From 8f1e3242ff00eaa6559129c417e5c88a3f8c819e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 03:17:04 +0000 Subject: [PATCH 1/5] Initial plan From 468eec9f51ebc46114e6314da5e8a96dc5e3de59 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 04:03:47 +0000 Subject: [PATCH 2/5] fix: suppress untrusted checkout exec warnings in smoke workflow-call lockfiles Agent-Logs-Url: https://github.com/github/gh-aw/sessions/87e804d1-7b3e-49b7-abf4-2ea07aff1cfe Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-workflow-call-with-inputs.lock.yml | 2 +- .github/workflows/smoke-workflow-call.lock.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml index 5e04db62d08..73658d64b2c 100644 --- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml +++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml @@ -191,6 +191,7 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" + # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file @@ -1355,4 +1356,3 @@ jobs: /tmp/gh-aw/safe-output-items.jsonl /tmp/gh-aw/temporary-id-map.json if-no-files-found: ignore - diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml index 72f9933fe7e..3edb9f45fa5 100644 --- a/.github/workflows/smoke-workflow-call.lock.yml +++ b/.github/workflows/smoke-workflow-call.lock.yml @@ -194,6 +194,7 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" + # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file @@ -1334,4 +1335,3 @@ jobs: /tmp/gh-aw/safe-output-items.jsonl /tmp/gh-aw/temporary-id-map.json if-no-files-found: ignore - From 245d233887977d040beeab25e084df90f09ed8a5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 04:04:08 +0000 Subject: [PATCH 3/5] chore: restore lockfile trailing newline formatting Agent-Logs-Url: https://github.com/github/gh-aw/sessions/87e804d1-7b3e-49b7-abf4-2ea07aff1cfe Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-workflow-call-with-inputs.lock.yml | 1 + .github/workflows/smoke-workflow-call.lock.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml index 73658d64b2c..79c877378e2 100644 --- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml +++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml @@ -1356,3 +1356,4 @@ jobs: /tmp/gh-aw/safe-output-items.jsonl /tmp/gh-aw/temporary-id-map.json if-no-files-found: ignore + diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml index 3edb9f45fa5..f115adde941 100644 --- a/.github/workflows/smoke-workflow-call.lock.yml +++ b/.github/workflows/smoke-workflow-call.lock.yml @@ -1335,3 +1335,4 @@ jobs: /tmp/gh-aw/safe-output-items.jsonl /tmp/gh-aw/temporary-id-map.json if-no-files-found: ignore + From e1097d481e7a89af2d6ee5e4332f855ffa2f875e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 05:26:01 +0000 Subject: [PATCH 4/5] chore: plan compiler-based suppression fix Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c8f7005c-21c3-4652-a120-3ef8ddb95f74 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-workflow-call-with-inputs.lock.yml | 1 - .github/workflows/smoke-workflow-call.lock.yml | 1 - 2 files changed, 2 deletions(-) diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml index 79c877378e2..5e04db62d08 100644 --- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml +++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml @@ -191,7 +191,6 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" - # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml index f115adde941..72f9933fe7e 100644 --- a/.github/workflows/smoke-workflow-call.lock.yml +++ b/.github/workflows/smoke-workflow-call.lock.yml @@ -194,7 +194,6 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" - # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file From 8482cf9837fde988de188a28b1f2e955aefdeb2a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 16 Apr 2026 05:41:14 +0000 Subject: [PATCH 5/5] fix: generate poutine suppression for save-base activation step Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c8f7005c-21c3-4652-a120-3ef8ddb95f74 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/smoke-workflow-call-with-inputs.lock.yml | 1 + .github/workflows/smoke-workflow-call.lock.yml | 1 + pkg/workflow/pr.go | 1 + .../testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | 1 + .../testdata/TestWasmGolden_CompileFixtures/with-imports.golden | 1 + 5 files changed, 5 insertions(+) diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml index 5e04db62d08..79c877378e2 100644 --- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml +++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml @@ -191,6 +191,7 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" + # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml index 72f9933fe7e..f115adde941 100644 --- a/.github/workflows/smoke-workflow-call.lock.yml +++ b/.github/workflows/smoke-workflow-call.lock.yml @@ -194,6 +194,7 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" + # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file diff --git a/pkg/workflow/pr.go b/pkg/workflow/pr.go index 5e3bbb7147e..c583b5b25f6 100644 --- a/pkg/workflow/pr.go +++ b/pkg/workflow/pr.go @@ -29,6 +29,7 @@ func generateSaveBaseGitHubFoldersStep(folders, files []string) []string { lines = append(lines, " env:\n") lines = append(lines, fmt.Sprintf(" GH_AW_AGENT_FOLDERS: \"%s\"\n", strings.Join(folders, " "))) lines = append(lines, fmt.Sprintf(" GH_AW_AGENT_FILES: \"%s\"\n", strings.Join(files, " "))) + lines = append(lines, " # poutine:ignore untrusted_checkout_exec\n") lines = append(lines, " run: bash \"${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh\"\n") return lines } diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden index d0dd21e2cba..6fc5c5d9d1f 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden @@ -93,6 +93,7 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" + # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden index 54c24d424a0..a1adaf0670c 100644 --- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden +++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden @@ -93,6 +93,7 @@ jobs: env: GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github" GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md" + # poutine:ignore untrusted_checkout_exec run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh" - name: Check workflow lock file id: check-lock-file