Conversation
…flows - Added @modelcontextprotocol/server-memory for in-session knowledge graph - Added @modelcontextprotocol/server-sequential-thinking for structured reasoning - Both compile to Docker stdio containers (node:lts-alpine) in .lock.yml files - Added usage guidance in SHARED_PROMPT_PATTERNS.md - All 12 workflows compiled successfully with gh aw compile v0.66.1 Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/c2fa7684-598f-4317-9232-e218e05beee9 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pethers
April 4, 2026 11:46
View session
github-actions
bot
added
documentation
Contributor
🏷️ Automatic Labeling SummaryThis PR has been automatically labeled based on the files changed and PR metadata. Applied Labels: documentation,workflow,ci-cd,size-xl,news,agentic-workflow Label Categories
For more information, see |
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
- Removed @modelcontextprotocol/server-memory (ephemeral, dies per run) - Removed @modelcontextprotocol/server-sequential-thinking (Claude Opus 4.6 has native CoT) - Added repo-memory: tool config to all 12 workflows (git-backed, persistent, shared) - All workflows share branch memory/news-generation for cross-workflow context - Updated SHARED_PROMPT_PATTERNS.md with repo-memory usage patterns - Added 🧠 Repo Memory section to each workflow markdown body - Recompiled all 12 lock files with gh aw compile v0.66.1 Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/a43c4617-1147-46c5-8ff5-325cf959c982 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
- SECURITY: Replace wildcard network domains (*.se, *.com, *.org, *.io) with explicit domain allowlist — wildcards defeated the firewall purpose - SCHEDULING: Convert 6 fixed cron schedules to gh-aw fuzzy scheduling (daily around X:00 on weekdays, weekly on friday/saturday around X:00) to distribute load and avoid Monday wall-of-work - PERMISSIONS: Keep discussions:read and security-events:read as required by toolsets: all (compiler validates these) - SKILLS: Update gh-aw-firewall skill with TLD wildcard warning - SKILLS: Update gh-aw-workflow-authoring with fuzzy schedule guidance and cross-run memory patterns (repo-memory > server-memory) - SKILLS: Update gh-aw-mcp-configuration with memory best practices - Recompiled all 12 lock files with gh aw compile v0.66.1 Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/9aa229a6-1a75-474f-809c-115fec935b35 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
… prompts - Add hack23.com, riksdagsmonitor.com, hack23.github.io to all 12 workflow network allowlists and safe-outputs allowed-domains - Fix duplicate domains (www.riksdagen.se, www.regeringen.se) in all safe-outputs sections - Enhance news-translate.md: add political intelligence translation standards, cross-language consistency rules, per-language detail for RTL/CJK/Nordic/European, BCP-47 nb for Norwegian - Enhance language-expertise SKILL.md: add 15+ new quality checklist items, 5 political intelligence translation principles - Add Hack23 Ecosystem Context section to SHARED_PROMPT_PATTERNS.md - Add Hack23 Ecosystem Integration table to ai-driven-analysis-guide.md - Recompiled all 12 lock files Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/e3ff40b6-bfab-4475-b1ea-8c4cd558d428 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s agentic news workflows and guidance to support Hack23 ecosystem linking, tighten egress allowlists/safe-outputs, and introduce git-backed cross-run “repo-memory” state shared across workflows.
Changes:
- Add Hack23 ecosystem context/links to analysis and shared prompt pattern docs.
- Replace broad network wildcards with explicit allowlisted domains (including Hack23 domains) and expand safe-outputs allowed-domains accordingly.
- Enable
repo-memoryacross news workflows and recompile associated.lock.ymlfiles; add generated agentic maintenance workflow and expand translation quality standards.
Reviewed changes
Copilot reviewed 32 out of 32 changed files in this pull request and generated 15 comments.
