Constrain `list_code_scanning_alerts` prompt usage with explicit state/severity bounds by Copilot · Pull Request #43744 · github/gh-aw

Copilot · 2026-07-06T08:31:56Z

Hippo flagged recurring oversized MCP responses from unbounded list_code_scanning_alerts usage in workflow prompt surfaces. This PR tightens prompt guidance to require bounded queries and adds a regression check so the bounds remain present.

Prompt/template guardrails
- Added explicit guidance to include:
  - state: open
  - severity: critical,high
- Updated:
  - .github/aw/github-mcp-server.md
  - .github/skills/github-mcp-server/SKILL.md
  - docs/src/content/docs/guides/mcps.md
Regression coverage
- Added pkg/cli/code_scanning_prompt_bounds_test.go to assert key workflow/prompt docs that reference list_code_scanning_alerts also include the required bounds near that reference.
- This protects against future prompt drift reintroducing unbounded usage.

Illustrative guidance pattern

When invoking `list_code_scanning_alerts` from workflow prompts/templates, always include:
- `state: open`
- `severity: critical,high`

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR tightens prompt/documentation guidance around using the GitHub MCP server’s list_code_scanning_alerts tool to reduce oversized responses by requiring bounded queries, and adds a Go regression test intended to prevent prompt drift.

Changes:

Added explicit prompt guidance to always include state: open and severity: critical,high when invoking list_code_scanning_alerts.
Added a regression test to ensure selected workflow/prompt surfaces keep these bounds near the tool reference.
Updated MCP documentation in .github and the docs site to reflect the bounded-query requirement.

Show a summary per file

File	Description
pkg/cli/code_scanning_prompt_bounds_test.go	Adds a regression test scanning key prompt/doc files for bounded `list_code_scanning_alerts` usage.
docs/src/content/docs/guides/mcps.md	Adds bounded-query guidance for `list_code_scanning_alerts` in the docs site guide.
.github/skills/github-mcp-server/SKILL.md	Adds bounded-query guidance for `list_code_scanning_alerts` in the GitHub MCP server skill.
.github/aw/github-mcp-server.md	Adds bounded-query guidance for `list_code_scanning_alerts` in the `.github/aw` MCP server guidance doc.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 3
Review effort level: Low

Copilot · 2026-07-06T14:18:25Z

+	paths := []string{
+		filepath.Join("..", "..", ".github", "workflows", "github-mcp-structural-analysis.md"),
+		filepath.Join("..", "..", ".github", "aw", "github-mcp-server.md"),
+		filepath.Join("..", "..", ".github", "skills", "github-mcp-server", "SKILL.md"),
+	}


Obsolete — the test file was deleted entirely (commit 31eed7e).

Copilot · 2026-07-06T14:18:25Z

+			hasBoundedReference := false
+			for i, line := range lines {
+				if !strings.Contains(line, "list_code_scanning_alerts") {
+					continue
+				}


Obsolete — the test file was deleted entirely (commit 31eed7e).

Copilot · 2026-07-06T14:18:24Z

 - `get_code_scanning_alert` - Get details of a specific alert
 - `create_code_scanning_alert` - Create a code scanning alert

+When invoking `list_code_scanning_alerts` from workflow prompts/templates, always include `state: open` and `severity: critical,high`.


Fixed in commit 4ea7df3 — the bounded state: open / severity: critical,high warning is now inlined in both the "All Available Toolsets" table and the allowed→toolsets migration table, in addition to the Code Security Toolset section.

pelikhan · 2026-07-06T11:13:57Z

@@ -0,0 +1,51 @@
+//go:build !integration


@copilot delete this test file

Done — the file has been deleted in the latest commit.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-06T13:40:17Z

🤖 PR Triage

Field	Value
Category	`docs`
Risk	`low`
Priority Score	44/100
Recommended Action	🚀 `fast_track`

Score breakdown: Impact 22 + Urgency 12 + Quality 10

Rationale: Constrains unbounded list_code_scanning_alerts prompt usage with explicit state/severity bounds — prevents oversized MCP responses. 3 files (.github/aw/, SKILL.md, docs). Human reviewer @pelikhan engaged in discussion. Low risk, actionable prompt guardrails.

