Upgrade gh-aw compiler to v0.47.4 with inline prompts#240
Conversation
📝 WalkthroughWalkthroughBumps GH‑AW tooling and images to v0.47.x across many workflows, adds context validation and safe‑output manifest uploads, moves roles/bots declarations under on/secrets, adds two trigger workflows, updates Makefile to build a local gh-aw binary, and updates lock entries for new setup action versions. Changes
Sequence Diagram(s)sequenceDiagram
actor GitHub_Workflow as Workflow
participant Setup as gh-aw/setup
participant Script as actions/github-script
participant Runner as Copilot_Runner
participant MCP as MCP_Server
participant Artifacts as GitHub_Artifacts
Workflow->>Setup: run Setup Scripts (v0.47.x or local ./actions/setup)
Setup-->>Workflow: setup env, binaries
Workflow->>Script: Execute setup_globals + validate_context_variables
Script-->>Workflow: validated context (env, tokens)
Workflow->>Runner: start Copilot agent (agent image, AWF)
Runner->>MCP: communicate / authenticate (GITHUB_MCP_SERVER_TOKEN fallback)
Runner-->>Workflow: produce safe outputs (/tmp/safe-output-items.jsonl)
Workflow->>Artifacts: Upload artifact safe-output-items.jsonl
Artifacts-->>Workflow: artifact stored
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
CI failed in job Root cause: after
Recommended fix (minimal): regenerate and commit the generated workflow outputs so What I ran:
What is this? | From workflow: PR CI Detective Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes due to reproducibility and upgrade-path regressions in Makefile that can leave developers on stale compiler binaries and produce non-deterministic compiler behavior.
What is this? | From workflow: PR Review Agent
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #240
|
CI failed only in Root cause from logs: after compile, these tracked generated workflow files changed and were not committed in the PR:
Recommended fix: run What is this? | From workflow: PR Checks Fixer Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (4)
.github/workflows/gh-aw-pr-ci-fixer.lock.yml (1)
1280-1280:GH_AW_GROUP_REPORTSset to"false"— confirm this is intentional for PR CI Fixer.This env var was added (or changed) to explicitly disable grouped reports. For a workflow that targets a single PR and run, this makes sense (each invocation is scoped to one CI failure). Worth confirming this matches expectations if other workflows have it set differently.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gh-aw-pr-ci-fixer.lock.yml at line 1280, The workflow sets GH_AW_GROUP_REPORTS: "false" which disables grouped reports; confirm whether PR CI Fixer should produce grouped reports and if not leave as-is, otherwise change the GH_AW_GROUP_REPORTS environment variable in the workflow to "true" (or remove the override to inherit the repository default) and add a brief comment near the GH_AW_GROUP_REPORTS entry explaining the intended scope for this workflow so future reviewers know the choice was intentional..github/workflows/gh-aw-upgrade-check.md (1)
56-58: Prompt monitorsgithub/gh-awreleases, but the installed binary comes fromstrawgate/gh-awThe prompt's data-gathering step queries
gh api repos/github/gh-aw/releasesand fetches the CHANGELOG fromgithub/gh-aw/main. After this PR, the actual compiler binary is installed fromstrawgate/gh-aw@feature/inline-prompt. If the inline-prompt feature branch hasn't been merged upstream togithub/gh-aw, the upgrade-check workflow will compare the Makefile'sGH_AW_VERSIONagainst canonical upstream releases—potentially flagging version mismatches or missing upgrade notices that don't apply to the fork, and vice versa.Consider updating both URLs to point at
strawgate/gh-aw(or adding a comment clarifying the intentional split) so the monitor stays accurate.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gh-aw-upgrade-check.md around lines 56 - 58, The workflow currently queries upstream release endpoints ('gh api repos/github/gh-aw/releases?per_page=10') and fetches the upstream CHANGELOG ('https://raw.githubusercontent.com/github/gh-aw/main/CHANGELOG.md') while our installed binary comes from the fork/branch (strawgate/gh-aw@feature/inline-prompt) and the Makefile variable GH_AW_VERSION reflects that; update the workflow to point to the forked repo by replacing those two URLs with the strawgate equivalents (e.g., 'gh api repos/strawgate/gh-aw/releases?per_page=10' and the raw CHANGELOG URL under strawgate) or alternatively add a clear comment above the steps explaining the intentional forked source and why the upstream check is skipped so the monitor's checks align with GH_AW_VERSION..github/workflows/gh-aw-mention-in-issue.lock.yml (1)
91-93: Remove unusedactivationjob outputscomment_idandcomment_repo.These outputs are never referenced by any downstream job in this workflow or by the calling trigger workflow (gh-agent-workflows/mention-in-issue/example.yml). They're hardcoded to empty strings and add unnecessary surface area. Since this file is auto-generated by the gh-aw compiler, update the corresponding
.mdsource file and recompile to remove them.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gh-aw-mention-in-issue.lock.yml around lines 91 - 93, Remove the unused hardcoded outputs "comment_id" and "comment_repo" from the activation job in the generated workflow; update the source markdown template that generates this workflow (the .md used by the gh-aw compiler) to delete these outputs from the activation job definition and then re-run the gh-aw compiler to regenerate the .github/workflows/gh-aw-mention-in-issue.lock.yml so the activation job no longer emits "outputs: comment_id" or "comment_repo"..github/aw/actions-lock.json (1)
53-57: Remove unusedv0.47.2entry from actions-lock.json.
