Skip to content

Expand language ecosystem inference for network.allowed in create-agentic-workflow prompt #18271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Feb 25, 2026
Merged

Expand language ecosystem inference for network.allowed in create-agentic-workflow prompt #18271

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
48abfa0
Initial plan
Copilot Feb 25, 2026
72aaba2
feat: expand language ecosystem inference for network.allowed in crea…
Copilot Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions .github/aw/create-agentic-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,14 +196,14 @@ These resources contain workflow patterns, best practices, safe outputs, and per
- What should trigger the workflow (`on:` — e.g., issues, pull requests, schedule, slash command)?
- What should the agent do (comment, triage, create PR, fetch API data, etc.)?
- If the user says “campaign”, “KPI”, “pacing”, “cadence”, or “stop-after”, consult `.github/aw/campaign.md` (it’s still an agentic workflow; this is just a pattern).

Copilot AI Feb 25, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

List indentation appears inconsistent here (- bullets at 196-198 vs the newly added bullets starting at 199). The extra leading space before - ⚠️ ... (and subsequent bullets) may render as a deeper nested list level in some Markdown parsers. Suggest normalizing indentation so all bullets under “Interact and Clarify” are at the same nesting level.

Suggested change
- If the user says “campaign”, “KPI”, “pacing”, “cadence”, or “stop-after”, consult `.github/aw/campaign.md` (it’s still an agentic workflow; this is just a pattern).
- If the user says “campaign”, “KPI”, “pacing”, “cadence”, or “stop-after”, consult `.github/aw/campaign.md` (it’s still an agentic workflow; this is just a pattern).

Copilot uses AI. Check for mistakes.
- ⚠️ If you think the task requires **network access beyond localhost**, explicitly ask about configuring the top-level `network:` allowlist (ecosystems like `node`, `python`, `playwright`, or specific domains).
- ⚠️ If you think the task requires **network access beyond localhost**, **automatically infer** the ecosystem from repository language files rather than asking the user. Only ask if you cannot determine the ecosystem from available context.
- 🌐 **Always infer network ecosystem from repository language**: If the workflow involves package management, building, or testing code, detect the repository's primary language from file indicators and include the matching ecosystem identifier. **Never use `network: defaults` alone for code workflows** — `defaults` only provides basic infrastructure and cannot reach package registries. Key indicators:
- `.csproj`, `.fsproj`, `*.sln`, `*.slnx`, `global.json` → add `dotnet` (for `dotnet restore`, NuGet)
- `requirements.txt`, `pyproject.toml`, `setup.py`, `Pipfile` → add `python` (for pip/conda)
- `package.json`, `yarn.lock`, `pnpm-lock.yaml` → add `node` (for npm/yarn/pnpm)
- `go.mod`, `go.sum` → add `go` (for go module downloads)
- `requirements.txt`, `pyproject.toml`, `setup.py`, `setup.cfg`, `Pipfile`, `uv.lock` → add `python` (enables `pypi.org`, `files.pythonhosted.org` for pip/conda)
- `package.json`, `.nvmrc`, `yarn.lock`, `pnpm-lock.yaml` → add `node` (enables `registry.npmjs.org` for npm/yarn/pnpm)
- `go.mod`, `go.sum` → add `go` (enables `proxy.golang.org`, `sum.golang.org` for go module downloads)
- `pom.xml`, `build.gradle`, `build.gradle.kts` → add `java` (for Maven/Gradle)
- `Gemfile`, `*.gemspec` → add `ruby` (for Bundler/RubyGems)
- `Gemfile`, `*.gemspec` → add `ruby` (enables `rubygems.org` for Bundler/RubyGems)
Comment on lines +202 to +206

Copilot AI Feb 25, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The added domain callouts look incomplete/inaccurate compared to the canonical ecosystem/domain mapping in .github/aw/github-agentic-workflows.md (see table around lines 1528-1537). In particular, python mentions “pip/conda” but only lists PyPI domains (conda uses conda.anaconda.org, etc.), and node/go/ruby omit other key domains listed there. Suggest either (a) switch these parentheticals to “e.g.” and avoid implying exhaustiveness, and/or (b) align the listed domains with the table (including conda/yarn/pkg.go.dev where appropriate).

