Implement lock-for-agent feature for issues by Copilot · Pull Request #6245 · github/gh-aw

Copilot · 2025-12-12T12:11:40Z

Implements the lock-for-agent optional boolean field for the on.issues trigger in workflow frontmatter. When enabled, issues are automatically locked during agent workflow execution and unlocked upon completion to prevent concurrent modifications.

Implementation

Frontmatter Configuration

on:
  issues:
    types: [opened]
    lock-for-agent: true

Key Features

Lock Step: Added to activation job, locks the issue before agent execution
- Only runs in issue context (checks github.event.issue.number)
- Uses embedded lock-issue.cjs JavaScript (already registered with bundler)
- Does not provide a lock reason as specified
- Checks lock status first: Skips lock operation if issue is already locked to avoid unnecessary API calls
- Sets output: Sets locked output to "true" when successfully locked, "false" otherwise
- Exposes job output: issue_locked output exposed from activation job for downstream use
Unlock Step: Added to conclusion job, unlocks the issue after completion
- Uses always() condition to run even on workflow failure
- Uses embedded unlock-issue.cjs JavaScript (already registered with bundler)
- Checks lock status first: Skips unlock operation if issue is not locked to ensure idempotent behavior
- Output-based condition: Only unlocks if needs.activation.outputs.issue_locked == 'true', ensuring we only unlock issues we locked
Reaction Message: When reactions are enabled, adds a 🔒 lock notification to the activation comment indicating the issue has been locked
Event Compatibility: Fully compatible with other event types (pull_request, discussion, etc.) - lock steps only execute in issue context

Changes Made

Compiler:
- Added LockForAgent field to WorkflowData struct
- Parse lock-for-agent from on.issues configuration in parseOnSection
- Generate lock step in activation job with issue context condition
- Generate unlock step in conclusion job with always() condition and output-based check
- Add issue_locked output to activation job
JavaScript:
- Enhanced add_reaction_and_edit_comment.cjs to display lock notification when GH_AW_LOCK_FOR_AGENT environment variable is set
- Smart lock checking: Both lock-issue.cjs and unlock-issue.cjs now check the issue's lock status using github.rest.issues.get() before performing operations
- Output tracking: lock-issue.cjs sets locked output to track whether the issue was successfully locked
- Prevents errors and unnecessary API calls when issue is already in the desired state
Tests:
- Go Tests (lock_for_agent_test.go): 4 comprehensive test cases
  - Lock-for-agent enabled with reaction
  - Lock-for-agent enabled without reaction
  - Lock-for-agent disabled (default)
  - Compatibility with pull_request events
- JavaScript Tests: Added comprehensive test suites for the lock/unlock scripts
  - lock-issue.test.cjs: 7 test cases covering successful operations, error handling, validation, skip-when-already-locked behavior, and output verification
  - unlock-issue.test.cjs: 8 test cases covering successful operations, error handling, edge cases, and skip-when-not-locked behavior
Enabled in Production: Added lock-for-agent: true to .github/workflows/ai-moderator.md to prevent concurrent modifications during AI moderation

Testing

✅ All lock-for-agent Go tests pass (4 tests)
✅ All JavaScript tests pass (15 tests: 7 for lock-issue, 8 for unlock-issue)
✅ Code formatted successfully
✅ All workflows recompiled (25 lock files updated, including ai-moderator)
✅ Lock/unlock steps properly conditional on issue context
✅ Unlock step runs on failure via always() condition
✅ Smart status checking prevents unnecessary operations and errors
✅ Output tracking provides visibility into lock operations and enables precise unlock control

Original prompt

This section details on the original issue you should resolve

<issue_title>Locking of issues</issue_title>
<issue_description>Add a "lock-for-agent" optional boolean field to the on.issue field in the front matter.

on:
issue:
lock-for-agent: true

When enabled, the issue is locked while the agent job runs and unlocked in the conclusion. This prevents concurrent updates to the issue while it is being analyzed.

If enabled, the compiler should emit a step in the activation job to lock the issue in context . Use a JavaScript script, from an embedded file registered with the bundler. Do not provide a reason.

If reaction is enabled, add a message that the issue is locked.