v0.47.2is pinned in the lock file but is not referenced by any compiled workflow lock file in.github/workflows/. Onlyv0.47.4(the declared upgrade target) is needed.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/aw/actions-lock.json around lines 53 - 57, Remove the unused lock entry "github/gh-aw/actions/setup@v0.47.2" from actions-lock.json: delete the entire object keyed by that version so only the needed "v0.47.4" entry remains, verify no compiled workflow in .github/workflows/ references v0.47.2, and then regenerate/compile the workflow lock files so the lock file matches the actual referenced actions.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/agentics-maintenance.yml:
- Line 52: The workflow generator is emitting an old setup action version;
update the version string in the maintenance workflow generator so the emitted
line uses github/gh-aw/actions/setup@da463a765059a5eed4cc345a003ecfc71c45ec49
(v0.47.4). Locate the template or constant in
pkg/workflow/maintenance_workflow.go (search for "github/gh-aw/actions/setup" or
the current "@v0.45.7" literal) and replace it with the new tag/commit hash so
generated agentics-maintenance.yml matches the other regenerated workflows.
In `@Makefile`:
- Around line 119-126: The Makefile currently clones gh-aw using a mutable
branch name "feature/inline-prompt" which can change over time; update the
install steps (the recipe that sets TMPDIR, clones gh-aw and runs
GOBIN="$(CURDIR)/.bin" go install ./cmd/gh-aw) to pin to an explicit commit: add
a variable (e.g., GH_AW_COMMIT or reuse GH_AW_VERSION) and after cloning check
out that commit (or clone then git -C "$$TMPDIR/gh-aw" fetch && git -C
"$$TMPDIR/gh-aw" checkout "$$GH_AW_COMMIT") so the built binary matches the
committed lockfiles instead of following the mutable feature/inline-prompt
branch.
---
Nitpick comments:
In @.github/aw/actions-lock.json:
- Around line 53-57: Remove the unused lock entry
"github/gh-aw/actions/setup@v0.47.2" from actions-lock.json: delete the entire
object keyed by that version so only the needed "v0.47.4" entry remains, verify
no compiled workflow in .github/workflows/ references v0.47.2, and then
regenerate/compile the workflow lock files so the lock file matches the actual
referenced actions.
In @.github/workflows/gh-aw-mention-in-issue.lock.yml:
- Around line 91-93: Remove the unused hardcoded outputs "comment_id" and
"comment_repo" from the activation job in the generated workflow; update the
source markdown template that generates this workflow (the .md used by the gh-aw
compiler) to delete these outputs from the activation job definition and then
re-run the gh-aw compiler to regenerate the
.github/workflows/gh-aw-mention-in-issue.lock.yml so the activation job no
longer emits "outputs: comment_id" or "comment_repo".
In @.github/workflows/gh-aw-pr-ci-fixer.lock.yml:
- Line 1280: The workflow sets GH_AW_GROUP_REPORTS: "false" which disables
grouped reports; confirm whether PR CI Fixer should produce grouped reports and
if not leave as-is, otherwise change the GH_AW_GROUP_REPORTS environment
variable in the workflow to "true" (or remove the override to inherit the
repository default) and add a brief comment near the GH_AW_GROUP_REPORTS entry
explaining the intended scope for this workflow so future reviewers know the
choice was intentional.