Show a summary per file
| File | Description |
|---|---|
analysis/methodologies/ai-driven-analysis-guide.md |
Adds Hack23 ecosystem integration references for analysis methodology. |
.github/workflows/SHARED_PROMPT_PATTERNS.md |
Adds Hack23 context + repo-memory usage patterns for workflows. |
.github/workflows/news-weekly-review.md |
Adds explicit allowlists/safe-outputs + repo-memory config + fuzzy schedule. |
.github/workflows/news-weekly-review.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-week-ahead.md |
Adds explicit allowlists/safe-outputs + repo-memory config + fuzzy schedule. |
.github/workflows/news-translate.md |
Adds explicit allowlists/safe-outputs + repo-memory + expanded translation standards. |
.github/workflows/news-translate.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-realtime-monitor.md |
Adds explicit allowlists/safe-outputs + repo-memory config. |
.github/workflows/news-realtime-monitor.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-propositions.md |
Adds explicit allowlists/safe-outputs + repo-memory config + fuzzy schedule. |
.github/workflows/news-propositions.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-motions.md |
Adds explicit allowlists/safe-outputs + repo-memory config + fuzzy schedule. |
.github/workflows/news-monthly-review.md |
Adds explicit allowlists/safe-outputs + repo-memory config. |
.github/workflows/news-monthly-review.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-month-ahead.md |
Adds explicit allowlists/safe-outputs + repo-memory config. |
.github/workflows/news-month-ahead.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-interpellations.md |
Adds explicit allowlists/safe-outputs + repo-memory config + fuzzy schedule. |
.github/workflows/news-evening-analysis.md |
Adds explicit allowlists/safe-outputs + repo-memory config. |
.github/workflows/news-evening-analysis.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-committee-reports.md |
Adds explicit allowlists/safe-outputs + repo-memory config + fuzzy schedule. |
.github/workflows/news-committee-reports.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/news-article-generator.md |
Adds explicit allowlists/safe-outputs + repo-memory config. |
.github/workflows/news-article-generator.lock.yml |
Recompiled lock with updated domains/repo-memory/push job. |
.github/workflows/agentics-maintenance.yml |
Adds generated maintenance workflow for expiring entities/operations. |
.github/skills/language-expertise/SKILL.md |
Expands translation QA checklist and principles; updates “Last Updated”. |
.github/skills/gh-aw-workflow-authoring/SKILL.md |
Updates scheduling guidance + adds repo-memory patterns. |
.github/skills/gh-aw-mcp-configuration/SKILL.md |
Updates MCP guidance to prefer repo/cache memory and skip sequential-thinking. |
.github/skills/gh-aw-firewall/SKILL.md |
Strengthens guidance against overly-broad wildcard allowlists. |
.github/aw/actions-lock.json |
Adds pinned entries for newer gh-aw setup/setup-cli actions. |
Comment on lines
+711
to
+715
| ```json | ||
| // covered-documents.json | ||
| { | ||
| "2026-04-04": { | ||
| "H901FiU1": { "workflow": "news-committee-reports", "timestamp": "2026-04-04T06:15:00Z" }, |
There was a problem hiding this comment.
The example block is fenced as json but includes a // covered-documents.json comment line, which is invalid JSON and easy to copy/paste into repo-memory files. Consider either removing the comment line or switching the fence to jsonc to avoid downstream parse/validation errors.
Comment on lines
+144
to
+148
| - Read `memory/news-generation/last-run-'news-weekly-review'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-weekly-review'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-weekly-review'.json). This will create a different filename than the shared convention (last-run-{workflow-name}.json, e.g. last-run-news-weekly-review.json) and can break cross-workflow tooling that expects the conventional pattern.
.github/workflows/news-week-ahead.md
Outdated
Comment on lines
+142
to
+146
| - Read `memory/news-generation/last-run-'news-week-ahead'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-week-ahead'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-week-ahead'.json). This deviates from the shared last-run-{workflow-name}.json convention and may lead to inconsistent/duplicate state files. Prefer last-run-news-week-ahead.json (no embedded quotes).
Suggested change
| - Read `memory/news-generation/last-run-'news-week-ahead'.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-'news-week-ahead'.json` with date, documents analyzed, quality score | |
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score |
Comment on lines
+142
to
+146
| - Read `memory/news-generation/last-run-'news-propositions'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-propositions'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-propositions'.json). This deviates from the shared last-run-{workflow-name}.json convention and can break scripts that rely on predictable filenames. Prefer last-run-news-propositions.json (no embedded quotes).
Suggested change
| - Read `memory/news-generation/last-run-'news-propositions'.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-'news-propositions'.json` with date, documents analyzed, quality score | |
| - Read `memory/news-generation/last-run-news-propositions.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-propositions.json` with date, documents analyzed, quality score |
.github/workflows/news-motions.md
Outdated
Comment on lines
+142
to
+146
| - Read `memory/news-generation/last-run-'news-motions'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-motions'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-motions'.json). This deviates from the shared last-run-{workflow-name}.json convention and may cause state to be written/read from an unexpected filename. Prefer last-run-news-motions.json (no embedded quotes).
Suggested change
| - Read `memory/news-generation/last-run-'news-motions'.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-'news-motions'.json` with date, documents analyzed, quality score | |
| - Read `memory/news-generation/last-run-news-motions.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-motions.json` with date, documents analyzed, quality score |
.github/workflows/news-translate.md
Outdated
Comment on lines
+326
to
+330
| - Read `memory/news-generation/last-run-'news-translate'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-translate'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-translate'.json). This deviates from the shared last-run-{workflow-name}.json convention and can make cross-workflow state harder to consume reliably. Prefer last-run-news-translate.json (no embedded quotes).
