[copilot-pr-merged-report] Daily Copilot PR Merged Report – 2026-04-22

[github-actions[bot]]

🤖 Daily Copilot PR Merged Report — 2026-04-22

Analysis Period: Last 24 hours (merged PRs only)
Total Merged PRs: 51
Total Lines Added: 22,512
Total Lines Deleted: 15,610
Net Code Change: +6,902 lines

💡 Insights

• High velocity day: 51 PRs merged in 24 hours, averaging ~2 PRs/hour — heavy infrastructure work with 3 bulk lock-file recompilation PRs (Pin builtin container images by digest in compiled lock files and AWF hash-spec configuration #27762, Bump default MCP gateway to v0.2.30 and AWF firewall to v0.25.28 #27722, Add comment_memory safe output support with editable file workflow integration #27479) accounting for 15,085 additions alone (67% of total).
• Strong test coverage: 30 of 51 PRs (59%) included test file changes, with 72 test file modifications total — predominantly Go tests (60), plus 12 JavaScript .test.cjs files.

Key Themes

• 🔒 Security & sandboxing: Migrated network.firewall → sandbox.agent.version (feat(workflow): support sandbox.agent.version and migrate deprecated network.firewall to sandbox.agent #27626), SEC-005 allowlist validation for comment-memory (Enforce SEC-005 allowlist validation for cross-repo comment-memory setup #27702), updated MCP gateway to v0.2.30 and AWF firewall to v0.25.28 (Bump default MCP gateway to v0.2.30 and AWF firewall to v0.25.28 #27722)
• 🛠 Codemods & fixups: New codemods for dependabot permissions ([aw-compat] Close gh aw fix --write gaps for Serena imports, workflow_run branches, and dependabot permissions #27836), cli-proxy → tools.github.mode migration (Refactor cli-proxy feature into tools.github.mode (gh-proxy) with codemod migration #27707), workflow-run branches ([aw-compat] Close gh aw fix --write gaps for Serena imports, workflow_run branches, and dependabot permissions #27836)
• 🔁 Safe outputs & comment-memory: Major PR thread routing (Route add_comment to PR review thread replies on pull_request_review_comment triggers (including relayed workflow contexts) #27838), supersede-older-reviews (Add supersede-older-reviews for PR reviews and shift guidance to COMMENT-first defaults #27662), full comment-memory integration (Add comment_memory safe output support with editable file workflow integration #27479), SEC-005 standardization (Standardize USE-001 error codes in comment_memory and merge_pull_request safe-output handlers #27701, Enforce SEC-005 allowlist validation for cross-repo comment-memory setup #27702)
• 🤖 AI engine work: Universal LLM consumer engine for OpenCode/Crush (Update OpenCode/Crush universal LLM consumer backend handling #27708), Codex openai-proxy injection (Codex: inject openai-proxy provider in generated config when API proxy is enabled #27711), OTEL error signals (Emit OTEL error signals for cancelled conclusions and success-with-errors runs #27739)
• 🧹 Refactoring: Compile pipeline helpers reorganized (Refactor compile helpers: co-locate stats logic, isolate infrastructure concerns, and collapse batch wrapper layers #27825), log parser shared summaries extracted (Refactor log parser shared summaries into submodule to reduce architecture violations #27596), error collector chain preserved (Preserve error chain in ErrorCollector.FormattedError for multi-error aggregation #27765)

Merged Pull Requests (51)

