[audit-workflows] Agentic Workflow Audit — 2026-06-17 (clean recovery day, 97.7% success)

[github-actions[bot]]

🔍 Daily Audit Summary — 2026-06-17

Window: last 24h (~8.1h compute, evening cluster) · Repository: github/gh-aw

A notably clean day. Of 43 completed runs, 42 succeeded (97.7%) — a strong rebound from 06-16's 71.2%. Zero missing tools, zero missing data, zero MCP failures. The single flagged failure is a known, already-tracked safe-output reddening issue.

Metric	Value
Completed runs	43 (+2 in-progress excluded: this audit, Release)
Success / fail	42 / 1 (97.7%)
Total tokens	23.7M
Compute	8.1h · 505 action-min · 569 turns
Missing tools / data / MCP failures	0 / 0 / 0
Safe outputs emitted	27 (4 write-capable runs, 39 read-only)
GitHub API calls	424
Firewall	1947 allowed / 489 blocked (all by-design smoke egress probes)

Engine mix: copilot 21 · codex 7 · claude 6 · antigravity 3 · gemini 3 · pi 3

---

📈 Trend Charts (30d)

Workflow Health

Success rate climbed to 97.7%, the highest in the visible window and a sharp recovery from the 06-13 (68.4%) and 06-16 (71.2%) dips. Run volume (43) was on the lighter side, with no large container-validation cluster skewing the denominator as on prior days. Only one internal failure was recorded.

Token Usage

Daily consumption fell to 23.7M tokens, well below the 7-day moving average (~40M) and far under the 06-12 spike (126M). The drop tracks the lighter run count; per-run efficiency stayed normal. Smoke/risk-classification test runs remain the dominant consumers by design.

---

⚠️ Findings

1 flagged failure — known recurring issue (MEDIUM)

upload-assets-reddens-successful-run — recurrence count now 2 (first seen 06-16)

• Workflow: Daily Project Performance Summary Generator (Using MCP Scripts) · copilot · run 27720651183 · 21.7m
• Observability flagged 100% failure (1/1), but the GitHub run status is completed — the agent and report succeeded; the upload_assets safe-output step reddened an otherwise-green run.
• Same signature as 06-16 (then affecting Daily Code Metrics + Daily Project Performance Summary). Still unfixed.

Recommendation: make the asset-publish step non-fatal (soft-fail + warning annotation) so a publish error does not redden a successful agent run. Related infra note below.

Infra note — asset upload path resolution

The host safeoutputs server cannot read /tmp/gh-aw/{python,agent,cache-memory}; upload_asset only resolves paths under $GITHUB_WORKSPACE. Chart-generating workflows must copy images into the workspace before calling upload_asset (this audit did so). Worth documenting in the Python/charts skill to prevent silent upload failures.

Execution drift (MEDIUM, informational)

smoke-copilot-aoai-apikey varied 2→25 turns (avg 15.7) across runs — unstable task shape on the AOAI apikey path. Consistent with the open aoai-apikey-persistent-transient-api-error issue (count 4). No failure today; monitoring.

Firewall blocks — all by-design (INFO)

489 blocked requests, 100% from smoke-test egress probes verifying network policy:

• Smoke Copilot (66/62/66), Smoke Gemini (58/47/22), Smoke Claude (38/32), Smoke Codex (30/23/12), Smoke Antigravity (10 each), Smoke Pi (1 each)
• Blocked domains: *.google.com, *.googleapis.com, playwright.azureedge.net, proxy.golang.org, localhost:8080 — all expected denials. No legitimate traffic blocked.

Top token consumers

Workflow	Tokens	Runs	Note
Smoke Copilot	9.2M	9	baseline+normal+risky test matrix
Daily Ambient Context Optimizer	3.29M	1
Daily Caveman Optimizer	2.16M	1
Contribution Check	1.37M	1
Daily Team Evolution Insights	1.22M	1

---

✅ Carry-over open issues (no recurrence today)

• model-param-config-incompatibility (HIGH, count 4, last 06-13) — no occurrence today.
• avenger-err-config-no-structured-logs (HIGH, count 9, last 06-14) — no occurrence today.
• copilot-sdk-driver tool-perm-lockout family — no prod-main tool-permission lockouts today (notable; dominant fail class on recent days was absent).

🎯 Next Actions

1. Fix upload_assets reddening (MEDIUM, 2 consecutive days) — soft-fail the publish step; document the $GITHUB_WORKSPACE path requirement in the charts skill.
2. Continue watching smoke-copilot-aoai-apikey turn drift / transient-API-error loop.
3. No escalation needed — today's health is the strongest in the 30-day window.

References:

• §27720651183 — flagged failure (Performance Summary)
• §27721789885 — this audit run

Generated by 🔍 Agentic Workflow Audit Agent · ◷

• expires on Jun 18, 2026, 2:04 PM UTC-08:00

[github-actions[bot]]

Smoke run 27726924811 says hi: browser, build, and artifact checks all landed from this lane.

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · ◷