Suggested change
| - Read `memory/news-generation/last-run-'news-translate'.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-'news-translate'.json` with date, documents analyzed, quality score | |
| - Read `memory/news-generation/last-run-news-translate.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-translate.json` with date, documents analyzed, quality score |
Comment on lines
+224
to
+228
| - Read `memory/news-generation/last-run-'news-article-generator'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-article-generator'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-article-generator'.json). This deviates from the shared last-run-{workflow-name}.json convention and may lead to writing state under unexpected filenames. Prefer last-run-news-article-generator.json (no embedded quotes).
Suggested change
| - Read `memory/news-generation/last-run-'news-article-generator'.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-'news-article-generator'.json` with date, documents analyzed, quality score | |
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score |
Comment on lines
+972
to
975
| ``` | ||
|
|
||
| **Avoid:** `@modelcontextprotocol/server-memory` — dies when the process ends, lost every run. Also skip `@modelcontextprotocol/server-sequential-thinking` — Claude has native CoT reasoning; it wastes context tokens. | ||
|
|
There was a problem hiding this comment.
This guidance says to skip @modelcontextprotocol/server-sequential-thinking, but the PR title/description indicate sequential-thinking MCP servers are being added to all workflows. Please align the PR messaging and the repo guidance (either add the server everywhere as described, or update the PR title/description to reflect that sequential-thinking is intentionally not used).
Comment on lines
+69
to
+74
| steps: | ||
| - name: Setup Scripts | ||
| uses: github/gh-aw-actions/setup@73ae9ce231580f337133352d321d42b6bf54b6a9 # v0.66.1 | ||
| with: | ||
| destination: ${{ runner.temp }}/gh-aw/actions | ||
|
|
There was a problem hiding this comment.
This newly added workflow runs with elevated write permissions in multiple jobs but does not include the repo’s standard hardening step (step-security/harden-runner) that is present in other workflows (e.g. .github/workflows/compile-agentic-workflows.yml). Consider adding a Harden Runner step at the start of each job to keep the workflow security baseline consistent.
Comment on lines
+146
to
+150
| - Read `memory/news-generation/last-run-'news-committee-reports'.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-'news-committee-reports'.json` with date, documents analyzed, quality score |
There was a problem hiding this comment.
The repo-memory filename examples include embedded single quotes (e.g., last-run-'news-committee-reports'.json). This deviates from the shared last-run-{workflow-name}.json convention and can lead to inconsistent state file naming across workflows. Prefer last-run-news-committee-reports.json (no embedded quotes).
Suggested change
| - Read `memory/news-generation/last-run-'news-committee-reports'.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-'news-committee-reports'.json` with date, documents analyzed, quality score | |
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score |
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
Comment on lines
86
to
+96
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se | ||
| - github.com | ||
| - hack23.com | ||
| - www.hack23.com | ||
| - riksdagsmonitor.com | ||
| - www.riksdagsmonitor.com | ||
| - hack23.github.io |
There was a problem hiding this comment.
safe-outputs.allowed-domains whitelists www.riksdagen.se but not the apex riksdagen.se. Existing generated articles in this repo link to https://riksdagen.se/..., and since this PR removes the *.se wildcard from the firewall/allowlists, those links (and any fetches to the apex host) will be blocked. Add riksdagen.se to both network: and safe-outputs.allowed-domains: (then recompile lockfiles).
Comment on lines
86
to
+96
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se | ||
| - github.com | ||
| - hack23.com | ||
| - www.hack23.com | ||
| - riksdagsmonitor.com | ||
| - www.riksdagsmonitor.com | ||
| - hack23.github.io |
There was a problem hiding this comment.
safe-outputs.allowed-domains whitelists www.riksdagen.se but not riksdagen.se. Since this PR removes the *.se wildcard, links/fetches to https://riksdagen.se/... (currently present in generated news content) will be blocked. Add riksdagen.se to both network: and safe-outputs.allowed-domains:.
Comment on lines
94
to
+105
| - api.scb.se | ||
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se | ||
| - github.com | ||
| - hack23.com | ||
| - www.hack23.com | ||
| - riksdagsmonitor.com | ||
| - www.riksdagsmonitor.com | ||
| - hack23.github.io |
There was a problem hiding this comment.
safe-outputs.allowed-domains includes www.riksdagen.se but not the apex riksdagen.se. With the removal of *.se wildcards, any generated links to https://riksdagen.se/... (which the repo already contains) will now violate allowlists. Add riksdagen.se to both network: and safe-outputs.allowed-domains:.
