From 2e027b25fb0641aa2ea0a996b98fd1c4b275fefc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 24 Jul 2026 19:19:08 +0000 Subject: [PATCH 1/3] Plan container pin consistency CI job Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/skills/agentic-workflows/SKILL.md | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md index c82d415e0fd..615a51e551e 100644 --- a/.github/skills/agentic-workflows/SKILL.md +++ b/.github/skills/agentic-workflows/SKILL.md @@ -15,13 +15,6 @@ Repository overlay (optional): Read only the files you need: Load these files from `github/gh-aw` (they are not available locally). - -Critical download method for Codespaces: -- Always download instruction files from the rawusercontent endpoint, not github.com HTML pages. -- Use URLs in this format: `https://raw.githubusercontent.com/github/gh-aw//`. -- Do not rely on `gh`-authenticated github.com content fetches for these files; Codespaces `gh` tokens can lack permissions to read github.com content. -- If any required instruction file cannot be downloaded, stop immediately and report that the skill cannot continue until the file is accessible. - - `.github/aw/action-container-substitutions.md` - `.github/aw/agentic-chat.md` - `.github/aw/agentic-workflows-mcp.md` From 3418694b3dea169ab6c7165661f9f8bfa9e24f70 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 24 Jul 2026 19:24:12 +0000 Subject: [PATCH 2/3] Add CI job to verify workflow container pin digests Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/ci.yml | 95 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 06773a77b41..97b0109aff8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,6 +14,8 @@ on: - 'actions/setup/**' - '.github/workflows/ci.yml' - '.github/workflows/*.md' + - '.github/workflows/*.lock.yml' + - '.github/aw/actions-lock.json' - '.github/aw/releases.json' - '.github/aw/releases.schema.json' - '.github/aw/compat.json' @@ -39,6 +41,99 @@ jobs: run: "if [ \"${{ github.event_name }}\" != \"schedule\" ]; then\n echo \"has_changes=true\" >> \"$GITHUB_OUTPUT\"\n echo \"✅ Non-scheduled run: integration tests enabled\" >> \"$GITHUB_STEP_SUMMARY\"\n exit 0\nfi\n\nCHANGES_IN_LAST_HOUR=$(git log --since='1 hour ago' --pretty=format:'%H' | wc -l | tr -d ' ')\nif [ \"$CHANGES_IN_LAST_HOUR\" -gt 0 ]; then\n echo \"has_changes=true\" >> \"$GITHUB_OUTPUT\"\n echo \"✅ Detected $CHANGES_IN_LAST_HOUR commit(s) in the last hour\" >> \"$GITHUB_STEP_SUMMARY\"\nelse\n echo \"has_changes=false\" >> \"$GITHUB_OUTPUT\"\n echo \"ℹī¸ No commits in the last hour; skipping integration jobs\" >> \"$GITHUB_STEP_SUMMARY\"\nfi" outputs: has_changes: ${{ steps.detect.outputs.has_changes }} + validate-container-pins: + name: Validate workflow container pins + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + with: + persist-credentials: false + - name: Check container images against actions pins + shell: bash + run: | + set -euo pipefail + + pins_file=".github/aw/actions-lock.json" + if [ ! -f "$pins_file" ]; then + echo "actions pins file not found: $pins_file" + exit 1 + fi + + if ! jq -e '.containers and (.containers | type == "object")' "$pins_file" >/dev/null; then + echo "actions pins file must include a containers object: $pins_file" + exit 1 + fi + + invalid_pin_entries=$( + jq -r ' + .containers + | to_entries[] + | select((.value.image + "@" + .value.digest) != .value.pinned_image) + | .key + ' "$pins_file" + ) + if [ -n "$invalid_pin_entries" ]; then + echo "invalid pinned_image values in actions pins file:" + echo "$invalid_pin_entries" + exit 1 + fi + + failures=0 + checked_files=0 + checked_images=0 + + while IFS= read -r lock_file; do + manifest_json="$(sed -n 's/^# gh-aw-manifest: //p' "$lock_file" | head -n 1)" + if [ -z "$manifest_json" ]; then + continue + fi + + checked_files=$((checked_files + 1)) + while IFS= read -r container; do + image="$(jq -r '.image' <<<"$container")" + digest="$(jq -r '.digest' <<<"$container")" + pinned_image="$(jq -r '.pinned_image' <<<"$container")" + expected_digest="$(jq -r --arg image "$image" '.containers[$image].digest // empty' "$pins_file")" + + checked_images=$((checked_images + 1)) + if [ -z "$expected_digest" ]; then + echo "missing container entry in actions pins for $image (file: $lock_file)" + failures=1 + continue + fi + + if [ "$digest" != "$expected_digest" ]; then + echo "digest mismatch for $image in $lock_file" + echo " expected: $expected_digest" + echo " actual: $digest" + failures=1 + fi + + expected_pinned_image="${image}@${expected_digest}" + if [ "$pinned_image" != "$expected_pinned_image" ]; then + echo "pinned image mismatch for $image in $lock_file" + echo " expected: $expected_pinned_image" + echo " actual: $pinned_image" + failures=1 + fi + done < <(jq -c '.containers // [] | .[]' <<<"$manifest_json") + done < <(find .github/workflows -maxdepth 1 -name '*.lock.yml' -print | sort) + + if [ "$checked_files" -eq 0 ]; then + echo "no lock workflows with gh-aw manifest were found" + exit 1 + fi + + if [ "$failures" -ne 0 ]; then + echo "container pin validation failed" + exit 1 + fi + + echo "validated $checked_images container pins across $checked_files workflow lock files" integration: name: "Integration: ${{ matrix.test-group.name }}" if: ${{ needs.changes.outputs.has_changes == 'true' }} From 49ed2dead4fd10bf26dd39a324aba7882f9a2f62 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 25 Jul 2026 16:55:04 +0000 Subject: [PATCH 3/3] Revert agentic-workflows skill instruction edits Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/skills/agentic-workflows/SKILL.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/skills/agentic-workflows/SKILL.md b/.github/skills/agentic-workflows/SKILL.md index 615a51e551e..c82d415e0fd 100644 --- a/.github/skills/agentic-workflows/SKILL.md +++ b/.github/skills/agentic-workflows/SKILL.md @@ -15,6 +15,13 @@ Repository overlay (optional): Read only the files you need: Load these files from `github/gh-aw` (they are not available locally). + +Critical download method for Codespaces: +- Always download instruction files from the rawusercontent endpoint, not github.com HTML pages. +- Use URLs in this format: `https://raw.githubusercontent.com/github/gh-aw//`. +- Do not rely on `gh`-authenticated github.com content fetches for these files; Codespaces `gh` tokens can lack permissions to read github.com content. +- If any required instruction file cannot be downloaded, stop immediately and report that the skill cannot continue until the file is accessible. + - `.github/aw/action-container-substitutions.md` - `.github/aw/agentic-chat.md` - `.github/aw/agentic-workflows-mcp.md`