See below for a potential fix:

     - `requirements.txt`, `pyproject.toml`, `setup.py`, `setup.cfg`, `Pipfile`, `uv.lock` → add `python` (enables package indexes for pip/conda, e.g., `pypi.org`, `files.pythonhosted.org`, `conda.anaconda.org`)
     - `package.json`, `.nvmrc`, `yarn.lock`, `pnpm-lock.yaml` → add `node` (enables npm ecosystem registries, e.g., `registry.npmjs.org`, `registry.yarnpkg.com` for npm/yarn/pnpm)
     - `go.mod`, `go.sum` → add `go` (enables Go module endpoints, e.g., `proxy.golang.org`, `sum.golang.org`, `pkg.go.dev` for module downloads)
     - `pom.xml`, `build.gradle`, `build.gradle.kts` → add `java` (for Maven/Gradle)
     - `Gemfile`, `*.gemspec` → add `ruby` (enables RubyGems endpoints, e.g., `rubygems.org` for Bundler/RubyGems)

Copilot uses AI. Check for mistakes.
- `Cargo.toml`, `Cargo.lock` → add `rust` (for cargo)
- `Package.swift`, `*.podspec` → add `swift`
- `composer.json` → add `php`
Expand Down Expand Up @@ -585,11 +585,11 @@ Based on the parsed requirements, determine:
- Browser automation → `tools: playwright:` and `network: allowed: [<domains>]`
- **Network ecosystem inference**: For workflows that build/test/install packages, always include the language ecosystem in `network: allowed:`. Never use `network: defaults` alone — it only covers basic infrastructure, not package registries. Detect from repository files:
- `.csproj`/`.fsproj`/`*.sln`/`*.slnx` → `network: { allowed: [defaults, dotnet] }` (NuGet)
- `requirements.txt`/`pyproject.toml` → `network: { allowed: [defaults, python] }` (pip/PyPI)
- `package.json` → `network: { allowed: [defaults, node] }` (npm/yarn)
- `go.mod` → `network: { allowed: [defaults, go] }` (Go modules)
- `requirements.txt`/`pyproject.toml`/`setup.py`/`uv.lock` → `network: { allowed: [defaults, python] }` (enables `pypi.org`, `files.pythonhosted.org`)
- `package.json`/`.nvmrc`/`yarn.lock` → `network: { allowed: [defaults, node] }` (enables `registry.npmjs.org`)
- `go.mod`/`go.sum` → `network: { allowed: [defaults, go] }` (enables `proxy.golang.org`, `sum.golang.org`)
- `pom.xml`/`build.gradle` → `network: { allowed: [defaults, java] }` (Maven/Gradle)
- `Gemfile` → `network: { allowed: [defaults, ruby] }` (Bundler)
- `Gemfile`/`*.gemspec` → `network: { allowed: [defaults, ruby] }` (enables `rubygems.org`)
Comment on lines +588 to +592

Copilot AI Feb 25, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This quick-reference indicator list is now inconsistent with the earlier “Key indicators” list above: it adds uv.lock but omits setup.cfg, and it adds .nvmrc but omits pnpm-lock.yaml (and Pipfile / *.gemspec consistency is mixed). If the intent is to keep both sections aligned (as described in the PR), consider updating this checklist list to match the indicators you just added earlier.

See below for a potential fix:

     - `requirements.txt`/`pyproject.toml`/`setup.py`/`setup.cfg`/`Pipfile` → `network: { allowed: [defaults, python] }` (enables `pypi.org`, `files.pythonhosted.org`)
     - `package.json`/`pnpm-lock.yaml`/`yarn.lock` → `network: { allowed: [defaults, node] }` (enables `registry.npmjs.org`)
     - `go.mod`/`go.sum` → `network: { allowed: [defaults, go] }` (enables `proxy.golang.org`, `sum.golang.org`)
     - `pom.xml`/`build.gradle` → `network: { allowed: [defaults, java] }` (Maven/Gradle)
     - `Gemfile` → `network: { allowed: [defaults, ruby] }` (enables `rubygems.org`)

Copilot uses AI. Check for mistakes.
- `Cargo.toml` → `network: { allowed: [defaults, rust] }` (Cargo)
4. **Safe Outputs**: For any write operations:
- Creating issues → `safe-outputs: create-issue:`
Expand Down