diff --git a/.github/workflows/deployment-incident-monitor.lock.yml b/.github/workflows/deployment-incident-monitor.lock.yml index 5e58df7f8bc..2942d1de19f 100644 --- a/.github/workflows/deployment-incident-monitor.lock.yml +++ b/.github/workflows/deployment-incident-monitor.lock.yml @@ -62,10 +62,10 @@ name: "Deployment Incident Monitor" on: deployment_status: - # state: # State filtering compiled into if condition - # - error # State filtering compiled into if condition - # - failure # State filtering compiled into if condition - # skip-if-match: is:issue is:open label:incident label:deployment-failure # Skip-if-match processed as search check in pre-activation job +# state: # State filtering compiled into if condition +# - error # State filtering compiled into if condition +# - failure # State filtering compiled into if condition +# skip-if-match: is:issue is:open label:incident label:deployment-failure # Skip-if-match processed as search check in pre-activation job permissions: {} diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml index 15a3ed21b8c..eacad788ec7 100644 --- a/.github/workflows/smoke-call-workflow.lock.yml +++ b/.github/workflows/smoke-call-workflow.lock.yml @@ -619,6 +619,11 @@ jobs: "inputSchema": { "additionalProperties": false, "properties": { + "aw_context": { + "default": "", + "description": "Agent caller context (used internally by Agentic Workflows).", + "type": "string" + }, "payload": { "description": "Input parameter 'payload' for workflow smoke-workflow-call", "type": "string" @@ -1104,15 +1109,25 @@ jobs: needs: safe_outputs if: needs.safe_outputs.outputs.call_workflow_name == 'smoke-workflow-call' # Imported from called workflow "smoke-workflow-call" because GitHub requires the caller job to grant permissions requested by reusable workflow jobs. - # Review the called workflow's frontmatter permissions in ./.github/workflows/smoke-workflow-call.md. + # Review the called workflow's job-level permissions in ./.github/workflows/smoke-workflow-call.lock.yml. permissions: + actions: read contents: read - pull-requests: read + issues: write + pull-requests: write uses: ./.github/workflows/smoke-workflow-call.lock.yml with: + aw_context: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload).aw_context }} payload: ${{ needs.safe_outputs.outputs.call_workflow_payload }} task-description: ${{ fromJSON(needs.safe_outputs.outputs.call_workflow_payload)['task-description'] }} - secrets: inherit + secrets: + COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }} + GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }} + GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }} + GH_AW_OTEL_GRAFANA_AUTHORIZATION: ${{ secrets.GH_AW_OTEL_GRAFANA_AUTHORIZATION }} + GH_AW_OTEL_GRAFANA_ENDPOINT: ${{ secrets.GH_AW_OTEL_GRAFANA_ENDPOINT }} + GH_AW_OTEL_SENTRY_AUTHORIZATION: ${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }} + GH_AW_OTEL_SENTRY_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }} conclusion: needs: diff --git a/pkg/workflow/compiler_forks_test.go b/pkg/workflow/compiler_forks_test.go index 176436c2f89..2a99dbd14ca 100644 --- a/pkg/workflow/compiler_forks_test.go +++ b/pkg/workflow/compiler_forks_test.go @@ -387,8 +387,8 @@ tools: allowed: [issue_read] ---`, expectedYAML: ` pull_request: - # forks: # Fork filtering applied via job conditions - # - specific/repo # Fork filtering applied via job conditions`, +# forks: # Fork filtering applied via job conditions +# - specific/repo # Fork filtering applied via job conditions`, description: "Should comment out forks array even when it's the only field", }, { @@ -409,7 +409,7 @@ tools: allowed: [issue_read] ---`, expectedYAML: ` pull_request: - # forks: specific/repo # Fork filtering applied via job conditions`, +# forks: specific/repo # Fork filtering applied via job conditions`, description: "Should comment out forks single string", }, { @@ -430,7 +430,7 @@ tools: allowed: [issue_read] ---`, expectedYAML: ` pull_request: - # forks: "*" # Fork filtering