If enabled, the conclusion job should unlock the issue even on failure. Use JavaScript, separate file, registered with bundle.</issue_description>

Comments on the Issue (you are @copilot in this section)
@pelikhan /plan @pelikhan copilot finish this feature, including sub issues.

add tests

must be compatible with other events, not sure run within issue context </comment_new>

Fixes Locking of issues #6201

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

pelikhan · 2025-12-12T12:18:00Z

@copilot restart

- Add LockForAgent field to WorkflowData struct - Parse lock-for-agent from on.issues configuration - Add lock step to activation job when enabled - Add unlock step to conclusion job (runs always, even on failure) - Pass lock-for-agent status to reaction script - Update reaction message to indicate issue is locked - Add comprehensive tests for lock-for-agent functionality - Recompile all workflows with updated JavaScript Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-12-12T12:40:57Z

@copilot add tests for JavaScript files

Copilot · 2025-12-12T12:44:35Z

@copilot restart

I've completed the lock-for-agent feature implementation:

What was implemented:

Added lock-for-agent boolean field parsing from on.issues frontmatter
Lock step added to activation job (only runs in issue context)
Unlock step added to conclusion job (runs always, even on failure)
Lock notification added to reaction messages when enabled
Comprehensive test suite with 4 test cases

Key features:

Lock step uses github.event.issue.number condition to only run on issues
Unlock step has always() condition to ensure issues are unlocked even on workflow failure
Works seamlessly with reactions - adds a 🔒 message to the activation comment
Fully compatible with other event types (pull_request, discussion, etc.)

Testing:

All lock-for-agent tests pass ✓
Workflows recompiled successfully ✓
Code formatted ✓

Commit: 5b16f9b

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login it/ref/tags/v5 GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE k/pty GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linu/var/run/docker/runtime-runc/moby env d-artifact.git d-artifact.git 2621828/b357=> GOINSECURE GOMOD GOMODCACHE 2621828/b339/importcfg (http block)
- Triggering command: /usr/bin/gh gh api user --jq .login e-github-app-token.git e-github-app-token.git /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env tags/v5 GO111MODULE e/git GOINSECURE /" + .name GOMODCACHE e/git (http block)
- Triggering command: /usr/bin/gh gh api user --jq .login b-script.git b-script.git b5c7b1ea66e5aafde94ae9659014d3abcf3/log.json GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linutest@example.com env yYG2/x0NfzuPN1kAbisUKyYG2 GO111MODULE (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

pelikhan · 2025-12-12T12:52:31Z

@copilot If the issue is already locked, do not lock/unlock.

- Add lock-issue.test.cjs with 6 test cases - Add unlock-issue.test.cjs with 7 test cases - Test successful lock/unlock operations - Test error handling for missing issue number - Test API error handling (rate limits, permissions) - Test non-Error exception handling - Test different issue numbers - Verify no lock_reason parameter is provided (lock-issue) - All tests pass successfully Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-12T12:52:55Z

@copilot add tests for JavaScript files

Added comprehensive JavaScript tests:

lock-issue.test.cjs (6 tests):

✅ Successful lock operation
✅ Missing issue number handling
✅ API error handling (rate limits)
✅ Non-Error exception handling
✅ Different issue numbers
✅ Verifies no lock_reason parameter

unlock-issue.test.cjs (7 tests):

✅ Successful unlock operation
✅ Missing issue number handling
✅ API error handling
✅ Non-Error exception handling
✅ Different issue numbers
✅ Permission errors
✅ Already unlocked handling

All 13 JavaScript tests pass. Commit: b16861e

pelikhan · 2025-12-12T12:53:10Z

@copilot enable for ai-moderator agentic workflow

…oderator - Update lock-issue.cjs to check if issue is already locked before locking - Update unlock-issue.cjs to check if issue is locked before unlocking - Skip lock operation if issue is already locked - Skip unlock operation if issue is not locked - Update tests to cover new behavior (7 tests for lock-issue, 8 for unlock-issue) - Enable lock-for-agent feature in ai-moderator workflow - All 15 JavaScript tests pass Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-12T13:04:56Z

@copilot enable for ai-moderator agentic workflow

Enabled lock-for-agent: true in ai-moderator workflow:

on:
  issues:
    types: [opened]
    lock-for-agent: true

The workflow now locks issues during moderation to prevent concurrent modifications. The compiled workflow includes both lock and unlock steps with the new smart status checking. Commit: 9b68f8f

@copilot If the issue is already locked, do not lock/unlock.

