Add Update PR Body workflow

[Copilot]

Adds a workflow that runs on every commit pushed to a PR and updates the PR body when the description has drifted significantly from the actual diff.

New files

• .github/workflows/gh-aw-fragments/safe-output-update-pr.md — shared fragment declaring the update-pull-request safe output (max: 1) with sanitization rules
• .github/workflows/gh-aw-update-pr-body.md — workflow source; agent reads the diff via git diff --stat base.sha..head.sha, compares against the current PR body, and calls update_pull_request (replace) only on significant drift
• gh-agent-workflows/update-pr-body/example.yml + README.md — consumer trigger template and docs
• Generated: gh-aw-update-pr-body.lock.yml, trigger-update-pr-body.yml

Drift criteria

Updates are triggered when the body is:

• Missing a new/removed public API, endpoint, config option, or workflow
• Describing behavior the code no longer implements
• Blank, a placeholder stub, or scope-mismatched

The agent calls noop when the body is a reasonable summary, avoiding noise on minor wording differences.

Trigger

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

Skips draft PRs. Concurrency group is per-PR with cancel-in-progress: true.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• github.github.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)
• https://api.github.com/repos/ruby/setup-ruby/git/ref/tags/v1
  • Triggering command: /usr/bin/gh gh api /repos/ruby/setup-ruby/git/ref/tags/v1 --jq .object.sha 0.1-go1.25.7.lin. (http block)
  • Triggering command: /usr/bin/gh gh api /repos/ruby/setup-ruby/git/ref/tags/v1 --jq .object.sha 0.1-go1.25.7.lin. 0.1-go1.25.7.lin--gdwarf2 rg/toolchain@v0.--64 (http block)
  • Triggering command: /usr/bin/gh gh api /repos/ruby/setup-ruby/git/ref/tags/v1 --jq .object.sha 0.1-go1.25.7.lin-c 0.1-go1.25.7.lin-I 0.1-go1.25.7.lin/tmp/go-build3696316152/b234/ (http block)
• https://api.github.com/user
  • Triggering command: /usr/bin/gh gh api user --jq .login -c=4 -nolocalimports -importcfg /tmp/go-build3696316152/b281/importcfg -embedcfg /tmp/go-build3696316152/b281/embedcfg -pack -r 0.1-go1.25.7.lin--gdwarf-5 /home/REDACTED/wor--64 ptables --include=*.yaml/home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.7.linux-amd64/pkg/tool/linux_amd64/compile --include=*.md -l rg/toolchain@v0.-trimpath (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login ux-amd64/src/net-p ux-amd64/src/crygithub.com/github/gh-aw/pkg/repoutil ux-amd64/pkg/tool/linux_amd64/asm (http block)
  • Triggering command: /usr/bin/gh gh api user --jq .login rg/toolchain@v0.-c=4 rg/toolchain@v0.-nolocalimports pkg/mod/golang.o-importcfg (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Update PR Body Workflow</issue_title>
<issue_description>Let's make a workflow which runs on commit and determines if the current state of the PR warrants an update to the body of the PR and updates the PR if there's significant drift</issue_description>

<agent_instructions>use update_pull_request safe output</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Custom agent used: default-agent
The default agent

• Fixes Update PR Body Workflow #216

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[github-actions]

Please fix the broken local action reference in .github/workflows/agentics-maintenance.yml before merging.

---

What is this? | From workflow: PR Review Agent

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #219

[github-actions]

CI failure is from Verify compiled workflows in run 22230683019: the Ensure lock files are up to date step failed because make compile left a dirty tree.

Observed in logs:

• Modified: .github/workflows/gh-aw-update-pr-body.lock.yml
• Modified: .github/workflows/gh-aw-upgrade-check.lock.yml
• Untracked: .github/workflows/gh-aw-docs-drift-external.lock.yml
• Untracked: .github/workflows/gh-aw-docs-new-contributor-review-external.lock.yml
• Untracked: .github/workflows/trigger-docs-drift-external.yml
• Untracked: .github/workflows/trigger-docs-new-contributor-review-external.yml

Root cause: compiled workflow/lock outputs are out of sync with repository state on this branch.

Recommended fix:

git checkout copilot/update-pr-body-workflow
make compile
git add .github/workflows/*.yml .github/workflows/*.lock.yml
git commit -m "chore: refresh compiled workflow locks"
git push

Validation to run before/after push:

make compile
[ -z "$(git status --porcelain)" ]

I did not push a commit from this automation run because the required file updates are under .github/workflows/, which is restricted in this workflow context.

---

What is this? | From workflow: PR Checks Fixer

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

CI failure is reproducible from the workflow log: the Verify compiled workflows job fails at Ensure lock files are up to date because make compile leaves a dirty working tree.

Evidence from run 22230683019 (job 64309140660):

• run-22230683019-failed-job.log:324-332 shows the guard step:
  • if [ -n "$(git status --porcelain)" ]; then ... exit 1
• run-22230683019-failed-job.log:333-364 shows modified/untracked generated files after compile, including:
  • M .github/workflows/agentics-maintenance.yml
  • many M .github/workflows/gh-aw-*.lock.yml
  • ?? .github/workflows/gh-aw-docs-drift-external.lock.yml
  • ?? .github/workflows/gh-aw-docs-new-contributor-review-external.lock.yml
• The job then exits with code 1 (...log:367).

Recommended fix (minimal):

1. Rebase/merge latest main into this branch.
2. Run make compile locally from repo root.
3. Commit all generated workflow artifacts that make compile updates (including new *.lock.yml files and agentics-maintenance.yml if changed).
4. Re-run CI.

Tests run in this investigation:

• No local build/tests executed; analysis is based on the failed job logs from run 22230683019.

---

What is this? | From workflow: PR CI Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.