Add agentic workflow code-simplifier#316
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| safe-outputs: | ||
| create-pull-request: | ||
| expires: ${{ github.aw.import-inputs.expires }} | ||
| title-prefix: "${{ github.aw.import-inputs.title-prefix }}" | ||
| labels: ${{ github.aw.import-inputs.labels }} | ||
| reviewers: ${{ github.aw.import-inputs.reviewers }} | ||
| noop: |
There was a problem hiding this comment.
max PR limit in shared template
The safe-outputs.create-pull-request block omits a max: 1 constraint. The compiled lock file currently carries "max":1 (apparently injected by the compiler as a default), but this shared template itself gives no guarantee. Any future workflow that imports daily-pr-base.md and is compiled with a different tool version — or one that changes the default — could produce unlimited automated PRs. Explicitly setting max: 1 here would make the limit authoritative and visible to maintainers without requiring them to inspect the compiled lock.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/shared/daily-pr-base.md
Line: 36-42
Comment:
**Missing `max` PR limit in shared template**
The `safe-outputs.create-pull-request` block omits a `max: 1` constraint. The compiled lock file currently carries `"max":1` (apparently injected by the compiler as a default), but this shared template itself gives no guarantee. Any future workflow that imports `daily-pr-base.md` and is compiled with a different tool version — or one that changes the default — could produce unlimited automated PRs. Explicitly setting `max: 1` here would make the limit authoritative and visible to maintainers without requiring them to inspect the compiled lock.
How can I resolve this? If you propose a fix, please make it concise.
| safe-outputs: | ||
| create-pull-request: | ||
| expires: ${{ github.aw.import-inputs.expires }} | ||
| title-prefix: "${{ github.aw.import-inputs.title-prefix }}" | ||
| labels: ${{ github.aw.import-inputs.labels }} | ||
| reviewers: ${{ github.aw.import-inputs.reviewers }} | ||
| noop: |
There was a problem hiding this comment.
protected_files_policy guard dropped
The old create-pull-request safe-outputs config included "protected_files_policy":"fallback-to-issue". That key is absent from the new compiled lock (confirmed in the diff) and from this shared template. Without it, if the agent accidentally touches a protected file (e.g., go.mod, go.sum, CODEOWNERS) the framework will no longer fall back to opening an issue to surface the attempt — the default behavior may silently abort or error instead. Consider adding a protected-files-policy: fallback-to-issue entry here so all callers of this shared template inherit the safe fallback.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/shared/daily-pr-base.md
Line: 36-42
Comment:
**`protected_files_policy` guard dropped**
The old `create-pull-request` safe-outputs config included `"protected_files_policy":"fallback-to-issue"`. That key is absent from the new compiled lock (confirmed in the diff) and from this shared template. Without it, if the agent accidentally touches a protected file (e.g., `go.mod`, `go.sum`, `CODEOWNERS`) the framework will no longer fall back to opening an issue to surface the attempt — the default behavior may silently abort or error instead. Consider adding a `protected-files-policy: fallback-to-issue` entry here so all callers of this shared template inherit the safe fallback.
How can I resolve this? If you propose a fix, please make it concise.| network: | ||
| allowed: | ||
| - go |
There was a problem hiding this comment.
The network.allowed list is now [go], restricting outbound access to Go-specific domains (e.g., proxy.golang.org, sum.golang.org). However, the agent prompt still contains detailed per-language instructions for JavaScript/TypeScript (npm test, npm run lint), Python (pytest, flake8), and .NET (dotnet test, dotnet build). On this Go repository the mismatch is harmless, but the prompt content will mislead the agent if it encounters non-Go files and attempts language-specific validation commands that require unreachable registries. Trimming the prompt to Go-only instructions would keep it consistent with the network restriction.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/code-simplifier.md
Line: 28-30
Comment:
**Prompt still describes multi-language workflows, but network is Go-only**
The `network.allowed` list is now `[go]`, restricting outbound access to Go-specific domains (e.g., `proxy.golang.org`, `sum.golang.org`). However, the agent prompt still contains detailed per-language instructions for JavaScript/TypeScript (`npm test`, `npm run lint`), Python (`pytest`, `flake8`), and .NET (`dotnet test`, `dotnet build`). On this Go repository the mismatch is harmless, but the prompt content will mislead the agent if it encounters non-Go files and attempts language-specific validation commands that require unreachable registries. Trimming the prompt to Go-only instructions would keep it consistent with the network restriction.
How can I resolve this? If you propose a fix, please make it concise.1 participant
Add agentic workflow code-simplifier
Greptile Summary
This PR upgrades the code-simplifier agentic workflow from a generic multi-language setup to a Go-specific configuration, migrating the source reference from
githubnext/agenticstogithub/gh-awand extracting shared PR-creation logic into a newdaily-pr-base.mdtemplate.permissions: read-allreplaced with explicitcontents/issues/pull-requests: read; network allowlist narrowed from ~100 multi-language domains to Go-only registries (proxy.golang.org,sum.golang.org,go.dev, etc.).shared/daily-pr-base.mdwith acopilotreviewer added; however the new shared template omitsmax: 1,protected_files_policy: fallback-to-issue, and related file-protection guards that the old inline config provided.strict: trueandtools.cli-proxy: trueadded;skip-if-matchmigrated to theshared/skip-if-issue-open.mdimport.Confidence Score: 4/5
Safe to merge with awareness of two gaps in the new shared template that could affect future workflows importing it.
The workflow itself is correctly compiled and the Go-only network restriction, explicit permissions, and strict mode are all improvements. The two concerns — the missing max cap and the dropped protected_files_policy in daily-pr-base.md — do not break the current code-simplifier run but make the shared template incomplete for future callers.
shared/daily-pr-base.md warrants a second look for the missing PR-creation guards before it is reused by other workflows.
Important Files Changed
copilotreviewer added to PR creation config, andprotected_files_policy: fallback-to-issueremoved from safe-outputs.max: 1PR limit andprotected-files-policy: fallback-to-issuethat the old inline config provided, making it incomplete as a general-purpose shared component.Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "Add agentic workflow code-simplifier" | Re-trigger Greptile