PR	Title	+Added	-Deleted	Test Files	Merged At
#27872	Stabilize wasm golden comparison	11	1	0	15:35 UTC
#27868	Handle PR #27837 review comments for create-project permissions	45	2	2	15:24 UTC
#27861	Resolve CLI help consistency gaps	39	9	4	15:10 UTC
#27849	Update smoke-ci haiku cache-memory behavior	5	4	0	14:48 UTC
#27848	Add progressive NOTE disclosure to comment-memory footer	34	1	1	14:45 UTC
#27846	Increase Q workflow timeout	18	18	0	14:41 UTC
#27838	Route add_comment to PR review thread replies	321	11	1	14:49 UTC
#27837	Add issues: read to update-project permissions	57	0	2	14:55 UTC
#27836	Close gh aw fix --write gaps for Serena imports, workflow_run, dependabot	667	1	4	14:40 UTC
#27826	Configure Daily Documentation Updater fallback	18	17	0	13:26 UTC
#27825	Refactor compile helpers	300	214	1	13:40 UTC
#27783	Accept deprecated max_tokens for MCP audit/compile	67	4	2	13:38 UTC
#27765	Preserve error chain in ErrorCollector	29	9	1	05:24 UTC
#27762	Pin builtin container images by digest (bulk lock recompile)	2,873	2,541	0	05:50 UTC
#27751	Prevent built-in jobs customization cycles	167	4	2	04:26 UTC
#27750	Fix built-in pre-steps insertion	248	1	1	05:39 UTC
#27745	ci: include runner-guard in cgo security-scan matrix	2	0	0	03:14 UTC
#27742	Fix firewall cleanup permissions	38	17	1	04:29 UTC
#27739	Emit OTEL error signals for cancelled/success-with-errors	58	7	2	02:38 UTC
#27735	Ignore link_sub_issue failure when already linked	25	1	1	02:04 UTC
#27734	Fix nosprintfhostport lint in codex_engine_test	168	12	1	01:42 UTC
#27722	Bump default MCP gateway to v0.2.30 (bulk lock recompile)	2,708	2,554	0	01:59 UTC
#27711	Codex: inject openai-proxy provider	111	1	1	00:07 UTC
#27708	Update OpenCode/Crush universal LLM consumer backend	523	179	5	01:14 UTC
#27707	Refactor cli-proxy feature into tools.github.mode	716	81	7	01:11 UTC
#27705	Fix smoke-ci safe_outputs failure on schedule triggers	17	16	0	22:30 UTC
#27702	Enforce SEC-005 allowlist for cross-repo comment-memory	137	0	1	00:05 UTC
#27701	Standardize USE-001 error codes in comment_memory	33	6	2	00:04 UTC
#27696	Use hash-based stale lock validation	2	2	0	22:15 UTC
#27683	Add smoke-ci coverage for cache/repo memory	344	23	0	21:57 UTC
#27679	fix: force extension upgrade for pinned installs	17	3	1	21:05 UTC
#27676	Fix Workflow Misc Part 2 failures	2	10	3	21:33 UTC
#27669	fix(cli): remove duplicate checkmark in upgrade output	3	3	0	20:52 UTC
#27662	Add supersede-older-reviews for PR reviews	405	7	3	21:55 UTC
#27658	docs: add Gemini quick-start coverage	9	3	0	20:06 UTC
#27657	Guard list_code_scanning_alerts to prevent MCP overflow	12	5	0	20:08 UTC
#27645	Fix Workflow Tools & MCP integration failures	35	38	2	18:59 UTC
#27644	Harden safe_outputs permission tests	75	34	3	18:47 UTC
#27643	Fix Workflow Features integration test fixture	2	3	1	18:28 UTC
#27642	Fix comment-memory permission regressions (bulk lock cleanup)	720	6,643	0	20:23 UTC
#27640	Update smoke-ci to use comment-memory	191	24	0	18:38 UTC
#27639	Pass workflow allowed domains into activation sanitization	199	1	1	18:35 UTC
#27626	feat(workflow): sandbox.agent.version + migrate network.firewall	616	252	10	17:54 UTC
#27622	Align CLI docs with current help output	6	6	0	17:04 UTC
#27617	Remove MCP startup log GitHub Action notices	0	2	0	16:38 UTC
#27616	Bootstrap Hippo Memory store with historical seeding	46	24	0	16:56 UTC
#27615	Add classic workflow to list active agentic task sessions	30	0	0	16:26 UTC
#27608	Fix lint-go and test failures in actionpins and cli specs	15	13	2	15:39 UTC
#27596	Refactor log parser shared summaries into submodule	611	748	0	16:00 UTC
#27591	Fix upload-asset allowed-exts parsing	233	4	4	16:38 UTC
#27479	Add comment_memory safe output support (bulk lock recompile)	9,504	2,051	0	17:23 UTC

Code Generation Metrics

Test Coverage

• PRs with test changes: 30/51 (59%)
• Total test file modifications: 72
  • Go tests (*_test.go): 60 modifications
  • JavaScript tests (*.test.cjs): 12 modifications
• Code-to-Test ratio: Strong — 59% of PRs ship with accompanying test changes

Notable Outliers

• Add comment_memory safe output support with editable file workflow integration #27479 (+9,504 lines): comment_memory safe output support — primarily bulk lock file regeneration across ~240 workflow files
• Fix comment-memory permission regressions, migrate config to tools, and exercise PR safe outputs in smoke-ci #27642 (-6,643 lines): comment-memory permission fix — massive lock file cleanup removing obsolete inline permission blocks
• feat(workflow): support sandbox.agent.version and migrate deprecated network.firewall to sandbox.agent #27626 (10 test files): sandbox.agent.version feature — most test-rich PR of the day, covering firewall, sandbox, and permissions
• Refactor cli-proxy feature into tools.github.mode (gh-proxy) with codemod migration #27707 (7 test files): cli-proxy → tools.github.mode refactor — comprehensive codemod coverage

Workflow Execution

Workflow run timing data is not available via the GitHub API for this report period.
Token consumption data is not directly available via the GitHub API — workflow execution time would be required as a proxy.

Generated by Daily Copilot PR Merged Report · ● 780.5K · ◷

• expires on Apr 23, 2026, 3:44 PM UTC

[github-actions[bot]]

🤖 Beep boop! The smoke test agent just parachuted in from the cloud and landed squarely on discussion #27875!

I'm a humble Copilot smoke test, checking that all systems are green — and so far, the instruments are looking 🟢!

Fun fact: I found 51 merged PRs in the last 24 hours. You all have been busy! Keep up the great work! 🚀

📰 BREAKING: Report filed by Smoke Copilot · ● 1.7M · ◷

[github-actions[bot]]

🎉 The smoke test agent strikes again!

Just dropped by to let you know that run §24788136304 completed with flying colors! 🌈

✅ All 13 active tests passed (PR review was N/A - no PR trigger)
🤖 Copilot is feeling confident and caffeinated
🚀 The gh-aw binary compiled, uploaded, and is ready for action!

"Tests pass in silence / Automation's steady hand / Green is the new code" 🍃

📰 BREAKING: Report filed by Smoke Copilot · ● 1.7M · ◷