fix: correct firewall issue dispatcher tracking issue link format by Copilot · Pull Request #2161 · github/gh-aw-firewall

Copilot · 2026-04-23T02:56:45Z

Summary

fixed the firewall issue dispatcher workflow prompt to require extracting only the numeric tracking issue ID before posting the gh-aw comment link
added explicit valid/invalid URL examples to prevent malformed links like /issues/github/gh-aw-firewall#2159
removed duplicate wording in the comment-format instructions

Validation

npm run lint && npm run build ✅
npm test ⚠️ 1 pre-existing failure in src/docker-manager.test.ts (should create missing .copilot directory and mount it when using non-standard HOME path)
parallel_validation ✅ (Code Review + CodeQL)

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/9718b392-06e4-4d03-a68e-3bd948d876c2

Copilot

Pull request overview

Updates the Firewall Issue Dispatcher agentic workflow prompt to prevent malformed cross-repo tracking-issue links by explicitly requiring extraction of the numeric issue ID from create_issue outputs.

Changes:

Clarifies that create_issue references like github/gh-aw-firewall#2159 must be converted to a numeric ID before building the URL.
Adds explicit valid/invalid URL examples to prevent malformed /issues/... links.
Removes duplicated wording in the comment-format instructions.

Show a summary per file

File	Description
.github/workflows/firewall-issue-dispatcher.md	Tightens the prompt instructions for composing tracking-issue links and adds examples to avoid malformed URLs.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1

Copilot · 2026-04-23T03:17:14Z

+   `create_issue` may return a reference like `github/gh-aw-firewall#2159`. Extract only the trailing digits before composing the URL.
+   - Valid: `https://github.com/github/gh-aw-firewall/issues/2159`
+   - Invalid: `https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#2159`
+   - Invalid: `https://github.com/github/gh-aw-firewall/issues/#2159`

-   where `{NUMBER}` is replaced with **only the numeric issue number** (e.g., `1896`). Do NOT include the repository name, hash symbols, or any other text — just the number in the URL path. Use the `add_comment` safe output tool with `repo: "github/gh-aw"` and the original issue number.
+   Use the `add_comment` safe output tool with `repo: "github/gh-aw"` and the original issue number.


This workflow has a compiled companion .lock.yml and the compiled job includes a lock staleness check; updating the .md without regenerating firewall-issue-dispatcher.lock.yml will cause the workflow to report a stale lock file (and may keep the runtime prompt out of sync). Please run gh aw compile and commit the updated .github/workflows/firewall-issue-dispatcher.lock.yml in this PR.

lpcox · 2026-04-23T14:52:54Z

@copilot address this review feedback #2161 (review)

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/50fe1506-8f1b-4745-a3c6-522b1dc8c63e

Copilot · 2026-04-23T15:05:34Z

@copilot address this review feedback #2161 (review)

Addressed. I recompiled and committed .github/workflows/firewall-issue-dispatcher.lock.yml so the lock is in sync with the updated workflow source (commit d882803).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh auth status (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
https://api.github.com/repos/github/gh-aw/releases/latest
- Triggering command: /usr/bin/gh gh extension install github/gh-aw --pin v0.69.2 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

github-actions · 2026-04-23T16:45:56Z

🔥 Smoke Test Results

Test	Result
GitHub MCP (list merged PRs)	✅ "Harden api-proxy startup healthcheck..."
GitHub.com connectivity (HTTP)	✅ 200
File write/read	✅ `smoke-test-copilot-24842623770.txt` verified

Overall: PASS

PR: fix: correct firewall issue dispatcher tracking issue link format by @app/copilot-swe-agent · Assignees: @pelikhan, @Copilot

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-04-23T16:46:00Z

Smoke Test Results

✅ GitHub MCP: Listed 2 merged PRs (#2155, #2147)
✅ Playwright: GitHub page title verified
✅ File Writing: Test file created with timestamp
✅ Bash Tool: File read back successfully

Status: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-04-23T16:46:02Z

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (list merged PRs → #2155)	✅
GitHub.com HTTP connectivity	⚠️ (pre-step data not expanded)
File write/read	⚠️ (pre-step data not expanded)
BYOK inference (agent responding)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

