[detection-analysis] Detection Analysis Report — 2026-06-30 (24h)

[github-actions[bot]]

Summary

• Window evaluated: last 24 full hours (UTC), ending 2026-06-30T13:30:00Z
• Total runs analyzed: 29 (of 75 runs in the window that had downloadable agentic artifacts)
• Detection-enabled runs (gh-aw-detection: true): 12 (41.4%)
• Regular runs (detection off/absent): 17 (58.6%)
• Misconfigured workflows found: 2

Warning

2 audit/report-class workflows are running without gh-aw-detection: true. Audit and report workflows aggregate cross-run data and should run threat detection on their outputs. See the table below for the recommended fixes.

Comparison Chart

Metric	Regular Runs	Detection Runs
Total runs	17	12
Success rate	76.5%	91.7%
Avg tokens (input+output+cache)	~1,225k	~939k
Failure count	4	1
Misconfigured count	2	0

Detection-enabled runs had a higher success rate (91.7% vs 76.5%) and lower average token usage this window. The 4 regular-run failures were 3× PR Sous Chef and 1× Smoke CI; the single detection-run failure (Daily Max Ai Credits Test) failed in its agent job — its detection job concluded successfully (threat-detection steps were correctly skipped because the agent produced no output to scan).

Misconfigured Workflows

Workflow	Misconfiguration type	Runs	Recommended fix
Daily Agentic Workflow AIC Usage Audit	Detection absent on an audit-class workflow (name matches audit)	1	Add gh-aw-detection: true to the workflow frontmatter so the audit's outputs are scanned.
Daily AIC Consumption Report (Sentry + Grafana OTel)	Detection absent on a report-class workflow (name matches report)	1	Add gh-aw-detection: true to the workflow frontmatter so the aggregated report is scanned.

Other checks (no misconfiguration confirmed):

• Detection job failures (criterion 3): none — all 12 detection jobs concluded success.
• Inconsistent detection state in 24h (criterion 4): none — no workflow ran with both detection on and off.
• Explicit gh-aw-detection: false on active workflows (criterion 1): Smoke CI ran with detection explicitly false, but only 1 run is present in the 24h window, so the ">3 runs in 7 days" threshold could not be confirmed from this data. Watch item, not a confirmed misconfiguration.

View All Run Metrics

Workflow	Detection	Engine	Status	Tokens
Auto-Triage Issues	✅ on	pi	success	146,152
Claude Code User Documentation Review	✅ on	claude	success	2,895,819
Constraint Solving — Problem of the Day	✅ on	copilot	success	183,604
Contribution Check	✅ on	copilot	success	3,359,296
Copilot PR Conversation NLP Analysis	✅ on	copilot	success	1,775,121
Daily A/B Testing Advisor	✅ on	pi	success	337,866
Daily Choice Type Test	✅ on	claude	success	147,071
Daily Documentation Updater	✅ on	pi	success	308,096
Daily Go Function Namer	✅ on	pi	success	96,586
Daily MCP Tool Concurrency Analysis	✅ on	copilot	success	271,572
Daily Max Ai Credits Test	✅ on	copilot	failure (agent job; detection job ok)	19,461
GitHub API Consumption Report Agent	✅ on	claude	success	1,723,132
Copilot Agent Prompt Clustering Analysis	—	claude	success	1,832,917
Daily AIC Consumption Report (Sentry + Grafana OTel)	—	claude	success	2,582,604
Daily Agentic Workflow AIC Usage Audit	—	copilot	success	575,611
Dev	—	codex	success	1,259,059
Draft PR Cleanup	—	copilot	success	233,868
Functional Pragmatist	—	copilot	success	528,816
GitHub MCP Structural Analysis	—	claude	success	2,531,497
Glossary Maintainer	—	copilot	success	5,123,634
PR Sous Chef	—	copilot	failure	0
PR Sous Chef	—	copilot	failure	0
PR Sous Chef	—	copilot	failure	0
PR Triage Agent	—	copilot	success	509,148
Package Specification Enforcer	—	pi	success	240,670
Package Specification Extractor	—	copilot	success	2,103,998
Smoke CI	—	copilot	failure	0
Team Status	—	copilot	success	334,385
Typist - Go Type Analysis	—	claude	success	2,975,571

View Historical Trend

A trend chart is generated once ≥7 days of history are accumulated. Current history: 4 days (2026-06-27 → 2026-06-30). Today's record was appended to trending/detection-metrics/history.jsonl.

Date	Regular runs	Detection runs	Reg. success	Det. success	Misconfig
2026-06-27	71	0	91.5%	—	6
2026-06-28	3	42	100.0%	88.1%	0
2026-06-29	56	19	100.0%	94.7%	7
2026-06-30	17	12	76.5%	91.7%	2

Note: per-day run counts swing widely because each day captures only the runs whose agentic artifacts were downloadable within the window, and avg-token figures are only comparable from 2026-06-30 onward (earlier days recorded the zeroed TokenUsage field rather than the token-usage summary). Treat success-rate and misconfig columns as the reliable trend signals.

Recommendations

1. Enable detection on the two audit/report workflows. Add gh-aw-detection: true to Daily Agentic Workflow AIC Usage Audit and Daily AIC Consumption Report (Sentry + Grafana OTel) — these aggregate cross-run data and are exactly the class that should be scanned.
2. Review Smoke CI's explicit gh-aw-detection: false. Confirm this is an intentional opt-out for a CI smoke test; if it ever exercises agent outputs, re-enable detection. Re-check once ≥7 days of run history is available to evaluate the ">3 runs / 7 days" threshold.
3. Investigate the recurring PR Sous Chef failures (3/3 runs failed this window) and the Daily Max Ai Credits Test agent-job failure — these are agent/CI issues, not detection issues, but they dominate the failure count.
4. No action needed on detection jobs themselves — all 12 ran cleanly.

References:

• §28443494710 — Daily Agentic Workflow AIC Usage Audit (misconfigured)
• §28444317961 — Daily AIC Consumption Report (misconfigured)
• §28442586368 — Daily Max Ai Credits Test (detection on, agent-job failure)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔎 Detection Analysis Report · 217.6 AIC · ⌖ 38.6 AIC · ⊞ 7.1K · ◷

• expires on Jul 3, 2026, 5:36 AM UTC-08:00

[pelikhan]

/w update agentic workflows to create actionable issue to fix issue

[github-actions[bot]]

This discussion has been marked as outdated by Detection Analysis Report.

A newer discussion is available at Discussion #42769.