Comment on lines
98
to
+111
| @@ -92,7 +102,13 @@ safe-outputs: | |||
| - data.riksdagen.se | |||
| - www.riksdagen.se | |||
| - www.regeringen.se | |||
| - www.scb.se | |||
| - github.com | |||
| - hack23.com | |||
| - www.hack23.com | |||
| - riksdagsmonitor.com | |||
| - www.riksdagsmonitor.com | |||
| - hack23.github.io | |||
There was a problem hiding this comment.
safe-outputs.allowed-domains whitelists www.riksdagen.se but not riksdagen.se. Now that the *.se wildcard is removed, links/fetches to the apex host (already used by existing generated articles) will be blocked. Add riksdagen.se to both network: and safe-outputs.allowed-domains:.
Comment on lines
+694
to
+717
| 2. Read `memory/news-generation/covered-documents.json` to avoid re-analyzing documents already covered today | ||
| 3. Read `memory/news-generation/quality-scores.json` to track improvement trends | ||
|
|
||
| **When to WRITE memory (end of every run):** | ||
| 1. Update `memory/news-generation/last-run-{workflow-name}.json` with: | ||
| - `date`, `article_type`, `documents_analyzed` (array of dok_ids), `articles_generated` (count), `quality_score` | ||
| 2. Append to `memory/news-generation/covered-documents.json`: | ||
| - Each dok_id processed today with article_type and timestamp | ||
| 3. Update `memory/news-generation/quality-scores.json` with cumulative quality metrics | ||
|
|
||
| **File naming convention:** | ||
| - `last-run-{workflow-name}.json` — per-workflow state (e.g., `last-run-news-propositions.json`) | ||
| - `covered-documents.json` — cross-workflow deduplication index | ||
| - `quality-scores.json` — quality tracking across all workflows | ||
| - `translation-status.json` — tracks which articles need translation (used by news-translate) | ||
|
|
||
| **Example: Deduplication across workflows** | ||
| ```jsonc | ||
| // covered-documents.json | ||
| { | ||
| "2026-04-04": { | ||
| "H901FiU1": { "workflow": "news-committee-reports", "timestamp": "2026-04-04T06:15:00Z" }, | ||
| "H902Prop45": { "workflow": "news-propositions", "timestamp": "2026-04-04T07:30:00Z" } | ||
| } |
There was a problem hiding this comment.
The guidance to continuously append to a single memory/news-generation/covered-documents.json (and other cumulative JSON files) will grow unbounded over time and is likely to exceed the configured repo-memory.max-file-size (50 KB) or hit patch-size limits, causing pushes to start failing. Consider sharding by date (e.g., covered-documents/2026-04-04.json) and/or pruning to a rolling window when writing.
Suggested change
| 2. Read `memory/news-generation/covered-documents.json` to avoid re-analyzing documents already covered today | |
| 3. Read `memory/news-generation/quality-scores.json` to track improvement trends | |
| **When to WRITE memory (end of every run):** | |
| 1. Update `memory/news-generation/last-run-{workflow-name}.json` with: | |
| - `date`, `article_type`, `documents_analyzed` (array of dok_ids), `articles_generated` (count), `quality_score` | |
| 2. Append to `memory/news-generation/covered-documents.json`: | |
| - Each dok_id processed today with article_type and timestamp | |
| 3. Update `memory/news-generation/quality-scores.json` with cumulative quality metrics | |
| **File naming convention:** | |
| - `last-run-{workflow-name}.json` — per-workflow state (e.g., `last-run-news-propositions.json`) | |
| - `covered-documents.json` — cross-workflow deduplication index | |
| - `quality-scores.json` — quality tracking across all workflows | |
| - `translation-status.json` — tracks which articles need translation (used by news-translate) | |
| **Example: Deduplication across workflows** | |
| ```jsonc | |
| // covered-documents.json | |
| { | |
| "2026-04-04": { | |
| "H901FiU1": { "workflow": "news-committee-reports", "timestamp": "2026-04-04T06:15:00Z" }, | |
| "H902Prop45": { "workflow": "news-propositions", "timestamp": "2026-04-04T07:30:00Z" } | |
| } | |
| 2. Read `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for today (and optionally yesterday) to avoid re-analyzing documents already covered recently | |
| 3. Read `memory/news-generation/quality-scores-summary.json` for rolling trends, and `memory/news-generation/quality-scores/{YYYY-MM-DD}.json` only when you need same-day detailed metrics | |
| **When to WRITE memory (end of every run):** | |
| 1. Update `memory/news-generation/last-run-{workflow-name}.json` with: | |
| - `date`, `article_type`, `documents_analyzed` (array of dok_ids), `articles_generated` (count), `quality_score` | |
| 2. Write today's processed documents to `memory/news-generation/covered-documents/{YYYY-MM-DD}.json`: | |
| - Each dok_id processed today with article_type and timestamp | |