Run §28795034579

Generated by 🔧 PR Triage Agent · 78.2 AIC · ⌖ 8.88 AIC · ⊞ 5.5K · ◷

gh-aw-bot · 2026-07-06T14:06:35Z

@copilot please run the pr-finisher skill, address any remaining unresolved review feedback, and rerun checks once the branch is up to date.

Triggered by PR Sous Chef: https://github.com/github/gh-aw/actions/runs/28797012897

Generated by 👨‍🍳 PR Sous Chef · 12.3 AIC · ⌖ 4.98 AIC · ⊞ 4.6K · ◷
_{Comment /souschef to run again}

…in SKILL.md Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

github-actions · 2026-07-07T10:07:05Z

🎉 This pull request is included in a new release.

Release: v0.82.3

Initial plan

be748f5

Copilot AI assigned Copilot and pelikhan Jul 6, 2026

Copilot started work on behalf of pelikhan July 6, 2026 08:32 View session

Copilot AI linked an issue Jul 6, 2026 that may be closed by this pull request

[hippo] Audit workflow prompts for unbounded list_code_scanning_alerts calls #43737

Closed

Copilot AI and others added 3 commits July 6, 2026 08:47

Bound list_code_scanning_alerts prompt usage

01dfc99

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Harden list_code_scanning_alerts bounds regression test

98e1f6d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Document and enforce bounded code-scanning alert queries

51751a4

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Audit workflow prompts for list_code_scanning_alerts~~ Constrain list_code_scanning_alerts prompt usage with explicit state/severity bounds Jul 6, 2026

Copilot AI requested a review from pelikhan July 6, 2026 08:54

Copilot finished work on behalf of pelikhan July 6, 2026 08:54

pelikhan marked this pull request as ready for review July 6, 2026 09:41

Copilot AI review requested due to automatic review settings July 6, 2026 09:41

Copilot started reviewing on behalf of pelikhan July 6, 2026 09:42 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

pelikhan reviewed Jul 6, 2026

View reviewed changes

Copilot started work on behalf of pelikhan July 6, 2026 11:14 View session

Remove code_scanning_prompt_bounds_test.go

31eed7e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 6, 2026 11:20

Copilot AI requested a review from pelikhan July 6, 2026 11:20

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:medium pr-risk:low pr-type:docs labels Jul 6, 2026

github-actions Bot mentioned this pull request Jul 6, 2026

[PR Triage Report] [PR Triage] Agent PR Report — 2026-07-06 #43788

Closed

github-actions Bot mentioned this pull request Jul 6, 2026

[pr-sous-chef] Run report — 7 nudged, 0 skipped #43793

Closed

Copilot started work on behalf of gh-aw-bot July 6, 2026 14:07 View session

Add bounded guidance to all list_code_scanning_alerts table mentions …

4ea7df3

…in SKILL.md Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 6, 2026 14:19

Copilot AI requested a review from gh-aw-bot July 6, 2026 14:19

pelikhan merged commit ad585d7 into main Jul 6, 2026
8 checks passed

pelikhan deleted the copilot/hippo-audit-workflow-prompts branch July 6, 2026 15:42

github-actions Bot mentioned this pull request Jul 6, 2026

[PR Triage Report] Agent PR Report — 2026-07-06 (run 28815219785) #43856

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Constrain `list_code_scanning_alerts` prompt usage with explicit state/severity bounds - #43744

Constrain `list_code_scanning_alerts` prompt usage with explicit state/severity bounds#43744
pelikhan merged 6 commits into
mainfrom
copilot/hippo-audit-workflow-prompts

Copilot AI commented Jul 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 6, 2026

Uh oh!

Copilot AI Jul 6, 2026

Uh oh!

Copilot AI Jul 6, 2026

Uh oh!

pelikhan Jul 6, 2026

Uh oh!

Copilot AI Jul 6, 2026

Uh oh!

github-actions Bot commented Jul 6, 2026

Uh oh!

gh-aw-bot commented Jul 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 6, 2026

🤖 PR Triage

Uh oh!

gh-aw-bot commented Jul 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 6, 2026 •

edited

Loading