In @.github/workflows/gh-aw-upgrade-check.md:
- Around line 56-58: The workflow currently queries upstream release endpoints
('gh api repos/github/gh-aw/releases?per_page=10') and fetches the upstream
CHANGELOG ('https://raw.githubusercontent.com/github/gh-aw/main/CHANGELOG.md')
while our installed binary comes from the fork/branch
(strawgate/gh-aw@feature/inline-prompt) and the Makefile variable GH_AW_VERSION
reflects that; update the workflow to point to the forked repo by replacing
those two URLs with the strawgate equivalents (e.g., 'gh api
repos/strawgate/gh-aw/releases?per_page=10' and the raw CHANGELOG URL under
strawgate) or alternatively add a clear comment above the steps explaining the
intentional forked source and why the upstream check is skipped so the monitor's
checks align with GH_AW_VERSION.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
39-46:⚠️ Potential issue | 🟠 MajorDocument or resolve the undocumented exemption of
agentics-maintenance.ymlfrom the compile-freshness checkThe new
git checkout --line hard-resets.github/workflows/agentics-maintenance.yml(an auto-generated file) immediately before thegit status --porcelaindirty-tree check. This silently exempts that file from the freshness assertion without explanation.Since
agentics-maintenance.ymlis auto-generated bygh-aw compileand tracked in git, any divergence after compilation will go undetected. This defeats the purpose of the "Ensure lock files are up to date" check for this file.Add an inline comment explaining the exemption and linking to any tracking issue, or fix the root cause in the compiler to ensure idempotent output:
Suggested explicit approach
- name: Ensure lock files are up to date run: | + # TODO: agentics-maintenance.yml is non-idempotent under `make compile` + # due to <reason / link to tracking issue>. Reset it before the dirty check + # until the root cause is resolved. git checkout -- .github/workflows/agentics-maintenance.yml if [ -n "$(git status --porcelain)" ]; then🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci.yml around lines 39 - 46, The CI step named "Ensure lock files are up to date" currently runs a hard reset via the command "git checkout -- .github/workflows/agentics-maintenance.yml", which silently exempts that auto-generated file from the freshness check; either remove that git checkout and fix the generator (gh-aw compile) so agentics-maintenance.yml is idempotent, or if you need a short-term exemption, replace the hard reset with an explicit inline comment explaining why the file is exempt and link to the tracking issue/PR; locate the "Ensure lock files are up to date" step and the "git checkout -- .github/workflows/agentics-maintenance.yml" invocation to apply the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 39-46: The CI step named "Ensure lock files are up to date"
currently runs a hard reset via the command "git checkout --
.github/workflows/agentics-maintenance.yml", which silently exempts that
auto-generated file from the freshness check; either remove that git checkout
and fix the generator (gh-aw compile) so agentics-maintenance.yml is idempotent,
or if you need a short-term exemption, replace the hard reset with an explicit
inline comment explaining why the file is exempt and link to the tracking
issue/PR; locate the "Ensure lock files are up to date" step and the "git
checkout -- .github/workflows/agentics-maintenance.yml" invocation to apply the
change.
There was a problem hiding this comment.
Requesting changes: make compile currently skips source sync, which can generate lockfiles from stale workflow inputs.
What is this? | From workflow: PR Review Agent
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #240
| @./scripts/dogfood.sh | ||
|
|
||
| compile: setup-gh-aw sync | ||
| compile: setup-gh-aw |
There was a problem hiding this comment.
[HIGH] make compile no longer syncs workflow sources before compilation
Dropping sync from the compile target means edits under gh-agent-workflows/ and related fragments are no longer copied into .github/workflows/ before gh-aw compile runs. A concrete failure case is updating a source workflow markdown file and running make compile: lock files are generated from stale copied inputs, so compiled outputs can silently miss the latest source changes.
| compile: setup-gh-aw | |
| compile: setup-gh-aw sync |
1 participant
Summary
strawgate/gh-aw@feature/inline-promptfork with--inline-prompt --action-mode releaseflagsroles:from root level to underon:in all 31 workflow.mdfiles (breaking change from v0.46.2)bots:from root level to underon:in 6 workflow.mdfiles (duplicate-issue-detector,issue-triage,issue-triage-pr,pr-review,docs-pr-review,update-pr-body).bin/directory with clone-and-build from fork (Go module path mismatch preventsgo install)safe-inputswarnings)Compiler changes picked up
roles/botsmoved underon:(breaking), secret detection inenvsections, expanded safe-output deny-listspersist-credentialsvalidation, expanded ecosystem domainspull-requests: writeremoved from add-comment-only workflows (e.g.,duplicate-issue-detector)trigger-docs-drift-external.ymlandtrigger-docs-new-contributor-review-external.ymlnow created by dogfood syncFixes #238
Fixes #212
Fixes #110
Test plan
make compileproduces 0 errors{{#runtime-import}}directives)duplicate-issue-detectoron a test issue) to confirm end-to-end functionalityduplicate-issue-detectorno longer requestspull-requests: writepermissionMade with Cursor
Summary by CodeRabbit
Chores
New Features