Motivation
Link to the gh-aw PR: github/gh-aw#49071 — "Add gh-aw-detection: true to 7 high-frequency workflows lacking anomaly/prompt-injection detection". This surfaces the features.gh-aw-detection: true frontmatter field, which enables the threat/anomaly detection engine job in the compiled lockfile. No existing test exercises this feature flag or asserts the detection job is present in the compiled output.
Proposed test
- Workflow file:
test-copilot-gh-aw-detection.md
- Trigger:
workflow_dispatch
- Engine: copilot
- Safe output:
create-issue (or noop) — the detection feature itself doesn't require a specific safe-output, so pick the simplest
- Variant: standard
Minimal test prompt sketch
Add features:\n gh-aw-detection: true to frontmatter and have the agent emit a simple safe output (e.g. create-issue via samples:). The primary assertion is that gh aw compile succeeds and the generated .lock.yml contains the detection/anomaly-scan job, confirming the flag compiles and runs end-to-end without breaking the normal safe-output flow.
New fixtures or secrets needed
None — reuses existing fixtures and Copilot credentials.
Notes
No open suggestion or existing test currently covers features.gh-aw-detection. This is a compiler/runtime plumbing check rather than a security-outcome test — it verifies the feature flag compiles cleanly and doesn't interfere with normal safe-output delivery.
Generated by 🔍 Suggest New E2E Tests · aut00 · 33.4 AIC · ⌖ 6.57 AIC · ⊞ 8.3K · ◷
Motivation
Link to the gh-aw PR: github/gh-aw#49071 — "Add gh-aw-detection: true to 7 high-frequency workflows lacking anomaly/prompt-injection detection". This surfaces the
features.gh-aw-detection: truefrontmatter field, which enables the threat/anomaly detection engine job in the compiled lockfile. No existing test exercises this feature flag or asserts the detection job is present in the compiled output.Proposed test
test-copilot-gh-aw-detection.mdworkflow_dispatchcreate-issue(ornoop) — the detection feature itself doesn't require a specific safe-output, so pick the simplestMinimal test prompt sketch
Add
features:\n gh-aw-detection: trueto frontmatter and have the agent emit a simple safe output (e.g. create-issue viasamples:). The primary assertion is thatgh aw compilesucceeds and the generated.lock.ymlcontains the detection/anomaly-scan job, confirming the flag compiles and runs end-to-end without breaking the normal safe-output flow.New fixtures or secrets needed
None — reuses existing fixtures and Copilot credentials.
Notes
No open suggestion or existing test currently covers
features.gh-aw-detection. This is a compiler/runtime plumbing check rather than a security-outcome test — it verifies the feature flag compiles cleanly and doesn't interfere with normal safe-output delivery.