applied via job conditions`, +# forks: "*" # Fork filtering applied via job conditions`, description: "Should comment out forks wildcard string", }, } diff --git a/pkg/workflow/frontmatter_on_section_cleanup.go b/pkg/workflow/frontmatter_on_section_cleanup.go index 965df2a94bf..bc43b163f61 100644 --- a/pkg/workflow/frontmatter_on_section_cleanup.go +++ b/pkg/workflow/frontmatter_on_section_cleanup.go @@ -745,13 +745,36 @@ func dedentTrailingOnCommentBlock(lines []string) []string { return lines } - // Only dedent comments at the direct `on:` children level (≤2 spaces / 1 tab). - // Comments nested deeper — e.g. `forks:` inside `pull_request:` at 4-space indent — - // are part of a nested event section and must keep their indentation so that the - // visual structure of the `on:` block is preserved. + // Comments at the direct `on:` children level (≤2 spaces / 1 tab) always dedent + // to column 0. Comments nested deeper — e.g. `forks:` inside `pull_request:` at + // 4-space indent — are usually part of a nested event section that still has real + // sibling content at the same indent (a `types:` line next to a commented + // `# forks:`), so they keep their indentation to preserve the visual structure of + // the `on:` block. + // + // The exception is a parent key whose children are *entirely* commented out — e.g. + // a `deployment_status:` whose only descendants are `# state:` / `# - error`. There + // the block's nearest real content line is the shallower parent key, so the comment + // aligns with neither that key nor the column-0 top-level key that follows the `on:` + // section, and yamllint's comments-indentation rule flags it. In that case dedent to + // column 0 (matching the following content) to clear the warning. firstLineIndent := len(lines[start]) - len(strings.TrimLeft(lines[start], " \t")) if firstLineIndent > 2 { - return lines + // Find the nearest preceding real (non-blank) content line — the anchor the + // comment block visually attaches to. + anchor := start - 1 + for anchor >= 0 && strings.TrimSpace(lines[anchor]) == "" { + anchor-- + } + if anchor < 0 { + return lines + } + anchorIndent := len(lines[anchor]) - len(strings.TrimLeft(lines[anchor], " \t")) + // A sibling at the same (or deeper) indent anchors the block — leave it as-is. + // Only a strictly shallower anchor (the parent key) needs dedenting. + if anchorIndent >= firstLineIndent { + return lines + } } for i := start; i <= last; i++ { diff --git a/pkg/workflow/frontmatter_on_section_cleanup_test.go b/pkg/workflow/frontmatter_on_section_cleanup_test.go index afb87174dd5..5c0e739251b 100644 --- a/pkg/workflow/frontmatter_on_section_cleanup_test.go +++ b/pkg/workflow/frontmatter_on_section_cleanup_test.go @@ -119,6 +119,40 @@ func TestDedentTrailingOnCommentBlock(t *testing.T) { "# - admin # Roles processed as role check in pre-activation job", }, }, + { + name: "deeply nested trailing block whose parent has no real children is dedented", + input: []string{ + "on:", + " deployment_status:", + " # state: # State filtering compiled into if condition", + " # - error # State filtering compiled into if condition", + " # - failure # State filtering compiled into if condition", + }, + want: []string{ + "on:", + " deployment_status:", + "# state: # State filtering compiled into if condition", + "# - error # State filtering compiled into if condition", + "# - failure # State filtering compiled into if condition", + }, + }, + { + name: "deeply nested trailing block with a real sibling at its indent is left untouched", + input: []string{ + "on:", + " pull_request:", + " types: [opened]", + " # forks: # Fork filtering applied via job conditions", + " # - octocat # Fork filtering applied via job conditions", + }, + want: []string{ + "on:", + " pull_request:", + " types: [opened]", + " # forks: # Fork filtering applied via job conditions", + " # - octocat # Fork filtering applied via job conditions", + }, + }, { name: "tab-indented trailing comment is dedented", input: []string{