| - Keep this sharded by date instead of appending forever to a single file; retain only a rolling window of recent shards needed for deduplication | |
| 3. Write detailed quality metrics to `memory/news-generation/quality-scores/{YYYY-MM-DD}.json` and update `memory/news-generation/quality-scores-summary.json` with compact rolling aggregates only | |
| - Do not store unbounded cumulative history in a single JSON file; prune old shards based on the retention window your workflow needs | |
| **File naming convention:** | |
| - `last-run-{workflow-name}.json` — per-workflow state (e.g., `last-run-news-propositions.json`) | |
| - `covered-documents/{YYYY-MM-DD}.json` — cross-workflow deduplication index, sharded by date | |
| - `quality-scores/{YYYY-MM-DD}.json` — detailed quality tracking, sharded by date | |
| - `quality-scores-summary.json` — bounded rolling summary across workflows | |
| - `translation-status.json` — tracks which articles need translation (used by news-translate) | |
| **Example: Deduplication across workflows** | |
| ```jsonc | |
| // covered-documents/2026-04-04.json | |
| { | |
| "H901FiU1": { "workflow": "news-committee-reports", "timestamp": "2026-04-04T06:15:00Z" }, | |
| "H902Prop45": { "workflow": "news-propositions", "timestamp": "2026-04-04T07:30:00Z" } |
Comment on lines
85
to
+91
| - riksdag-regering-ai.onrender.com | ||
| - api.scb.se | ||
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se |
There was a problem hiding this comment.
Only www.riksdagen.se is allowlisted (not riksdagen.se) in network.allowed and safe-outputs.allowed-domains. With *.se removed, existing https://riksdagen.se/... links will now fail allowlist validation. Add riksdagen.se to both allowlists and recompile.
Comment on lines
85
to
+91
| - riksdag-regering-ai.onrender.com | ||
| - api.scb.se | ||
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se |
There was a problem hiding this comment.
network.allowed / safe-outputs.allowed-domains list www.riksdagen.se but not riksdagen.se. Since the PR removes *.se, any https://riksdagen.se/... URLs (present in existing generated articles) will be blocked. Add riksdagen.se to both allowlists and recompile.
Comment on lines
96
to
+102
| - riksdag-regering-ai.onrender.com | ||
| - api.scb.se | ||
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se |
There was a problem hiding this comment.
The allowlists include www.riksdagen.se but not the apex riksdagen.se. With the removal of *.se, generated links to https://riksdagen.se/... (already used in repo content) will be rejected/blocked. Add riksdagen.se to both network.allowed and safe-outputs.allowed-domains and recompile.
Comment on lines
84
to
+90
| - riksdag-regering-ai.onrender.com | ||
| - api.scb.se | ||
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se |
There was a problem hiding this comment.
www.riksdagen.se is allowlisted but the apex riksdagen.se is not. After removing *.se, any use of https://riksdagen.se/... (seen in existing generated news pages) will fail allowlist validation. Add riksdagen.se to both network.allowed and safe-outputs.allowed-domains, then recompile.
Comment on lines
97
to
+103
| - riksdag-regering-ai.onrender.com | ||
| - api.scb.se | ||
| - api.worldbank.org | ||
| - data.riksdagen.se | ||
| - www.riksdagen.se | ||
| - www.regeringen.se | ||
| - www.scb.se |
There was a problem hiding this comment.
network.allowed / safe-outputs.allowed-domains allow www.riksdagen.se but not riksdagen.se. With *.se removed, any generated https://riksdagen.se/... links will be blocked (these already exist in repo news pages). Add riksdagen.se to both allowlists and recompile the lockfile.
Member
|
@copilot apply changes based on the comments in this thread |
…repo-memory by date - Add riksdagen.se (apex) to network: and safe-outputs: in all 12 news-*.md workflows. Previously only www.riksdagen.se was listed; with *.se wildcard removed, links to https://riksdagen.se/... would be blocked. - Shard repo-memory files by date in SHARED_PROMPT_PATTERNS.md guidance: covered-documents/{YYYY-MM-DD}.json and quality-scores/{YYYY-MM-DD}.json with quality-scores-summary.json for compact aggregates. Prevents unbounded growth that would exceed max-file-size (50 KB). - Recompile all 12 lock files with gh aw compile. Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/53b4375b-2806-4f3a-ba4d-c1e960a3e108 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
Contributor
Author
All 13 review comments addressed in
All 12 lock files recompiled. Code Review ✅, CodeQL ✅. |
| This workflow uses **persistent repo-memory** on branch `memory/news-generation` (shared with all news workflows). | ||
|
|
||
| **At run START — read context:** | ||
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today |
There was a problem hiding this comment.
