fix: allow package.json/lock in dep security monitor PRs#2041
Conversation
The workflow's safe-outputs create-pull-request was blocked by the compiler's default protected_files list which includes package-lock.json. Add allowed-files for package.json and package-lock.json, and set protected-files: fallback-to-issue as a safety net for any other protected file modifications. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Smoke Test Results
Overall: PASS
|
🔥 Smoke Test: Copilot BYOK (Offline) — PASS ✅
Running in BYOK offline mode ( cc @lpcox
|
🔥 Smoke Test: OpenCode — PASS
Overall: PASS
|
✅ Copilot Smoke Test: PASS
All tests passed. cc @lpcox
|
|
Smoke test summary:
|
Smoke Test: GitHub Actions Services Connectivity
All 3 checks passed.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
There was a problem hiding this comment.
Pull request overview
Updates the Dependency Security Monitor agentic workflow so dependency update PRs can include package.json and package-lock.json changes without failing safe-outputs, while adding a fallback policy for attempts to modify other protected files.
Changes:
- Allow
package.jsonandpackage-lock.jsoninsafe-outputs.create-pull-request. - Configure protected-file handling to
fallback-to-issueinstead of hard-failing. - Recompile/regenerate the workflow lock file to reflect the new safe-outputs configuration (and updated generated tooling metadata).
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/dependency-security-monitor.md | Adds allowed-files and sets protected-files handling policy for safe-outputs PR creation. |
| .github/workflows/dependency-security-monitor.lock.yml | Regenerates the compiled workflow, embedding the updated safe-outputs config and refreshed generated pins/metadata. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 2
| "on": | ||
| schedule: | ||
| - cron: "33 19 * * *" | ||
| - cron: "18 23 * * *" |
There was a problem hiding this comment.
The generated lock workflow changes the scheduled cron time ("33 19" -> "18 23"). Even if this is a side-effect of recompilation, it changes when dependency monitoring runs and could affect vulnerability detection latency; consider keeping the previous cron value stable (or explicitly documenting that schedule time will shift on recompiles).
| - cron: "18 23 * * *" | |
| - cron: "33 19 * * *" |
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"43dc3b26ba9f321a89ba02e8db987efce53088afcc6293f16e4d574264ebf39e","compiler_version":"v0.68.4","strict":true,"agent_id":"copilot"} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"373c709c69115d41ff229c7e5df9f8788daa9553","version":"v9"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"57583dfa129051b855aa5d750d36fbeb8a885579","version":"v0.68.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.21"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.21"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.21"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.2.19"},{"image":"ghcr.io/github/github-mcp-server:v0.32.0"},{"image":"node:lts-alpine"}]} |
There was a problem hiding this comment.
This lock file recompilation bumps the gh-aw compiler/actions/tooling versions (e.g., compiler_version v0.68.1 -> v0.68.4, new container image tags, updated action SHAs), which is a functional workflow change beyond the safe-outputs allowlist tweak. If the version bump isn’t required for allowed-files support, consider keeping the previous compiler/tooling versions and doing upgrades in a separate PR to reduce rollout risk.
The Dependency Security Monitor workflow failed because
create-pull-requestsafe-outputs tried to modifypackage-lock.json, which is in the compiler's defaultprotected_fileslist.Changes:
allowed-files: [package.json, package-lock.json]tocreate-pull-requestconfig — these files are legitimately modified when bundling dependency updatesprotected-files: fallback-to-issueas safety net — if the agent tries to modify other protected files (e.g.,.github/paths,CODEOWNERS), it creates a review issue instead of hard-failingRoot cause: Run 24530903368 failed at
safe_outputswith:Recompiled lock file and ran post-processing.