From 0f6af302bd4acd1df27b3f9c66d7c16c87ee7d9e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 21:28:32 +0000 Subject: [PATCH 1/3] Initial plan From 539ea989c5e16ec451e3e210f7ccf809c2a85ff0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 21:39:21 +0000 Subject: [PATCH 2/3] skills: add cascading safe-output failure triage guidance Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/skills/debugging-workflows/SKILL.md | 27 +++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/skills/debugging-workflows/SKILL.md b/.github/skills/debugging-workflows/SKILL.md index aa8c423a2a7..8de542dcbd8 100644 --- a/.github/skills/debugging-workflows/SKILL.md +++ b/.github/skills/debugging-workflows/SKILL.md @@ -339,6 +339,33 @@ safe-outputs: labels: [ai-generated] ``` +### Cascading Safe-Output Message Failures (Process Safe Outputs step) + +**Symptoms**: +- `Process Safe Outputs` reports multiple failed messages in one run +- One failed `update_pull_request` message includes a 403 workflows-permission warning +- Other failed messages (for example `add_comment`) include `Bad credentials` + +**What this means**: +- Do not assume all safe-output failures share one root cause. +- A 403 workflows-permission error on `update_pull_request` can be expected/non-fatal in some workflows. +- A 401-style `Bad credentials` error on other messages is a separate authentication failure that needs its own fix. + +**Diagnostic steps**: + +```bash +# Summarize failed safe-output messages and types +gh aw audit + +# Inspect full failing job logs to classify each message failure +gh run view --job= --log +``` + +- Triage each failed message by its own HTTP status code and tool/action name. +- Check `permissions:` for missing scopes when 403 errors appear. +- Compare the "failed message count" against the individual failed message lines to confirm whether there are multiple independent failures. +- If several credential failures cluster together in time, investigate token freshness/expiry and token source for the run. + ### Network Access Errors **Symptoms**: From 3aab2b313ba73823c6938208d4a8f155d7285ce5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 21:59:19 +0000 Subject: [PATCH 3/3] skills: expand safe-output audit artifact guidance Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/skills/debugging-workflows/SKILL.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/skills/debugging-workflows/SKILL.md b/.github/skills/debugging-workflows/SKILL.md index 8de542dcbd8..d528f2ecf76 100644 --- a/.github/skills/debugging-workflows/SKILL.md +++ b/.github/skills/debugging-workflows/SKILL.md @@ -357,6 +357,12 @@ safe-outputs: # Summarize failed safe-output messages and types gh aw audit +# Include additional artifacts when diagnosis needs more context +gh aw audit --artifacts usage,github-api,mcp,agent + +# Escalate to full artifact collection for hard-to-classify failures +gh aw audit --artifacts all + # Inspect full failing job logs to classify each message failure gh run view --job= --log ```