The repo-memory guidance here points to memory/news-generation/covered-documents.json, but SHARED_PROMPT_PATTERNS defines the dedup index as sharded by date (covered-documents/{YYYY-MM-DD}.json) to avoid unbounded growth and exceeding repo-memory max-file-size/max-patch-size. Update the referenced path to the sharded file (and align the “today/yesterday” lookup with that convention).
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-weekly-review.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
This end-of-run instruction appends to memory/news-generation/covered-documents.json, which contradicts the PR’s sharded repo-memory design (covered-documents/{YYYY-MM-DD}.json) and can cause the file to grow until pushes fail the 50KB size/patch limits. Write to the date shard and include a retention/prune note consistent with SHARED_PROMPT_PATTERNS.
.github/workflows/news-week-ahead.md
Outdated
Comment on lines
+143
to
+149
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
The repo-memory guidance here points to memory/news-generation/covered-documents.json, but SHARED_PROMPT_PATTERNS defines the dedup index as sharded by date (covered-documents/{YYYY-MM-DD}.json) to keep repo-memory bounded. Update the read path to the date shard (today and optionally yesterday).
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for today to check which dok_ids were already analyzed | |
| - Optionally also read yesterday's shard `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` when needed to avoid overlap across day boundaries | |
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to today's shard: `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` |
.github/workflows/news-week-ahead.md
Outdated
Comment on lines
+143
to
+149
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
This end-of-run instruction appends to memory/news-generation/covered-documents.json, but the shared repo-memory spec in SHARED_PROMPT_PATTERNS uses date-sharded files (covered-documents/{YYYY-MM-DD}.json) to prevent unbounded growth and repo-memory push failures. Update the write path accordingly (and retain/prune shards).
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read today's shard `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` (using the effective article date for this run) to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-week-ahead.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-week-ahead.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to today's shard `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` instead of a shared append-only file | |
| - Retain/prune dated `covered-documents/` shards according to the shared repo-memory policy so repo-memory stays bounded |
.github/workflows/news-translate.md
Outdated
Comment on lines
+327
to
+333
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-translate.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-translate.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
The repo-memory read guidance references memory/news-generation/covered-documents.json, but the shared repo-memory contract in SHARED_PROMPT_PATTERNS expects date-sharded dedup files (covered-documents/{YYYY-MM-DD}.json). Align this workflow’s instructions to read the date shard(s) instead of a single ever-growing file.
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-translate.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-translate.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read the relevant date shard(s) under `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` to check which dok_ids were already analyzed for the article date/run date | |
| - Read `memory/news-generation/last-run-news-translate.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-translate.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to the current run date shard at `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` |
Comment on lines
+189
to
+196
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-evening-analysis.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-evening-analysis.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | ||
| - Update `memory/news-generation/translation-status.json` with new articles needing translation |
There was a problem hiding this comment.
The end-of-run instructions append to memory/news-generation/covered-documents.json, but the repo-memory pattern in SHARED_PROMPT_PATTERNS is sharded by date (covered-documents/{YYYY-MM-DD}.json) to keep pushes within limits. Update the write target to the date shard and include retention/pruning guidance.
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-evening-analysis.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-evening-analysis.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Update `memory/news-generation/translation-status.json` with new articles needing translation | |
| - Read `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the effective article date (use `article_date` when provided, otherwise today's run date) to check which dok_ids were already analyzed for that day | |
| - Read `memory/news-generation/last-run-news-evening-analysis.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-evening-analysis.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the effective article date (create the shard if missing) | |
| - Update `memory/news-generation/translation-status.json` with new articles needing translation | |
| - Retention/pruning: keep covered-document memory sharded by date, avoid rewriting older shards unnecessarily, and prune/expire old daily shards according to the shared repo-memory retention policy so pushes stay within size limits |
Comment on lines
+147
to
+153
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
Repo-memory dedup is described in SHARED_PROMPT_PATTERNS as covered-documents/{YYYY-MM-DD}.json (date-sharded). This workflow still instructs reading covered-documents.json, which will diverge from the shared convention and risks unbounded growth. Update the read path to the date shard(s).
