T20:20:13Z, same day) — identical pattern reproduced (1 of 3 messages failed the same way).
• Source inspection of actions/setup/js/update_pull_request.cjs confirmed the 403 workflows-permission case is already correctly classified as non-fatal/expected (isNonFatalUpdateBranchError()), while the Bad credentials failures on other messages are a genuinely different, unaddressed error class not covered by existing skill guidance.

Mutation: Refinement (not a new skill) — added a new "Cascading Safe-Output Message Failures (Process Safe Outputs step)" subsection to the existing debugging-workflows skill, right after "Safe-Output Errors". It teaches agents to triage each failed safe-output message by its own error type/status code rather than assuming later failures share the root cause of an earlier, unrelated, already-benign warning, plus gives concrete diagnostic steps (gh aw audit, gh run view --job=<id> --log, checking permissions:, correlating failure/message counts, watching for time-clustered failures suggesting token expiry). Content is generalized — no hardcoded PR numbers or workflow file names from the training samples.

Held-out validation:

• Baseline score: 40/100 (no guidance for this pattern; safe but unhelpful for a future recurrence)
• Candidate score: 79/100 (correctly distinguishes 403 permission-scope vs 401 auth failures, actionable diagnostics, generalized wording)
• Regressions: none — validated against 5 successful held-out runs (PR Sous Chef x2, Agentic Commands, Issue Monster, Daily AWF Spec Compiler Surfacing Review) confirming the additive subsection does not alter existing guidance or affect successful-run triage, plus 1 held-out failure (Daily BYOK Ollama Test MCP-gateway ECONNRESET, run https://github.com/github/gh-aw/actions/runs/29784505320) confirming the new section's symptom list (403 workflows-permission + 401 Bad credentials + Process Safe Outputs step) is specific enough to avoid misapplication to unrelated MCP-gateway connectivity failures.
• Confidence: medium

Scope: Only .github/skills/debugging-workflows/SKILL.md was changed (1 file). No workflows, source code, tests, dependencies, or root instruction files were modified. The underlying model and non-skill repository files are unchanged.

Generated by 🧬 EvoSkill Evolver · sonnet50 · 154.4 AIC · ⌖ 9.05 AIC · ⊞ 7.5K · ◷

• expires on Aug 4, 2026, 1:17 PM UTC-08:00

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: pushSignedCommits: refusing unsigned push for branch 'evoskill/debugging-workflows-safe-output-cascade-f44eab08f5490728': Signed-commit payload violates file-protection policy (request_review): .github/skills/debugging-workflows/SKILL.md

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 30398919819 -n agent -D /tmp/agent-30398919819

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-30398919819/aw-evoskill-debugging-workflows-safe-output-cascade.bundle refs/heads/evoskill/debugging-workflows-safe-output-cascade:refs/bundles/create-pr-evoskill-debugging-workflows-safe-output-cascade-f44eab08f5490728-407800c1
git update-ref refs/heads/evoskill/debugging-workflows-safe-output-cascade-f44eab08f5490728 refs/bundles/create-pr-evoskill-debugging-workflows-safe-output-cascade-f44eab08f5490728-407800c1
git checkout evoskill/debugging-workflows-safe-output-cascade-f44eab08f5490728
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-evoskill-debugging-workflows-safe-output-cascade-f44eab08f5490728-407800c1

# Push the branch to origin
git push origin evoskill/debugging-workflows-safe-output-cascade-f44eab08f5490728

# Create the pull request
gh pr create --title '[evoskill] skills: refine debugging-workflows for cascading safe-output credential failures' --base main --head evoskill/debugging-workflows-safe-output-cascade-f44eab08f5490728 --repo github/gh-aw