Updated both scripts to check lock status before taking action:

lock-issue.cjs:

Calls github.rest.issues.get() to check issue.locked status
Skips lock operation if already locked with info message
Prevents unnecessary API calls and potential errors

unlock-issue.cjs:

Checks issue.locked status first
Skips unlock operation if not locked
Ensures idempotent behavior

All tests updated to verify the new behavior. Commit: 9b68f8f

pelikhan · 2025-12-12T13:08:29Z

+    }
+
+    core.info(`Locking issue #${issueNumber} for agent workflow execution`);
+


@copilot

set output to indicate that the issue needs to be unlocked (expose as job output too)

use the output in unlock step in conclusion job as if condition

Implemented output tracking and conditional unlock:

Lock Step Output:

Sets locked output: "true" when successfully locked, "false" otherwise

Exposed as job output: issue_locked: ${{ steps.lock-issue.outputs.locked }}

Unlock Condition:

Checks needs.activation.outputs.issue_locked == 'true'

Three-part condition: always() && github.event.issue.number && needs.activation.outputs.issue_locked == 'true'

Only unlocks if activation job successfully locked the issue

Benefits:

Prevents unlock attempts when issue was already locked

Provides visibility into lock operations

Maintains precise control over unlock behavior

Commit: 3962c98

- lock-issue.cjs now sets 'locked' output ('true' when locked, 'false' otherwise) - Activation job exposes issue_locked output from lock-issue step - Unlock step in conclusion job checks needs.activation.outputs.issue_locked - Only unlocks if the activation job successfully locked the issue - Prevents unlock attempts when issue was already locked - Updated tests to verify output behavior in all scenarios - All 15 JavaScript tests pass, all 4 Go tests pass Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Initial plan

206a93c

Copilot AI assigned Copilot and pelikhan Dec 12, 2025

Copilot started work on behalf of pelikhan December 12, 2025 12:12 View session

pelikhan closed this Dec 12, 2025

pelikhan reopened this Dec 12, 2025

Copilot AI requested a review from pelikhan December 12, 2025 12:15

Copilot stopped work on behalf of pelikhan due to an error December 12, 2025 12:15
Copilot has encountered an error. See logs for additional details.

Copilot started work on behalf of pelikhan December 12, 2025 12:18 View session

Copilot AI changed the title ~~[WIP] Add lock-for-agent field to issue front matter~~ Implement lock-for-agent feature for issues Dec 12, 2025

Copilot finished work on behalf of pelikhan December 12, 2025 12:47

Copilot started work on behalf of pelikhan December 12, 2025 12:48 View session

Copilot finished work on behalf of pelikhan December 12, 2025 12:55

Copilot started work on behalf of pelikhan December 12, 2025 12:55 View session

Copilot finished work on behalf of pelikhan December 12, 2025 13:07

pelikhan reviewed Dec 12, 2025

View reviewed changes

Copilot started work on behalf of pelikhan December 12, 2025 13:09 View session

Copilot AI requested a review from pelikhan December 12, 2025 13:20

Copilot finished work on behalf of pelikhan December 12, 2025 13:20

pelikhan marked this pull request as ready for review December 12, 2025 13:23

pelikhan merged commit 6871642 into main Dec 12, 2025
5 checks passed

pelikhan deleted the copilot/add-lock-for-agent-field branch December 12, 2025 13:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement lock-for-agent feature for issues#6245

Implement lock-for-agent feature for issues#6245
pelikhan merged 5 commits into
mainfrom
copilot/add-lock-for-agent-field

Copilot AI commented Dec 12, 2025 •

edited

Loading

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

Copilot AI commented Dec 12, 2025 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

Copilot AI commented Dec 12, 2025

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

Copilot AI commented Dec 12, 2025 •

edited

Loading

Uh oh!

pelikhan Dec 12, 2025

Uh oh!

Copilot AI Dec 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		}

		core.info(`Locking issue #${issueNumber} for agent workflow execution`);

Conversation

Copilot AI commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation

Frontmatter Configuration

Key Features

Changes Made

Testing

Comments on the Issue (you are @copilot in this section)

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

Copilot AI commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

Copilot AI commented Dec 12, 2025

Uh oh!

pelikhan commented Dec 12, 2025

Uh oh!

Copilot AI commented Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Dec 12, 2025 •

edited

Loading

Copilot AI commented Dec 12, 2025 •

edited

Loading

Copilot AI commented Dec 12, 2025 •

edited

Loading