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the effective article date of this run to check which dok_ids were already analyzed that day | |
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the effective article date of this run |
Comment on lines
+147
to
+153
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
The end-of-run guidance appends to memory/news-generation/covered-documents.json, but the shared repo-memory design uses date shards (covered-documents/{YYYY-MM-DD}.json) to stay within repo-memory max-file-size/max-patch-size. Update this instruction to write to the date shard and prune old shards.
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the run/article date to check which dok_ids were already analyzed that day | |
| - Read `memory/news-generation/last-run-news-committee-reports.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-committee-reports.json` with date, documents analyzed, quality score | |
| - Update `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the run/article date with processed dok_ids | |
| - Prune old `memory/news-generation/covered-documents/*.json` date shards according to the shared repo-memory retention policy to keep file sizes and patch sizes bounded |
Comment on lines
+225
to
+231
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
Repo-memory dedup is defined in SHARED_PROMPT_PATTERNS as date-sharded (covered-documents/{YYYY-MM-DD}.json). This workflow still tells the agent to read covered-documents.json, which conflicts with the shared contract and can lead to unbounded growth. Update the read path to the date shard(s).
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the current run date to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` for the current run date |
Comment on lines
+225
to
+231
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | ||
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | ||
| - Skip documents already covered by another workflow to avoid duplicate analysis | ||
|
|
||
| **At run END — write context:** | ||
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score | ||
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` |
There was a problem hiding this comment.
This workflow instruction appends to memory/news-generation/covered-documents.json, but SHARED_PROMPT_PATTERNS specifies date-sharded dedup files (covered-documents/{YYYY-MM-DD}.json) to keep repo-memory within the 50KB file/patch limits. Update the write instruction to target the date shard and prune old shards per retention.
Suggested change
| - Read `memory/news-generation/covered-documents.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to `memory/news-generation/covered-documents.json` | |
| - Read today's shard `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` to check which dok_ids were already analyzed today | |
| - Read `memory/news-generation/last-run-news-article-generator.json` for previous run metadata | |
| - Skip documents already covered by another workflow to avoid duplicate analysis | |
| **At run END — write context:** | |
| - Update `memory/news-generation/last-run-news-article-generator.json` with date, documents analyzed, quality score | |
| - Append processed dok_ids to today's shard `memory/news-generation/covered-documents/{YYYY-MM-DD}.json` | |
| - Prune old `memory/news-generation/covered-documents/` date shards according to repo-memory retention policy |
Member
|
@copilot apply changes based on the comments in this thread |
…ory pattern
Update covered-documents references in all 12 news-*.md workflows from
single-file `covered-documents.json` to date-sharded
`covered-documents/{YYYY-MM-DD}.json` matching SHARED_PROMPT_PATTERNS.md.
READ: check today's shard (and optionally yesterday) for deduplication
WRITE: write to today's date shard; retain last 7 days
Prevents unbounded growth that would exceed repo-memory max-file-size
(50 KB) and max-patch-size limits.
Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/0a06569b-64cb-4670-996f-e422131776b8
Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Contributor
Author
All 24
The remaining comments about |
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_4fbb84651aa35f9e_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_a574f281fe28922f_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
In the generated safe-outputs config JSON, create_pull_request.protected_files does not include AGENTS.md, but later in the workflow GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG does list AGENTS.md as protected. This inconsistency can allow the agent-side safe-outputs tool to think edits to AGENTS.md are permitted (or cause late-stage failures when the handler rejects them). Align these configs by adding AGENTS.md to the protected_files list in the generated config (and re-compile lock files if needed).