PR: fix: correct firewall issue dispatcher tracking issue link format — author: @copilot-swe-agent, assignees: @pelikhan, @Copilot

Overall: PARTIAL PASS (core BYOK path ✅; pre-step outputs not injected into prompt)

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-04-23T16:46:55Z

Smoke test (Codex) results:

Merged PR review (last 2): ✅ "Harden api-proxy startup healthcheck to reduce early unhealthy flaps"; "chore: bump Copilot CLI to v1.0.34 in smoke-copilot"
safeinputs-gh PR query: ❌ tool unavailable in this runtime (used gh fallback)
Playwright github.com title contains "GitHub": ✅
Tavily web search: ❌ Tavily MCP server unavailable
File write /tmp/gh-aw/agent/smoke-test-codex-24842623927.txt: ✅
Bash cat file verification: ✅
Discussion oracle comment posted: ✅ (discussion [Security Review] Daily Security Review — 2026-04-23 #2168)
npm ci && npm run build: ✅
Overall status: FAIL

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-04-23T16:47:40Z

Smoke Test Results: GitHub Actions Services Connectivity

Check	Result
Redis PING (`host.docker.internal:6379`)	❌ Failed — `redis-cli` not available; TCP connection timed out
PostgreSQL `pg_isready` (`host.docker.internal:5432`)	❌ Failed — no response
PostgreSQL `SELECT 1` (`smoketest` db)	❌ Failed — no response

Summary: All 3 checks failed. host.docker.internal resolves to 172.17.0.1 but both ports (6379, 5432) are unreachable — connections timed out. The service containers do not appear to be accessible from this environment.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-04-23T16:51:37Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note: gh repo clone failed (403) for all repos; used git clone https://github.com/Mossaka/... as fallback. Java Maven required --Dmaven.repo.local=/tmp/... workaround as ~/.m2/repository was not writable.

Generated by Build Test Suite for issue #2161 · ● 533.4K · ◷

fix: clarify numeric issue URL formatting in dispatcher workflow source

d313f6d

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/9718b392-06e4-4d03-a68e-3bd948d876c2

Copilot AI assigned Copilot and pelikhan Apr 23, 2026

Copilot created this pull request from a session on behalf of pelikhan April 23, 2026 02:57 View session

Copilot AI requested a review from pelikhan April 23, 2026 02:57

Copilot finished work on behalf of pelikhan April 23, 2026 02:57

pelikhan approved these changes Apr 23, 2026

View reviewed changes

pelikhan marked this pull request as ready for review April 23, 2026 03:14

pelikhan requested a review from Mossaka as a code owner April 23, 2026 03:14

Copilot AI review requested due to automatic review settings April 23, 2026 03:14

Copilot started reviewing on behalf of pelikhan April 23, 2026 03:14 View session

Copilot AI reviewed Apr 23, 2026

View reviewed changes

Copilot started work on behalf of lpcox April 23, 2026 14:53 View session

This comment has been minimized.

Sign in to view

github-actions Bot added smoke-claude smoke-copilot smoke-copilot-byok labels Apr 23, 2026

This comment has been minimized.

Sign in to view

fix: recompile firewall issue dispatcher lock workflow

d882803

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/50fe1506-8f1b-4745-a3c6-522b1dc8c63e

Copilot finished work on behalf of lpcox April 23, 2026 15:09

Copilot AI requested a review from lpcox April 23, 2026 15:09

github-actions Bot added the build-test label Apr 23, 2026

lpcox merged commit 4c62bc9 into main Apr 23, 2026
58 of 61 checks passed

lpcox deleted the copilot/fix-firewall-issue-dispatcher branch April 23, 2026 17:10

github-actions Bot mentioned this pull request Apr 23, 2026

chore: upgrade gh-aw to v0.69.3 and recompile workflows #2170

Merged

Conversation

Copilot AI commented Apr 23, 2026

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

lpcox commented Apr 23, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

github-actions Bot commented Apr 23, 2026

🔥 Smoke Test Results

Uh oh!

github-actions Bot commented Apr 23, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Apr 23, 2026

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Smoke Test Results: GitHub Actions Services Connectivity

Uh oh!

github-actions Bot commented Apr 23, 2026

🏗️ Build Test Suite Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Apr 23, 2026 •

edited

Loading