Set agentic workflow threat detection to warning-only mode#2094
Merged
Set agentic workflow threat detection to warning-only mode#2094
Conversation
Closed
Contributor
🏷️ Automatic Labeling SummaryThis PR has been automatically labeled based on the files changed and PR metadata. Applied Labels: size-xs Label Categories
For more information, see |
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
Agent-Logs-Url: https://github.com/Hack23/riksdagsmonitor/sessions/8d7905c7-66b9-4e8e-8727-6478972a5865 Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>
github-actions
Bot
added
documentation
Contributor
🔍 Lighthouse Performance Audit
📥 Download full Lighthouse report Budget Compliance: Performance budgets enforced via |
Copilot
AI
changed the title
[WIP] Track detection runs for threat detection warnings and failures
Set agentic workflow threat detection to warning-only mode
Apr 28, 2026
pethers
approved these changes
Apr 28, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the agentic news workflow frontmatter so safe-output threat detection runs in warning-only mode, and adds a regression test to prevent future drift across the repo’s compiled agentic workflows.
Changes:
- Added
safe-outputs.threat-detection.continue-on-error: trueto allnews-*.mdagentic workflow sources. - Recompiled all corresponding
news-*.lock.ymlworkflows so the executed workflows carry the new setting. - Added a Vitest guard asserting all agentic news workflow sources keep threat detection in warning-only mode.
Reviewed changes
Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/network-diagnostics.test.ts | Adds a guard asserting all news workflows set threat detection to warning-only mode. |
| .github/workflows/news-committee-reports.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-committee-reports.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-evening-analysis.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-evening-analysis.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-interpellations.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-interpellations.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-month-ahead.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-month-ahead.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-monthly-review.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-monthly-review.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-motions.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-motions.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-propositions.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-propositions.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-realtime-monitor.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-realtime-monitor.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-translate.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-translate.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-week-ahead.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-week-ahead.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
| .github/workflows/news-weekly-review.md | Adds safe-outputs.threat-detection.continue-on-error: true to the workflow source. |
| .github/workflows/news-weekly-review.lock.yml | Recompiled workflow to include the updated safe-output threat-detection behavior. |
Comment on lines
+381
to
+385
| expect( | ||
| fm, | ||
| `${workflow} missing safe-outputs.threat-detection.continue-on-error: true` | ||
| ).toMatch(/safe-outputs:[\s\S]*^\s{2}threat-detection:\n^\s{4}continue-on-error:\s+true\b/m); | ||
| }); |
There was a problem hiding this comment.
This assertion is quite strict because it requires continue-on-error: true to appear immediately on the next line after threat-detection: with fixed indentation. If additional threat-detection keys are added later (still keeping continue-on-error: true), this test will fail. Consider loosening the regex to allow intervening lines, or parsing the frontmatter block line-by-line similar to the existing domain parsers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Threat detection runs were being tracked for agentic workflows, and the workflow sources needed explicit warning-only behavior for safe-output threat detection. This change makes that behavior consistent across all agentic news workflows.
Workflow configuration
safe-outputs.threat-detection.continue-on-error: trueto everynews-*.mdagentic workflow source.news-*.lock.ymlfiles so executed workflows carry the updated setting.Regression coverage
tests/network-diagnostics.test.tsto ensure every agentic news workflow keeps threat detection in warning-only mode.