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_eccf6858ce0d0085_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_4030335f840e288c_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
In the generated safe-outputs config JSON, create_pull_request.protected_files does not include AGENTS.md, but GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG later treats it as protected. This mismatch can lead to agent-side tools permitting (or attempting) edits that will be rejected during safe-outputs handling. Add AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","translation"],"max":1,"max_patch_size":2048,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_95b78508d4ddd919_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_fc6a2d4e7700668c_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","translation"],"max":1,"max_patch_size":2048,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The generated safe-outputs config JSON omits AGENTS.md from create_pull_request.protected_files, while the handler config later includes it. This inconsistency can cause agent-side safe outputs to allow edits that will be rejected at replay time (or create confusing failures). Ensure AGENTS.md is included in the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","translation"],"max":1,"max_patch_size":2048,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","translation"],"max":1,"max_patch_size":2048,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_5633029cff706316_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_00e191acde2769b9_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The safe-outputs config JSON written for the agent run does not list AGENTS.md in create_pull_request.protected_files, but the later GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG does. This mismatch can allow agent-side attempts to modify AGENTS.md that then fail during safe-outputs handling. Align the protected_files lists (add AGENTS.md to the generated config) and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_cf92668cdd2961dc_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_1d2dda48ffa6e02f_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The generated safe-outputs config JSON omits AGENTS.md from create_pull_request.protected_files, while the later handler configuration includes it. This inconsistency can lead to agent-side edits that are rejected during safe-outputs replay/handling. Add AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_b41965f144037ec5_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_56e8af31e973e0a4_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The agent-run safe-outputs config JSON does not list AGENTS.md under create_pull_request.protected_files, while the later handler config does. This mismatch can result in edits being permitted/attempted during the run but rejected during safe-outputs handling. Add AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_17eb96aaa414889b_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_7c81bf5db8e98e96_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The generated safe-outputs config JSON omits AGENTS.md from create_pull_request.protected_files, but the handler config later includes it. This inconsistency can cause agent-side safe outputs to behave differently than the handler, leading to late failures. Align by adding AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_1bc23e7d091c4dc7_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_e50aef7bef44b2ae_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The safe-outputs config JSON written for the agent run omits AGENTS.md from create_pull_request.protected_files, while the later handler config includes it. This mismatch can allow agent-side edits that will be rejected during safe-outputs replay/handling. Add AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_b77ea16a1ef16021_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_69f0cc24c6ef0551_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The generated safe-outputs config JSON omits AGENTS.md from create_pull_request.protected_files, but the later handler configuration includes it. This inconsistency can lead to agent-side changes being accepted during the run and rejected later. Align by adding AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"}} | ||
| GH_AW_SAFE_OUTPUTS_CONFIG_5fd5be83a297479a_EOF | ||
| cat > ${RUNNER_TEMP}/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_530b068db95ab168_EOF' | ||
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
There was a problem hiding this comment.
The agent-side safe-outputs config JSON omits AGENTS.md from create_pull_request.protected_files, but GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG later includes it. This mismatch can cause late-stage safe-outputs handling failures or allow unexpected edits. Add AGENTS.md to the protected_files list in the generated config and recompile.
Suggested change
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} | |
| {"add_comment":{"max":1},"create_pull_request":{"draft":false,"expires":336,"labels":["agentic-news","analysis-data"],"max":1,"max_patch_size":1024,"protected_files":["package.json","bun.lockb","bunfig.toml","deno.json","deno.jsonc","deno.lock","global.json","NuGet.Config","Directory.Packages.props","mix.exs","mix.lock","go.mod","go.sum","stack.yaml","stack.yaml.lock","pom.xml","build.gradle","build.gradle.kts","settings.gradle","settings.gradle.kts","gradle.properties","package-lock.json","yarn.lock","pnpm-lock.yaml","npm-shrinkwrap.json","requirements.txt","Pipfile","Pipfile.lock","pyproject.toml","setup.py","setup.cfg","Gemfile","Gemfile.lock","uv.lock","CODEOWNERS","AGENTS.md"],"protected_path_prefixes":[".github/",".agents/"]},"dispatch_workflow":{"aw_context_workflows":["news-translate"],"max":1,"workflow_files":{"news-translate":".lock.yml"},"workflows":["news-translate"]},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"push_repo_memory":{"memories":[{"dir":"/tmp/gh-aw/repo-memory/default","id":"default","max_file_count":50,"max_file_size":51200,"max_patch_size":51200}]}} |
Member
|
@copilot apply changes based on the comments in this thread |
Apply `expires: 14` → `expires: 14d` codemod fix across all 12 news-*.md workflows (explicit day suffix per gh-aw schema). Recompile all 12 lock files. Note: The `AGENTS.md` not appearing in the agent-side `protected_files` (line ~418 in lock files) is a gh-aw compiler design decision. The handler config `GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG` (line ~1362) IS the enforcement point and correctly includes `AGENTS.md`. The agent-side config is intentionally a subset - even if the agent attempts to edit AGENTS.md, the handler will reject it. This cannot be overridden from the workflow source files. Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/e1a3c185-c180-4364-9f77-e019a8009e47 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
Contributor
Author
Applied in
|
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gh aw compilejsoncfence for JSON with comments in SHARED_PROMPT_PATTERNS.md--cross-checkflag from news-translate.mdnovs BCP-47nbin news-translate.mdriksdagen.seto all 12 workflow network + safe-outputs allowlistscovered-documents/{YYYY-MM-DD}.jsonexpires: 14dcodemod + recompile lock files with gh-aw v0.66.1AGENTS.mdin agent-sideprotected_filesis a gh-aw compiler design decision (handler config enforces it)