fix: increase security-guard max-turns from 15 to 25 by lpcox · Pull Request #1856 · github/gh-aw-firewall

lpcox · 2026-04-09T21:26:08Z

Problem

The Security Guard agent hits the 15-turn limit on large PRs (e.g., 29-file workflow recompiles with ~979KB diffs). The agent spends several turns handling oversized MCP payloads (354K+ tokens) that exceed Claude Code's 25K Read limit, then falls back to alternative strategies, leaving insufficient turns to complete the review.

Observed in run 24207729211 on PR #1845. The agent correctly concluded 'no security issues' and called noop, but had already consumed all 15 turns getting there → error_max_turns → exit code 1.

Fix

Increase max-turns from 15 to 25 in security-guard.md, giving adequate headroom for large diffs without being wasteful.

github-actions · 2026-04-09T21:27:06Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	85.85%	85.95%	📈 +0.10%
Statements	85.76%	85.85%	📈 +0.09%
Functions	87.54%	87.54%	➡️ +0.00%
Branches	78.56%	78.61%	📈 +0.05%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	86.3% → 86.6% (+0.36%)	85.9% → 86.2% (+0.35%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR adjusts the Security Guard agent configuration to allow more interaction turns on large pull requests, aiming to prevent error_max_turns failures during security reviews.

Changes:

Increased the Claude engine max-turns in security-guard.md from 15 to 25.
Recompiled the corresponding workflow lock file so the generated workflow runs Claude with --max-turns 25 and updates related compiled metadata/tooling.

Show a summary per file

File	Description
.github/workflows/security-guard.md	Raises the Security Guard agent turn budget to handle larger PRs.
.github/workflows/security-guard.lock.yml	Regenerates the compiled workflow to reflect the new max-turns (and includes additional compiler-generated updates).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 1

Copilot · 2026-04-09T21:28:39Z

.github/workflows/security-guard.lock.yml

+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"fdc5d074ff6aa249000e70a95557cfdc669f36e497595e5bab8632bfe18005ff","compiler_version":"v0.67.4","strict":true,"agent_id":"claude"}
+# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"ed597411d8f924073f98dfc5c65a23a2325f34cd","version":"v8"},{"repo":"actions/setup-node","sha":"53b83947a5a98c8d113130e565377fae1a50d02f","version":"v6.3.0"},{"repo":"actions/upload-artifact","sha":"bbbca2ddaa5d8feaa63e36b76fdaad77386f024f","version":"v7"},{"repo":"github/gh-aw-actions/setup","sha":"9d6ae06250fc0ec536a0e5f35de313b35bad7246","version":"v0.67.4"}]}


This PR is described as only increasing Security Guard max-turns, but the regenerated lock file also bumps the gh-aw compiler/actions versions (v0.67.2 → v0.67.4) and changes multiple workflow behaviors (e.g., pinning AWF/Claude Code versions, adding new permissions/steps, changing install & image handling). If these broader changes are intentional, please update the PR title/description to reflect the scope; otherwise, consider recompiling with the previous gh-aw version or splitting the lockfile recompile into a separate PR to keep this change narrowly scoped.

The security guard agent was hitting the 15-turn limit on large PRs (e.g., 29-file workflow recompiles with ~979KB diffs). The agent spends several turns handling oversized MCP payloads before falling back to alternative strategies, leaving insufficient turns to complete the review. Increasing to 25 turns gives adequate headroom for large diffs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-09T21:43:00Z

Smoke Test Results

✅ GitHub MCP: fix: increase claude-token-usage-analyzer timeout to 45 minutes / test: add regression tests for cli-proxy validated fixes from #1820
✅ Playwright: GitHub page title verified ("GitHub · Change is constant...")
✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-24214577220.txt created
✅ Bash: File content verified via cat

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-09T21:43:48Z

PRs: "fix: rewrite squid_https_latency to use background containers" | "fix: increase claude-token-usage-analyzer timeout to 45 minutes"
GitHub MCP (last 2 merged PRs): ✅
safeinputs-gh PR query (2 PRs): ❌
Playwright title contains "GitHub": ❌
Tavily search returned >=1 item: ❌
File write /tmp/gh-aw/agent/smoke-test-codex-24214577182.txt: ✅
Bash cat verification: ✅
Discussion query + mystical discussion comment: ❌
Build (npm ci && npm run build): ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-04-09T21:47:15Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #1856 · ● 1.2M · ◷

lpcox requested a review from Mossaka as a code owner April 9, 2026 21:26

Copilot AI review requested due to automatic review settings April 9, 2026 21:26

Copilot started reviewing on behalf of lpcox April 9, 2026 21:26 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

github-actions bot mentioned this pull request Apr 9, 2026

[aw] No-Op Runs #1668

Open

This comment has been minimized.

Sign in to view

github-actions bot added the smoke-claude label Apr 9, 2026

This comment has been minimized.

Sign in to view

github-actions bot mentioned this pull request Apr 9, 2026

[aw] Build Test Suite failed #1857

Closed

lpcox force-pushed the fix/security-guard-max-turns branch from 6b4e8d0 to aea2b72 Compare April 9, 2026 21:36

github-actions bot mentioned this pull request Apr 9, 2026

[aw] Smoke Services failed #1859

Open

lpcox enabled auto-merge (squash) April 9, 2026 21:43

lpcox disabled auto-merge April 9, 2026 21:43

lpcox merged commit 7786971 into main Apr 9, 2026
53 of 56 checks passed

lpcox deleted the fix/security-guard-max-turns branch April 9, 2026 21:43

github-actions bot added the build-test label Apr 9, 2026

github-actions bot mentioned this pull request Apr 9, 2026

feat: enable cli-proxy for smoke-services and firewall-issue-dispatcher #1862

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: increase security-guard max-turns from 15 to 25#1856

fix: increase security-guard max-turns from 15 to 25#1856
lpcox merged 1 commit intomainfrom
fix/security-guard-max-turns

lpcox commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Apr 9, 2026

Uh oh!

Uh oh!

github-actions bot commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"fdc5d074ff6aa249000e70a95557cfdc669f36e497595e5bab8632bfe18005ff","compiler_version":"v0.67.4","strict":true,"agent_id":"claude"}
		# gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"ed597411d8f924073f98dfc5c65a23a2325f34cd","version":"v8"},{"repo":"actions/setup-node","sha":"53b83947a5a98c8d113130e565377fae1a50d02f","version":"v6.3.0"},{"repo":"actions/upload-artifact","sha":"bbbca2ddaa5d8feaa63e36b76fdaad77386f024f","version":"v7"},{"repo":"github/gh-aw-actions/setup","sha":"9d6ae06250fc0ec536a0e5f35de313b35bad7246","version":"v0.67.4"}]}

Conversation

lpcox commented Apr 9, 2026

Problem

Fix

Uh oh!

github-actions bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Apr 9, 2026

Smoke Test Results

Uh oh!

Uh oh!

github-actions bot commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026

🏗️ Build Test Suite Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Apr 9, 2026 •

edited

Loading