[detection-analysis] Detection Analysis Report — 2026-07-05 (last 24h)

[github-actions[bot]]

Summary

• Window evaluated: last 24 full hours (UTC) — runs created 2026-07-05T07:29:42Z → 2026-07-05T12:51:53Z
• Total runs analyzed: 101
• Detection-enabled runs: 26 (25.7%)
• Regular runs: 75 (74.3%)
• Misconfigured workflows found: 3

Warning

3 workflows were flagged as misconfigured for the detection feature. See the table below for recommended fixes.

Detection-enabled runs showed a higher success rate (92.3% vs 81.3%) but higher average token usage (~1.01M vs ~705K), consistent with the extra detection job stage. All 26 detection runs had a passing detection job.

Comparison Chart

Metric	Regular Runs	Detection Runs
Total runs	75	26
Success rate	81.3%	92.3%
Avg tokens (incl. cache)	705,282	1,010,876
Failure count	14	2
Misconfigured count	—	3

Misconfigured Workflows

Workflow	Misconfiguration	Runs	Recommended fix
Smoke CI	Detection explicitly disabled on an active workflow (gh-aw-detection: false, 4 runs)	4	Confirm the opt-out is intentional; Smoke CI is a high-frequency CI job with 0 token usage, so disabling detection is likely deliberate — document the exemption or enable detection. Example run: 28735256896
Copilot Agent Prompt Clustering Analysis	Analysis workflow missing gh-aw-detection: true	1	Add gh-aw-detection: true — analysis workflows that process agent prompts/output should run threat detection. Example run: 28737657305
GitHub MCP Remote Server Tools Report Generator	Report workflow missing gh-aw-detection: true	1	Add gh-aw-detection: true — report-generation workflows should run threat detection. Example run: 28741234846

Note on Type 1 detection: the "more than 3 total runs in the last 7 days" rule was evaluated against the available 24h window (7-day history was not downloaded), so Smoke CI is flagged on its 4 in-window runs. No detection-job failures (Type 3) and no in-window detection-state flips (Type 4) were found.

View All Run Metrics (35 workflows)

Workflow	Runs	Success	Detection	Avg tokens
Matt Pocock Skills Reviewer	12	92%	—	850,610
Test Quality Sentinel	12	100%	✅ all	291,489
Impeccable Skills Reviewer	12	92%	—	604,790
Design Decision Gate 🏗️	12	100%	—	288,275
PR Code Quality Reviewer	11	36%	—	1,103,186
PR Sous Chef	7	86%	—	100,671
Smoke CI	4	0%	— (false)	0
Issue Monster	3	100%	—	36,439
Auto-Triage Issues	2	100%	✅ all	83,546
[aw] Failure Investigator (6h)	1	100%	✅ all	151,520
Daily Rendering Scripts Verifier	1	100%	✅ all	3,817,898
Copilot Session Insights	1	100%	✅ all	3,414,724
PR Triage Agent	1	100%	—	1,091,021
GitHub API Consumption Report Agent	1	100%	✅ all	3,484,803
Constraint Solving — Problem of the Day	1	100%	✅ all	153,015
Daily Syntax Error Quality Check	1	100%	—	146,299
PR Description Updater	1	100%	—	709,282
Code Scanning Fixer	1	100%	✅ all	91,743
Draft PR Cleanup	1	100%	—	325,032
Copilot Agent Prompt Clustering Analysis	1	100%	— (missing)	1,495,135
Team Status	1	100%	—	618,643
Daily Max Ai Credits Test	1	0%	✅ all	19,450
Daily Documentation Updater	1	100%	✅ all	558,682
Daily A/B Testing Advisor	1	100%	✅ all	311,296
Daily Workflow Updater	1	100%	—	404,662
Contribution Check	1	0%	✅ all	4,771,218
Package Specification Enforcer	1	100%	—	291,287
GitHub MCP Remote Server Tools Report Generator	1	100%	— (missing)	963,334
daily-experiment-report	1	100%	✅ all	5,695,610
Instructions Janitor	1	100%	—	2,227,200
Package Specification Extractor	1	100%	—	1,426,644
Daily Go Function Namer	1	100%	✅ all	147,839
Dev	1	100%	—	1,136,042
Terminal Stylist	1	100%	—	1,289,913
ESLint Miner	1	100%	—	4,077,401

View Historical Trend

Trend built from 9 days of cached daily metrics (detection-metrics/history.jsonl). Detection-run success rate has stayed in the ~80–95% band while daily detection-run volume trends gently upward.

Recommendations

1. Enable detection on the two audit/analysis/report workflows — Copilot Agent Prompt Clustering Analysis and GitHub MCP Remote Server Tools Report Generator both process agent-generated content and should run threat detection (gh-aw-detection: true).
2. Document or revisit the Smoke CI opt-out — it explicitly sets gh-aw-detection: false across all 4 in-window runs. If detection is intentionally skipped for this CI smoke test, record the exemption; its 0% success / 0-token runs may also warrant a separate look.
3. Investigate the PR Code Quality Reviewer failure rate (36% success over 11 runs) — unrelated to detection but the largest reliability gap in the window.
4. Keep watching adoption — detection covers ~26% of runs; broaden the trend history (currently 9 days) toward 30 days for a firmer adoption baseline.

References:

• §28741234846
• §28737657305
• §28735256896

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔎 Detection Analysis Report · 187.7 AIC · ⌖ 35.5 AIC · ⊞ 6.4K · ◷

• expires on Jul 8, 2026, 5:20 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Detection Analysis Report.

A newer discussion is available at Discussion #43797.